针对恶意逃避行为的PDF文档检测  

PDF Document Detection for Malicious Evasion Behavior

作　　者：李东帅 尚培文 LI Dongshuai;SHANG Peiwen(School of Electronics&Information Engineering,Liaoning University of Technology,Jinzhou 121001,China)

机构地区：[1]辽宁工业大学电子与信息工程学院,辽宁锦州121001

出　　处：《现代信息科技》2024年第10期7-12,共6页Modern Information Technology

摘　　要：便捷式文档格式(PDF)是全球数据交换中广泛使用的格式之一,人们对其有很高的信任度。然而,近年来不法分子利用PDF文档进行恶意网络攻击的情况越来越严重。随着黑客技术的进步,他们也逐渐采用一些逃避检测的方法,使得常见的学习算法难以检测到这种恶意文件。针对这些“更聪明”的恶意PDF攻击样本,对PDF文档的特性进行了分析,提取了25维特征,并应用调参后的Adaboost算法训练模型,准确率达到99.63%,优于同领域的其他研究成果。The Portable Document Format(PDF)is one of the widely used formats in global data exchange,and people have a high level of trust in it.However,in recent years,the situation of criminals using PDF documents for malicious network attacks has become increasingly serious.With the advancement of hacker technology,they are gradually adopting methods to evade detection,making it more difficult for common learning algorithms to detect such malicious files.In response to these“smarter”malicious PDF attack samples,an analysis of the characteristics of PDF documents is conducted,and 25-dimensional features are extracted.By applying a finely-tuned Adaboost algorithm for model training,an accuracy rate of 99.63%is achieved,surpassing other research achievements in the same field.

关 键 词：PDF 逃避检测 ADABOOST算法 网络攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]