# A Universal Malicious Documents Static Detection Framework Based on Feature Generalization
## 2 Related Work
### Features of Static Analysis  
At present, most researches extract features from structural paths or code keywords and perform malicious document detection. Benign samples are usually generated by documentation tools and have high compliance. Attackers usually deliberately design the content of the document or embed malicious code, which will make the structure of the document different from a benign document ([PERSON] et al., 2017).  
Many researches focus on the detection of malicious PDF documents, such as the research of [PERSON] et al. (2017). We refer to the PDF detection method and found that structural paths or code keywords can achieve good results in the selection of document features.  
Keywords are the features of the code embedded in the document. Malicious samples of VBA (Visual Basic for Applications) programs embedded in Word documents usually use keywords such as \"URLDownloadToFile\" and \"AutoExec\". The former is used to download bits from the Internet and save them in a document. The latter is used to automatically execute batch commands. These two keywords rarely appear in ordinary samples, but they usually appear in malicious samples. Therefore, the VBA code can be used to detect the maliciousness of Word documents.  
PDF documents allow JavaScript code to be embedded in. Some PDF readers contain some vulnerabilities or flaws that allow a file to execute malicious code ([PERSON] et al., 2018). The keywords in the JavaScript code and the keywords in the PDF document are used in the malicious PDF detection, and good results have been achieved ([PERSON] et al., 2017; [PERSON] et al., 2017).  
[PERSON] and [PERSON] et al. proposed the \"format agnostic theory\" to detect malicious document content ([PERSON] and [PERSON], 2018). In recent years, the detection of malicious PDF documents has achieved better results by document structure. [PERSON] and [PERSON] proposed the concept of a structured path that had a good detection effect and a strong ability to respond to unknown security threats. [PERSON] et al. (2018) proposed a detection scheme based on structure and content. [PERSON] et al. (2018) extracted the structural path features, and the input features have 3514 dimensions; however, its robustness is weak. [PERSON] et al. (2018) proposed a bypass method based on structure detection for this scheme, which is called \"reverse mimicry\", and it proved the feasibility and simplicity of this attack.  
Some researchers applied the structure path of the PDF to the dox document. [PERSON] et al. (2017) trained the xml tag of the doxc based on Open-xml and the document path of the compressed package as the structure feature of the doxc document, and this method obtained a high detection rate. [PERSON] et al. (2018) proposed a malicious word document detection method based on multi-view features learning. They analyzed Word documents from four independent views: VBA functional words, Ole file object formats, structure paths, and specification errors. The method of analysing malicious documents from independent different views is helpful.  
Generally, the detection methods based on one-dimensional features are easily bypassed. The content of the malicious document or embed malicious code makes the structure of the document, specification compliance, structural order, number of objects, and malicious code inserted in the document different from a benign document. In this paper, we will combine multiple features to improve detection performance.