CN112035837B - Malicious PDF document detection system and method based on mimic defense - Google Patents

Abstract

The invention belongs to the technical field of information content security, and particularly relates to a malicious PDF document detection system and method based on mimicry defense, which are used for simultaneously processing an input PDF document based on a plurality of heterogeneous host systems with equivalent functions, respectively tracking the processing action of a PDF reader and the influence of the PDF document on the host systems, and outputting a document detection result according to majority judgment, wherein once internal behaviors or external behaviors are found to be inconsistent among the heterogeneous host systems, the PDF document is considered to be malicious. According to the invention, by introducing a mimicry defense technology in the detection of the malicious PDF document, the known and unknown risks faced by the PDF document can be effectively prevented, and the detection accuracy and detection efficiency are improved.

Description

Malicious PDF document detection system and method based on mimic defense

technical field

The invention belongs to the technical field of information content security, and in particular relates to a malicious PDF document detection system and method based on mimicry defense.

Background technique

As users learned about malicious email attachments and web links, cyber attackers turned to document-based malicious attacks. Browsers, email proxies, or antivirus products often warn users more about the dangers of executable files. However, documents such as PDFs receive little attention and suspicion because they give the impression of being static files that do little harm.

In recent years, however, the PDF specification has changed. New scripting capabilities enable documents to work in almost the same way as executables, including the ability to connect to the Internet, run processes, and interact with other files/programs. Growth in content complexity provides attackers with more holes to launch powerful attacks and more flexibility to hide malicious payloads and evade detection. A malicious PDF document usually exploits one or more vulnerabilities in the PDF interpreter to launch an attack. Considering the increasing complexity and extensive library/system component dependencies of PDF document readers, it is easy to form a large exposed attack surface.

Taking the PDF reader Adobe Acrobat Reader as an example, 274 CVEs were discovered in 2019. The wide variety of PDF readers and the large attack surface they create make them one of the top targets for attackers. The collected malware cases show that many Abode components have been compromised, including element parsers and decoders, font managers, and JavaScript engines. System-wide dependencies, such as graphics libraries, are also targeted by attackers.

With the continuous development of PDF readers and the popularity of PDF format, malicious PDF document detection has become an urgent problem. However, existing malicious PDF document detection schemes oversimplify the PDF specification, resulting in incomplete malicious payload extraction and detection failure, and lack of real-time tracking of document running process. Therefore, it is necessary to design a novel malicious PDF document detection system to guard against the known and unknown risks of PDF documents.

In recent years, in order to solve the serious security problems caused by the insufficient security of traditional defense methods, relevant researchers have proposed mimic defense technology. Mimic defense is an active defense method. Its core idea is dynamic heterogeneous redundancy. It organizes multiple redundant heterogeneous functional equivalents to jointly process the same external request, and discovers and shields malicious attacks through multi-mode adjudication. In order to make up for the static, similar, and single security flaws in traditional defense technologies.

Contents of the invention

Aiming at malicious attacks initiated by attackers using loopholes and backdoors in PDF documents, based on the idea of dynamic heterogeneous redundancy in mimic defense, the present invention designs a malicious PDF document detection system and method based on mimic defense, so that the detection system has endogenous Security attributes that quickly and efficiently detect known and unknown risks in PDF documents.

In order to solve the problems of the technologies described above, the present invention adopts the following technical solutions:

The invention provides a malicious PDF document detection system based on mimic defense, comprising:

Multiple heterogeneous hosts with equivalent functions are used to process the same PDF document, and track the system behavior of multiple heterogeneous hosts when processing PDF documents;

The arbiter is configured to judge the tracking processing result and determine whether the PDF document is malicious.

Further, PDF readers of the same type and version are installed in the heterogeneous host system of the heterogeneous host.

Further, tracking the system behavior of multiple heterogeneous hosts when processing PDF documents includes internal behavior and external behavior, the internal behavior is to track the PDF document processing flow of the PDF reader in the heterogeneous host system, and the external behavior is to track the PDF document processing Effects of heterogeneous host systems.

Further, the arbiter includes an internal behavior arbiter and an external behavior arbiter; the internal behavior arbiter is used to perform multi-modal arbitration on the internal behavior tracking result, and the external behavior arbiter is used to perform multi-modal arbitration on the external behavior tracking result. ruling.

The present invention also provides a method for detecting malicious PDF documents based on mimicry defense, comprising the following steps:

Skeuomorphic treatment of the same PDF document;

Track the system behavior of multiple heterogeneous hosts when processing PDF documents;

Determine whether the PDF document is malicious or not by making a judgment on the tracking processing result.

Further, performing mimetic processing on the same PDF document includes:

The PDF documents to be detected are distributed as input incentives to multiple heterogeneous hosts with equivalent functions for simultaneous processing, and the heterogeneous host systems of the heterogeneous hosts are installed with the same type and the same version of the PDF reader.

Further, tracking the system behavior of multiple heterogeneous hosts when processing PDF documents includes internal behavior and external behavior, the internal behavior is to track the PDF document processing flow of the PDF reader in the heterogeneous host system, and the external behavior is to track the PDF document processing Effects of heterogeneous host systems.

Further, the internal behavior includes COS object parsing, PD tree construction, script execution and element presentation.

Further, the external behavior includes file system operation, network activity and program loading.

Further, determining whether the PDF document is malicious includes:

Send the internal behavior tracking results to the internal behavior arbiter for comparison, and determine whether the PDF document is malicious by comparing processing actions and executing multi-mode rulings; send the external behavior tracking results to the external behavior arbiter for comparison, and compare the behavior of heterogeneous host systems and perform a multimodal verdict to determine whether a PDF document is malicious.

Compared with the prior art, the present invention has the following advantages:

In order to effectively improve the malicious PDF document detection capability, the present invention designs a malicious PDF document detection system based on mimicry defense. Since normal PDF documents behave the same on different host systems, when malicious PDF documents launch attacks on different host systems, they will cause different behaviors, ranging from PDF document processing actions (internal behavior) to PDF document impact on the host system (External Behavior), thus outputting malicious PDF document detection results based on multimodal adjudication by extensively comparing the behavior of PDF documents on heterogeneous host systems (e.g., Windows, Linux, Macintosh) (both internal and external). Specifically, multiple functionally equivalent heterogeneous host systems simultaneously process the input PDF documents, respectively track the PDF reader processing action and the impact of PDF documents on the host system, and output the document detection results according to the majority decision. If the internal behavior or external behavior inconsistency among heterogeneous host systems is found, the PDF document is considered to be malicious. By introducing the mimetic defense technology into malicious PDF document detection, the present invention can effectively prevent known and unknown risks faced by PDF documents, and improve detection accuracy and detection efficiency.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are For some embodiments of the present invention, those skilled in the art can also obtain other drawings based on these drawings without creative work.

Figure 1 is an abstract model diagram of the mimic defense system;

Fig. 2 is the PDF reader processing action flowchart of the embodiment of the present invention;

Fig. 3 is an overall framework diagram of a malicious PDF document detection system based on mimicry defense according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the protection of the present invention. scope.

Based on the principle of mimic defense, the invention designs a malicious PDF document detection system based on mimic defense. The core idea of mimic defense is to improve the system's ability to cope with unknown threats by introducing a dynamic heterogeneous redundant architecture. The abstract model of the mimic defense system is shown in Figure 1. In this abstract model, the input agent needs to distribute the input sequence to the corresponding multiple Heterogeneous functional equivalents; Executors in the set of functionally equivalent heterogeneous executors that receive input stimuli produce output vectors that satisfy the given semantics and syntax; the multi-mode arbiter generates an adjudication strategy based on the adjudication parameters or algorithms, Study and judge the consistency of the multi-mode output vector content and form an output response sequence. Therefore, by introducing mimic defense technology into malicious PDF document detection, the detection efficiency and accuracy can be greatly improved, and the information security protection capability can be effectively enhanced.

Generally, when a PDF document is opened by a PDF reader, the PDF reader has already started to process it. The basic process is shown in Figure 2, and it goes through actions such as COS object analysis, PD tree construction, script execution, and element presentation. . When a PDF document to be detected is opened, the PDF header is scanned to quickly locate the trailer and cross-reference table (XRT). Once the XRT is located, the basic elements of the PDF document (called COS objects) are enumerated and parsed. A COS object is just data with a type label such as integer, string, key, array, dictionary, or stream. Then, according to the interpretation of the PDF specification by the PDF reader, one or more COS objects are assembled into PDF-specific components, such as ext, image, font, form, page, JavaScript code, etc. The hierarchical structure of the PDF document (for example, which text appears in a specific page) is also constructed according to this process, and the corresponding output is called a PD tree, which is then passed to the rendering engine for display. For a PDF reader, when the rendering engine executes a JavaScript action, or renders a form that embeds JavaScript, the entire code block of JavaScript will be executed. After execution, the PDF reader presents the corresponding PDF document content.

Due to the cross-platform (Windows, Linux, Mac) nature of the PDF specification, if some legitimate operation affects the host system on one platform, the same operation will be performed when the document is opened on another platform. For example, if a benign document connects to a remote host, it will do the same on other platforms. When opening a PDF document on different host systems, for a benign document, the function execution order and results are the same, but for a malicious document, the PDF tracking results may be different in many places, including the PDF document processing process and the PDF document’s impact on the host. system impact.

Based on the abstract model of the mimetic defense system, this embodiment transforms the process of the malicious PDF document detection system into a mimetic transformation, and designs a malicious PDF document detection system based on mimetic defense. The overall framework is shown in Figure 3, including multiple Heterogeneous host and arbiter, install the same type and version of PDF reader in the heterogeneous host system of the heterogeneous host, the heterogeneous host system can use Windows, Linux or Mac, etc.; the heterogeneous host is used to view the same PDF document Process and track the system behavior of multiple heterogeneous hosts when processing PDF documents. The system behavior includes internal behavior and external behavior. The internal behavior is to track the PDF document processing flow of the PDF reader in the heterogeneous host system, and the external behavior is to track The impact of PDF document processing on the heterogeneous host system; the arbiter is used to judge the tracking processing results, determine whether the PDF document is malicious, and output the detection results. The arbiter includes an internal behavior arbiter and an external behavior arbiter; the internal behavior arbiter is used to judge The internal behavior tracking results perform multi-modal judgment, and the external behavior arbiter is used to perform multi-modal judgment on the external behavior tracking results.

Through the malicious PDF document detection system based on mimic defense, malicious PDF documents can be detected quickly and effectively.

Corresponding to the above-mentioned malicious PDF document detection system based on mimicry defense, this embodiment also provides a malicious PDF document detection method based on mimicry defense, in which multiple heterogeneous hosts process the same PDF document simultaneously. After detecting that the PDF document is processed by different host systems, track the processing result and send it to the arbiter, and output the adjudication result through the majority decision in the arbiter; specifically, the following steps are included:

Step S101, performing mimetic processing on the same PDF document based on host diversity.

When there is a PDF document input to be detected, the input PDF document is distributed as an input stimulus to multiple heterogeneous hosts with equivalent functions. The heterogeneous host systems are all equipped with PDF readers of the same type and version. PDF documents are processed simultaneously.

Step S102, tracking system behaviors of multiple heterogeneous hosts when processing PDF documents.

Tracking the PDF document processing process is divided into two parts: on the one hand, tracking the PDF document processing process (called internal behavior) of the PDF reader in the heterogeneous host system. The internal behavior is the four types of processing actions of the PDF reader, including COS object parsing, PD tree construction, JavaScript script execution, and PDF element rendering; on the other hand, tracking the impact of PDF document processing on heterogeneous host systems (called external behavior) can be summarized as a series of executable operations, including file system Operations, network activities, and program loading, hook system calls through hooking technology, and record parameters and return values, so as to capture the impact of executing malicious documents on the host system.

Step S103, judging the result of the tracking process to determine whether the PDF document is malicious.

Send the above four types of processing actions of the PDF reader to the internal behavior adjudicator for comparison, and determine whether the PDF document is malicious by comparing the processing actions and performing multi-mode adjudication;

Send the external behavior tracking results to the external behavior arbiter for comparison, and determine whether the PDF document is malicious by comparing the behavior of heterogeneous host systems and performing multi-mode adjudication.

It should be noted that, in this document, the terms "comprising", "comprising" or any other variation thereof are intended to cover a non-exclusive inclusion such that a process, method, article or apparatus comprising a set of elements includes not only those elements, It also includes other elements not expressly listed, or elements inherent in the process, method, article, or apparatus.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by program instructions related hardware, and the aforementioned programs can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that the above descriptions are only preferred embodiments of the present invention, and are only used to illustrate the technical solution of the present invention, and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (6)

1. A malicious PDF document detection system based on mimic defense, characterized in that it comprises: Multiple heterogeneous hosts with equivalent functions are used to process the same PDF document, and track the system behavior of multiple heterogeneous hosts when processing PDF documents. The system behavior includes internal behavior and external behavior. The internal behavior is to track heterogeneous The PDF document processing flow of the PDF reader in the institutional host system, and the external behavior is to track the impact of PDF document processing on the heterogeneous host system; The arbiter is used to determine whether the PDF document is malicious to the tracking processing result; the arbiter includes an internal behavior arbiter and an external behavior arbiter; the internal behavior arbiter is used to perform a multi-mode ruling on the internal behavior tracking result, and the The external behavior arbiter is used to perform multimodal adjudication on the external behavior tracking results. 2. The malicious PDF document detection system based on mimicry defense according to claim 1, wherein a PDF reader of the same type and the same version is installed in the heterogeneous host system of the heterogeneous host. 3. A malicious PDF document detection method based on mimic defense, it is characterized in that, comprising the following steps: Skeuomorphic treatment of the same PDF document; Track the system behavior of multiple heterogeneous hosts when processing PDF documents. The system behavior includes internal behavior and external behavior. The internal behavior is to track the PDF document processing flow of the PDF reader in the heterogeneous host system, and the external behavior is to track PDF document processing. Impact on heterogeneous host systems; Judgment on the result of tracking and processing to determine whether the PDF document is malicious, including: Send the internal behavior tracking results to the internal behavior arbiter for comparison, and determine whether the PDF document is malicious by comparing processing actions and executing multi-mode rulings; send the external behavior tracking results to the external behavior arbiter for comparison, and compare the behavior of heterogeneous host systems and perform a multimodal verdict to determine whether a PDF document is malicious. 4. the malicious PDF document detection method based on mimicry defense according to claim 3, is characterized in that, carrying out mimicry processing to same PDF document comprises: The PDF documents to be detected are distributed as input incentives to multiple heterogeneous hosts with equivalent functions for simultaneous processing, and the heterogeneous host systems of the heterogeneous hosts are installed with the same type and the same version of the PDF reader. 5. The method for detecting malicious PDF documents based on mimicry defense according to claim 3, wherein the internal behaviors include COS object parsing, PD tree construction, script execution and element presentation. 6. The method for detecting malicious PDF documents based on mimicry defense according to claim 3, wherein the external behaviors include file system operations, network activities and program loading.

Images