A pattern recognition system for malicious PDF files detection

Authors:
Davide Maiorca;Giorgio Giacinto;Igino Corona
Affiliations:
Department of Electrical and Electronic Engineering (DIEE), University of Cagliari, Cagliari, Italy;Department of Electrical and Electronic Engineering (DIEE), University of Cagliari, Cagliari, Italy;Department of Electrical and Electronic Engineering (DIEE), University of Cagliari, Cagliari, Italy
Venue:
MLDM'12 Proceedings of the 8th international conference on Machine Learning and Data Mining in Pattern Recognition
Year:
2012

Citing 5
Cited 3

Toward Automated Dynamic Malware Analysis Using CWSandbox

IEEE Security and Privacy
Detection and analysis of drive-by-download attacks and malicious JavaScript code

Proceedings of the 19th international conference on World wide web
NOZZLE: a defense against heap-spraying code injection attacks

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Combining static and dynamic analysis for the detection of malicious documents

Proceedings of the Fourth European Workshop on System Security
Static detection of malicious JavaScript-bearing PDF documents

Proceedings of the 27th Annual Computer Security Applications Conference

Malicious PDF detection using metadata and structural features

Proceedings of the 28th Annual Computer Security Applications Conference
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues

Information Sciences: an International Journal
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Malicious PDF files have been used to harm computer security during the past two-three years, and modern antivirus are proving to be not completely effective against this kind of threat. In this paper an innovative technique, which combines a feature extractor module strongly related to the structure of PDF files and an effective classifier, is presented. This system has proven to be more effective than other state-of-the-art research tools for malicious PDF detection, as well as than most of antivirus in commerce. Moreover, its flexibility allows adopting it either as a stand-alone tool or as plug-in to improve the performance of an already installed antivirus.