A Structural and Content-based Approach for a Precise and Robust Detection of Malicious PDF Files

Davide Maiorca, Davide Ariu, Igino Corona, Giorgio Giacinto

2015

Abstract

During the past years, malicious PDF files have become a serious threat for the security of modern computer systems. They are characterized by a complex structure and their variety is considerably high. Several solutions have been academically developed to mitigate such attacks. However, they leveraged on information that were extracted from either only the structure or the content of the PDF file. This creates problems when trying to detect non-Javascript or targeted attacks. In this paper, we present a novel machine learning system for the automatic detection of malicious PDF documents. It extracts information from both the structure and the content of the PDF file, and it features an advanced parsing mechanism. In this way, it is possible to detect a wide variety of attacks, including non-Javascript and parsing-based ones. Moreover, with a careful choice of the learning algorithm, our approach provides a significantly higher accuracy compared to other static analysis techniques, especially in the presence of adversarial malware manipulation.

Paper Citation

in Harvard Style

Maiorca D., Ariu D., Corona I. and Giacinto G. (2015). A Structural and Content-based Approach for a Precise and Robust Detection of Malicious PDF Files . In Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-081-9, pages 27-36. DOI: 10.5220/0005264400270036

in Bibtex Style

@conference{icissp15,
author={Davide Maiorca and Davide Ariu and Igino Corona and Giorgio Giacinto},
title={A Structural and Content-based Approach for a Precise and Robust Detection of Malicious PDF Files},
booktitle={Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2015},
pages={27-36},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005264400270036},
isbn={978-989-758-081-9},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 1st International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - A Structural and Content-based Approach for a Precise and Robust Detection of Malicious PDF Files
SN - 978-989-758-081-9
AU - Maiorca D.
AU - Ariu D.
AU - Corona I.
AU - Giacinto G.
PY - 2015
SP - 27
EP - 36
DO - 10.5220/0005264400270036