 |
Advanced machine learning (ML) and hybrid techniques have been applied to improve the accuracy, scalability, and robustness of detection. ML methods are typically evaluated based on the type of features they are engineered to detect, particularly meaningful attributes in the PDF structure metadata, embedded JavaScript properties, or file content patterns. They are strong in identifying patterns using statistical modeling and work well under known threats. However, they are less adaptable to obfuscation or new attack types, as all the features must be handcrafted. ML algorithms have shown poor performance for real-time applications and problems involving large feature sets, as they are computationally expensive for large datasets. It is also known that ML algorithms tend to fail in cases where some features are correlated, thus limiting the utility of this classifier in scenarios where PDF parts dynamically interact with each other. On the other hand, deep learning (DL) algorithms are known to adapt to dynamic threats, as learning occurs directly through raw data. DL models, such as Convolutional Neural Networks (CNN), also yield good performance by processing high-dimensional inputs. Transformers also possess self-attention capabilities and complex deep learning architectures, making them particularly suitable for context-dependent relationships. Therefore, from each part of the input features, like the interdependencies between PDF objects, it can efficiently compute while maintaining a certain level of relevance.
|
IEEE/ICACT20260055 Slide.05
[Big Slide]