## 4 Experiment and Results
### Feature Extraction
#### 4.2.2 JavaScript Features  
We applied text-mining techniques to derive keywords from JavaScript embedded in malicious PDF. The decoder filter was adopted to make JavaScript readable. JavaScript is different from plain text. It has numerous special characters like operators, and quotations. Full references on keywords used in JavaScript are referenced in the official JavaScript website [21]. We extracted keywords based on the frequency of randomly selected samples from our entire sample set. Then, we categorized the keywords derived from JavaScript into three categories as follows. The first category is predefined names including the method name, the object, and the attribute name. Keywords in this category include length, replace, String, fromCharCode, unescape, split, eval and so on. We compared the cumulative sum of occurrences of the name of keywords per class shown in Table 3. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Keywords** & **Malware** & **Benign** & **Benign with JavaScript** \\ \hline Obj: object starts & 11 & 90 & 180 \\ Stream : stream starts & 3 & 31 & 96 \\ /Page : pages,\# in PDF & 0.7 & 2 & 1.8 \\ /JS: JavaScript starts & 0.7 & 0.01 & 1.1 \\ /JavaScript: JavaScript starts & 0.9 & 0.03 & 1.3 \\ /AA: autorun & 0.01 & 0.1 & 0.9 \\ /OpenAction: launch something without user interaction & 0.4 & 0.06 & 0.1 \\ /Type: object type information & 3 & 5.6 & 29 \\ /Filter: filter pages within a PDF by a word & 2 & 5 & 26 \\ /FlateDecode : to access the decompressed stream & 1 & 5 & 33 \\ /Length: page length & 3 & 13 & 25 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The average count of each keyword appearance per a document. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Predefined Names** & **Malware** & **Benign** & **Benign with JavaScript** \\ \hline length: variable length & 9.30 & 0.11 & 2.20 \\ replace: Replace text in strings with regular expressions & 0.83 & 0.04 & 0.18 \\ or search strings & & & \\ String: variable type & 0.70 & 0 & 1.55 \\ fromCharCode: Returns a string from multiple Unicode & & & \\ character values. & 0.37 & 0 & 0 \\ unescape: Decodes a String object encoded with the & & & \\ escape function escape. & 0.47 & 0 & 0 \\ split: Splits a string into substrings using the specified & & & \\ delimiter and returns it as an array. & & 0.32 & 0.06 & 0.42 \\ eval: This makes JavaScript source code being executed & & & \\ dynamically. & & & \\ Array: variable type & 0.28 & 0.01 & 0.57 \\ substr: Returns the substring at the specified position in & & & \\ the string object. & 0.80 & 0.02 & 0 \\ charCodeAt: Returns the Unicode value of the character & & & \\ at a specified position. & 0.05 & 0 & 0 \\ Date: variable type & 0.05 & 1.05 & 2.09 \\ Object: variable type & 0.04 & 0.02 & 1.39 \\ charAt: Returns the character value corresponding to the & & & \\ specified index. & & & \\ Push: Adds a new element to the array and returns the & & & \\ new length of the array. & & & \\ indexOf: Returns the start of a substring in a String & & & \\ object. & & & \\ Number: variable type & 0 & 1.47 & 2.57 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The average count of names in JavaScript. In Table 4, the second category includes the operator, constant, type and reserved words. These reserved words include var, if, this, function, return, for and so on. To enrich lexical features such as app, frc, plugIns, buf, sum, arr, num, doc, and so on known to be readable with meaning in human language, we extracted readable words frequently shown in JavaScript of documents. Table 5 demonstrates the number of appearances of a few frequent words in JavaScript. We selected the keywords based on the frequency appeared in randomly chosen malicious documents and manually classified into \"names\", \"reserved words\", and \"readable words\" using JavaScript programming skills. In the detection model, it is not necessary to categorize keywords because we consider all keywords equally.