Explainable PDF Malware Detection
PUBLIC DOCUMENT VERIFIEDSecurity ML / explainability study with a verified public project report. Not production malware infrastructure.
- malware detection
- explainability
- security ML
Explainable PDF Malware Detection
Security ML / explainability study with a verified public project report. Not production malware infrastructure.
Project Autopsy
Inspection lenses
Same project, six engineering perspectives. Switching lenses keeps RUN and X-RAY mounted so lab/scrubber state is not wiped.
Deterministic Runtime Lab — PORTFOLIO_EXTENSION. Prefer this lens over a separate route when you want lab state to survive inspection switches.
Static feature controls
Toggle study-oriented PDF static features. No file is uploaded and no malware is executed — this is a deterministic reconstruction surface.
Explainability reconstruction
Study signal · 0.50 · Moderate reconstructed study signal (static features only).
Not a security verdict. Not a live classifier output.
| Feature | Enabled | Contribution |
|---|---|---|
| JavaScript present | on | 0.28 |
| OpenAction / automatic action | on | 0.22 |
| Embedded files | off | 0.00 |
| AA (additional actions) | off | 0.00 |
| RichMedia annotations | off | 0.00 |
| Launch action | off | 0.00 |
Project X-Ray — responsibility layers with isolation, component selection, and Source Trace. Causal reconstruction (M9) remains below.
Malware Project X-Ray remains report/study framing — Explainability Lab RUN is the M13 inspection surface. LIMITED_EVIDENCE SHAP detail stays honest on EVIDENCE.
Engineering decisions grounded in public evidence — not a fabricated post-mortem diary.
Ground explainability claims in the public project report
PUBLIC DOCUMENT VERIFIEDThe verified public PDF report is the primary document evidence for the explainability study — not invented production malware infrastructure.
Keep detailed SHAP / model internals LIMITED_EVIDENCE
LIMITED EVIDENCEWhere direct public verification of detailed model/SHAP internals is incomplete, the evidence state stays limited rather than upgraded.
Label the browser Explainability Lab as PORTFOLIO_EXTENSION
PORTFOLIO EXTENSIONStatic feature reconstruction is a portfolio lab — no malware execution, no file upload, and no live classifier verdict presented as truth.
Artifact-grade publication gate
Exhibits appear here only when they clear the evidence gate. Future renderer is ready; the canonical dataset is currently empty.
- At least one artifact-grade source (SHA-pinned GitHub file/repo, public report URL, or project artifact URL).
- Every claimed metric cites an artifact on the same exhibit.
- Evidence state must not be NOT_DEMONSTRATED or PORTFOLIO_EXTENSION for published exhibits.
- No remembered outage theatre or reconstructed failure story without original artifacts.
Evidence
Explainable PDF Malware Detection — flagship
PUBLIC DOCUMENT VERIFIEDPublic malware explainability report
PUBLIC DOCUMENT VERIFIEDDetailed SHAP / model internals
LIMITED EVIDENCEDetailed model/SHAP claims remain limited where direct public source verification is incomplete.
Browser PDF Malware Explainability Lab
PORTFOLIO EXTENSIONDeterministic static-feature explainability reconstruction grounded in the public report — no malware execution, no file upload, not a live classifier verdict.
- Explainable Machine Learning Models for Detecting PDF Malware (public PDF)@ca79ecc
- Malware-Detection-Using-ML repository@ca79ecc
- Portfolio PDF Malware Explainability Lab (deterministic extension)
PORTFOLIO_EXTENSION — browser explainability reconstruction grounded in the public malware report; no execution, no upload, not a live classifier.