# PDFInspect: A Unified Feature Extraction Framework for Malicious Document Detection

arXiv: https://arxiv.org/abs/2601.12866 · HTML: https://mlsanity.com/paper/2601.12866/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 23 references that are in the map.
- First posted on arXiv 19 Jan 2026.

## Builds on (most cited first, 5 of 5)

- [KAN: Kolmogorov-Arnold Networks](https://mlsanity.com/paper/2404.19756/) (2024)
- [Towards Adversarial Malware Detection: Lessons Learned from PDF-based Attacks](https://mlsanity.com/paper/1811.00830/) (2018)
- [Graph Mining for Cybersecurity: A Survey](https://mlsanity.com/paper/2304.00485/) (2023)
- [Graph-based Document Structure Analysis](https://mlsanity.com/paper/2502.02501/) (2025)
- [MLPdf: An Effective Machine Learning Based Approach for PDF Malware Detection](https://mlsanity.com/paper/1808.06991/) (2018)

## Built on by (most cited first, 1 of 1)

- [A Leakage-Free Stacked Ensemble Method for Multiclass Classification](https://mlsanity.com/paper/2607.22081/) (2026)

## Abstract (arXiv)

The increasing prevalence of malicious Portable Document Format (PDF) files necessitates robust and comprehensive feature extraction techniques for effective detection and analysis. This work presents a unified framework that integrates graph-based, structural, and metadata-driven analysis to generate a rich feature representation for each PDF document. The system extracts text from PDF pages and constructs undirected graphs based on pairwise word relationships, enabling the computation of graph-theoretic features such as node count, edge density, and clustering coefficient. Simultaneously, the framework parses embedded metadata to quantify character distributions, entropy patterns, and inconsistencies across fields such as author, title, and producer. Temporal features are derived from creation and modification timestamps to capture behavioral signatures, while structural elements including, object streams, fonts, and embedded images, are quantified to reflect document complexity. Boolean flags for potentially malicious PDF constructs (e.g., JavaScript, launch actions) are also extracted. Together, these features form a high-dimensional vector representation (170 dimensions) that is well-suited for downstream tasks such as malware classification, anomaly detection, and forensic analysis. The proposed approach is scalable, extensible, and designed to support real-world PDF threat intelligence workflows.6