# PDF Malware Detection Based on Fuzzy Unordered Rule Induction Algorithm (FURIA)
## 1 Introduction
### PDF-Based Malware  
Phishing and exploits are the two main types of PDF-based attacks. Phishing attempts frequently appear in emails. A typical instance is a PDF delivery or purchase confirmation receipt attached to an email that seems to be from a trustworthy online store or logistics company. Apart from the social engineering techniques used to persuade recipients to open phishing PDF attachments, the text content of such emails is largely meaningless. These PDF documents are typically one page long and include social engineering elements as well as a phishing URL that leads to a suspicious website where malicious downloads, personal data collection, and other activities can be carried out. In contrast to plain-text-based phishing efforts, PDF documents include binary or a blend of binary and ASCII languages, making them harder to detect. This is one of the factors contributing to the rise in the popularity of phishing attempts based on PDFs. Its motivation is identical to that of standard phishing scams. The information that attackers collect from victims may be used by them or may be sold on the illicit market for use in the so-called shadow economy [6].  
The PDF file format is a popular option for use in offices because of its high efficiency, dependability, and interactivity. The development of non-executable file assault technologies and attack techniques such as the advanced persistent threat has seriously jeopardized PDF's security since malicious PDF files are the most researched infection routes in adversarial scenarios [7; 8]. With the development of machine learning (ML) technology [9] in recent years, researchers have developed a variety of ML-based techniques to recognize distinct attack types related to PDF files. The technology for detecting malicious PDF files may be divided into techniques based on static analysis, dynamic analysis, and techniques based on a combination of static and dynamic analyses. Modern research has demonstrated that PDF detectors based on ML may achieve excellent accuracy with a remarkably low false positive rate (FPR) [10]. However, such a study focuses on the proposed Fuzzy Unordered Rule Induction Algorithm (FURIA) for malware detection in PDF files compared with Naive Bayes (NB), Decision Tree (J48), Hoeffding Tree (HT), and Quadratic Discriminant Analysis (QDA). These models are compared based on some of the well-known assessment measures, including accuracy (ACC), F-measure (FM), recall, precision, [PERSON]'s correlation coefficient (MCC), and mean absolute error (MAE). This study has two primary objectives:  
* To propose a malware detection model that will protect the systems from any harmful activity caused by PDF malware;
* To compare the findings from the suggested and existing models in use to discover a better and more effective solution for PDF malware detection.  
The main contributions of this study are summarized as follows:  
* We propose a FURIA-based model for the PDF malware detection;
* We analyze the outcomes of the proposed model with four well-known ML models: NB, J48, HT, and QDA;
* We do several tests on the dataset available at: [[http://205.174.165.80/CICDataset/CICvasivePDFMal2022/Dataset/](http://205.174.165.80/CICDataset/CICvasivePDFMal2022/Dataset/)]([http://205.174.165.80/CICDataset/CICvasivePDFMal2022/Dataset/](http://205.174.165.80/CICDataset/CICvasivePDFMal2022/Dataset/)) (accessed on 5 February 2023);
* We disclose the intuition of the experiments using MAE, ACC, FM, MCC, precision, and recall metrics.  
The rest of this paper is organized as follows: Section 2 summarizes the literature review. Sections 3 and 4 discuss the methodology and results analysis and discussion, respectively. Finally, Section 5 concludes this work.