Malicious PDF Detection using Machine Learning

The complexity and structure of modern documents make it possible to hide malicious code or confuse it with data. For that reason, the so-called trojan documents are often used as a vehicle for the distribution of malicious code, often appearing as legitimate and useful. The goal is to exploit vulnerabilities in the client application to perform arbitrary code execution. The PDF file format, one of the most widely spread file formats, has become popular due to its ease of use and broad set of functionalities. In this seminar, we will explore a method for static analysis of PDF documents that employs machine learning algorithms to discriminate between benign and malicious PDF documents. Besides benign/malicious classification, the same method will be used to discriminate between malicious documents designed for large-scale phishing attacks and the ones designed for targeted attacks.

It works.

[1] Paper