Semantic PDF Object Embedding Pooling with Random Forest for Malware Detection
DOI:
https://doi.org/10.68307/tye1s915Keywords:
BERT embeddings, graph pooling, malware detection, object reference graph, PDF, Random ForestAbstract
This study evaluates a Random Forest on precomputed BERT-65k PDF object embeddings from the PDFObj2Vec evaluation dataset by combining four pooling operations with eleven graph statistics to form 4,107 features per document; the classifier correctly labels 6,131 of 6,133 baseline test PDFs for 99.97% accuracy and 44,154 of 45,947 extended set PDFs for 96.10% accuracy while producing 1,268 false positives and 525 false negatives on the latter set; the published BERT-65k+GIN result is 96.62% extended accuracy, although this aggregate comparison does not establish statistical equivalence or a computational advantage because adversarial robustness, split independence, calibration and end to end latency remain untested.
Impact Statement: Object-embedding pooling supports classification without graph neural message passing at the final decision stage, yet the measured extended set false positive rate of 5.18% and false negative rate of 2.45% together with unmeasured parsing and embedding costs mean that independent temporal testing, adversarial evaluation, calibration and operational measurement are needed before deployment.
References
[1] CISA, "Phishing guidance and cyber hygiene resources," Cybersecurity and Infrastructure Security Agency, 2022.
[2] P. Laskov and N. Srndic, "Static detection of malicious JavaScript-bearing PDF documents," ACSAC, 2011.
[3] C. Smutz and A. Stavrou, "Malicious PDF detection using metadata and structural features," ACSAC, 2012.
[4] N. Srndic and P. Laskov, "Hidost: a static machine-learning-based detector of malicious files," EURASIP Journal on Information Security, 2016.
[5] D. Maiorca, G. Giacinto, and I. Corona, "A pattern recognition system for malicious PDF files detection," MLDM, 2012.
[6] D. Maiorca et al., "Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection," ASIACCS, 2013.
[7] W. Xu, Y. Qi, and D. Evans, "Automatically evading classifiers: A case study on PDF malware classifiers," NDSS, 2016.
[8] N. Srndic and P. Laskov, "Practical evasion of a learning-based classifier: A case study," IEEE Symposium on Security and Privacy, 2014.
[9] L. Tong et al., "Improving robustness of ML classifiers against realizable evasion attacks using conserved features," USENIX Security, 2019.
[10] Y. Chen, S. Wang, D. She, and S. Jana, "On training robust PDF malware classifiers," USENIX Security Symposium, 2020.
[11] A. Jordaney et al., "Transcend: Detecting concept drift in malware classification models," USENIX Security, 2017.
[12] F. Barbero et al., "Transcending Transcend: Revisiting malware concept drift detection," security literature, 2022.
[13] S. Chua et al., "Neural nets can learn function type signatures from binaries," USENIX Security, 2017.
[14] S. Ding et al., "Asm2Vec: Boosting static representation robustness for binary clone search," IEEE S&P, 2019.
[15] X. Li et al., "PalmTree: Learning an assembly language model for instruction embedding," CCS, 2021.
[16] J. Devlin et al., "BERT: Pre-training of deep bidirectional transformers for language understanding," NAACL, 2019.
[17] K. Xu et al., "How powerful are graph neural networks?" ICLR, 2019.
[18] L. Breiman, "Random forests," Machine Learning, vol. 45, no. 1, pp. 5-32, 2001.
[19] Adobe Systems, "PDF Reference and ISO 32000-1 portable document format specification," 2008.
[20] PDF Association, "Stressful PDF corpus and PDF parser robustness resources," 2020.
[21] A. Kantchelian et al., "Evasion and hardening of tree ensemble classifiers," ICML, 2016.
[22] A. Biggio and F. Roli, "Wild patterns: Ten years after the rise of adversarial machine learning," Pattern Recognition, 2018.
[23] T. Chen and C. Guestrin, "XGBoost: A scalable tree boosting system," KDD, 2016.
[24] L. Akoglu, H. Tong, and D. Koutra, "Graph based anomaly detection and description," Data Mining and Knowledge Discovery, 2015.
[25] M. Newman, Networks, Oxford University Press, 2018.
[26] DGL Team, "Deep Graph Library," software documentation, 2024.
[27] A. Anantharaman et al., "PolyDoc: A corpus for PDF parser differential analysis," 2023.
[28] QPDF Project, "QPDF manual and PDF transformation tools," 2024.
[29] S. Liu, J. Ming, G. Zhou, X. Liu, J. Fu, and G. Peng, "Analyzing PDFs like Binaries: Adversarially Robust PDF Malware Analysis via Intermediate Representation and Language Model," ACM CCS, 2025, doi: 10.1145/3719027.3744829.
[30] PDFObj2Vec Evaluation Dataset, Zenodo, version 1, 2025, doi: 10.5281/zenodo.15428814. Accessed: September 2026.
[31] M. K. Bagwani and G. K. Shrivastava, “Comparative analysis of microservices architectures: Evaluating performance, scalability, and maintenance,” International Journal on Advances in Engineering Technology and Science, vol. 5, no. 32, p. 33, 2023.
[32] M. K. Bagwani, V. K. Tiwari, and A. Jain, “Implementing GrapesJS in educational platforms for web development training on AWS,” International Journal of Scientific Research in Multidisciplinary Studies, vol. 10, no. 8, pp. 1–8, 2024.
[33] M. K. Bagwani, V. K. Tiwari, and A. Jain, “Optimizing face detection performance with cloud machine learning services,” Journal of Engineering and Technology Management, vol. 73, pp. 1167–1180, 2024, doi: 10.14118/v73.2024.102213.
[34] M. K. Bagwani, V. K. Tiwari, N. Singh, and A. Sharma, “Integrating GrapesJS with AWS: Building an educational platform for web development training,” in An Overview of Literature, Language and Education Research, vol. 10, pp. 106–124, 2025, doi: 10.9734/bpi/aoller/v10/4349.
[35] M. K. Bagwani, S. Dwivedi, V. Kumar, P. Koshti, and S. Jain, “Transmitting malware through QR codes: Risk analysis and a hybrid detection method,” International Journal for Multidisciplinary Research, vol. 8, no. 3, pp. 1–25, 2026.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Nihal Thakur, Prajwal Raghuwanshi, Pushkar Kushwaha, NIranjan Saxena, Manas Khutte
This work is licensed under a Creative Commons Attribution 4.0 International License.
Articles published in the International Journal of Artificial Intelligence, Cybersecurity and Emerging Technologies (IJAICET) are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Under this license, users are free to share, copy, redistribute, adapt, and build upon the published material for any purpose, including commercial use, provided appropriate credit is given to the original author(s) and the source, a link to the license is provided, and any changes made are indicated.
Authors retain copyright of their work while granting IJAICET the right to publish, archive, distribute, and index the article. The journal supports the free exchange of scientific knowledge through open access publishing and encourages the widest possible dissemination of research.
