A Pattern Recognition System for Malicious PDF Files Detection

By Davide Maiorca, Giorgio Giacinto, Igino Corona. 2012

129 citations recorded by the source corpus.

Subfields: Information Systems, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Privacy & Security

In Signal Processing

Citations in the corpus

Evasion Attacks against Machine Learning at Test Time (2013, methodology): “For example, in the task of PDF malware detection [20, 24, 25], removal of content is not feasible, and content addition may cause correlated changes in the feature vectors.”
Is Feature Selection Secure against Training Data Poisoning? (2015, methodology): “In our experiments, we exploit the feature representation proposed by Maiorca et al. (2012), where each feature simply denotes the number of occurrences of a given keyword in the PDF file.”
Automatically Evading Classifiers: A Case Study on PDF Malware Classifiers (2016, background): “The mutation is either a deletion (the object is removed), an insertion (another object is inserted after it), or a replacement (this object is replaced with some other object).”
On Security and Sparsity of Linear Classifiers for Adversarial Settings (2016, methodology): “We represent every file using the 114 features that are described in [24].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, methodology): “Several recent works proposed machine-learning techniques for detecting malicious PDFs use the file’s logical structure to accurately identify the malware [49, 62, 63].”
PlatPal: Detecting Malicious Documents with Platform Diversity (2017, methodology): “PDF Malware Slayer [36] uses the linearized path to specific PDF elements (e.”
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware (2017, methodology): “PDF malware detectors based on such features include Slayer and Slayer NEO [1], [2], Hidost [3], and PDFRate [4], [5].”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, methodology): “A number of machine learning models, including Support Vector Machines (SVM) [117], Hidden Markov Models (HMM) [34], N-grams [162], Decision Trees [96], Artificial Neural Networks [47] have been successfully applied for solving different intrusion detection tasks.”
Towards Adversarial Malware Detection (2018, methodology): “Second, there is a consistent F1-score difference between Slayer [64] and its evolved Slayer NEO [61] version, and between PDFRate-v1 [82] and PDFRate-v2 [83], where the attained F1-scores decreased in the most recent versions of the tools.”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, background): “Existing work investigated problem-space attacks on text [3, 43], malicious PDFs [12, 22, 41, 45, 46, 74], Android malware [23, 75], Windows malware [38, 60], NIDS [6, 7, 20, 28], ICS [76], source code attribution [58], malicious Javascript [27], and eyeglass frames [62].”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “…digits (represented as grey scale images) for the perfect knowledge case using a linear SVM classiﬁer, and for the case of malicious PDF detection (with features extracted according to previous work by Maiorca et al. [2012]) in both the PK and SK cases, using both SVM and neural networks.”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, background): “The technical realization of these two fundamental tasks is presented below.”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “Machine learning has become a standard tool for malware research in the academic security community: it has been used in a wide range of domains including Windows malware [9, 28, 41], PDF malware [22, 26], malicious URLs [23, 39], Javascript malicious code [8, 35], and Android malware [4, 10, 15, 27”
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, background): “It is possible to embed di.erent types of attacks, such as sophisticated JavaScript and ActionScript code [28, 27], as well as malicious .les Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not…”