Главная
Study mode:
on
1
Introduction
2
Agenda
3
Problem Space
4
File Formats
5
Click Rates
6
Web Browsing Security
7
Mail vs Web
8
Document Analysis Pipeline
9
Evaluation Criteria
10
File Type Detection
11
Problems with File Type Detection
12
Webpage Example
13
Sandbox
14
CDLs
15
Remote Viewing
16
RealTime Pipeline
17
Offline Pipeline
18
Summary
Description:
Explore a comprehensive conference talk on building robust document analysis pipelines for detecting malicious content in various file formats. Delve into the challenges faced by security teams in addressing vulnerabilities in PDFs, Office files, and legacy textual formats. Learn about best practices for constructing effective analysis pipelines, including true type detection, sandboxing, signatures, dynamic/static content inspection, isolation, and content disarming and reconstruction. Gain insights into attackers' perspectives and evasion techniques for malicious payloads. Examine evaluation criteria, file type detection issues, and real-time versus offline pipeline implementations. Presented by Dan Amiga and Dor Knafo, this 52-minute Black Hat session offers valuable knowledge for enhancing document security measures.

The Irrelevance of K-Bytes Detection - Building a Robust Pipeline for Malicious Documents

Black Hat
Add to list