Detection of Security Vulnerabilities in Javascript Functions Using Machine Learning Methods

Abstract

JavaScript has become an essential programming language in modern web applications; however, its dynamic and loosely-typed nature introduces considerable security vulnerabilities. This paper presents JSVULNDETECT, a novel machine learning-based framework designed to automatically detect vulnerabilities in JavaScript code segments. Unlike traditional manual review approaches, which are often error-prone and inefficient, our system offers a scalable, automated solution for static code analysis. We evaluate and compare twelve machine learning algorithms—such as Random Forest, XGBoost, LightGBM, and Support Vector Machines—using a carefully preprocessed and balanced dataset. To address class imbalance, we apply the SMOTE-Tomek method, and we optimize model performance via Bayesian hyperparameter search. Moreover, we integrate ensemble learning strategies (Voting and Stacking), achieving a maximum accuracy of 97.51% with the Stacking Classifier. Our work advances the field by combining multiple learning paradigms, enhancing detection performance, and providing a web-based interface for real-time analysis. The proposed framework not only surpasses previous results reported in similar studies but also serves as a practical tool for developers and security analysts in identifying potential threats in JavaScript functions.