Leveraging Interpretable Tsetlin Machine for PDF Malware Detection

Technical Summary: Leveraging Interpretable Tsetlin Machine for PDF Malware Detection

Problem Statement
The Portable Document Format (PDF) is a dominant standard for digital document exchange due to its platform independence and rich functionality. However, these capabilities, including embedded objects, JavaScript, and interactive actions, have made PDFs a primary attack vector for cyberattacks. Malicious actors exploit these features to deliver payloads for credential theft, spyware installation, and system compromise. Traditional detection methods face significant challenges: signature-based approaches fail against zero-day threats, while anomaly-based and standard machine learning (ML) classifiers often operate as "black boxes," lacking intrinsic interpretability. Although post-hoc explainability tools (e.g., SHAP, LIME) exist, they offer approximate explanations rather than revealing the underlying decision logic. Furthermore, the rapid evolution of attack techniques necessitates detection systems that are not only accurate but also computationally efficient and transparent.

Methodology
The paper proposes a novel framework utilizing the Tsetlin Machine (TM), an interpretable, rule-based ML model that learns human-readable logical clauses. The methodology proceeds through the following stages:

1. Static Feature Extraction: The framework extracts 42 salient features directly from PDF files without execution. These features include structural elements (e.g., xref, trailer, stream), metadata properties (e.g., pdfsize, metadata size), and content indicators (e.g., JS, JavaScript, OpenAction, isEncrypted).
2. Data Preprocessing: The raw data undergoes cleaning, including the removal of duplicate samples and handling of class imbalance via random undersampling. Features are normalized using min-max scaling and then binarized using KBinsDiscretizer to convert them into binary inputs suitable for propositional logic learning.
3. Tsetlin Machine Training: The TM model learns a collection of conjunctive clauses. Each clause consists of a conjunction of selected literals (features) and their negations. The model aggregates votes from these clauses, weighted by polarity (+1 or -1), to classify a document as either benign or malicious. The training employs k-fold cross-validation to ensure robustness.
4. Interpretability Mechanism: Unlike black-box models, the TM provides intrinsic interpretability. Classification decisions are explained through:
   • Clause Activation Heatmaps: Visualizing which logical rules fired for a specific sample.
   • Class-Vote Analysis: Quantifying the evidence (votes) supporting a specific class.
   • Feature-Level Contribution: Identifying which specific features drove the decision, distinguishing between those that support or suppress a classification.

Key Contributions

• Framework Design: The development of an effective TM-based framework specifically tailored for PDF malware detection using the RIT-PDFMal-2026 dataset.
• Performance Benchmarking: A comprehensive numerical evaluation comparing the proposed TM against seven conventional ML classifiers (Decision Tree, Random Forest, KNN, Naive Bayes, Logistic Regression, XGBoost, and LightGBM).
• Interpretability Analysis: A detailed demonstration of the model's decision-making process through learned clauses and feature contributions, offering transparent insights into how benign and malicious documents are distinguished.

Experimental Results
The framework was evaluated on the RIT-PDFMal-2026 dataset, which contains 24,337 samples (13,235 benign and 11,102 malicious) across 42 features. After preprocessing (removing duplicates and balancing the training set), the results were as follows:

• Accuracy: The proposed TM achieved an accuracy of 98.02%. This performance is competitive with, and in some metrics comparable to, state-of-the-art ensemble methods like Random Forest (98.28%), XGBoost (97.37%), and LightGBM (97.30%).
• Precision, Recall, and F1-Score: The TM attained a macro-averaged precision of 96.03%, recall of 95.95%, and F1-score of 95.99%, demonstrating balanced performance across both classes.
• Efficiency: In terms of inference time, the TM required 2.853 µs per sample. This is significantly faster than Random Forest (3.901 µs) and LightGBM (15.274 µs), though slightly slower than Decision Trees and Logistic Regression.
• Interpretability Case Studies: The paper illustrates that the model correctly classifies samples by aggregating votes from activated clauses. For instance, in a correctly classified benign sample, the benign class received a vote score of 10, driven by features such as isEncrypted and Encrypt. Conversely, misclassifications were analyzed, revealing that overlapping feature characteristics between benign and malicious samples can occasionally lead to incorrect vote aggregation.

Significance and Claims
The paper claims that the proposed framework offers a practical solution for PDF malware detection by successfully balancing three critical factors: competitive detection performance, computational efficiency, and intrinsic interpretability.

The authors emphasize that unlike conventional ML classifiers which require post-hoc explanation tools, the TM inherently provides transparent, human-readable logic. This transparency enhances the trustworthiness of the detection system, a crucial requirement for cybersecurity applications where understanding why a file is flagged is as important as the flag itself. The study concludes that while the current work is limited to a single public dataset and representative case studies, the TM framework represents a promising direction for future research in explainable AI for cybersecurity. Future work is proposed to validate the interpretability through user studies and to extend the evaluation to diverse malware families.