Explainable Machine Learning Models For Detecting Malware in PDF Files

The Portable Document Format (PDF) is widely used for document sharing, making it a common target for cyber threats. Attackers often embed malicious code within PDFs to exploit system vulnerabilities. Traditional malware detection techniques struggle to keep up due to evolving attack methods and reliance on predefined feature sets. This study presents an improved approach for detecting PDF malware using machine learning and explainability analysis. A comprehensive dataset of 15,958 PDF samples—comprising benign, malicious, and evasive files—is developed for this research. Three widely used PDF analysis tools (PDFiD, PDFINFO, and PDF-PARSER) are employed to extract meaningful features, alongside additional derived features that enhance classification accuracy. Through systematic feature selection and empirical evaluation, an optimal feature set is identified. The proposed method is tested with various machine learning classifiers, with the Random Forest model achieving approximately 2% higher accuracy compared to baseline models. Additionally, a decision tree is generated to enhance model interpretability, offering insights into classification rules. A comparative analysis with existing studies highlights key findings and advancements in PDF malware detection.