Entropy and n-gram Analysis of Malicious PDF Documents
Himanshu Pareek, P R L Eswari · 2013
Malware is a persistent problem in field of computer security and its complexity has increased multiple folds in past decade. In past few years malicious documents attacks have emerged as preferred method to bypass the security of a host computer. This work assumes that such kind of exploits do not carry any important information and hence should not be highly random. However use of randomness is not a deterministic approach for detection of malicious code but gives a useful indication to malware analyst. This research report presents two discrete analyses of malicious PDF documents. One is entropy and other being n-gram term frequency.