An Intelligent Automated PDF Analyser for Detecting Embedded Threats Using Static Analysis, VirusTotal, and AI-Powered Insights

Abstract

The widespread adoption of Portable Document Format (PDF) files across industries has also made them a common vector for cyber threats, including malware distribution, phishing, and data exfiltration. This study presents the design, development, and evaluation of an intelligent automated PDF threat detection tool that combines static analysis, threat intelligence integration, and AI-powered contextual recommendations. Built using a Design Science Research (DSR) methodology, the tool incorporates five core modules: text extraction, JavaScript threat detection, metadata analysis, VirusTotal API integration, and an OpenAI-driven mitigation engine. A benchmark dataset of 100 PDF files comprising 50 malicious and 50 benign samples was used to evaluate the system. The analyser achieved a 94.2% detection accuracy, 92.6% precision, and a false positive rate of just 5.8%, outperforming traditional static analysis tools. During testing, the tool successfully processed batches of up to 100 PDFs with minimal latency, demonstrating promising scalability for operational use. Integration with large language models (LLMs) significantly enhanced threat interpretability and response guidance, making the tool not only accurate but also practical for cybersecurity workflows. This research contributes a modular, scalable, and intelligent framework that bridges PDF static inspection with AI-driven contextual awareness, an advancement that addresses critical gaps in existing PDF threat detection systems and offers potential for real-world deployment.