CN108959930A - Malice PDF detection method, system, data storage device and detection program - Google Patents

Abstract

The invention discloses a malicious PDF detection method, system, data storage device and detection program, which belong to the technical field of information security; the malicious PDF detection method is: convert the PDF file to be checked into a byte sequence, and calculate the information of each PDF file Entropy; set the threshold α according to the maximum, minimum and average values of information entropy values of malicious PDF files and benign PDF files and experience values, compare the information entropy of each PDF file with threshold α, and set the information entropy higher than α PDF files are regarded as normal files, and PDF files with information entropy lower than α are regarded as suspicious files; Origami analysis is used to extract JavaScript and structural features commonly used in malicious attacks in suspicious files; C5.0 decision tree algorithm is used for classification. The invention can solve the problems of small detection range, high time consumption of model detection and the like.

Description

Malicious PDF detection method, system, data storage device and detection program

technical field

The invention is applied to the detection field of malicious PDF files in information security. In particular, it relates to a malicious PDF detection method, system, data storage device and detection program.

Background technique

Portable Document Format (PDF) is an electronic document format released by Adobe Systems Incorporated in 1993. Due to PDF's high popularity, flexible structure, and diverse functions, more and more cybercriminals use PDF files to carry out cybercrimes such as information theft and malicious extortion. And in recent years, advanced persistent threat (APT) attacks on commercial organizations and government agencies have occurred frequently, and malicious PDF files are an important carrier of APT attacks, and the attack process is completed by executing malicious code embedded in the file. Despite software vendors' efforts to prevent and address them, PDF software is often vulnerable to zero-day attacks, especially those that exploit the PDF file format with third-party technologies such as JavaScript or Flash, making it increasingly difficult to create temporary patches. more difficult. In addition, due to the complex architecture of PDF files, attackers use various code obfuscation techniques, making it difficult for antivirus software to provide detection for new malicious PDF files.

Through the analysis of malicious PDF files, the main attack methods for existing PDF vulnerabilities are JavaScript-based attacks and non-JavaScript-based attacks. The JavaScript-based attack exploits the vulnerability of the PDF reader to transfer the execution process to the embedded malicious JavaScript code. Non-JavaScript-based attacks mainly use many PDF functions: such as "/Launch", "/Go To" and "/URl", etc., to automatically open remote resources and increase the threat of the Internet to the client.

At present, most antivirus software adopts methods based on heuristics or string matching to detect and kill viruses, but these methods cannot effectively deal with the problem of polymorphic attacks. To address this issue, recent research has focused on two aspects:

(1) Use the JavaScript embedded in the PDF file to extract its JavaScript features through static and dynamic analysis, and then classify it through machine learning. Such methods are resilient to malicious JavaScript-based attacks, but are vulnerable to code obfuscation.

(2) Use the structural information of PDF files to detect malicious PDF files, which is characterized by not analyzing the attack code or loopholes it carries, and the advantage of this method relative to JavaScript analysis is that they can detect non-JavaScript attacks and will not Suffer from code obfuscation. But how to enhance the robustness of the model is a big challenge for malicious file detection methods based on structural information.

Malicious PDF file detection based on the above methods usually only detects malicious attacks based on a single method, and the model time consumption is relatively high.

Contents of the invention

In order to solve the above problems, the object of the present invention is to provide a malicious PDF detection method, system, data storage device and detection program.

In order to achieve the above object, technical scheme of the present invention is:

A malicious PDF detection method at least includes the following steps:

Step 1, convert the PDF file to be checked into a byte sequence, and calculate the information entropy of each PDF file;

Step 2, according to the maximum value, minimum value and average value of the information entropy value of the malicious PDF file and the benign PDF file and the empirical value setting threshold α, the information entropy of each PDF file is compared with the threshold α, and the information entropy is high The PDF files whose information entropy is lower than α are regarded as normal files, and the PDF files whose information entropy is lower than α are regarded as suspicious files;

Step 3: Use Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

Step 4: Use the C5.0 decision tree algorithm to classify.

Further: the above-mentioned step 1 is specifically: first convert the PDF file to be checked into a binary byte file with PDFParser, and then calculate the information entropy of each PDF file.

Further: the above step three is specifically: first use Origami to analyze the structure of the suspicious file and search for malicious features and general features of the structure, and then analyze the JavaScript code of the suspicious file and search for malicious features.

Further: the above step 4 is specifically as follows: first, each PDF file is represented by a vector, which is composed of general features of the structure, dynamic features of the structure and JavaScript features; then the vectors and categories are input into the C5.0 decision tree for classification .

Another object of the present invention is to provide a malicious PDF detection system, comprising:

The information entropy calculation module converts the PDF file to be checked into a byte sequence, and calculates the information entropy of each PDF file;

The screening module sets the threshold α according to the maximum value, minimum value and average value of the information entropy value of the malicious PDF file and the benign PDF file and the empirical value, compares the information entropy of each PDF file with the threshold α, and compares the information entropy value with high information entropy The PDF files whose information entropy is lower than α are regarded as normal files, and the PDF files whose information entropy is lower than α are regarded as suspicious files;

Analysis module, using Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

The classification module uses the C5.0 decision tree algorithm for classification.

Another object of the present invention is to provide a data storage device, including instructions, which, when run on a computer, cause the computer to execute the above malicious PDF detection method.

Another object of the present invention is to provide a detection program for realizing the above malicious PDF detection method.

The advantages and positive effects that the present invention has are:

The invention combines information entropy, javascript features and structural features of PDF files to classify using the C5.0 decision tree algorithm. The method has high detection accuracy, greatly reduces detection time, and enhances practicability.

Description of drawings

Fig. 1 is the flowchart of preferred embodiment of the present invention;

Detailed ways

In order to further understand the invention content, characteristics and effects of the present invention, the following examples are given, and detailed descriptions are as follows in conjunction with the accompanying drawings:

As shown in Figure 1, a malicious PDF detection method: comprises the following steps:

Step 1, convert the PDF files in the data set into byte sequences, and calculate the information entropy of each PDF file;

Specific steps are as follows:

(1) First use PDFParser to convert the PDF files in the data set into binary.

(2) Then use formula 1 to calculate the information entropy of the file.

Among them, x represents the file; N represents the total number of different bytes after the file is converted into a byte sequence; i represents the byte in the i-th byte sequence in the file; p _i represents the probability of byte i appearing.

Step 2. Comparing the information entropy of each file with the threshold α, the files with information entropy higher than α are regarded as normal files, and the files with information entropy lower than α are regarded as suspicious files;

Specific steps are as follows:

(1) According to the simulation of multiple experiments, set the information entropy threshold α to 7.74.

(2) Substitute the information entropy H(x) and threshold α obtained in step 1 into formula 2 to obtain their difference. If the difference is greater than 0, then the PDF file is regarded as a suspicious file for step 3, otherwise it is output as a normal file.

ΔH=α-H(x) (2)

ΔH: the difference between the threshold α and the information entropy H(x) of the PDF file to be tested.

Step 3: Use Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

Specific steps are as follows:

(1) First use Origami to analyze the structure of the PDF file and search for malicious features and general features of the structure. The malicious features include '/JS', '/JavaScript', '/Go To', 'Go To R', 'Go To E', 'openaction', '/Submit Form'); the general features of the structure include the Size, number of indirect objects.

(2) Then analyze the JavaScript code of the PDF file and search for malicious features. Malicious features include substring, fromChar Code, stringcount, document.Write, document.create Element, Eval, setTime Out, eval_length, max_string.

Step 4, select the C5.0 decision tree algorithm for classification;

Specific steps are as follows:

(1) S is a feature sample set, including a structural feature set S ₁ and a JavaScript feature set S ₂ . Taking structural features as an example, the metadata type variable C has K classes, and the number of samples belonging to class C _i is freq(C _i ,S ₁ ). Use formula 3 to calculate the information entropy Info(S ₁ ) of the structural feature set S ₁ :

Among them, |S ₁ | is the number of elements in the structural feature set S ₁ .

(2) The characteristic attribute T has N types, and the conditional entropy Info(T) of the attribute T is calculated by formula 4:

Among them, T _i is the feature attribute of the i-th category.

(3) Use Formula 5 to calculate the information gain Gain(T) of the attribute variable T:

Gain(T)=Info(S ₁ )-Info(T) (5)

(4) Use the information gain rate to generate nodes, that is, formula 6:

Gainration(A)＝Gain(A)/Info(A) (6)

Among them, Gain(A) indicates the information gain of child nodes generated in case A; Info(A) indicates the number of child nodes generated in case A, the more child nodes after division, Info(A) bigger.

(5) After the tree is generated, the method based on tree rules is used to realize pruning.

A malicious PDF detection system, including:

The information entropy calculation module converts the PDF file to be checked into a byte sequence, and calculates the information entropy of each PDF file;

The screening module sets the threshold α according to the maximum value, minimum value and average value of the information entropy value of the malicious PDF file and the benign PDF file and the empirical value, compares the information entropy of each PDF file with the threshold α, and compares the information entropy value with high information entropy The PDF files whose information entropy is lower than α are regarded as normal files, and the PDF files whose information entropy is lower than α are regarded as suspicious files;

Analysis module, using Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

The classification module uses the C5.0 decision tree algorithm for classification.

A data storage device, including an instruction, when it is run on a computer, causes the computer to perform the following malicious PDF detection method;

Step 1, convert the PDF file to be checked into a byte sequence, and calculate the information entropy of each PDF file;

Step 2, according to the maximum value, minimum value and average value of the information entropy value of the malicious PDF file and the benign PDF file and the empirical value setting threshold α, the information entropy of each PDF file is compared with the threshold α, and the information entropy is high The PDF files whose information entropy is lower than α are regarded as normal files, and the PDF files whose information entropy is lower than α are regarded as suspicious files;

Step 3: Use Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

Step 4: Use the C5.0 decision tree algorithm to classify.

As a preference: the above-mentioned step one specifically includes: first converting the PDF file to be checked into a binary byte file with PDFParser, and then calculating the information entropy of each PDF file.

As a preference: the above step three specifically includes: firstly using Origami to analyze the structure of the suspicious file and search for malicious features and general features of the structure, and then analyze the JavaScript code of the suspicious file and search for malicious features.

As a preference: the above step 4 is specifically as follows: first, each PDF file is represented by a vector, which is composed of general features of the structure, dynamic features of the structure, and JavaScript features; then the vectors and categories are input to the C5.0 decision tree for Classification.

A detection program that implements the following malicious PDF detection method;

Step 1, convert the PDF file to be checked into a byte sequence, and calculate the information entropy of each PDF file;

Step 2, according to the maximum value, minimum value and average value of the information entropy value of the malicious PDF file and the benign PDF file and the empirical value setting threshold α, the information entropy of each PDF file is compared with the threshold α, and the information entropy is high The PDF files whose information entropy is lower than α are regarded as normal files, and the PDF files whose information entropy is lower than α are regarded as suspicious files;

Step 3: Use Origami to analyze and extract JavaScript and structural features commonly used in malicious attacks in suspicious files;

Step 4: Use the C5.0 decision tree algorithm to classify.

As a preference: the above-mentioned step one specifically includes: first converting the PDF file to be checked into a binary byte file with PDFParser, and then calculating the information entropy of each PDF file.

As a preference: the above step three specifically includes: firstly using Origami to analyze the structure of the suspicious file and search for malicious features and general features of the structure, and then analyze the JavaScript code of the suspicious file and search for malicious features.

As a preference: the above step 4 is specifically as follows: first, each PDF file is represented by a vector, which is composed of general features of the structure, dynamic features of the structure, and JavaScript features; then the vectors and categories are input to the C5.0 decision tree for Classification.

Example:

In order to verify the effect of this method, the inventor designed corresponding embodiments. On the one hand, the influence of different parameters on the model detection effect was experimentally designed. model (PJScan) and a structural feature-based detection model (PDFMS) for comparison.

The detection data set is used in Contagiodump, a total of 11,207 malicious files and 9,745 normal files, of which 10,310 malicious samples are embedded with JavaScript, accounting for 92% of the malicious samples. Formal detection was repeated 10 times by 10-fold cross-validation.

Comparison 1: In order to verify the detection performance of the present invention based on different attack methods, it is used to evaluate whether the malicious PDF detection method based on javascript and structural features under information entropy is conducive to improving the detection accuracy of malicious detection. The experimental results are shown in Table 1. It can be seen from Table 1 that the method in this paper makes the detection rate reach 98.73%, and the false detection rate is 1.8%. The detection rate (TPR) of PJScan is 71.94%, and the false detection rate (FPR) is 1.1%. The detection rate of PDFMS is 99.55%, and the false detection rate is 2.5%. Although the false detection rate of the method proposed in this paper is higher than that of PDFM, the detection rate is 26.79% higher than that of PJScan. It can be seen that the method proposed in this paper is reasonable and effective, and while effectively detecting malicious PDF files based on malicious JavaScript attacks, it can also effectively detect malicious PDF files based on non-JavaScript attacks.

Table 1 Comparison of detection accuracy and detection time of different algorithms

Comparison 2: In order to verify the detection time of the present invention based on different attack methods, it is used to evaluate whether the method of malicious detection using PDF JavaScript features and structural features is beneficial to reduce the time consumption of malicious detection. Table 1 shows the comparison of accuracy rate (TPR), false detection rate (FPR) and detection time (T(s)) between our method and PDFMS and PJScan. It can be seen from Table 1 that the detection time consumed by PDFMS is the most at 2330s; the detection time consumed by PJScan is in the middle, which is 2247s; the method proposed in the present invention consumes the least detection time, which is 1857s, which is 473s less than PDFMS and less than PJScan 390s. In summary, the method proposed in the present invention is superior to PDFMS and PJScan in terms of detection time.

The basic principle of the malicious PDF detection method based on javascript and structural features under information entropy provided by the present invention is as follows: in order to reduce time consumption, first use information entropy to screen out suspicious files and normal files, and then only detect suspicious files; then, in order to expand Detection range, during detection, extract structural features and JavaScript features; finally use C5.0 decision tree algorithm for classification.

The embodiments of the present invention have been described in detail above, but the content described is only a preferred embodiment of the present invention, and cannot be considered as limiting the implementation scope of the present invention. All equivalent changes and improvements made according to the application scope of the present invention shall still belong to the scope covered by the patent of the present invention.

Claims (7)

1. a kind of malice PDF detection method, it is characterised in that: include at least following steps:

Step 1: pdf document to be checked is converted into byte sequence, the comentropy of each PDF part is calculated；

Step 2: according to the maximum value of the information entropy of the malice pdf document of statistics and benign pdf document, minimum value and being averaged Threshold alpha is arranged in value and empirical value, by the comentropy of each pdf document compared with threshold alpha, comentropy is higher than the pdf document of α As normal file, the pdf document using comentropy lower than α is as apocrypha；

Step 3: analyzing the JavaScript and structure feature for extracting and being usually used in malicious attack in apocrypha using Origami；

Step 4: being classified using C5.0 decision Tree algorithms.

2. malice PDF detection method according to claim 1, it is characterised in that: above-mentioned steps one specifically: use first Pdf document to be checked is converted into binary system byte file by PDFParser, then calculates the comentropy of each pdf document.

3. malice PDF detection method according to claim 1, it is characterised in that: above-mentioned steps three specifically: first with The structure of Origami analysis apocrypha and the general features for searching for malice feature and structure, then analyze apocrypha again JavaScript code simultaneously searches for malice feature.

4. malice PDF detection method according to claim 1, it is characterised in that: above-mentioned steps four specifically: first every A pdf document indicates that the vector is by the general features of structure, the behavioral characteristics of structure and JavaScript feature with a vector Composition；Then vector, classification C5.0 decision tree is input to classify.

5. a kind of malice PDF detection system, it is characterised in that: include:

Pdf document to be checked is converted into byte sequence by comentropy computing module, calculates the comentropy of each PDF part；

Screen module, maximum value, minimum value peace according to the information entropy of the malice pdf document and benign pdf document of statistics Threshold alpha is arranged in mean value and empirical value, the PDF text by the comentropy of each pdf document compared with threshold alpha, comentropy higher than α Part is as normal file, and the pdf document using comentropy lower than α is as apocrypha；

Analysis module is analyzed using Origami and extracts the JavaScript for being usually used in malicious attack in apocrypha and structure spy Sign；

Categorization module is classified using C5.0 decision Tree algorithms.

6. a kind of data storage device, it is characterised in that: including instruction, when run on a computer, so that computer is held The malice PDF detection method of any one of row claim 1-4.

7. a kind of detection program for the malice PDF detection method for realizing any one of claim 1-4.