Method and system for detecting malicious PDF documents

Abstract

The invention discloses a method for detecting malicious PDF (Portable Document Format) documents, which comprises the following steps of: converting an acquired malicious PDF document sample data setand a normal PDF document sample data set into a first gray level image and a second gray level image; constructing a deep convolutional generative adversarial network for increasing the number of the first grayscale images by using the first convolutional neural network; inputting the second grayscale image and the random noise into a generative adversarial network to generate a malicious PDF file grayscale image; constructing an initial classifier model of the malicious PDF file by utilizing a second convolutional neural network; training an initial classifier model to obtain a core malicious PDF file classifier; and detecting the PDF file to be detected through the core malicious PDF file classifier. The invention further discloses a system for detecting the malicious PDF document, thesystem has the advantage of automatically extracting image features, the defect that the prior art excessively depends on existing features is overcome, and the defect that when the number of novel malicious PDF samples is small, it is difficult to train a detection model with high accuracy is overcome.

Description

technical field [0001] The invention relates to the technical field of computer communication detection, and more particularly, to a method and system for detecting malicious PDF documents. Background technique [0002] With the development of information technology, the carrier format of information has also become various, among which PDF file is an electronic file format, because it is easy to use, small in size and stable, it has been widely used in various industries daily work in the field. PDF files have their own public standard specifications, and there are also dedicated PDF readers. However, while PDF files are widely used in information storage and dissemination, they have also attracted the attention of many attackers. At present, there are a large number of malicious codes on the Internet. PDF documents, users with weak security awareness are easily attacked when they download and open these malicious PDF files, and PDF files with malicious codes are often del...

AI Technical Summary

Problems solved by technology

[0005] In order to overcome the existing deep learning method and system for detecting malicious PDFs that rely too much on existing features, the present invention has many defects in dealing with the threat of new malicious PDF files, and the number of new malicious PDF samples is small, and it is difficult to train In view of the drawbacks of a detection model with high accuracy, the present invention proposes a new method and system for detecting malicious PDF documents. When the number of malicious PDF samples is small, PDF samples can be flexibly generated to supplement and ensure the detection effect

Images