LISP-TBCNN: An AutoCAD Malware Detection Approach

AutoCAD is a famous computer-aided design software widely used by engineers and designers. AutoCAD relies on AutoLISP scripting language to achieve powerful design functions. AutoCAD malware is written in AutoLISP to steal valuable designs on the infected system automatically. Script-based malware is difficult to be detected, because cyber adversaries could easily craft adversarial perturbations to malicious code to evade detectors. In this paper, LISP-TBCNN, a new AutoCAD malware detection approach is proposed which is based on AutoLISP abstract syntax tree(AST). The features are extracted from AutoLISP and TBCNN is introduced to build detection model. The experiment results show that LISP-TBCNN could effectively detect AutoCAD malware variants.