Machine learning powered cloud sandbox for malware detection in portable document format (PDF) files
A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely open and extract information about a PDF file and uses machine learning algorithms to analyze the information to predict whether the PDF file contains malware. Specifically, dynamic information about the PDF file is captured while it is open in the sandbox. Static information is extracted from the PDF file as well. The dynamic and static information is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the PDF file contains malware. A verdict engine uses the output from the AI or machine learning model to classify the document as malicious or clean. Security policies can then be applied based on the classification.
1 . A computer-implemented method, comprising:
receiving, by a cloud-based network security system, a request to access a portable document format (PDF) file;
opening, by the cloud-based network security system, the PDF file in a sandbox of the cloud-based network security system;
obtaining, by the cloud-based network security system, dynamic information associated with the PDF file in the sandbox, wherein the dynamic information comprises a size of a process tree spawned by the opening the PDF file, wherein the size of the process tree is a count of processes and subprocesses spawned by the opening;
extracting, by the cloud-based network security system, static information from the PDF file;
providing, by the cloud-based network security system, the dynamic information and the static information as input to an artificial intelligence model trained to provide an output indicating a prediction of whether the PDF file contains malware based on the input;
classifying, by a verdict engine of the cloud-based network security system, the PDF file as one of malicious or clean based at least in part on the output of the artificial intelligence model provided as input to the verdict engine; and
implementing, by the cloud-based network security system, a security policy based at least in part on the classification of the PDF file.
2 . The computer-implemented method of claim 1 , wherein the obtaining the dynamic information associated with the PDF file comprises:
analyzing behavior of the PDF file during opening in the sandbox; and
extracting data from the behavior, wherein the dynamic information associated with the PDF file further comprises:
a set of behavior features of the PDF file exhibited during the opening, and
a set of signature features exhibited during the opening.
3 . The computer-implemented method of claim 2 , wherein the set of behavior features comprises at least one of: visited files, visited paths, and pathways explored by processes in the sandbox.
4 . The computer-implemented method of claim 2 , wherein the set of signature features comprises:
a signature vector having a dimension for each of a plurality of software signatures, wherein a value of each dimension indicates whether the PDF file invoked the respective software signature in the sandbox, and
severity scores for each of the software signatures the PDF file invoked.
5 . The computer-implemented method of claim 2 , wherein the providing the dynamic information as input comprises:
generating a feature vector representing at least a portion of the dynamic information; and
providing the feature vector as the input to the artificial intelligence model.
6 . The computer-implemented method of claim 1 , wherein the artificial intelligence model comprises a gradient boosting tree algorithm.
7 . The computer-implemented method of claim 1 , wherein the extracting the static information from the PDF file comprises calculating an entropy of the PDF file based at least in part on a frequency of each occurrence of each American Standard Code for Information Interchange (ASCII) code in the PDF file.
8 . The computer-implemented method of claim 1 , wherein the extracting the static information from the PDF file comprises calculating a count of each of a plurality of keywords in the PDF file.
9 . The computer-implemented method of claim 1 , wherein:
the output of the artificial intelligence model is a score; and
the verdict engine classifies the PDF file based at least in part on comparing the score with a threshold value.
10 . The computer-implemented method of claim 1 , further comprising:
calculating one or more heuristics based on content of the PDF file; and
providing, by the cloud-based network security system, the one or more heuristics to the verdict engine, wherein the verdict engine classifies the PDF file further based at least in part on the one or more heuristics.
11 . A cloud-based network security system, comprising:
one or more processors; and
one or more memories having stored thereon instructions that, upon execution by the one or more processors, cause the one or more processors to:
receive a request to access a portable document format (PDF) file;
open the PDF file in a sandbox of the cloud-based network security system;
obtain dynamic information associated with the PDF file in the sandbox, wherein the dynamic information comprises a size of a process tree spawned by the opening the PDF file, wherein the size is a count of processes and subprocess spawned by the opening;
extract static information from the PDF file;
provide the dynamic information and the static information as input to an artificial intelligence model trained to provide an output indicating a prediction of whether the PDF file contains malware based on the input;
classify, with a verdict engine, the PDF file as one of malicious or clean based at least in part on the output of the artificial intelligence model provided as input to the verdict engine; and
implement a security policy based at least in part on the classification of the PDF file.
12 . The cloud-based network security system of claim 11 , wherein the instructions to obtain the dynamic information associated with the PDF file comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
analyze behavior of the PDF file during opening in the sandbox; and
extract data from the behavior, wherein the dynamic information associated with the PDF file further comprises:
a set of behavior features of the PDF file exhibited during the opening, and
a set of signature features exhibited during the opening.
13 . The cloud-based network security system of claim 12 , wherein the set of behavior features comprises at least one of: visited files, visited paths, and pathways explored by processes in the sandbox.
14 . The cloud-based network security system of claim 12 , wherein the set of signature features comprises:
a signature vector having a dimension for each of a plurality of software signatures, wherein a value of each dimension indicates whether the PDF file invoked the respective software signature in the sandbox, and
severity scores for each of the software signatures the PDF file invoked.
15 . The cloud-based network security system of claim 12 , wherein the instructions to provide the dynamic information as input comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
generate a feature vector representing at least a portion of the dynamic information; and
provide the feature vector as the input to the artificial intelligence model.
16 . The cloud-based network security system of claim 11 , wherein the artificial intelligence model comprises a gradient boosting tree algorithm.
17 . The cloud-based network security system of claim 11 , wherein the instructions to extract the static information from the PDF file comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
calculate an entropy of the PDF file based at least in part on a frequency of each occurrence of each American Standard Code for Information Interchange (ASCII) code in the PDF file.
18 . The cloud-based network security system of claim 11 , wherein the instructions to extract the static information from the PDF file comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
calculate a count of each of a plurality of keywords in the PDF file.
19 . The cloud-based network security system of claim 11 , wherein:
the output of the artificial intelligence model is a score; and
the verdict engine classifies the PDF file based at least in part on comparing the score with a threshold value.
20 . The cloud-based network security system of claim 11 , wherein the instructions comprise further instructions that, upon execution by the one or more processors, cause the one or more processors to:
calculate one or more heuristics based on content of the PDF file; and
provide the one or more heuristics to the verdict engine, wherein the verdict engine classifies the PDF file further based at least in part on the one or more heuristics.