A Combined Malicious Documents Detecting Method Based on Emulators

Abstract

ShellCode injections with malicious JavaScript code in documents are becoming more prevalent and dangerous. However, the existing methods have some limitations in detecting this kind of attacks. In this article, we explore the detections of malicious documents and propose an approach of detecting malicious documents that contains JavaScript ShellCode. In our approach, we provide an impact factor which represents the reliability of the document being malicious. We use both static detections and dynamic detections and then combine the results of the two different methods. Therefore, we can get an acceptable overhead and make the detection immune to obfuscation. We have implemented a proof-of-concept prototype of the detection system on a Linux platform. We also have evaluated the accuracy and the performance overhead on the test platform. The results show that the system reports very few faults with an acceptable overhead.