Static detection of malicious JavaScript-bearing PDF documents

By Pavel Laskov, Nedim Srndic. 2011

202 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Privacy & Security

In Signal Processing

Citations in the corpus

Poisoning Attacks against Support Vector Machines (2012, background): “…to a number of such security-sensitive tasks including spam, worm, intrusion and fraud detection (Meyer & Whateley, 2004; Biggio et al., 2010; Stolfo et al., 2003; Forrest et al., 1996; Bolton & Hand, 2002; Cova et al., 2010; Rieck et al., 2010; Curtsinger et al., 2011; Laskov & ˇSrndi´c, 2011).”
Automatically Evading Classifiers: A Case Study on PDF Malware Classifiers (2016, methodology): “Since both of the classifiers we target employ the object structure of the PDF file as features, we need to generate variants by manipulating the PDF files at that level.”
Towards Making Systems Forget with Machine Unlearning (2015, methodology): “…(2) an independent re-implementation of Zozzle, the aforementioned closed-source JavaScript malware detector whose algorithm was adopted by Microsoft Bing [42]; (3) an open-source online social network (OSN) spam filter [46]; and (4) PJScan, an open-source PDF malware detector [51].”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, methodology): “The technical realization of these two fundamental tasks is presented below.”
PlatPal: Detecting Malicious Documents with Platform Diversity (2017, methodology): “COS object and PD tree information can be fed to metadata-based techniques [33, 36, 46, 52], while the JavaScript code dump can be fed to JavaScript-oriented techniques [14, 27, 31, 45, 48, 58, 59] for analysis.”
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware (2017, methodology): “The PDF malware detectors mentioned throughout this article adopt different learning algorithms; e.g., Wepawet [6] uses a Bayesian classifier, PJScan [7] uses Support Vector Machines (SVMs), while several other approaches use classifier ensembles including Random Forests and Adaboost [1]–[4], [8], a”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “The use of k-fold CV is widespread in malware classification research [8, 9, 22, 25, 28, 30, 33, 40, 41, 46]; while a commonmechanism to prevent overfitting [6], it is ill-suited for estimating the real-world performance of machine learning techniques with non-stationary data (e.”
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, background): “It is possible to embed di.erent types of attacks, such as sophisticated JavaScript and ActionScript code [28, 27], as well as malicious .les Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not…”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, background): “Existing work investigated problem-space attacks on text [3, 43], malicious PDFs [12, 22, 41, 45, 46, 74], Android malware [23, 75], Windows malware [38, 60], NIDS [6, 7, 20, 28], ICS [76], source code attribution [58], malicious Javascript [27], and eyeglass frames [62].”
Towards Adversarial Malware Detection (2018, methodology): “[24] Wepawet 2010 x Execution-Based x Laskov and Šrndić [54] PJScan 2011 x Lexical x Maiorca et al.”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “However, most classifier evasion attempts, including nine targeted mimicry scenarios from two recent studies, are given an outcome of uncertain indicating that these observations cannot be given a reliable prediction by the classifier.”
A Pattern Recognition System for Malicious PDF Files Detection (2012, methodology): “This tool only analyzes files that have embedded Javascript code [17].”