# HAPSSA: Holistic Approach to PDF Malware Detection Using Signal and Statistical Analysis

arXiv: https://arxiv.org/abs/2111.04703 · HTML: https://mlsanity.com/paper/2111.04703/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 41 references that are in the map.
- First posted on arXiv 8 Nov 2021.

## Builds on (most cited first, 4 of 4)

- [Natural TTS Synthesis by Conditioning WaveNet on Mel Spectrogram Predictions](https://mlsanity.com/paper/1712.05884/) (2017)
- [Bag of Visual Words and Fusion Methods for Action Recognition: Comprehensive Study and Good Practice](https://mlsanity.com/paper/1405.4506/) (2014)
- [Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning](https://mlsanity.com/paper/2101.10578/) (2021)
- [Boosting Image Forgery Detection using Resampling Features and Copy-move analysis](https://mlsanity.com/paper/1802.03154/) (2018)

## Built on by (most cited first, 1 of 1)

- [MalGrid: Visualization Of Binary Features In Large Malware Corpora](https://mlsanity.com/paper/2211.02696/) (2022)

## Abstract (arXiv)

Malicious PDF documents present a serious threat to various security organizations that require modern threat intelligence platforms to effectively analyze and characterize the identity and behavior of PDF malware. State-of-the-art approaches use machine learning (ML) to learn features that characterize PDF malware. However, ML models are often susceptible to evasion attacks, in which an adversary obfuscates the malware code to avoid being detected by an Antivirus. In this paper, we derive a simple yet effective holistic approach to PDF malware detection that leverages signal and statistical analysis of malware binaries. This includes combining orthogonal feature space models from various static and dynamic malware detection methods to enable generalized robustness when faced with code obfuscations. Using a dataset of nearly 30,000 PDF files containing both malware and benign samples, we show that our holistic approach maintains a high detection rate (99.92%) of PDF malware and even detects new malicious files created by simple methods that remove the obfuscation conducted by malware authors to hide their malware, which are undetected by most antiviruses.