Looking inside a malware classifier.
A PDF can look ordinary while carrying malicious code. My research trained four classifiers to flag those files and used SHAP, an explainable-AI method, to ask what each verdict rested on.
PDFGuardianB.Sc. researchBRAC University2023Revisited 2026
- Role
- Team research for my B.Sc. at BRAC University.
- Data
Data
21,095 PDFs from the Contagio archive, described by 21 PDFiD keyword counts.- Models
Models
A perceptron, an SGD classifier, XGBoost with a linear booster and a small neural network.- Explained
Explained
SHAP for single verdicts and for each model across the test set.- Finding
- Judged by what they relied on, the models compared differently than by their errors: the SGD classifier ran close behind the leaders on two features alone. In 2026, the saved models reproduced the study’s error counts exactly, and my re-check showed that each explanation must name the question it answers.
Reading the PDF’s structure
PDF files can carry scripts, forms and actions alongside the text a reader sees. PDFGuardian counted those structural signals in each file and trained four classifiers on the counts.
The structure underneath
- /JS · /JavaScript
- Script-related entries
- /OpenAction
- An action or destination on opening
- Objects · streams · xref
- Content and the references connecting it
- 01Count structural signals
PDFiD counts keywords inside the file.
- 02Prepare the data and train
Compare SGD, a perceptron, XGBoost and an artificial neural network.
- 03Evaluate and explain predictions
Error counts show what the models got wrong. SHAP explains each verdict, and each model across the test set.
These PDF features can have legitimate uses; their presence alone does not establish malware.
Missed malware and false alarms
Accuracy alone hides two different costs: a malicious file going undetected, and a harmless document being flagged. In the study’s comparison, the neural network made the fewest errors overall, while the perceptron missed the fewest malicious files. The choice depends on which errors matter most in use.
A malicious file is classified as benign.
The threat goes undetected.A benign file is classified as malicious.
A legitimate document is questioned.Asking each model for its reasons
SHAP divides a model’s output into a share for each feature. The study read it at two scales: for a single file, which signals moved that verdict, and across the test set, which signals each model leaned on.
Read that way, the four models differed in ways the error counts could not show. The SGD classifier sat close behind the leaders while resting on two features, /JS and /XFA. The model with the most errors spread small weights across every feature. The study concluded that a model should be judged on what it relies on as well as on how often it is right.
| Model | By its errors | By what it relied on |
|---|---|---|
| Neural network | Fewest errors overall | Script and action markers led its explanations |
| Perceptron | Fewest missed malware | Weights across script, form and structure counts, with none on /JS |
| SGD classifier | Close behind the leaders | Two weights that matter, on /JS and /XFA |
| XGBoost, linear | The most errors | Small weights on every feature |
Errors from the study’s counts. Reliance for the three linear models read from their saved weights in 2026; for the neural network, from the study’s SHAP plots alone.
Revisited: the explainer’s setting
In 2026, I reopened the study to test its conclusions the way I now review AI work: against the evidence they rest on, here the saved models and data. The saved models reproduce the study’s error counts exactly, so the explanations could be tested against the models themselves.
One puzzle had stayed open. For the SGD classifier, the explanation of a single file credited /OpenAction and /JavaScript, while the explanation across the test set gave them nothing. The two came from different SHAP settings. The conditional setting asks what tends to accompany the verdict in the data, so it shares credit among markers that appear together. The independent setting asks what the model itself weighs, and this model gives /OpenAction and /JavaScript no weight at all.
The SGD model and one malicious file, explained under SHAP’s two settings. Each starts from the model’s average output and arrives at the same verdict.
ConditionalWhat travels with the verdict in the data
IndependentWhat the model itself weighs
Drawn to scale from a 2026 re-check of the study’s model, with values left out. The model gives weight to /JS and /XFA alone; the conditional setting shares the /JS credit with markers that tend to appear beside it.
Both are correct answers to different questions. The perceptron shows the same effect from the other side: it gives /JS no weight, yet under the conditional setting /JS ranks second across the test set. A reader can check an explanation only when it names the question it answers.
What I’d do now
The study’s main result holds: SHAP showed what each model rested on, and that changed how the four compared. The revisit adds a condition to it: an explanation has to name its setting. If I ran the study today, I would build that into it from the start, along with a harder test.
- A harder test. Hold out whole malware families and a newer collection built to evade detectors.
- Explanations checked against the model. Report each explanation with its setting, then confirm it against the model’s weights where they exist, and by whether removing a feature changes the verdict.
- Reasons a person can read. An analyst deciding on a flagged file needs its reason in words. A language model can draft that reason from the SHAP shares and the file’s structure, with each draft checked against those shares before anyone acts on it.
- Which features did this prediction rely on?
- SHAP estimates each feature’s share, once its setting is named.
- Does a feature cause the attack?
- Needs evidence beyond the explanation.
- Will it recognise malware it hasn’t seen?
- Needs a test on malware held out from training.
Structural signals such as /JS, /OpenAction and xref appear in legitimate documents too.
Each of those changes keeps the study’s question and makes its answer easier to check.