Multi-feature Fusion Malicious PDF Detection Based on CBAM

Existing malicious PDF document detection methods often only consider single-type features, can not fully describe the features of the malicious documents, and cannot effectively detect hidden malicious content. To solve such problems, this paper proposes a malicious PDF document detection method based on Multi-feature Fusion (MF-CBAM) based on the general and structural features extracted by static analysis and API sequences extracted by dynamic analysis. At the same time, to learn more key features of malicious documents, this paper adds the convolutional block attention module to the convolutional neural network. It assigns different weights to the extracted features. Experiments using the Evasive-PDFMal2022 data set show that the model's accuracy reaches 99.85%. Compared with the model without CBAM, the accuracy of the model with CBAM is improved by 1.25 percentage points. Compared with a single-type feature detection method, it has obvious advantages in accuracy.