Identificação de comportamento malicioso em WebAssembly

Abstract

Cryptojacking in web ecosystems has evolved drastically with the adoption of WebAssembly (Wasm), whose low-level binary modules facilitate algorithmic obfuscation and evasion of traditional defenses. Signature-based static approaches fail in the face of syntactic metamorphism, while dynamic instrumen- tation imposes intolerable operational overhead. To circumvent these vulnerabilities, this dissertation proposes a static analysis architecture supported by vector classification and feature fusion. The method- ological pipeline intercepts and converts Wasm binaries into an AST using a parser developed in Rust, segmenting the code into independent functional units. Subsequently, large language models generate embeddings that are mathematically concatenated with deterministic heuristic metrics associated with Proof-of-Work routines. The resulting vector, operating in hyperspaces of up to 1027 dimensions, is indexed in a Qdrant Vector Database for topological inference. The empirical evaluation, conducted on a corpus of 74 native binaries (53.888 chunks), evaluated and compared decision engine based on spatial similarity (k-NN), statistical consolidation via traditional Machine Learning (Mean Pooling), and cognitive inference from local LLMs. The results attest that, while topological prediction achieves a Mean Reciprocal Rank of 0.9188 optimized for forensic triage, aggregated classification via Linear SVM attains an F1-Score of 0.9501, surpassing the semantic ambiguity inherent to isolated fragments. It is concluded that the projection of code into hybrid latent spaces provides precise and scalable identification of polymorphic threats, mitigating the costs of continuous execution.