SKIM-PDF: A Unified IQR–Chi-Squared Adaptive Selection Pipeline for Structural PDF Malware Detection

DOI

https://www.doi.org/10.59256/indjcst.20260502100

Published In

Volume 5, Issue 2 (2026)

Published Online

May-August 2026

Pages

920-927

Article Type

Original Article

Check for updates

Malicious PDF files continue to rely on familiar delivery mechanisms, including embedded JavaScript, OpenAction triggers, and encrypted content streams. This makes it important to detect suspicious documents without opening or executing them. Rather than proposing a new classifier, this study focuses on preprocessing and a fair comparison of existing classifiers. We developed IQR-χ²-AS (Interquartile Range–Chi-Squared Adaptive Selection), a unified pipeline that clips outliers using the IQR method, fills missing values through forward-fill imputation, and selects informative features with chi-squared K-Best scoring. Closed-form derivations and complexity bounds are provided for each stage. The pipeline was evaluated on the balanced PDFMalware2022 dataset (10,000 samples and 17 structural attributes) using seven classifiers: Random Forest, AdaBoost, K-Nearest Neighbors, SVM, a pruned decision tree (J48/C5.0), Gradient Boosting, and a compact feed-forward neural network. Chi-squared K-Best selection reduced the feature space from 17 to 10 attributes without lowering test accuracy. Random Forest achieved the best result, with 99.5% test accuracy and an AUC of 0.998. Across the classifiers, the selected feature set produced an average accuracy improvement of 0.9 percentage points and an average speed increase of 18% over the original feature set. Hyperparameters, confusion matrices, ROC curves, and chi-squared feature rankings are reported for reproducibility. The main contribution is the unified pipeline and the like-for-like benchmark it provides for future structural PDF malware detection studies.