Malicious PDF document detection based on mixed feature - Xuehui DU; Yangdong LIN; Yi SUN (Tongxin xuebao)
Aiming at the problem of poor robustness and easy to evade detection in the detection of malicious PDF document,a malicious PDF document detection method based on mixed features was proposed.It adopted dynamic and static analysis technology to extract the regular information,structure information and API calling information from the document,and then a feature extraction method based on K-means clustering algorithm was designed to filter and select the key mixed features that characterize the document security.Ultimately,it improved the robustness of features.On this basis,it used random forest algorithm to construct classifier and perform experiment to discuss the detection performance of the scheme and its ability to resist mimicry attacks.