Malicious PDF Detection Model against Adversarial Attack Built from Benign PDF Containing JavaScript
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kang, Ah Reum | - |
dc.contributor.author | Jeong, Young-Seob | - |
dc.contributor.author | Kim, Se Lyeong | - |
dc.contributor.author | Woo, Jiyoung | - |
dc.date.accessioned | 2021-08-11T09:23:38Z | - |
dc.date.available | 2021-08-11T09:23:38Z | - |
dc.date.issued | 2019-11-02 | - |
dc.identifier.issn | 2076-3417 | - |
dc.identifier.uri | https://scholarworks.bwise.kr/sch/handle/2021.sw.sch/4084 | - |
dc.description.abstract | Intelligent attacks using document-based malware that exploit vulnerabilities in document viewing software programs or document file structure are increasing rapidly. There are many cases of using PDF (portable document format) in proportion to its usage. We provide in-depth analysis on PDF structure and JavaScript content embedded in PDFs. Then, we develop the diverse feature set encompassing the structure and metadata such as file size, version, encoding method and keywords, and the content features such as object names, keywords, and readable strings in JavaScript. When features are diverse, it is hard to develop adversarial examples because small changes are robust for machine-learning algorithms. We develop a detection model using black-box type models with the structure and content features to minimize the risk of adversarial attacks. To validate the proposed model, we design the adversarial attack. We collect benign documents containing multiple JavaScript codes for the base of adversarial samples. We build the adversarial samples by injecting the malware codes into base samples. The proposed model is evaluated against a large collection of malicious and benign PDFs. We found that random forest, an ensemble algorithm of a decision tree, exhibits a good performance on malware detection and is robust for adversarial samples. | - |
dc.language | 영어 | - |
dc.language.iso | ENG | - |
dc.publisher | MDPI | - |
dc.title | Malicious PDF Detection Model against Adversarial Attack Built from Benign PDF Containing JavaScript | - |
dc.type | Article | - |
dc.publisher.location | 스위스 | - |
dc.identifier.doi | 10.3390/app9224764 | - |
dc.identifier.scopusid | 2-s2.0-85075250648 | - |
dc.identifier.wosid | 000502570800041 | - |
dc.identifier.bibliographicCitation | Applied Sciences-basel, v.9, no.22 | - |
dc.citation.title | Applied Sciences-basel | - |
dc.citation.volume | 9 | - |
dc.citation.number | 22 | - |
dc.type.docType | Article | - |
dc.description.isOpenAccess | Y | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Chemistry | - |
dc.relation.journalResearchArea | Engineering | - |
dc.relation.journalResearchArea | Materials Science | - |
dc.relation.journalResearchArea | Physics | - |
dc.relation.journalWebOfScienceCategory | Chemistry, Multidisciplinary | - |
dc.relation.journalWebOfScienceCategory | Engineering, Multidisciplinary | - |
dc.relation.journalWebOfScienceCategory | Materials Science, Multidisciplinary | - |
dc.relation.journalWebOfScienceCategory | Physics, Applied | - |
dc.subject.keywordAuthor | malicious PDF | - |
dc.subject.keywordAuthor | malware | - |
dc.subject.keywordAuthor | detection | - |
dc.subject.keywordAuthor | machine-learning | - |
dc.subject.keywordAuthor | adversarial attack | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(31538) 22, Soonchunhyang-ro, Asan-si, Chungcheongnam-do, Republic of Korea+82-41-530-1114
COPYRIGHT 2021 by SOONCHUNHYANG UNIVERSITY ALL RIGHTS RESERVED.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.