Leveraging Interpretable Tsetlin Machine for PDF Malware Detection
2026-07-10 • Cryptography and Security
Cryptography and SecurityMachine Learning
AI summaryⓘ
The authors developed a new way to detect harmful PDF files using a method called Tsetlin Machine, which learns rules to tell apart safe and dangerous PDFs. They analyze the files without opening them, making the process safer and faster. Their method was tested on a dataset and found to be almost 98% accurate, performing as well or better than other machine learning approaches. An important feature is that their system explains why it labels a file as harmful or safe, helping users understand its decisions.
PDFMalware DetectionTsetlin MachineStatic AnalysisMachine LearningRule-Based LearningCybersecurityInterpretable ModelsRIT-PDFMal-2026 datasetClassification Accuracy
Authors
Rahul Jaiswal
Abstract
In the digital era, Portable Document Format (PDF) is one of the most widely used file formats for storing and exchanging digital documents due to its platform independence and rich functionality. However, these same capabilities have also made PDF files an attractive attack vector for cyberattackers, who embed malicious code within seemingly legitimate documents to compromise target systems. This paper presents a novel interpretable Tsetlin Machine (TM)-based framework for PDF malware detection. The proposed framework extracts salient features from PDF documents through static analysis without executing the files and employs rule-based learning to accurately classify benign and malicious PDF documents. Numerical evaluation on the RIT-PDFMal-2026 dataset demonstrates that the proposed framework achieves competitive performance, attaining an accuracy of 98.02% compared with several ML classifiers and existing methods. Moreover, the proposed framework provides intrinsic interpretability by transparently explaining its classification decisions. The combination of competitive detection performance, computational efficiency, and intrinsic interpretability makes the proposed framework a promising solution for practical PDF malware detection.