In today’s digital era of constant information sharing, ensuring the authenticity and integrity of digital documents—particularly portable document format (PDF) files—has become increasingly important. This paper introduces a watermarking scheme for PDF files by embedding quick response (QR) codes into the spatial domain of text color. The method takes a PDF and a QR code as input, resizing the QR code to match the length of the text on each page. The embedding process incorporates Arnold’s transformation and a permutation equal to the QR code’s size to secure both embedding and extraction. The QR code is applied by slightly altering the color of specific text characters that correspond to black pixels in the QR code image, achieving spatial-domain watermarking without degrading visual quality. Experimental evaluation demonstrates the method’s robustness against various attacks, with the watermarked PDFs achieving an average Peak Signal-to-Noise Ratio (PSNR) of 57.6 dB and Structural Similarity Index (SSIM) of 0.99. The extracted QR codes maintain PSNR values above 68.8 dB and SSIM equal to 1 after common processing attacks. The scheme also effectively detects malicious tampering, proving the potential of the proposed watermarking scheme in the protection of PDF files.

In this paper we present a graph-based framework that, utilizing relations between groups of System-calls, detects whether an unknown software sample is malicious or benign, and classifies a malicious software to one of a set of known malware families. In our approach we propose a novel graph representation of dependency graphs by capturing their structural evolution over time constructing sequential graph instances, the so-called Temporal Graphs. The partitions of the temporal evolution of a graph defined by specific time-slots, results to different types of graphs representations based upon the information we capture across the capturing of its evolution. The proposed graph-based framework utilizes the proposed types of temporal graphs computing similarity metrics over various graph characteristics in order to conduct the malware detection and classification procedures. Finally, we evaluate the detection rates and the classification ability of our proposed graph-based framework conducting a series of experiments over a set of known malware samples pre-classified into malware families.