SYSTEM AND METHOD OF DETECTING MALICIOUS MULTIMEDIA FILES

摘要

Systems and methods for detection of malicious exploitations in a multimedia file are disclosed. In one embodiment, such an approach includes parsing the compiled bytecode of a multimedia file to detect identified key instructions and determine if such key instructions are repeated in specific patterns that signify the presence of malicious exploitation. The approach may also include examining the contents of the constant pool table in a compiled multimedia file to detect specific shellcode strings that are indicative of presence of malicious exploitation. When the bytecode or the constant pool table indicates that malicious exploitation is present, an approach may be utilized to reduce instances of false positive identification of malicious exploitation.

主权项

1. At least one computer readable medium on which are stored instructions comprising instructions that when executed cause a programmable device to:
match an instruction in a multimedia file with a predetermined list of instructions; identify repetitions of the matched instruction in the multimedia file; calculate a distance between repetitions of the matched instruction; and identify the multimedia file as malicious responsive to equidistant repetitions of the matched instruction.