Benign and Malicious PDF Detection
Turning PDFs into binary visualizations and training a CNN to tell malicious from benign.
PDFs are a durable malware delivery vector because the format is large enough to hide things in such as embedded JavaScript, malformed objects, obfuscated streams. Signature-based scanning catches what it already knows about. I explored whether the shape of a file gives it away.
This project treats the problem visually. Each PDF’s raw bytes are rendered as a binary visualization, turning a file into an image, and a CNN is trained to classify those images as benign or malicious. Structural regularities, where entropy clusters, and how sections are laid out become visual texture the network can learn, without parsing the format or knowing anything about a specific exploit.
