Machine learning powered cloud sandbox for malware detection in portable document format (PDF) files

A computer-implemented method, comprising:

• receiving, by a cloud-based network security system, a request to access a portable document format (PDF) file;
• opening, by the cloud-based network security system, the PDF file in a sandbox of the cloud-based network security system;
• obtaining, by the cloud-based network security system, dynamic information associated with the PDF file in the sandbox, wherein the dynamic information comprises a size of a process tree spawned by the opening the PDF file, wherein the size of the process tree is a count of processes and subprocesses spawned by the opening;
• extracting, by the cloud-based network security system, static information from the PDF file;
• providing, by the cloud-based network security system, the dynamic information and the static information as input to an artificial intelligence model trained to provide an output indicating a prediction of whether the PDF file contains malware based on the input;
• classifying, by a verdict engine of the cloud-based network security system, the PDF file as one of malicious or clean based at least in part on the output of the artificial intelligence model provided as input to the verdict engine;
• and
• implementing, by the cloud-based network security system, a security policy based at least in part on the classification of the PDF file.