Search for malicious powershell scripts using syntax trees

Purpose of the paper: a search for rather abstract representation PowerShell script functionality using syntax trees such that an invisible obfuscated can be detected provided associated is already known malware. Research method: obfuscation analysis performed on three types obfuscation: token, string, and tree. The obtained result: 1) we have found simple AST-based features, as number AST functions their distributed depth, well similarity distance parameter calculated from location in are sufficient to attribute scripts original script, not subject obfuscation; 2) method creating extended data set described implemented including marking source files; 3) extensive several represent structure.