Systems and Methods for Detecting Malicious PDF Network Content

• US 20110247072A1
• Filed: 01/21/2011
• Published: 10/06/2011
• Est. Priority Date: 11/03/2008
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Staniford, Stuart Gresley, Aziz, Ashar
• Granted Patent: US 8,997,219 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems and methods for detecting malicious PDF network content are provided herein. According to some embodiments, the methods may include at least the steps of examining received PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the PDF network content, providing PDF network content determined to include at least one suspicious characteristic to one or more virtual machines, and analyzing responses received from the one or more virtual machines to verify the inclusion of malicious network content in the PDF network content determined to include at least one suspicious characteristic.

Claims

1. A method for detecting malicious portable document format (PDF) network content, comprising:

examining at least a portion of received PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the at least a portion of PDF network content; and

wherein if the at least a portion of PDF network content is determined to include one or more suspicious characteristics indicative of malicious network content, providing the at least a portion of PDF network content to one or more virtual machines to verify the inclusion of malicious network content in the at least a portion of PDF network content.

2. The method according to claim 1, wherein examining further includes:

determining a score for each PDF network content determined to include one or more suspicious characteristics, the score indicative of a probability that the PDF network content includes malicious network content; and

identifying the PDF network content as suspicious if the score satisfies a threshold value.

3. The method according to claim 2, wherein the score is determined by an approximate Bayesian probability analysis using a corpus of malicious network content and a corpus of non-malicious network content.

4. The method of claim 2, further comprising increasing a priority level or the score if more than one suspicious characteristic has a score that satisfies the threshold value.

5. The method according to claim 1, wherein the one or more suspicious characteristics indicative of malicious network content includes one or more objects that include JavaScript code.

6. The method according to claim 5, wherein the JavaScript code includes any of eval( ), util.printf( ), media.newPlayer( ), and combinations thereof.

7. The method according to claim 1, further comprising determining obfuscated JavaScript code by:

locating one or more getField( ) functions associated with JavaScript code included in the PDF network content;

assembling the JavaScript code by combining information included in the one or more getField( ) functions; and

determining if the JavaScript code includes one or more suspicious characteristics by comparing the JavaScript code to JavaScript code known to include malicious network content.

8. The method according to claim 1, wherein determining includes applying heuristics to determine if at least one suspicious characteristic indicative of malicious network content is included in the at least a portion of PDF network content.

9. The method according to claim 1, wherein the one or more suspicious characteristics includes an inability to completely parse the at least a portion of PDF network content.

10. The method according to claim 1, wherein the one or more suspicious characteristics indicative of malicious network content includes any of JavaScript information, VirtualBasic Script information, malformed header information, and combinations thereof.

11. The method according to claim 10, wherein the JavaScript information includes one or more JavaScript keyword sequences that include an “

unescape”

command nested within an “

eval”

command argument.

12. The method according to claim 1, wherein examining further includes measuring a length of time or number of characters between a start and an end of a JavaScript code included in the at least a portion of PDF network content.

13. The method according to claim 1, wherein examining further includes identifying a string of unusual character transitions within a JavaScript code embedded within the at least a portion of PDF network content.

14. The method according to claim 10, wherein the JavaScript information is included in one or more AcroForm dictionary objects included in the at least a portion of the PDF network content.

15. The method according to claim 10, wherein the JavaScript information is included in one or more XML forms architecture (XFA) dictionary objects included in the at least a portion of the PDF network content.

16. The method according to claim 1, wherein the one or more virtual machines includes two or more augmented finite state machines.

17. The method according to claim 16, wherein the two or more augmented finite state machines each include a configuration that includes at least one of operating system instructions, at least one web browser instructions, and at least one PDF reader instructions, wherein the configuration of each of the two or more augmented finite state machines is different from one another in at least one way.

18. The method according to claim 17, further comprising selecting the at least one PDF reader instructions based upon a PDF specification version number included in the at least a portion of PDF network content.

19. The method according to claim 17, further observing behavior of each of the two or more augmented finite state machines to determine an effect of malicious network content relative to each of the two or more augmented finite state machines.

20. The method according to claim 1, further comprising indexing the at least a portion of PDF network content verified to include malicious network content by associating the at least a portion of PDF network content with one or more domains from which the at least a portion of PDF network content was obtained.

21. The method according to claim 1, further comprising preventing the delivery of the at least a portion of PDF network content verified to include malicious network content to a web browser application from which the delivery was requested.

22. The method according to claim 1, further comprising intercepting the at least a portion of PDF network content before the step of examining.

23. A system for detecting malicious portable document format (PDF) network content, comprising:

a computing processor;

a data access component configured to intercept PDF network content from a network; and

logic configured to control the computing processor to perform a method for detecting malicious portable document format (PDF) network content including;

examining at least a portion of intercepted PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the at least a portion of PDF network content; and

wherein if the at least a portion of PDF network content is determined to include one or more suspicious characteristics indicative of malicious network content, providing the at least a portion of PDF network content to one or more virtual machines to verify the inclusion of malicious network content in the PDF network content.

24. The system according to claim 23, wherein the data access component includes a tap operatively coupling one or more client device and one or more server devices, the tap adapted to intercept requests for at least a portion of PDF network content and provide the at least a portion of PDF network content to a PDF parser.

25. The system according to claim 23, wherein examining further includes:

determining a score for each PDF network content determined to include one or more suspicious characteristics, the score indicative of a probability that the PDF network content includes malicious network content; and

identifying the PDF network content as suspicious if the score satisfies a threshold value.

26. The system according to claim 25, wherein the score is determined by an approximate Bayesian probability analysis using a corpus of malicious network content and a corpus of non-malicious network content.

27. The system according to claim 25, further comprising increasing a priority level or the score if more than one suspicious characteristic has a score that satisfies the threshold value.

28. The system according to claim 23, wherein the one or more suspicious characteristics indicative of malicious network content includes one or more objects that include JavaScript code.

29. The system according to claim 28, wherein the JavaScript code includes any of eval( ), util.printf( ), media.newPlayer( ), and combinations thereof.

30. The system according to claim 23, further comprising determining obfuscated JavaScript code by:

locating one or more getField( ) functions associated with JavaScript code included in the PDF network content;

assembling the JavaScript code by combining information included in the one or more getField( ) functions; and

determining if the JavaScript code includes one or more suspicious characteristics by comparing the JavaScript code to JavaScript code known to include malicious network content.

31. The system according to claim 23, wherein determining includes applying heuristics to determine if one or more suspicious characteristics indicative of malicious network content is included in the at least a portion of PDF network content.

32. The system according to claim 23, wherein the one or more suspicious characteristics includes an inability to completely parse the at least a portion of PDF network content.

33. The system according to claim 23, wherein the one or more suspicious characteristics indicative of malicious network content includes any of JavaScript information, malformed header information, and combinations thereof.

34. The system according to claim 33, wherein JavaScript information includes one or more JavaScript keyword sequences that include an “

unescape”

command nested within an “

eval”

command argument.

35. The system according to claim 23, wherein examining further includes measuring a length of time or number of characters between a start and an end of a JavaScript code included in the at least a portion of PDF network content.

36. The system according to claim 23, wherein examining further includes identifying a string of unusual character transitions within a JavaScript code embedded within the at least a portion of PDF network content.

37. The system according to claim 33, wherein the JavaScript information is included in one or more AcroForm dictionary objects included in the at least a portion of PDF network content.

38. The system according to claim 33, wherein the JavaScript information is included in one or more XML forms architecture (XFA) dictionary objects included in the at least a portion of PDF network content.

39. The system according to claim 23, wherein the one or more virtual machines includes two or more augmented finite state machines.

40. The system according to claim 39, wherein the two or more augmented finite state machines each include a configuration that includes at least one of operating system instructions, at least one web browser instructions, and at least one PDF reader instructions, wherein the configuration of each of the two or more augmented finite state machines is different from one another.

41. The system according to claim 23, further comprising indexing the at least a portion of PDF network content verified to include malicious network content by associating the at least a portion of PDF network content with one or more domains from which the at least a portion of PDF network content was obtained.

42. The system according to claim 23, further comprising preventing the delivery of the at least a portion of PDF network content verified to include malicious network content to a web browser application from which the delivery was requested.

43. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for detecting malicious portable document format (PDF) network content that includes:

examining at least a portion of received PDF network content to determine if one or more suspicious characteristics indicative of malicious network content are included in the at least a portion of PDF network content; and

wherein if the at least a portion of PDF network content is determined to include one or more suspicious characteristics indicative of malicious network content, providing the at least a portion of PDF network content to one or more virtual machines to verify the inclusion of malicious network content in the PDF network content.