Malicious PDF document intelligent detection method and system based on feature aggregation

Abstract

The invention discloses a malicious PDF document intelligent detection method and system based on feature aggregation. The method comprises the following steps: acquiring a to-be-detected PDF document; analyzing the PDF document, extracting content features and structural features of the document from the PDF document, merging the content features and the structural features, and performing feature clustering by taking the minimum variance of feature clusters as a target to obtain aggregated features; inputting the aggregation features into a pre-trained convolutional neural network model, and if the output is 1, determining that the document is a malicious document; if the output is 0, judging the document to be a benign document. The invention has the advantages that the dimensionality of the features is reduced, the training pressure of a deep learning model is relieved, and the efficiency of the system is improved; according to the aggregation features of the input document, the convolutional neural network model is utilized to detect and classify the document or automatically train the parameters of the model, so that the accuracy and usability of the system are improved.

Description

Technical field [0001] The present invention relates to a malicious PDF document intelligent detection method and system based on feature agglomeration, belonging to the information security technology. Background technique [0002] The traditional malicious PDF document detection method is based primarily on the signature identification and heuristic rules. The advantage is that the false positive rate is low, but it is limited to detection of malicious samples existing in the virus database. It is sluggish to the unknown malicious document, and the attacker can By counterfeiting new malicious documents. [0003] In recent years, malicious PDF document testing based on machine learning has been widely used. Compared to traditional signature matching detection, it can find new malicious documents in time and the model update is convenient. According to the feature extraction method, it can be divided into dynamic detection and static detection. Dynamic detection requires a docume...

AI Technical Summary

Problems solved by technology

[0004] The disadvantages of existing malicious PDF document detection methods include: the generalization ability of features is poor, and when there are few training samples, the classification model is prone to underfitting, which affects the performance of the detection system; unprocessed original features are easy to be attacked by attackers Carry out reverse imitation attacks, thereby affecting the detection rate of the detection system; the dimension of the feature space is large, resulting in low training efficiency of the deep learning model, which depends on the configuration of the system

Images