Drive by Download Interceptor using Abstract Syntax Tree

Rapid increase of malware attacks cause many malware propagation techniques to arise. One most common techniques is using web browser. Drive by download attacks is the highest attack in web browser used by malware to propagate itself. Drive by download attack download malicious program by executing script -commonly javascript- without user's consent. Drive by script varies from simple one to the hard one. The code become harder to detect when the malware developer craft the code using obfuscation technique. Obfuscated code often slip away from detection and requires high computing process to recognize its original form. This paper will present design of tools to intercept drive by download attack without using excessive computation resource when it comes to obfuscated code by using Abstract Syntax Tree to detect code duplication and de-obfustication technique using DeFusinator plugin. As far this research went, we able to extract AST from a benign javascript, but we also find obstacle to find active malicious page to be extracted. This research will provide tools to prevent user from visiting malicious web pages infected with drive by script.