AdvDetector: PDF Adversarial Sample Detection Based on Path Entropy and Perturbation Sensitivity

The Portable Document Format (PDF) is widely used for information exchange but is also a common attack vector. Its complexity and customizability make it vulnerable to exploitation, allowing attackers to embed malicious JavaScript or hyperlinks that pose significant security risks by tricking users into opening them. While machine learning is widely used to classify malicious PDF samples, it remains vulnerable to adversarial evasion attacks. Although methods have been proposed to enhance detector robustness by identifying adversarial samples, they often compromise performance on clean samples, increase computational overhead, and fail to generalize across all attack types, limiting their real-world applicability. This paper introduces AdvDetector, a novel method for PDF adversarial sample detection based on Hierarchical Conditional Path Entropy (HCPE) and Sample Perturbation Sensitivity (SPS). AdvDetector employs HCPE to evaluate the confusion degree of parent–child node relationships within the tree structure of a PDF sample. Additionally, it utilizes SPS to assess the fluctuation in prediction confidence of the PDF sample under controlled perturbations. Thus, AdvDetector can effectively identify adversarial PDF samples without impairing the processing of benign ones. Leveraging both HCPE and SPS, AdvDetector assesses the adversariality of the PDF sample. By combining them with the PDF sample’s original prediction confidence, it produces a final detection result. Experimental results validate the effectiveness of AdvDetector and demonstrate its superiority compared to existing methods.