Detecting malicious PDF documents
Jarle Kittilsen · NORA - Norwegian Open Research Archives · 2011
ENGELSK: As the internet has become the new playground for organized crime and foreign intelligence, the sophistication of internet attacks has increased. The traditional attacks targeting listening services on the target computer is no longer as viable as it used to, much thanks to firewalls, NAT and more secure administration of servers. This has forced the attackers to find new targets, which they have found in client applications, and in the users themselves. Client-side attacks are now the most used method of attack on the internet. A popular vector for conducting such attacks are malicious PDF documents. Traditional signature based network intrusion detection systems (IDS) have a hard time detecting such threats, and no good alternative solutions have been discovered. In this thesis we seek the answer to the question ”How can malicious PDF-documents transferred in a network be detected? “ An anomaly based network IDS approach was chosen, several machine learning classifiers were investigated and Support Vector Machines gave the best accuracy and performance. Several features of PDFs are analyzed in order to retrieve those significant for the detection of malicious PDF documents. Experiments were performed to find the best combination of features and SVM configurations to maximize performance of the detection algorithm. A real world study was also performed by implementing the algorithm in a network belonging to the Norwegian Defence.