RIT-PDFMal-2026: A Comprehensive Benchmark Dataset for PDF Malware Detection

Portable Document Format (PDF) has gained rapid popularity in the past two decades due to its platform-independence, and portability. A ingle PDF file can contain all the elements needed to convey a document in a fixed format, such as text, images, and fonts. This popularity made PDF documents an important attack vector for malicious activity. In this paper, we present a carefully curated comprehensive benchmark dataset for PDF malware detection. The dataset capture a large number of real-life malicious samples, and benign samples to build a 24,337-sample dataset suitable for training and testing of machine learning-based malicious PDF detection systems. The work also presents an extended set of features extracted statically from PDF files to support the detection process. The presented dataset was used in training and testing of a pipeline of different machine learning classifiers. Testing results showed that the extreme gradioent-boost classifeir was capable of detecting malicious PDF with F1 score exceeding 0.99. The model also performed similarly well in 10-fold cross validation. Additionally, the model was explained using Shapley additive explanation to ensure the model’s transparency and increase confidence and ensure the alignment of the classifier decision with human experience.