# A Universal Malicious Documents Static Detection Framework Based on Feature Generalization
## 1 Introduction  
Documents are efficient, convenient, and safe information carriers. However, via some deliberate designs, an attacker can run malicious code on a document, or can use the vulnerabilities of document parsing software to invade the operating system; these documents are called malicious documents. According to statistics, malicious documents are mainly Portable Document Format (PDF), Word, Excel, Rich Test format (RTF), PowerPoint, Graphics Interchange Format (GIF), Joint Photographic Experts Group (JPEG), and Portable Network Graphic Format (PNG) documents. Among them, PDF and Word documents respectively account for 60.1% and 38.7% of malicious documents [1], which is mainly because these documents are more widely used for information transmission. Moreover, PDF and Word documents can contain almost any type of document as the document content, and script programs can be inserted to increase the specific functions of the document. In January 2014, an attacker launched an attack by disguising a malicious PDF document as a document of the Israeli Ministry of Defense, and then sending the PDF as an attachment to an email [2]. In some kinds of malicious PDF attacks, the PDF reader itself contains a vulnerability or flaw that allows a file to execute malicious code [3]. Many attacks try to abuse this flaw via the use of social engineering or by hosting malicious PDF files on the Internet. Attackers can induce people to open malicious documents by sending emails with malicious attachments. Just opening the PDF file could exploit a vulnerability [4]. In December 2018, a threat report from the security company MalwareBytes warned that the banking Trojan/download/botnet and its common complicity, Trickbot, mainly use email to distribute malicious Office documents that use PowerShell to download malware [5]. Malicious document attacks not only bring huge risks to individuals, but also seriously threaten the security of enterprises [6]. To date, there has been some research on the detection of malicious documents. This research includes the detection of malicious code based on image processing using deep learning [7], the detection of malicious documents for business process management based on a multi-layer abstract model [8], the detection of unknown malicious Microsoft Office documents via the use of designated active learning methods based on a new structural feature extraction methodology [9], the detection of malicious PDF documents based on mixed features [10], and the improvement of the detection of malicious Office documents using one-side classifiers [11]. Currently, the research on malicious document detection basically only involves one certain type of malicious document, and related research has rarely investigated whether the detection features proposed for one type of document can be used to detect other types of documents. Because the types of documents are rich and diverse, it is inefficient to study the detection features and design classifiers for each type of document. For this reason, in the present study, the common features of malicious PDF and Word documents are extracted to detect multiple types of malicious documents, and this technology is defined as feature generalization. A universal static detection framework for malicious documents based on feature generalization is developed in this research. The framework uses four feature dimensions, namely specification check errors, the structure path of the document, document code analysis, and the number of objects. By combining these four types of features, the decision tree and random forest models are used for classification. Through experimental comparisons with antivirus software and other research, the effectiveness of the proposed universal static detection framework for malicious documents based on feature generalization is proven. The main contributions of this work are as follows:  
1. In this research, document specification check errors are innovatively utilized as a component of feature engineering;
2.