{"id":"https://openalex.org/W4280582787","doi":"https://doi.org/10.1007/s11042-022-11960-x","title":"Towards enhanced PDF maldocs detection with feature engineering: design challenges","display_name":"Towards enhanced PDF maldocs detection with feature engineering: design challenges","publication_year":2022,"publication_date":"2022-05-17","ids":{"openalex":"https://openalex.org/W4280582787","doi":"https://doi.org/10.1007/s11042-022-11960-x"},"language":"en","primary_location":{"id":"doi:10.1007/s11042-022-11960-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11042-022-11960-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11042-022-11960-x.pdf","source":{"id":"https://openalex.org/S110206669","display_name":"Multimedia Tools and Applications","issn_l":"1380-7501","issn":["1380-7501","1573-7721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Multimedia Tools and Applications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11042-022-11960-x.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064626440","display_name":"Ahmed Falah","orcid":"https://orcid.org/0000-0001-6359-8570"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":true,"raw_author_name":"Ahmed Falah","raw_affiliation_strings":["Deakin University, Melbourne, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6359-8570","affiliations":[{"raw_affiliation_string":"Deakin University, Melbourne, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038446422","display_name":"Shiva Raj Pokhrel","orcid":"https://orcid.org/0000-0001-5819-765X"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Shiva Raj Pokhrel","raw_affiliation_strings":["Deakin University, Melbourne, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Deakin University, Melbourne, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045991464","display_name":"Lei Pan","orcid":"https://orcid.org/0000-0002-4691-8330"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Lei Pan","raw_affiliation_strings":["Deakin University, Melbourne, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Deakin University, Melbourne, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5112837997","display_name":"Anthony de Souza-Daw","orcid":null},"institutions":[{"id":"https://openalex.org/I4403386716","display_name":"Melbourne Polytechnic","ror":"https://ror.org/04cq7wg91","country_code":null,"type":"education","lineage":["https://openalex.org/I4403386716"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Anthony de Souza-Daw","raw_affiliation_strings":["Melbourne Polytechnic, Melbourne, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Melbourne Polytechnic, Melbourne, Australia","institution_ids":["https://openalex.org/I4403386716"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5064626440"],"corresponding_institution_ids":["https://openalex.org/I149704539"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":0.4641,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.55410285,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"81","issue":"28","first_page":"41103","last_page":"41130"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9197365045547485},{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.8990197777748108},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5944960713386536},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.5928754210472107},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.5889073610305786},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5867006778717041},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5315285325050354},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.530833899974823},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5145532488822937},{"id":"https://openalex.org/keywords/signature","display_name":"Signature (topology)","score":0.4841226041316986},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4451677203178406},{"id":"https://openalex.org/keywords/confusion","display_name":"Confusion","score":0.43379148840904236},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.32424816489219666},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2959177494049072},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.19810673594474792},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.18098753690719604}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9197365045547485},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.8990197777748108},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5944960713386536},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.5928754210472107},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.5889073610305786},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5867006778717041},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5315285325050354},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.530833899974823},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5145532488822937},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.4841226041316986},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4451677203178406},{"id":"https://openalex.org/C2781140086","wikidata":"https://www.wikidata.org/wiki/Q557945","display_name":"Confusion","level":2,"score":0.43379148840904236},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.32424816489219666},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2959177494049072},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.19810673594474792},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.18098753690719604},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C11171543","wikidata":"https://www.wikidata.org/wiki/Q41630","display_name":"Psychoanalysis","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s11042-022-11960-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11042-022-11960-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11042-022-11960-x.pdf","source":{"id":"https://openalex.org/S110206669","display_name":"Multimedia Tools and Applications","issn_l":"1380-7501","issn":["1380-7501","1573-7721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Multimedia Tools and Applications","raw_type":"journal-article"},{"id":"pmh:oai:dro.deakin.edu.au:DU:30168237","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306401102","display_name":"Own your potential (DEAKIN)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I149704539","host_organization_name":"Deakin University","host_organization_lineage":["https://openalex.org/I149704539"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal Article"},{"id":"pmh:oai:figshare.com:article/20597796","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Towards_enhanced_PDF_maldocs_detection_with_feature_engineering_design_challenges/20597796","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1007/s11042-022-11960-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11042-022-11960-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11042-022-11960-x.pdf","source":{"id":"https://openalex.org/S110206669","display_name":"Multimedia Tools and Applications","issn_l":"1380-7501","issn":["1380-7501","1573-7721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Multimedia Tools and Applications","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.6600000262260437}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320970","display_name":"Deakin University","ror":"https://ror.org/02czsnj07"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4280582787.pdf","grobid_xml":"https://content.openalex.org/works/W4280582787.grobid-xml"},"referenced_works_count":22,"referenced_works":["https://openalex.org/W1972531058","https://openalex.org/W2014466911","https://openalex.org/W2038296020","https://openalex.org/W2082190528","https://openalex.org/W2084264686","https://openalex.org/W2280263187","https://openalex.org/W2486441280","https://openalex.org/W2501098765","https://openalex.org/W2525598640","https://openalex.org/W2573650634","https://openalex.org/W2575541032","https://openalex.org/W2596914666","https://openalex.org/W2597977396","https://openalex.org/W2749572357","https://openalex.org/W2755537837","https://openalex.org/W2779064420","https://openalex.org/W2807782820","https://openalex.org/W2944146009","https://openalex.org/W2962695400","https://openalex.org/W3088861647","https://openalex.org/W3104158743","https://openalex.org/W6688169353"],"related_works":["https://openalex.org/W2461078469","https://openalex.org/W123790205","https://openalex.org/W2085515337","https://openalex.org/W3087706721","https://openalex.org/W3102852402","https://openalex.org/W4287664162","https://openalex.org/W4385695489","https://openalex.org/W827014118","https://openalex.org/W2498635018","https://openalex.org/W2767752325"],"abstract_inverted_index":{"Abstract":[0],"In":[1],"this":[2],"paper,":[3],"we":[4,85],"perform":[5],"an":[6],"in-depth":[7],"analysis":[8],"of":[9,13,21],"a":[10,51,109,128],"large":[11],"corpus":[12],"PDF":[14,41],"maldocs":[15,42],"to":[16,74,130],"identify":[17],"the":[18,34,105,132],"key":[19],"set":[20],"significantly":[22],"important":[23],"features":[24,134],"and":[25,38,47,81,95,113,141],"help":[26],"in":[27],"maldoc":[28,124],"detection.":[29],"Existing":[30],"industry-based":[31],"tools":[32],"for":[33],"detection":[35],"are":[36,45],"inefficient":[37],"cannot":[39],"prevent":[40],"because":[43],"they":[44],"generic":[46],"depend":[48],"primarily":[49],"on":[50],"signature-based":[52],"approach.":[53],"Besides,":[54],"several":[55],"other":[56],"methods":[57],"developed":[58],"by":[59],"academics":[60],"suffer":[61],"heavily":[62],"from":[63],"reduced":[64],"effectiveness.":[65],"The":[66],"feature-set":[67],"using":[68],"machine":[69],"learning":[70],"classifiers":[71],"is":[72],"prone":[73],"various":[75],"known":[76],"attacks,":[77],"such":[78],"as":[79],"mimicry":[80],"parser":[82],"confusion.":[83],"Also,":[84],"discover":[86],"that":[87,138],"increasingly":[88],"more":[89],"malicious":[90],"files":[91],"i)":[92],"contain":[93,116],"evasive":[94],"obfuscated":[96],"JavaScript":[97,118],"code,":[98],"ii)":[99],"include":[100],"hidden":[101],"contents":[102],"(mostly":[103],"outside":[104],"objects),":[106],"iii)":[107],"have":[108],"corrupted":[110],"document":[111],"structure,":[112],"iv)":[114],"usually":[115],"short":[117],"code":[119],"blocks":[120],".":[121],"We":[122],"utilise":[123],"attacks\u2019":[125],"evolution":[126],"over":[127],"decade":[129],"highlight":[131],"essential":[133],"(e.g.,":[135],"concept":[136],"drifts)":[137],"impact":[139],"detectors":[140],"classifiers.":[142]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":2}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}