Abstract:In order to detect malicious PDF and DOCX format documents more accurately and quickly, a visual detection method of malicious documents based on deep learning is proposed. This method converts the byte stream of the document into a three-channel color image through the Markov model, so as to obtain a visual representation that can better distinguish between malicious documents and benign documents, and uses the current mainstream EfficientNet-B0 model to extract visual features to classify. Combined with the fine-tuning technology in the field of transfer learning, the classification weights on ImageNet are applied to the training of the EfficientNet-B0 model, which speeds up the convergence of the detection model and shortens the training time of the model. Experiments show that on two datasets, the convergence speed of the model is faster than the pre-training of random initialization weights, and the detection accuracy of the model for malicious PDF documents and malicious DOCX documents reaches 99.80% and 98.14%, respectively, which is better than models such as ResNet34 and MobileNetV2.Compared with the mainstream malicious document detection tools Wepawet and PJScan, the proposed method has better comprehensive detection performance, which further verifies the effectiveness of the proposed method for malicious document detection.