Abstract:
Since Portable Document Format (PDF) is one of the most common file types, scammers
put damaging code into people’s PDF files to get into their computers. Standard solutions
and methods for identifying PDF malware are often insufficient to stop it completely. This
is because PDF malware is very flexible and does not rely on a single set of traits. This
work mainly aims to identify PDF malware quickly and effectively so that the problems can
be addressed. To achieve the objective, initially various benchmark datasets were combined
to generate an extensive dataset consisting of 15958 PDF samples, which considers the
many types of behaviours exhibited by the samples, including non-malevolent, fraudulent,
and deceptive behaviours. Three widely recognized PDF analysis tools (PDF-PARSER,
PDFINFO, and PDFiD ) were employed to extract notable attributes from the PDF samples
in the recently compiled merged dataset. Additionally, several types of derivations of
traits were developed that have been shown through experimentation to help diagnose PDF
malware. A technique was devised for constructing a highly effective and comprehensible
set of characteristics by conducting a thorough empirical analysis of the retrieved and
deduced features. Various standard machine learning models were examined which showed
that the Random Forest classifier when using the final feature set, achieved an increase
in accuracy of approximately 2%. In addition, the model’s explainability was showcased
through the creation of a decision tree that produces rules that can be easily understood by
humans. Finally, a comparative analysis was conducted with prior research that helped to
highlight several significant findings.
