# AST-Based Deep Learning for Detecting Malicious PowerShell

arXiv: https://arxiv.org/abs/1810.09230 · HTML: https://mlsanity.com/paper/1810.09230/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Oct 2018.

## Built on by (most cited first, 3 of 3)

- [A Survey on Cross-Architectural IoT Malware Threat Hunting](https://mlsanity.com/paper/2306.07989/) (2023)
- [Evaluating the Impact of Source Code Parsers on ML4SE Models](https://mlsanity.com/paper/2206.08713/) (2022)
- [Detection of Insider Attacks in Distributed Projected Subgradient Algorithms](https://mlsanity.com/paper/2101.06917/) (2021)

## Abstract (arXiv)

With the celebrated success of deep learning, some attempts to develop effective methods for detecting malicious PowerShell programs employ neural nets in a traditional natural language processing setup while others employ convolutional neural nets to detect obfuscated malicious commands at a character level. While these representations may express salient PowerShell properties, our hypothesis is that tools from static program analysis will be more effective. We propose a hybrid approach combining traditional program analysis (in the form of abstract syntax trees) and deep learning. This poster presents preliminary results of a fundamental step in our approach: learning embeddings for nodes of PowerShell ASTs. We classify malicious scripts by family type and explore embedded program vector representations.