Detecting malicious PDF documents

摘要: As the internet has become new playground for organized crime and foreign intelligence, sophistication of attacks increased. The traditional targeting listening services on target computer is no longer as viable it used to, much thanks to firewalls, NAT more secure administration servers. This forced attackers find targets, which they have found in client applications, users themselves. Client-side are now most method attack internet. A popular vector conducting such malicious PDF documents. Traditional signature based network intrusion detection systems (IDS) a hard time detecting threats, good alternative solutions been discovered. In this thesis we seek answer question ”How can PDF-documents transferred be detected? “ An anomaly IDS approach was chosen, several machine learning classifiers were investigated Support Vector Machines gave best accuracy performance. Several features PDFs analyzed order retrieve those significant Experiments performed combination SVM configurations maximize performance algorithm. real world study also by implementing algorithm belonging Norwegian Defence.