Static detection of malicious JavaScript-bearing PDF documents

Laskov, Pavel; Šrndić, Nedim

doi:10.1145/2076732.2076785

Cited by 134 publications

(122 citation statements)

References 14 publications

Supporting

Mentioning

122

Contrasting

Order By: Relevance

“…False Positive True Positive N-grams [17] 31% 84% PJScan [7] 16% 85% PDFRate [4] 2% 99% Structural [5] 0.05% 99% MDScan [9] N/A 89% Wepawet [18] N/A 68% [9] Ours 0 97% system with other methods by analyzing possible advanced attacks.…”

Section: Methodsmentioning

confidence: 99%

“…In 2011, Laskov et al [7] presented PJScan, the first static method dedicated to the detection of malicious PDF. Using a patched SpiderMonkey, PJScan extracts lexical tokens of Javascript and trains an OCSVM (One Class Support Vector Machine) classifier to identify malicious PDF.…”

Section: Related Workmentioning

confidence: 99%

“…The first step of our method is to reconstruct all Javascript chains in a document. We use a similar technique described in previous works [7] [8] [9] to locate Javascript. Specifically, we scan the document for keywords /JS and /JavaScript that indicate a string or stream containing Javascript [29].…”

Section: Document Instrumentationmentioning

confidence: 99%

“…Unfortunately, it appears that traditional signature and behavior based detection methods, which are favored by the majority of modern antivirus software, cannot handle malicious PDF well. Recently, researchers exploit the structural differences between benign and malicious documents to detect malicious PDF [4] [5] [6] [7]. These methods have been proven to be simple, fast, and accurate.…”

Section: Introductionmentioning

confidence: 99%

“…This method, to the best of our knowledge, has never been explored before for PDF malware detection and confinement. For each PDF Javascript snippet, we include a prologue and epilogue to inform our runtime detector for the entry to and exit from [6] No Yes No Yes Extract-and-Emulate [9] Neutral No Yes No Lexical Analysis of Javascript [7] Neutral Yes No Yes Adobe Sandboxing [12] Neutral Yes No Yes CWSandbox [13] Neutral Javascript context. The advantage of using static document instrumentation over the other two alternatives lies in three aspects.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Detecting Malicious Javascript in PDF through Document Instrumentation

Liu

Wang

Stavrou

2014

2014 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks

View full text Add to dashboard Cite

Abstract-An emerging threat vector, embedded malware inside popular document formats, has become rampant since 2008. Owed to its wide-spread use and Javascript support, PDF has been the primary vehicle for delivering embedded exploits. Unfortunately, existing defenses are limited in effectiveness, vulnerable to evasion, or computationally expensive to be employed as an on-line protection system. In this paper, we propose a context-aware approach for detection and confinement of malicious Javascript in PDF. Our approach statically extracts a set of static features and inserts context monitoring code into a document. When an instrumented document is opened, the context monitoring code inside will cooperate with our runtime monitor to detect potential infection attempts in the context of Javascript execution. Thus, our detector can identify malicious documents by using both static and runtime features. To validate the effectiveness of our approach in a realworld setting, we first conduct a security analysis, showing that our system is able to remain effective in detection and be robust against evasion attempts even in the presence of sophisticated adversaries. We implement a prototype of the proposed system, and perform extensive experiments using 18623 benign PDF samples and 7370 malicious samples. Our evaluation results demonstrate that our approach can accurately detect and confine malicious Javascript in PDF with minor performance overhead.

show abstract