Malicious PDF detection using metadata and structural features

By Charles Smutz, Angelos Stavrou. 2012

307 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, methodology): “, PDFRate, an online tool for detecting malware in PDF files [14]).”
Evasion Attacks against Machine Learning at Test Time (2013, methodology): “For example, in the task of PDF malware detection [20, 24, 25], removal of content is not feasible, and content addition may cause correlated changes in the feature vectors.”
Stealing Hyperparameters in Machine Learning (2018, background): “For instance, Xu et al. [56] proposed a general evasion attack to search for a malware variant that preserves the malicious behavior of the malware but is classiﬁed as benign by the classiﬁer (e.g., PDFrate [47] or Hidost [50]).”
Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization (2017, methodology): “PDFRate2 is an online malware detection tool that analyzes the submitted PDF files to reveal the presence of embedded malware [34].”
Is Feature Selection Secure against Training Data Poisoning? (2015, methodology): “For instance, detection of malware in PDF ﬁles relies on the analysis of the PDF logical structure, which consists of a large set of different kinds of objects and metadata, yielding a high-dimensional data representation (Smutz & Stavrou, 2012; Maiorca et al., 2012; 2013; ˇSrndi´c & Laskov, 2013).”
Practical Evasion of a Learning-Based Classifier: A Case Study (2014, methodology): “135 of those were described in [24], the rest remain unknown.”
Automatically Evading Classifiers: A Case Study on PDF Malware Classifiers (2016, methodology): “We choose among these options with uniform random probability.”
DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, methodology): “Therefore, we define and train three different DNNs using 135 static features from PDFrate [54, 68], an online service for PDF malware detection.”
Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, neutral): “[4, 5, 6, 7]).”
Evading Classifiers by Morphing in the Dark (2017, methodology): “We evaluate the proposed evasion technique on two well-known PDF malware classifiers, namely PDFrate [27] and Hidost [29].”
Security Evaluation of Support Vector Machines in Adversarial Environments (2014, background): “Several recent works proposed machine-learning techniques for detecting malicious PDFs use the file’s logical structure to accurately identify the malware [49, 62, 63].”
Support vector machines under adversarial label contamination (2015, methodology): “, PDFRate,1 an online tool for detecting PDF malware [36]).”
Towards Making Systems Forget with Machine Unlearning (2015, neutral): “We are aware of other machine learningbased PDF detection engines [66, 68] after PJScan, however we choose PJScan because it is open-source and unique in adopting one-class machine learning.”
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware (2017, methodology): “PDF malware detectors based on such features include Slayer and Slayer NEO [1], [2], Hidost [3], and PDFRate [4], [5].”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, unknown): “Classifier g SVM-RBF (Hidost [57]), RF (PDFRate [56]).”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, methodology): “PDFrate is useful for this study because the underlying mechanisms are well documented [40], it is openly available for online attack, and it provides considerable information about each submitted PDF.”
Practical Attacks Against Graph-based Clustering (2017, background): “For example, features are directly obtained from spam emails [36, 60], PDF files [49, 53, 62], phishing pages [49], images [16, 25, 44, 52], network attack packets [24], and exploits [55, 58].”
Social Engineering Attacks: A Survey (2019, methodology): “In [45], the authors proposed a detection technique based on machine learning algorithms.”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, background): “The technical realization of these two fundamental tasks is presented below.”