PDF Malware Detection Using Ensemble Learning

Abstract

Since Portable Document Format (PDF) is one of the most common file types, scammers put damaging code into people’s PDF files to get into their computers. Standard solutions and methods for identifying PDF malware are often insufficient to stop it completely. This is because PDF malware is very flexible and does not rely on a single set of traits. This work mainly aims to identify PDF malware quickly and effectively so that the problems can be addressed. To achieve the objective, initially various benchmark datasets were combined to generate an extensive dataset consisting of 15958 PDF samples, which considers the many types of behaviours exhibited by the samples, including non-malevolent, fraudulent, and deceptive behaviours. Three widely recognized PDF analysis tools (PDF-PARSER, PDFINFO, and PDFiD ) were employed to extract notable attributes from the PDF samples in the recently compiled merged dataset. Additionally, several types of derivations of traits were developed that have been shown through experimentation to help diagnose PDF malware. A technique was devised for constructing a highly effective and comprehensible set of characteristics by conducting a thorough empirical analysis of the retrieved and deduced features. Various standard machine learning models were examined which showed that the Random Forest classifier when using the final feature set, achieved an increase in accuracy of approximately 2%. In addition, the model’s explainability was showcased through the creation of a decision tree that produces rules that can be easily understood by humans. Finally, a comparative analysis was conducted with prior research that helped to highlight several significant findings.