Cloudflare's Client-Side Security: Detecting Malicious JavaScript with ML and GNNs
This article details Cloudflare's Page Shield ML, a client-side security system designed to detect malicious JavaScript on storefronts. It highlights the architectural use of Graph Neural Networks (GNNs) and Large Language Models (LLMs) to analyze JavaScript behavior at scale, identifying threats that traditional scanners miss. The system leverages sophisticated ML pipelines and an ensemble of models to provide continuous browser visibility and prevent various client-side attacks.
Read original on Cloudflare BlogCloudflare's Client-Side Security, specifically Page Shield ML, addresses the critical blind spot in web security: malicious JavaScript silently operating within seemingly normal storefronts. Unlike traditional signature-based scanners, Page Shield ML focuses on behavioral analysis of JavaScript code, making it highly effective against polymorphic and evasive threats.
Architecture for Scalable JavaScript Analysis
The core of Cloudflare's detection system is a multi-stage machine learning pipeline. It starts with a Graph Neural Network (GNN) which treats JavaScript code not as flat text, but as a graph representing its syntax tree and call dependencies. This allows the GNN to recognize suspicious patterns even across minification, renaming, and obfuscation, without relying on known URLs or byte signatures.
GNNs for Code Analysis
Graph Neural Networks are particularly powerful for code analysis because they can understand relationships and structures within the code. This is crucial for detecting sophisticated malware that tries to hide its intent through various obfuscation techniques. By representing code as a graph, GNNs can learn features that are invariant to cosmetic changes, focusing on the underlying malicious logic.