Detecting malicious pdf documents using semi-supervised machine learning - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Detecting malicious pdf documents using semi-supervised machine learning

Résumé

Portable Document Format (PDF) documents are often used as carriers of malicious code that launch attacks or steal personal information. Traditional manual and supervised-learning-based detection methods rely heavily on labeled samples of malicious documents. But this is problematic because very few labeled malicious samples are available in real-world scenarios.This chapter presents a semi-supervised machine learning method for detecting malicious PDF documents. It extracts structural features as well as statistical features based on entropy sequences using the wavelet energy spectrum. A random sub-sampling strategy is employed to train multiple sub-classifiers. Each classifier is independent, which enhances the generalization capability during detection. The semi-supervised learning method enables labeled as well as unlabeled samples to be used to classify malicious and benign PDF documents. Experimental results demonstrate that the method yields an accuracy of 94% despite using training data with just 11% labeled malicious samples.
Fichier principal
Vignette du fichier
519603_1_En_7_Chapter.pdf (650.33 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03764374 , version 1 (31-08-2022)

Licence

Paternité

Identifiants

Citer

Jianguo Jiang, Nan Song, Min Yu, Kam-Pui Chow, Gang Li, et al.. Detecting malicious pdf documents using semi-supervised machine learning. 17th IFIP International Conference on Digital Forensics (DigitalForensics), Feb 2021, Virtual, China. pp.135-155, ⟨10.1007/978-3-030-88381-2_7⟩. ⟨hal-03764374⟩
58 Consultations
81 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More