The malicious PDF documents posed a significant threat to network security in recent years. Extracting malicious indicators from PDF documents is a critical method for subsequent analysis and detection. However, current static and dynamic extraction methods are easily interfered by evasion methods such as highly obfuscation and sandbox detection, etc. Therefore, we creatively apply optimized symbolic execution to PDF indicator extraction and propose PDFIET, a technique of PDF malicious indicators extraction consisting of three modules: code parsing, symbolic execution and indicator extraction. We design the code rewriting method to improve code coverage by enforcing branch transfers. We also use the concurrency strategy and two constraint-solving optimization methods to enhance the efficiency of symbolic execution. We use 1271 malicious samples to make several experiments. The success rate and the effectiveness of indicators is high. The code coverage and the system efficiency improve significantly after optimization. The evaluation supports the design of the approach.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

PDFIET: PDF Malicious Indicators Extraction Technique Through Optimized Symbolic Execution

  • Enzhou Song,
  • Tao Hu,
  • Peng Yi,
  • Wenbo Wang

摘要

The malicious PDF documents posed a significant threat to network security in recent years. Extracting malicious indicators from PDF documents is a critical method for subsequent analysis and detection. However, current static and dynamic extraction methods are easily interfered by evasion methods such as highly obfuscation and sandbox detection, etc. Therefore, we creatively apply optimized symbolic execution to PDF indicator extraction and propose PDFIET, a technique of PDF malicious indicators extraction consisting of three modules: code parsing, symbolic execution and indicator extraction. We design the code rewriting method to improve code coverage by enforcing branch transfers. We also use the concurrency strategy and two constraint-solving optimization methods to enhance the efficiency of symbolic execution. We use 1271 malicious samples to make several experiments. The success rate and the effectiveness of indicators is high. The code coverage and the system efficiency improve significantly after optimization. The evaluation supports the design of the approach.