Inline Detection Of Evil JavaScript

This report analyzes how exploit kits and injected obfuscated JavaScript evade detection and proposes two scalable inline heuristics—Shannon entropy scoring and JavaScript "density" scoring—to flag potentially malicious scripts for further inspection; tests showed benign pages typically have entropy around 5–6 and low density, while many exploit pages deviate from that range and exhibit much higher density, making these metrics useful filters to reduce the subset of JS requiring deobfuscation or blocking.