κ-Depth Mimicry Attack to Secretly Embed Shellcode into PDF Files and the Evaluation and the Countermeasure

다국어 초록 (Multilingual Abstract)

This paper revisits the shellcode embedding problem for PDF files. We found that a popularly used shellcode embedding technique called reverse mimicry attack has not been shown to be effective against well-trained state-of-the-art detectors. To overcome the limitation of the reverse mimicry method against existing shellcode detectors, we extend the idea of reverse mimicry attack to a more generalized one by applying the ��-depth mimicry method to PDF files. We implement a proof-of-concept tool for the ��-depth mimicry attack and show its feasibility by generating shellcode-embedded PDF files to evade the best known shellcode detector (PDFrate) with three classifiers. The experimental results show that all tested classifiers failed to effectively detect the shellcode embedded by the ��-depth mimicry method when �� ≧ 20. As the countermeasure of our ��-depth mimicry attack, we propose a novel PDF parser toolkit to approach a suspicious PDF document files from different aspects, functioning object-by-object analysis. We implement the toolkit named ‘PDF Antagonist’ as the result, and demonstrate the effectiveness.

목차 (Table of Contents)

• ABSTRACT
• 1 Introduction
• 1-1 Overview
• 1-2 Contributions
• 1-3 Organization of the Paper
• 2 Background
• 2-1 Object, categorized by Types
• 2-2 File Structure
• 2-3 Document Structure
• 2-4 Common Shellcode Types
• 3 Related Work
• 3-1 Malicious PDF Detection Techniques
• 3-2 Evasion of Malicious PDF Detection Techniques
• 4 K-Depth Mimicry Attack
• 5 Experiments
• 5-1 Evaluation of ��-depth Mimicry based on Commonplace Object Dictionary
• 5-2 Evaluation of ��-depth Mimicry based on Self-built Objects Dictionary
• 5-3 Comparison to Evaluation Result
• 6 Countermeasure
• 7 Conclusion
• References
• 논문요약(국문초록)