Machine learning (ML)-based malware detection systems are becoming increasingly important as malware threats increase and get more sophisticated. PDF files are often used as vectors for phishing attacks because they are widely regarded as trustworthy data resources, and are accessible across different platforms. Therefore, researchers have developed many different PDF malware detection methods. Performance in detecting PDF malware is greatly influenced by feature selection. In this research, we propose a small features set that don't require too much domain knowledge of the PDF file. We evaluate proposed features with six different machine learning models. We report the best accuracy of 99.75% when using Random Forest model. Our proposed feature set, which consists of just 12 features, is one of the most conciseness in the field of PDF malware detection. Despite its modest size, we obtain comparable results to state-of-the-art that employ a much larger set of features.

翻译：基于机器学习（ML）的恶意软件检测系统随着恶意软件威胁的增加与复杂化而日益重要。由于PDF文件被广泛视为可信数据资源且跨平台可访问，常被用作网络钓鱼攻击的载体。为此，研究人员开发了多种PDF恶意软件检测方法。特征选择对PDF恶意软件检测性能具有显著影响。本研究提出一种无需过多PDF文件领域知识的小规模特征集，并通过六种不同机器学习模型评估所提特征。使用随机森林模型时，我们报告的最佳准确率达99.75%。提出的特征集仅包含12个特征，是PDF恶意软件检测领域最简洁的特征集之一。尽管规模较小，我们仍获得了与采用更庞大特征集的现有最优方法相媲美的检测结果。