SAFE-PDF: Robust Detection of JavaScript PDF Malware Using Abstract Interpretation

摘要: The popularity of the PDF format and rich JavaScript environment that viewers offer make documents an attractive attack vector for malware developers. present a serious threat to security organizations because most users are unsuspecting them thus likely open from untrusted sources. We propose identify malicious PDFs by using conservative abstract interpretation statically reason about behavior embedded code. Currently, state-of-the-art tools either: (1) based on structural similarity known samples; or (2) dynamically execute code detect behavior. These two approaches subject evasion attacks mimic structure benign do not exhibit their when being analyzed dynamically. In contrast, is oblivious both types evasions. A comparison with detection shows our approach achieves similar accuracy, while more resilient attacks.