Detection method for malicious PDF document containing JavaScript, and electronic equipment

Abstract

The invention provides a detection method for a malicious PDF (Portable Document Format) document containing JavaScript. The detection method for the malicious PDF document containing the JavaScript comprises the following steps of extracting a JavaScript code; carrying out feature extraction on the JavaScript code to obtain feature data; inputting the feature data into a pre-constructed trainingclassification model for processing to obtain a classification result; and obtaining a detection result of the PDF document based on the classification result. According to the detection method for the malicious PDF document containing the JavaScript, the JavaScript code in the PDF document is extracted, feature extraction is carried out on the JavaScript code, and the feature data is input into the pre-constructed training classification model to be processed to obtain the classification result, so the malicious JavaScript code can be effectively extracted; therefore, whether the PDF documentis benign or malicious can be accurately and reliably judged according to the classification result, and malicious PDF document detection accuracy is improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method for detecting malicious PDF documents containing JavaScript. Background technique [0002] Since the Portable Document Format (PDF) is widely used for document exchange due to its high efficiency and stability, PDF files have become an important vector of cyber attacks. A typical scenario is phishing attacks using emails targeting governments and large corporations. Since most mail servers block executable files attached to emails for security reasons, PDF files have played an increasing role in recent cyberattacks. Regular users consider non-executable files safer than executable files, making them less suspicious of receiving files by email. However, PDF files are just as dangerous as executable files, and attackers can exploit vulnerabilities in the document format to gain illegal access to the host. [0003] An important reason why PDF files are insecure comes f...

AI Technical Summary

Problems solved by technology

Generally speaking, the disadvantage of static features is that it is difficult to detect obfuscation and encryption and hide deep malicious codes, while the acquisition of dynamic features requires the construction of a large number of heterogeneous operating environments, which require a lot of resource overhead and are easy to pass time delays, interactive manipulation and other techniques to circumvent

Images