中图分类号： TP309
文献标识码： A
DOI： 10.19358/j.issn.2096-5133.2021.11.003
引用格式： 俞远哲，王金双，邹霞. 基于文档图结构的恶意PDF文档检测方法[J].信息技术与网络安全，2021，40(11)：16-23.

Malicious PDF detection method based on document graph structure

Abstract： Malicious PDF detection methods based on machine learning rely on the expert knowledge, which still cannot fully reflect the document attributes. Moreover, the performances of the detectors are easily affected by adversarial samples. To overcome these limitations, a malicious PDF detection method based on the PDF document graph structures and Convolutional Neural Network(CNN) was proposed. Firstly, a directed graph was constructed according to the document structure and the reference relationships between document objects. Secondly, the contribution of each node was calculated using TF-IDF algorithm, according to which the graph structures was simplified. Thirdly, the adjacency and degree matrices of the simplified graph were calculated, and the Laplacian matrix of the graph was obtained, which was used as a feature and sent to the CNN classification model for training. Adversarial samples were also added to train the model. It was evaluated that this method has an accuracy of 99.71% which is better than KNN and SVM classification models. Compared with the 67 antivirus engines on VirusTotal, it has achieved higher detection performance in the detection of adversarial samples.

Key words : malicious PDF document；document graph structure；CNN；adversarial sample