Comparative analysis of machine learning models for malware detection in PDF: evaluation of training and testing criteria

In recent years, there has been a sharp increase in sophisticated cyberattacks using maliciously encrypted documents as the amount of information transmitted increases. Executable files attached to emails or web pages can be dangerous, as most internet users are aware of. Nevertheless, documents are a useful tool for spreading malware because people are unaware of them. The spread of maliciously encrypted documents with an increase in the number of information transfers has led to an increase in the number of sophisticated attacks. Portable Document Format (PDF) files have become the main attack vector of malicious code due to their adaptability and widespread use. Detecting malicious code in PDF files is challenging due to its ability to include various malicious elements, such as embedded scripts, exploits and malicious URLs. This article analyzes machine learning approaches and provides a comparative analysis of machine learning (ML) methods, including Naive Bayes (NB), K-Near Neighbor (KNN), Average One Dependency Estimator (A1DE), Random Forest (RF), and Support Vector Machine (SVM) to detect malicious PDF files. This study is based on different types of testing criteria, with percentage division and K-fold cross-validation, to obtain more objective results. The results of the study highlight the effectiveness of machine learning models in accurately detecting malicious code in PDF files, identify the most effective methods, and provide insight into the development of robust systems to protect against malicious activities. Further research in the field of detecting malicious PDF files should focus on investigating deep learning methods that can improve the performance and accuracy of models.