Title:  Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection
Internal authors: 
Issue Date:  2013
Abstract:  PDF files have proved to be excellent malicious-code bearing vectors. Thanks to their flexible logical structure, an attack can be hidden in several ways, and easily deceive protection mechanisms based on file-type filtering. Recent work showed that malicious PDF files can be accurately detected by analyzing their logical structure, with excellent results. In this paper, we present and practically demonstrate a novel evasion technique, called reverse mimicry, that can easily defeat such kind of analysis. We implement it using real samples and validate our approach by testing it against various PDF malware detectors proposed so far. Finally, we highlight the importance of developing systems robust to adversarial attacks and propose a framework to strengthen PDF malware detection against evasion.
URI:  http://hdl.handle.net/11584/106938
ISBN:  978-1-4503-1767-2
Type: 4.1 Contributo in Atti di convegno

Files in This Item:
There are no files associated with this item.

Questionnaire and social

Share on: