构建统一框架，从多维度提取PDF恶意特征
PDFInspect: A Unified Feature Extraction Framework for Malicious Document Detection
- 融合图结构、元数据和时序信息，生成170维特征向量
- 通过词关系图计算节点数、边密度等指标，识别异常文档
- 适合安全研究人员用于检测恶意PDF文件
恶意PDF文件日益增多，亟需高效全面的特征提取方法。本文提出一个统一框架，整合基于图、结构和元数据的分析方法，为每份PDF生成丰富特征表示。系统从页面中提取文本，构建基于词对关系的无向图，计算节点数、边密度、聚类系数等图论特征；同时解析嵌入的元数据，量化字符分布、熵模式及作者、标题、生产者等字段不一致情况；利用创建与修改时间戳提取时序特征，反映行为特征；对对象流、字体、嵌入图像等结构元素进行量化，衡量文档复杂度；并提取可能恶意的布尔标志（如JavaScript、启动动作）。这些特征共同构成170维高维向量，适用于恶意软件分类、异常检测和取证分析。该方法可扩展、可伸缩，适配真实世界PDF威胁情报工作流。
原文摘要 · Abstract (English)
The increasing prevalence of malicious Portable Document Format (PDF) files necessitates robust and comprehensive feature extraction techniques for effective detection and analysis. This work presents a unified framework that integrates graph-based, structural, and metadata-driven analysis to generate a rich feature representation for each PDF document. The system extracts text from PDF pages and constructs undirected graphs based on pairwise word relationships, enabling the computation of graph-theoretic features such as node count, edge density, and clustering coefficient. Simultaneously, the framework parses embedded metadata to quantify character distributions, entropy patterns, and inconsistencies across fields such as author, title, and producer. Temporal features are derived from creation and modification timestamps to capture behavioral signatures, while structural elements including, object streams, fonts, and embedded images, are quantified to reflect document complexity. Boolean flags for potentially malicious PDF constructs (e.g., JavaScript, launch actions) are also extracted. Together, these features form a high-dimensional vector representation (170 dimensions) that is well-suited for downstream tasks such as malware classification, anomaly detection, and forensic analysis. The proposed approach is scalable, extensible, and designed to support real-world PDF threat intelligence workflows.6
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。