Detecting malicious pdf documents using semi-supervised machine learning - Advances in Digital Forensics XVII
Conference Papers Year : 2021

Detecting malicious pdf documents using semi-supervised machine learning

Abstract

Portable Document Format (PDF) documents are often used as carriers of malicious code that launch attacks or steal personal information. Traditional manual and supervised-learning-based detection methods rely heavily on labeled samples of malicious documents. But this is problematic because very few labeled malicious samples are available in real-world scenarios.This chapter presents a semi-supervised machine learning method for detecting malicious PDF documents. It extracts structural features as well as statistical features based on entropy sequences using the wavelet energy spectrum. A random sub-sampling strategy is employed to train multiple sub-classifiers. Each classifier is independent, which enhances the generalization capability during detection. The semi-supervised learning method enables labeled as well as unlabeled samples to be used to classify malicious and benign PDF documents. Experimental results demonstrate that the method yields an accuracy of 94% despite using training data with just 11% labeled malicious samples.
Fichier principal
Vignette du fichier
519603_1_En_7_Chapter.pdf (650.33 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03764374 , version 1 (31-08-2022)

Licence

Identifiers

Cite

Jianguo Jiang, Nan Song, Min Yu, Kam-Pui Chow, Gang Li, et al.. Detecting malicious pdf documents using semi-supervised machine learning. 17th IFIP International Conference on Digital Forensics (DigitalForensics), Feb 2021, Virtual, China. pp.135-155, ⟨10.1007/978-3-030-88381-2_7⟩. ⟨hal-03764374⟩
88 View
107 Download

Altmetric

Share

More