An Interpretable Hybrid Model for PDF Malware Detection Using CNN and Vision Transformer

In recent years, malware has become more prevalent just as the internet has become more complex and ubiquitous. Malware is expanding at an alarming rate, and PDF documents are a prominent attack surface due to their programmable components and hardware independence. Various approaches have been employed to protect PDF(portable document format) files from malware attacks. Older approaches, such as dependency-based algorithms, addressed structural anomalies but struggled to handle black-box threats. Other existing techniques are known to be less efficient and perform poorly against new vulnerabilities. This study presents an efficient and novel hybrid solution (Convolutional Neural Network(CNN) + Vision Transformer (ViT)) for combating PDF malware using the PDFRep dataset. The study identified key players in detecting PDF malware, achieving an average of 0.99 across receiver operating characteristics, accuracy, recall, precision, and F1 score. Furthermore, the hybrid model obtained relatively low false-positive and false-negative rates. According to the results, the solution proved to be an improvement over others for detecting PDF malware.