Detection of Malicious Non-Executable Files Using Syntactic Structure

A major portion of threats against end-user systems arises from non-executable files, e.g., PDF documents or Flash animations. Such files may contain malicious executable content which is launched when a file is opened in a vulnerable viewer. Such attacks are hard to detect due to the high complexity of respective file formats. Conventional antivirus products often miss malicious content hidden in the rich syntactic structure of file formats.

A research group at the University of Tübingen developed a patent-pending technology: a highly performant static analysis tool for detection of malicious PDF documents. Instead of performing analysis of JavaScript or any other content for detection, the new developed method provides a reliable means for detection of malicious files by focusing precisely on structural artifacts arising from embedded malicious content. The research group could demonstrate its effectiveness on a dataset of about 500,000 real-world malicious and benign PDF files: the new method outperforms each of the 43 antiviruses at VirusTotal and other specialized detection methods. Additionally, the new method is almost completely immune to nearly worst-case attack scenarios.

Further Information: PDF

Eberhard Karls Universität Tübingen
Phone: +49 (7071) 29-72639

Contact
Dr. Rolf Hecker

Media Contact

info@technologieallianz.de TechnologieAllianz e.V.

All latest news from the category: Technology Offerings

Back to home

Comments (0)

Write a comment

Newest articles

Young Corals Provide Insight into Recovery from Coral Bleaching

The number of young corals can reveal how reefs are recovering from coral bleaching. A new study from the University of Bremen, which was recently published in “PLOS ONE” journal,…

Defense or repair: How immune cells are controlled during wound healing

For the first time, scientists show a causal link between tissue repair, mitochondrial metabolism, and the activation and function of macrophages (scavenger cells) / Publication in ’Cell Metabolism’. A Cologne-based…

Transforming material topology with a drop of liquid

Liquid acts across multiple scales to reorganize connectivity in networks of artificial microscopic cells. The Science Networks of cells in nature have inspired researchers to develop their own materials made…

Partners & Sponsors