Malicious PDF Detection Using Support Vector Machine

The aim of this study is to develop a system that can detect and classify the Portable Document Format (PDF) as malware or benign document based on its features, using the Support Vector Machine (SVM) as an underlying model. Based on feature extraction and the Support Vector Machine technique, a method is proposed for efficiently detecting PDFs with harmful payloads. It was proved in this study that by extracting a wide range of feature sets, a robust PDF malware classifier can be produced. By employing data sets with a total of 10,000 harmful and 10,000 benign documents, the classification rate can reach up to 99 percent while retaining low false positive rates of 0.2 percent or less for various classification parameters.