PlatPal: Detecting Malicious Documents with Platform Diversity
summary
Prototype PLATPAL harvests OS differences to detect maldocs by tracing inside Adobe Reader and capturing host syscall effects in sandboxed VMs; PLATPAL hooks into Adobe Reader and collects internal + external traces. Evaluation uses ~1,030 benign PDFs (zero false alarms) and 320 malware samples where 65% of malicious samples show divergence, average detection ~20s and ~2 GB per VM. Some 24% of malicious cases never trigger divergence; cloud scanning is the suggested deployment.
AI-written summary · about
chapters (8)
- 0:00Introduction to threat
- 1:37Current detection limitations
- 4:35Proposed platform diversity
- 7:17System design and workflow
- 9:53Evaluation of effectiveness
- 13:42Root causes of divergence
- 17:31Conclusion and limitations
- 21:16Q&A session
related talks
01h 03mEffects Malware hunting in Cloud environment
26mWhen Models Write Malware: Defending Against On-demand Exploits
18mMac-A-Mal: An Automated Platform for Mac Malware Hunting
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
19mO-Checker: Detection of Malicious Documents Through Deviation From File Format Specifications
26mPANDEMONIUM: Automated Identification of Cryptographic Algorithms
47mPrevalent Characteristics in Modern Malware
25mCommSec D1 - A Deep Dive Into Malicious Documents