The malicious PDF documents posed a significant threat to network security in recent years. Extracting malicious indicators from PDF documents is a critical method for subsequent analysis and detection. However, curre...
详细信息
ISBN:
(纸本)9783031649530;9783031649547
The malicious PDF documents posed a significant threat to network security in recent years. Extracting malicious indicators from PDF documents is a critical method for subsequent analysis and detection. However, current static and dynamic extraction methods are easily interfered by evasion methods such as highly obfuscation and sandbox detection, etc. Therefore, we creatively apply optimized symbolic execution to PDF indicator extraction and propose PDFIET, a technique of PDF malicious indicators extraction consisting of three modules: code parsing, symbolicexecution and indicator extraction. We design the code rewriting method to improve code coverage by enforcing branch transfers. We also use the concurrency strategy and two constraint-solving optimization methods to enhance the efficiency of symbolicexecution. We use 1271 malicious samples to make several experiments. The success rate and the effectiveness of indicators is high. The code coverage and the system efficiency improve significantly after optimization. The evaluation supports the design of the approach.
暂无评论