Detecting malicious PDF using CNN

Raphael Fettaya, Yishay Mansour

Keywords: Cybersecurity, Convolutional Neural Network, Malware

Abstract:

Malicious PDF files represent one of the biggest threats to computer security. To
detect them, significant research has been done using handwritten signatures or
machine learning based on manual feature extraction. Those approaches are both
time-consuming, requires significant prior knowledge and the list of features has
to be updated with each newly discovered vulnerability. In this work, we propose
a novel algorithm that uses a Convolutional Neural Network (CNN) on the byte
level of the file, without any handcrafted features. We show, using a data set
of 130000 files, that our approach maintains a high detection rate (96%) of PDF
malware and even detects new malicious files, still undetected by most antiviruses.
Using automatically generated features from our CNN network, and applying a
clustering algorithm, we also obtain high similarity between the antiviruses’ labels
and the resulting clusters.

Code: https://anonymous.4open.science/r/e553967d-5dfc-4a99-8624-f47c6b5fac5e/