Benign and Malicious PDF Detection
Turning PDFs into binary visualizations and training a CNN to tell malicious from benign.
PDFs are a durable malware delivery vector because the format is large enough to hide things in — embedded JavaScript, malformed objects, obfuscated streams. Signature-based scanning catches what it already knows about; the interesting question is whether the shape of a file gives it away.
This project treats the problem visually. Each PDF’s raw bytes are rendered as a binary visualization, turning a file into an image, and a CNN is trained to classify those images as benign or malicious. Structural regularities — where entropy clusters, how sections are laid out — become visual texture the network can learn, without parsing the format or knowing anything about a specific exploit.
