Malicious PDF document intelligent detection method and system based on graph structure

Abstract

The invention discloses a malicious PDF document intelligent detection method and system based on a graph structure. The method comprises the steps of obtaining a to-be-detected PDF document; analyzing a PDF document to obtain a graph structure feature of the document, performing classification importance sorting on all nodes of the graph structure feature, performing retention and merging processing according to a sorting result to obtain a simplified graph structure feature, and calculating a Laplacian matrix of the simplified graph structure feature as an input feature; inputting the input features into a pre-trained convolutional neural network model, and if the output is 1, determining that the document is a malicious document; if the output is 0, judging the document to be a benign document. The graph structure extraction and image simplification method has the advantages that the dimensionality of features is reduced, the training pressure of a deep learning model is relieved, and the efficiency of a system is improved; and according to the input features, the convolutional neural network model is utilized to detect and classify the documents or automatically train parameters of the model, so that the accuracy and usability of the system are improved.

Description

technical field [0001] The invention relates to a graph structure-based intelligent detection method and system for malicious PDF documents, belonging to the technical field of information security. Background technique [0002] Traditional malicious PDF document detection methods are mainly based on signature recognition and heuristic rule matching. The advantage is that the false positive rate is low, but it is limited to the detection of existing malicious samples in the virus database, and the response to unknown malicious documents is slow. Attackers can Bypassing detection by forging new malicious documents. [0003] The feature selection of existing machine learning-based malicious document detection methods mostly relies on expert knowledge-driven, and observations are made during manual analysis of malicious documents to select feature sets (such as the number of call class objects, document page numbers, or version numbers, etc. ), or through mathematical statisti...

AI Technical Summary

Problems solved by technology

[0004] The disadvantages of existing malicious PDF document detection methods include: relying on expert experience to select features, which cannot fully reflect document attributes; in the face of adversarial samples, the performance of the detector drops significantly; the dimension of the feature space is large, which leads to deep learning models. The training efficiency is relatively low, depending on the configuration of the system

Images