license: cc-by-4.0
task_categories:

• tabular-classification
• other
  tags:
• pdf
• malware-detection
• security
• synthetic-data
• eicar
• cybersecurity
  pretty_name: Generated Injected PDFs (Harmless)
  size_categories:
• 1K<n<10K

Generated Injected PDFs — HARMLESS

A synthetic dataset of 1,100 PDF files built for training and evaluating structural PDF-malware detectors. It pairs benign PDFs with PDFs into which safe, non-executable "malware-shaped" objects have been injected, so a model can learn to separate the two from byte-level structure alone.

⚠️ Safety notice — read first

Nothing in this dataset is real malware. Every injected payload is built from industry-standard, non-executable antivirus test markers — EICAR, AMTSO, WICAR, and RanSim-style strings — that are explicitly designed to be harmless. There is no working shellcode, no real exploit, and no executable logic. The injected objects only look like the structural shapes malicious PDFs use (e.g. a /JavaScript action, a /Launch action, an /EmbeddedFile); the actual content is a research test string. These files are safe to store, share, and open, and are intended purely for defensive security research.

1. What's in the dataset

All files live under Output_PDFs/. PDFs only — no executables.

File naming

• Injected: {injection_type}_{framework}_{index:04d}.pdf — e.g. javascript_injection_WICAR_0001.pdf. index runs 0000–0899.
• Clean: the original source hash-style filename, e.g. TW5273JZ43VOQUCL7FRZ2N6STHYBBCQ4.pdf.

The filename encodes the ground truth: the leading token is the injection category, the second is the "framework" family the test marker imitates.

Repository contents

The two feature tables (synthetic_combined_CIC.csv and PDFMalware2022.csv) share identical columns by design, which is what makes the combined table possible.

2. Source material

The clean PDFs are drawn from the public Kaggle corpus manisha717/dataset-of-pdf-files (~1,076 everyday PDFs). These serve two roles: 200 are kept untouched as the benign class, and the rest act as carriers into which the injection pipeline splices its safe payload objects.

3. How the injected files were made

Each injected PDF is produced by an injection pipeline (v2) with three stages: choose an attack shape, generate a safe payload variant with an LLM, then splice it in with randomized structure.

3.1 Injection types (12)

Each injected file imitates the structure of one of these attack families (the semantic marker), without any of the actual malicious behavior:

javascript_injection, cross_site_scripting, ssrf, object_action_injection, llm_prompt_injection, shellcode_embedded_exe, polyglot_file, dde_template_injection, steganographic_payload, ransomware_simulation, xfa_acroform_injection, uri_redirect_phishing.

Each type is tagged with a "framework" label (e.g. AMTSO, WICAR, AtomicRedTeam, Metasploit, Glasswall, RanSim) recorded in the manifest — this is a naming/provenance tag for the test-marker family, not an actual tool being run.

3.2 Safe payload variation (LLM)

The base payloads are the four canonical harmless test strings (EICAR / AMTSO / WICAR / RANSIM). To avoid every file carrying a byte-identical marker, an open-source LLM (Qwen2.5-7B-Instruct) is prompted to produce variations of each base string (re-encoding, casing, spacing, safe prefixes/suffixes) while keeping it non-executable. Generations are passed through a safety filter that strips anything resembling real code. A deterministic rule-based fallback (base64/hex/reverse/etc.) is used if the model is unavailable.

3.3 Randomized structure + obfuscation — the key design decision

This is the most important rationale in the dataset. A naïve injector that always uses the same object IDs, the same insertion point, and the same literal code shape produces data where a detector can hit ~100% accuracy by memorizing those fixed artifacts — and learn nothing that transfers to real malware. To prevent that, every injected file randomizes:

• Object IDs — random distinct IDs per object, not a fixed 999/998 pattern.
• Insertion point — before the final %%EOF, right after the first endobj, or before trailer, so the payload isn't always in the same structural location.
• JS obfuscation strategy (for JS-bearing types) — plain string, String.fromCharCode char-code array, \xNN hex escapes, atob() base64, URL-encoded unescape(), or split-and-concatenated chunks — mirroring how real malicious PDF JavaScript is rarely left in plain readable form.
• Cosmetic variation — PDF comment lines appear in only ~50% of files.

Every structural choice made (insertion_strategy, obfuscation_strategy) is recorded per file in the manifest, so you can audit that a trained detector isn't just keying off one specific variant.

Generation is fully reproducible: each example i uses its own random.Random(SEED + i) with SEED = 42.

3.4 Distributed generation

The 900 injected examples were generated in parallel across 9 machines using the Colab notebook Split_Run_Dataset_Generation_900_Colab.ipynb — run once per machine, each prompted for its computer number (1–9) so it produces a contiguous 100-example slice (0–99, 100–199, …, 800–899). Per-machine JSON outputs (dataset_part<N>.json, injection_manifest_part<N>.json) were then concatenated by index into the combined dataset.

4. Feature extraction (CIC-compatible)

For detector training, a byte-level structural feature extractor computes ~37 features per PDF — object/stream/xref counts, page count, encryption flag, and keyword counts such as /JS, /JavaScript, /OpenAction, /AcroForm, /EmbeddedFile, /Launch, /XFA, /RichMedia, /ObjStm. It works directly on raw bytes (regex counting rather than a strict parser) so it does not choke on the deliberately non-standard structure of the injected files.

These feature names and their value conventions are made column-for-column identical to CIC-Evasive-PDFMal2022 (Class = Malicious/Benign, text = Yes/No, etc.). This is deliberate: it lets this synthetic feature table be concatenated directly with the real CIC malware feature table.

Combining with the official CIC dataset

The real-world half is CIC-Evasive-PDFMal2022, a research dataset from the Canadian Institute for Cybersecurity (UNB) of ~10k real PDFs with 33 pre-extracted static structural features, labeled malicious/benign. It ships as a feature CSV, not raw PDFs — so it cannot be fed through the injector; it belongs one stage downstream, at detector training, as a second labeled table living in the same feature space as ours. It is obtained via the Kaggle mirror kk0105/cicpdfmal2022 and stored here as Datasets/PDFMalware2022.csv.

The merge (Datasets/combined_features.csv) is a straight row-concatenation of the two identically-columned tables, with one added source column:

Why keep the source tag — it turns "more training data" into a validity experiment. With it you can:

• Train on Synthetic + a CIC train split, test on a held-out CIC split only → measures whether the detector generalizes to real malicious structure it never trained on, instead of reporting an inflated in-distribution score on the generator's own style.
• Train on Synthetic alone, test on Real alone (and vice-versa) → directly quantifies the synthetic-to-real domain gap, the central caveat of any synthetic security dataset.

⚠️ Note on the real CIC columns: several are loosely typed (numeric columns contain stray strings like unclear / -1). Coerce/clean them before model training. Our synthetic rows are written cleanly in the same schema.

5. Intended use & limitations

Intended use. Defensive security research: training/benchmarking static PDF-malware classifiers, studying structural feature robustness, and measuring synthetic-vs-real domain gap.

Limitations.

• Injected files carry the structure of an attack, not its behavior — they are for structural/static detection, not dynamic/sandbox analysis.
• Because payloads are harmless test markers, this data does not capture the full byte-level diversity of real-world malicious payloads; treat synthetic-only results as optimistic and validate against real datasets like CIC-Evasive-PDFMal2022.
• The benign carriers come from a single public corpus, so structural diversity of clean PDFs is bounded by that source.
• Labels are generation-ground-truth (1 = injected, 0 = clean), not the verdict of any AV engine.

6. Reproducibility summary

• Base payloads: EICAR / AMTSO / WICAR / RANSIM (harmless test markers)
• LLM: Qwen/Qwen2.5-7B-Instruct (with rule-based fallback)
• Seed: 42 (per-example random.Random(SEED + index))
• Source PDFs: manisha717/dataset-of-pdf-files (Kaggle)
• Real-world comparison set: CIC-Evasive-PDFMal2022 (downloaded separately)

7. Licensing note

The dataset card is offered under CC-BY-4.0, but parts of the data derive from third parties:

• The carrier PDFs derive from the Kaggle corpus manisha717/dataset-of-pdf-files — review and respect its terms for redistribution or commercial use.
• Datasets/PDFMalware2022.csv and the Real rows of Datasets/combined_features.csv are the CIC-Evasive-PDFMal2022 dataset, © Canadian Institute for Cybersecurity, UNB. Its use requires citing UNB's work and is subject to their terms — see the CIC dataset page. It is included here only to support the real-vs-synthetic evaluation described in §4.
• The injected markers themselves (EICAR / AMTSO / WICAR / RanSim) are public, free-to-use test strings.

If redistribution of the third-party CIC feature table is a concern for your use, delete PDFMalware2022.csv and combined_features.csv and regenerate combined_features.csv locally from your own CIC download.