## 3 Malicious Portable Document Format (PDF) Detection Model
### Structure of PDF  
PDF provides various functions other than those frequently used by normal users, one of which is its ability to add objects. Thus malicious code often exploits them. PDF has the following components.  
* Object: PDF consists of data objects.
* File Structure: File structure contains object storage, access, and update information.
* Document Structure: Document structure refers to how various object configurations organize and put the document.
* Content Streams: Content streams contain the appearance of the document, and graphical elements.  
PDF file structure is organized with header, Body, Cross-reference table, and Trailer as shown in Figure 1.  
Figure 1: Portable document format (PDF) file structure.  
* Header: One-line header to inform the PDF specification version.
* Body: A body contains objects that make up the PDF document. It consists of indirect objects that contain the actual content of the document. Body represents document content, font, page, and image elements.
* Cross-reference (xref) table: It is the table used for referencing objects. It usually has a form of the global reference table referencing indirect objects. It has position information of each indirect object and enables random access of a specific object. Each entry is 20 bytes long, including an end-of-line marker.
* Trailer: It indicates which one is the Root object among objects in the body part and where the cross-reference table is located. It starts with the directive trailer and ends with % EOF (End of File). It represents the characteristics of objects wrapped with << >>. In Figure 2/Size represents the number of cross-reference table entries, and/Root represents i.d. of the Root object. \"startxref\" tells the location of the cross-reference table.  
Figure 2 shows an example of a trailer, located at the end of the file and shows the location of the root object and the cross-reference table. The contents inside the red box refer to the offset 0 of the first object. R stands for reference. Figure 2 shows that the root object is number 1, the number of cross-reference table items is 5, and the starting offset value of the cross-reference table is 7507.  
Figure 3 shows an example of a cross-reference table, which shows the position values of objects in the PDF Body part and whether they are used or not. Each entry in the table has a size of 20 bytes, including spaces. The keyword xref indicates the beginning of the cross-reference table. \"\(\ell\)\" indicates free entry and \"n\" indicates in-use entry. The number 0 of line 92 represents the object start number, and the number after the object number 5 represents the number of entries. Line 93 indicates object ID 0, offset 0, disabled and line 94 indicates object ID 1, offset 10. Line 95 indicates that object ID 2 is used and offset 120 is used. Line 96 indicates object ID 3 and offset 189. Line 97 is object ID 4, and offset 408.  
Figure 4 is an example of a body. In the red box, object ID 1 refers to the catalog type, whose page layout refers to a single page, page contents refer to object ID 2, an action refers to object ID 4. In the blue box, object ID 3 indicates that its type has a square picture including page content and media contents, and additionally includes object ID 6 and 8, and object ID 2 as a parent object. Among various types of objects, the stream object is a group of consecutive bytes (bin  
Figure 3: A snapshot of a cross-reference table.  
Figure 2: A snapshot of a trailer of PDF.  
size object. This object consists of a Dictionary object followed by several bytes between the keywords'stream' and 'endstream'.