Combining static and dynamic analysis for the detection of malicious documents

Tzermias, Zacharias; Sykiotakis, Giorgos; Polychronakis, Michalis; Markatos, Evangelos P.

doi:10.1145/1972551.1972555

Cited by 96 publications

(70 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Tzermias et al [9] proposed MDScan, which extracts Javascript from documents and executes it in instrumented SpiderMonkey and Nemu [19]. However, such a method suffers several limitations.…”

Section: Related Workmentioning

confidence: 99%

“…These features characterize the obfuscation techniques frequently used in malicious PDF. The combination of static and runtime features will be more effective and robust than existing methods, which are either fully static [5] [4] [6] or fully dynamic [9] [13]. A more thorough comparison between our method and others is presented in Table I.…”

Section: Introductionmentioning

confidence: 99%

“…However, when attackers are aware of these static features, they can evade easily [8]. Another recent work extracts and tests malicious Javascript in an emulated interpreter [9]. Although it is more robust against evasion, attackers can still exploit syntax obfuscations to subvert Javascript extraction.…”

Section: Introductionmentioning

confidence: 99%

“…One intuitive choice is to extract Javascript from documents [9] [14]. Alternatively, Javascript interpreters can be instrumented [15].…”

Section: Introductionmentioning

confidence: 99%

“…This method, to the best of our knowledge, has never been explored before for PDF malware detection and confinement. For each PDF Javascript snippet, we include a prologue and epilogue to inform our runtime detector for the entry to and exit from [6] No Yes No Yes Extract-and-Emulate [9] Neutral No Yes No Lexical Analysis of Javascript [7] Neutral Yes No Yes Adobe Sandboxing [12] Neutral Yes No Yes CWSandbox [13] Neutral Javascript context. The advantage of using static document instrumentation over the other two alternatives lies in three aspects.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Detecting Malicious Javascript in PDF through Document Instrumentation

Liu

Wang

Stavrou

2014

2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks

View full text Add to dashboard Cite

Abstract-An emerging threat vector, embedded malware inside popular document formats, has become rampant since 2008. Owed to its wide-spread use and Javascript support, PDF has been the primary vehicle for delivering embedded exploits. Unfortunately, existing defenses are limited in effectiveness, vulnerable to evasion, or computationally expensive to be employed as an on-line protection system. In this paper, we propose a context-aware approach for detection and confinement of malicious Javascript in PDF. Our approach statically extracts a set of static features and inserts context monitoring code into a document. When an instrumented document is opened, the context monitoring code inside will cooperate with our runtime monitor to detect potential infection attempts in the context of Javascript execution. Thus, our detector can identify malicious documents by using both static and runtime features. To validate the effectiveness of our approach in a realworld setting, we first conduct a security analysis, showing that our system is able to remain effective in detection and be robust against evasion attempts even in the presence of sophisticated adversaries. We implement a prototype of the proposed system, and perform extensive experiments using 18623 benign PDF samples and 7370 malicious samples. Our evaluation results demonstrate that our approach can accurately detect and confine malicious Javascript in PDF with minor performance overhead.

show abstract

Section: Related Workmentioning

confidence: 99%