Detection of Malicious PDF Files Using a Two‐Stage Machine Learning Algorithm

He, Kang; Zhu, Yanzi; He, Yubo; Liu, Long; Lü, Bin; Lin, Wei

doi:10.1049/cje.2020.10.002

Cited by 7 publications

(12 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The author in [40] methodically puts forth several guiding concepts to select features to decrease the capacity for escape while retaining high accuracy. These guidelines are followed for extracting features and training a two-stage classifier.…”

Section: Literature Reviewmentioning

confidence: 99%

PDF Malware Detection Based on Optimizable Decision Trees

Al‐Haija¹,

Odeh²,

Qattous³

2022

Preprint

View full text Add to dashboard Cite

Portable Document Format (PDF) files are one of the most universally used file types. This has fascinated hackers to develop methods to use these normally innocent PDF files to create security threats via infection vectors PDF files. This is usually realized by hiding embedded malicious code in the victims’ PDF documents to infect their machines. This, of course, results in PDF Malware and requires techniques to identify benign files from malicious files. Research studies indicated that machine-learning methods provide efficient detection techniques against such malware. In this paper, we present a new detection system that can analyze PDF documents in order to identify benign PFD files from malware PFD files. The proposed system makes use of the AdaBoost decision tree with optimal hyperparameters, which is trained and evaluated on a modern-inclusive dataset, viz. Evasive-PDFMal2022. The investigational assessment demonstrates a lightweight-accurate PDF detection system, achieving a 98.84% prediction accuracy with a short prediction interval of 2.174 μSec. To this end, the proposed model outperforms other state-of-the-art models in the same study area. Hence, the proposed system can be effectively utilized to uncover PDF malware at high detection performance and low detection overhead.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

PDF Malware Detection Based on Optimizable Decision Trees

Al‐Haija¹,

Odeh²,

Qattous³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…It can be problematic to directly discover features that possess robust causal relationships with class labels but removing features with low relationships is straightforward. In practical terms, causal feature selection requires a comprehensive analysis of the samples [5,13].…”

Section: Pdf Malware Classifiers and Evading Techniquesmentioning

confidence: 99%

“…Not only does it improve robustness, but it also makes it easy to reduce the feature dimensions. Similar to the study by He et al [5], the feature extraction method is applied to a benign dataset, and then abnormality is performed. The steps of the feature extraction based on encoding and n-gram are as follows:…”

Section: Feature Extraction From Object Content Based On Encoding And...mentioning

confidence: 99%

“…The dataset utilized in this study was obtained from the VirusTotal and Contagio platforms. In previous research [5,6], the data used for training the algorithms is approximately one-third or less the size of the data used in this study. Using small datasets decreases the generalizability of the training model, which underfits the data and yields ambiguous results.…”

Section: Introductionmentioning

confidence: 99%

“…Using small datasets decreases the generalizability of the training model, which underfits the data and yields ambiguous results. Furthermore, the algorithm designed by He et al [5] achieved an accuracy of more than 98%, with imbalanced data having a higher proportion of malicious data over benign data.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Toward Robust Classifiers for PDF Malware Detection

Albahar¹,

Thanoon²,

Alzilai³

et al. 2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Malicious Portable Document Format (PDF) files represent one of the largest threats in the computer security space. Significant research has been done using handwritten signatures and machine learning based on detection via manual feature extraction. These approaches are time consuming, require substantial prior knowledge, and the list of features must be updated with each newly discovered vulnerability individually. In this study, we propose two models for PDF malware detection. The first model is a convolutional neural network (CNN) integrated into a standard deviation based regularization model to detect malicious PDF documents. The second model is a support vector machine (SVM) based ensemble model with three different kernels. The two models were trained and tested on two different datasets. The experimental results show that the accuracy of both models is approximately 100%, and the robustness against evasive samples is excellent. Further, the robustness of the models was evaluated with malicious PDF documents generated using Mimicus. Both models can distinguish the different vulnerabilities exploited in malicious files and achieve excellent performance in terms of generalization ability, accuracy, and robustness.

show abstract

A study of health management of LWD tool based on data-driven and model-driven

Zhang

et al. 2022

Acta Geophys.

View full text Add to dashboard Cite

Detection of Malicious PDF Files Using a Two‐Stage Machine Learning Algorithm

Cited by 7 publications

References 21 publications

PDF Malware Detection Based on Optimizable Decision Trees

PDF Malware Detection Based on Optimizable Decision Trees

Toward Robust Classifiers for PDF Malware Detection

A study of health management of LWD tool based on data-driven and model-driven

Contact Info

Product

Resources

About