Detecting Malicious Javascript in PDF through Document Instrumentation

摘要: An emerging threat vector, embedded malware inside popular document formats, has become rampant since 2008. Owed to its wide-spread use and Javascript support, PDF been the primary vehicle for delivering exploits. Unfortunately, existing defenses are limited in effectiveness, vulnerable evasion, or computationally expensive be employed as an on-line protection system. In this paper, we propose a context-aware approach detection confinement of malicious PDF. Our statically extracts set static features inserts context monitoring code into document. When instrumented is opened, will cooperate with our runtime monitor detect potential infection attempts execution. Thus, detector can identify documents by using both features. To validate effectiveness real world setting, first conduct security analysis, showing that system able remain effective robust against evasion even presence sophisticated adversaries. We implement prototype proposed system, perform extensive experiments 18623 benign samples 7370 samples. evaluation results demonstrate accurately confine minor performance overhead.