k-Depth Mimicry Attack to Secretly Embed Shellcode into PDF Files
k-Depth Mimicry Attack to Secretly Embed Shellcode into PDF Files
复制标题
k-深度模仿攻击秘密地将 Shellcode 嵌入 PDF 文件
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Hyoungshick Kim
中科院分区：
文献类型：
--
作者：
Jaewoo Park;Hyoungshick Kim
本文重新研究了PDF文件的shellcode嵌入问题。我们发现，一种被称为反向模仿攻击的常用shellcode嵌入技术并没有被证明对训练有素的最先进的检测器有效。为了克服反向模仿方法对现有shellcode检测器的限制，我们通过将k深度模仿方法应用于PDF文件，将反向模仿攻击的思想扩展到更广义的思想。我们实现了k深度模仿攻击的概念验证工具，并通过生成嵌入shell代码的PDF文件来证明其可行性，该文件可以通过三个分类器逃避最著名的shellcode检测器（PDFrate）。实验结果表明，当k深度模拟方法嵌入的shell代码在（k ge 20）时，所有被测试的分类器都不能有效地检测到。
This paper revisits the shellcode embedding problem for PDF files. We found that a popularly used shellcode embedding technique called reverse mimicry attack has not been shown to be effective against well-trained state-of-the-art detectors. To overcome the limitation of the reverse mimicry method against existing shellcode detectors, we extend the idea of reverse mimicry attack to a more generalized one by applying the k-depth mimicry method to PDF files. We implement a proof-of-concept tool for the k-depth mimicry attack and show its feasibility by generating shellcode-embedded PDF files to evade the best known shellcode detector (PDFrate) with three classifiers. The experimental results show that all tested classifiers failed to effectively detect the shellcode embedded by the k-depth mimicry method when (k ge 20).