Improving file security through an optimized auto-classification approach using learning models

Malware targeting PDF files poses a serious threat to digital security. In this study, a comprehensive method is proposed for the classification of PDF files. Within the scope of the study, 43 different general and structural features were extracted from PDFs using PyPDF2, PDFMiner and PyMuPDF libraries. There are two different stages in the study. In the first stage, the dataset used was digitized as a single column with TF-IDF, N-gram Count Vectorizer and Word2Vec methods and used in model training without feature selection. In the second stage, the columns containing text were digitized with Word2Vec and used in model training by applying feature selection methods. In the first stage, seven different machine learning and four different deep learning models were applied. In the second stage, an original designed Multi-Branch CNN model was used in addition to the machine learning models. SelectKBest, Recursive Feature Elimination (RFE) and Lasso methods were applied in feature selection. The proposed Multi-Branch CNN architecture was applied to the results of feature selection methods. As a result of the test conducted on the Multi- Branch CNN model, 0.9982 accuracy value was obtained with Lasso feature selection. Experiments with machine learning models are evaluated on datasets with and without feature extraction, and comparatively, metrics such as accuracy, precision, recall rate, and F1 score are analyzed for both stages. The study is tested on a comprehensive dataset of approximately 30,000 PDF files. The obtained results aim to provide an effective approach for the detection of PDF-based malware.