[grants behavior]

Behavior Classification Project

The Behavior Classification Project aims to improve the security of client-side applications by developing a solution that monitors and classifies behaviors in web applications.

Read in Portuguese

About the Project

The project’s primary purpose is to enhance the security of client-side applications by developing new approaches that complement existing solutions related to monitoring behaviors in web applications. Ensuring robust security is a significant challenge as modern web applications become increasingly complex and integrated.

Traditional security measures, such as firewalls and network intrusion detection systems, may not fully address client-side vulnerabilities. Therefore, the project aims to create a dynamic solution that focuses specifically on identifying and mitigating risks at the client level.

Creating solutions for this context involves two fundamental steps:

  • Identifying behaviors
  • Classifying them according to the risk they present.

The BEHAVIOR solution enhances the security of client-side applications by developing a prototype that monitors and collects behaviors in web applications and identifies potential threats using artificial intelligence models. This prototype dynamically assesses any action or sequence of actions, identifying deviations from normal behavior that may indicate malicious activity. Artificial intelligence allows the solution to continuously learn and adapt to new attack patterns, ensuring it remains effective against evolving threats.

#1 Goal

The first goal includes not only the identification of behaviors per se but also the identification of the resources responsible for them, namely which entities triggered such actions.

By mapping behaviors to their corresponding entities, the system can better understand the underlying causes of potential issues and security threats. This step is essential for distinguishing between legitimate application behavior and malicious or unintended actions that could compromise security, which we address in the second goal.

#2 Goal

The second goal of the project is to classify the behaviors that have been dynamically captured during the application’s execution. This is done by analyzing the chain of behaviors observed and which entity triggered them.

By examining the context and sequence of these behaviors, the system can identify patterns indicative of potential threats. The goal is to classify their risk and malicious intent, which varies depending on the scenario.

Project Dissemination & Results

Research papers, academic conference participation, and industry webinars showcasing outcomes from the BEHAVIOR project.

Under this project, we had five scientific contributions accepted: four conference papers and one poster presentation. These works address key topics in software security, including vulnerability detection using Large Language Models (LLMs), code processing optimization, JavaScript malware detection, and Magecart threat identification:

Publication Title Authors & Citation Link
Evaluating LLaMA 3.2 for Software Vulnerability Detection Gonçalves, J. et al. (2025)
https://doi.org/10.1007/978-3-031-94855-8_3
Enhancing JavaScript Malware Detection Through Weighted Behavioral DFAs Pereira, P., Gonçalves, J., Vitorino, J., Maia, E., Praça, I. (2025)
https://doi.org/10.1007/978-3-031-94855-8_13
Enhancing Large Language Models with Faster Code Preprocessing for Vulnerability Detection Gonçalves, J., Silva, M., Maia, E., Praça, I. (2025)
https://link.springer.com/chapter/10.1007/978-3-032-04160-9_17
Adversarially Robust and Interpretable Magecart Malware Detection Pereira, P., Gouveia, J., Vitorino, J., Maia, E., Praça, I. (2025)
https://ieeexplore.ieee.org/abstract/document/11261630
A Magecart Malware Detection with Feature Engineering (Poster) Pereira, P., Gouveia, J., Vitorino, J., Maia, E., Praça, I. (2025)
https://ieeexplore.ieee.org/abstract/document/11261553

 

Conference Participation & Academic Events

Presenting research at scientific conferences complemented publication. In-person participation by ISEP across these international venues facilitated knowledge exchange, promoted project findings, and fostered collaboration with researchers and industry professionals:

EICC 2025 — European Interdisciplinary Cybersecurity Conference
  • Date: June 18–19, 2025
  • Location: Rennes, France
  • Overview: EICC 2025 focuses on cybersecurity from an interdisciplinary perspective, connecting computer science, law, criminology, and social sciences.
  • Presented Works:
    • Evaluating LLaMA 3.2 for Software Vulnerability Detection
    • Enhancing JavaScript Malware Detection Through Weighted Behavioral DFAs
  • Outcome: Published in Springer’s Communications in Computer and Information Science (CCIS) series. The event enabled me to present software vulnerability and JavaScript malware detection research directly to the academic cybersecurity community.
DCAI 2025 — 22nd International Conference on Distributed Computing and Artificial Intelligence
  • Date: June 25–27, 2025
  • Location: University of Lille, France
  • Overview: DCAI 2025 is an international conference dedicated to distributed computing and AI applications, including healthcare, blockchain, cyber-resilience, and quantum computing.
  • Presented Work:
    • Enhancing Large Language Models with Faster Code Preprocessing for Vulnerability Detection
  • Outcome: Demonstrated how optimizing code preprocessing improves LLM effectiveness in vulnerability detection, reaching a broad scientific audience in AI and distributed systems.
NCA 2025 — IEEE International Symposium on Network Computing and Applications
  • Date: November 5–7, 2025
  • Location: Lisbon, Portugal
  • Overview: An IEEE flagship symposium centered on network computing, edge/fog environments, energy efficiency, and AI applications in distributed systems.
  • Presented Contributions:
    • Adversarially Robust and Interpretable Magecart Malware Detection
    • A Magecart Malware Detection with Feature Engineering (Poster Presentation)
  • Outcome: Addressed key dimensions of Magecart malware detection—focusing on adversarial robustness, interpretability, and feature engineering techniques—within an international technical forum.

 

 

Industry Dissemination & Commercial Alignment

Complementing ISEP’s academic contribution, Jscrambler spearheaded industry dissemination initiatives designed to translate research insights into practical applications for web security, regulatory compliance, and e-commerce/retail risk mitigation:

SAQ A and Beyond: Tackling PCI DSS Anti-Skimming Requirements by April 1
  • Date: March 19, 2025
  • Speakers: John Elliott, Gareth Bowker, Pedro Fortuna
  • Focus: Addressed key industry challenges and tactical solutions for satisfying stringent PCI DSS anti-skimming requirements.

▶︎ Watch Webinar Recording

Iframe Integrity: Empowering PSPs to Secure Payment Iframes Against Skimming Attacks with Zero Hassle
  • Date: April 23, 2025
  • Speakers: Pedro Fortuna, Gareth Bowker
  • Focus: Focused on providing Payment Service Providers (PSPs) with simple, effective mechanisms to shield payment iframes against skimming threats.

▶︎ Watch Webinar Recording

Beyond Skimming: Reduce Costs and Risks with Comprehensive Web Security
  • Date: September 9, 2025
  • Speakers: Gareth Bowker, Ruth Barra, Thomas Freeman
  • Focus: Explored broader web security topics beyond skimming, highlighting how holistic client-side security reduces operational and financial risk.

▶︎Watch Webinar Recording


The Behavior Classification Project Partners

Jscrambler, a global leader in Client-Side Protection and Compliance, serves as the principal co-promoter of this project, contributing its extensive expertise in securing client-side applications and monitoring behaviors in web environments. The project aims to improve the security of client-side applications by developing a prototype that monitors and classifies behaviors in web applications, identifying risks and potential threats using Artificial Intelligence.

In this context, Jscrambler will leverage its experience in analyzing and protecting web applications to support mapping interactions between resources and behaviors. This expertise will be key to enabling a detailed risk assessment and advancing the development of innovative solutions for detecting and mitigating security threats. Jscrambler’s contribution focuses on its deep understanding of JavaScript behaviors, runtime analysis, and risk classification, aligning with the project’s goal of providing actionable insights into client-side security.

By combining practical security applications with the project’s research objectives, Jscrambler will help deliver impactful results that strengthen the protection of client-side applications and advance both technical and academic outcomes. This includes supporting and disseminating results through academic theses, publications, and educational materials, reinforcing the project’s contribution to advancing security standards in web environments.

SEP/IPP—GECAD, a recognized entity within the scientific system, actively participates in projects to create and implement innovative solutions and services for end users. In this project, its team will leverage all its expertise and experience in extracting knowledge from large volumes of data, applying Artificial Intelligence-based algorithms to the new contexts presented by the project, and developing new algorithms and combined approaches that will culminate in an utterly disruptive service platform.

In particular, ISEP/IPP – GECAD contributes its knowledge and experience in the field of Knowledge and Learning Technologies, specifically in the following areas: Knowledge-Based Systems, Ontologies, Semantic Web, Social Web, Data Mining, Knowledge Discovery, Neural Networks, Intelligent Agents, and Intelligent Tutors. The project results will feature a Master’s thesis and educational materials for courses taught by the institution, disseminating the results and adding value to the academic community.