# PDF Malware Detection Based on Fuzzy Unordered Rule Induction Algorithm (FURIA)
## 3 Research Methodology
\begin{table}
\begin{tabular}{c c c} \hline \hline
**S No.** & **Feature** & **Description** \\ \hline
1 & Obj & This might be a sign of an attempt to obfuscate. \\ \hline
2 & endobj & Many other forms of obfuscations are supported by PDFs, including string obfuscations in hex, octal, etc. \\  & & that are typically used for evasion efforts. \\ \hline
3 & Stream & This represents the quantity of binary data sequences in the PDF. \\ \hline
4 & Endstream & Keywords that signify the streams’ termination. \\ \hline
5 & Xref & Size of the stream because streams may include a dangerous code. \\ \hline
6 & Trailer & How many trailers there are in the PDF. \\ \hline
7 & Startxref & How many keywords include ”startxref,” which designates the location where the Xref table is begun. \\ \hline
8 & Pageno & Because malicious PDF files do not care how their material is presented, they often contain fewer pages—often only one blank page. \\ \hline
9 & Encrypt & This function indicates if a PDF file is password-protected or not. \\ \hline
10 & Objstm & streams with other items in them. \\ \hline
11 & JS & The proportion of Javascript-containing objects. \\ \hline
12 & Javascript & This indicates the amount of items that include a Javascript code, the most often used feature, as is clear. \\ \hline
13 & AA & specifies a particular response to an event. \\ \hline
14 & OpenAction & Defines a specific action to be taken when the PDF file is opened. The bulk of common malicious PDF files have been found to use this functionality in conjunction with Javascript. \\ \hline
15 & Acroform & Form fields in Acrobat forms, which are PDF files, offer scripting technology that may be abused by hackers. \\ \hline
16 & JBIG2 Decode & A popular filter for encoding harmful stuff is JBig2 Decode. \\  & & How many items have nested filters? Nested filters can make decoding more challenging and may be an indicator of evasion. \\ \hline
17 & Richmeddia & The quantity of flash files and embedded media is indicated by the number of RichMedia keywords. \\ \hline
18 & Launch & A command or program can be run by using the term launch. \\ \hline
19 & EmbeddedFile & PDFs can attach or embed a variety of things inside themselves that may be exploited, such as additional PDF files, Word documents, pictures, etc. \\ \hline
20 & XFA & Certain PDF 40 files contain XFAs, which are XML Form Architectures that offer scripting technologies that can be abused by attackers. \\ \hline
21 & Color & In the PDF, many colors are utilized. \\ \hline
22 & Class & Classify as malicious or benign. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Selected features with their descriptions. \[\text{ACC}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{FN}} \tag{6}\]  
Here, the important thing is to discuss the use of MAE in this study. MAE is typically used as an evaluation metric in regression problems, where the goal is to predict a continuous numerical output. However, in some cases, MAE can also be used in classification problems to evaluate the performance of the classification model. In classification, the output is a categorical variable, so using MAE as the primary evaluation metric might not be as informative as other classification-specific metrics such as accuracy, precision, recall, F1-score, or AUC-ROC. These metrics provide a more detailed understanding of how well the model performs in terms of correctly identifying positive and negative examples. However, in some cases, using MAE in classification can provide additional insights into the model's performance. In this scenario, MAE can be used to evaluate how far the predicted probabilities are from the true labels.