MLPdf: An Effective Machine Learning Based Approach for PDF Malware Detection
This addresses the need for effective malware detection in PDF documents, which are commonly used in cyber attacks, but the approach is incremental as it applies a standard neural network method to this domain.
The paper tackled the problem of detecting PDF malware by proposing MLPdf, a multilayer perceptron neural network approach, which achieved a true positive rate of 95.12% and a false positive rate of 0.08%, outperforming eight commercial anti-virus scanners.
Due to the popularity of portable document format (PDF) and increasing number of vulnerabilities in major PDF viewer applications, malware writers continue to use it to deliver malware via web downloads, email attachments and other methods in both targeted and non-targeted attacks. The topic on how to effectively block malicious PDF documents has received huge research interests in both cyber security industry and academia with no sign of slowing down. In this paper, we propose a novel approach based on a multilayer perceptron (MLP) neural network model, termed MLPdf, for the detection of PDF based malware. More specifically, the MLPdf model uses a backpropagation algorithm with stochastic gradient decent search for model update. A group of high quality features are extracted from two real-world datasets which comprise around 105000 benign and malicious PDF documents. Evaluation results indicate that the proposed MLPdf approach exhibits excellent performance which significantly outperforms all evaluated eight well known commercial anti-virus scanners with a much higher true positive rate of 95.12% achieved while maintaining a very low false positive rate of 0.08%.