StegPDF-21 is a benchmark dataset developed for machine learning-based PDF steganography detection. The dataset consists of clean and steganographic PDF documents generated using multiple information-hiding techniques and is intended to support research in:
- PDF Steganalysis
- Digital Forensics
- Cybersecurity
- Document Security
- Explainable Artificial Intelligence (XAI)
- Machine Learning Benchmarking
Unlike image and audio steganography, publicly available benchmark datasets for PDF steganography are extremely limited. StegPDF-21 addresses this gap by providing engineered feature representations extracted from PDF document structures.
Computer Science — Cybersecurity, PDF Steganography Detection, and Machine Learning
| Item | Description |
|---|---|
| Subject | Computer Science — Cybersecurity, PDF Steganography Detection, and Machine Learning |
| Type of data | Table (CSV dataset), figures, and graphs |
| Data collection | Raw and processed data |
| Data format | PDF documents; CSV file containing extracted numerical features |
| Data source | A publicly available PDF testing set (PDF Association Stressful Corpus) was used to generate the dataset. Approximately 32,500 PDFs from six TAR archives were the starting point. After removing corrupted, encrypted, malformed, and duplicate files using Python scripts, about 20,000 valid PDFs remained. Ten thousand of these were selected as the initial collection of valid PDFs. Eight document steganography algorithms and three payload variations were used to create stego variants. Python packages such as NumPy, Pandas, SciPy, and PyPDF2 were used to extract the features. |
| Data accessibility | Repository name: StegPDF-21: A Feature-Engineered Dataset for PDF Steganography Detection. Data identification number: 10.17632/pfvvrydk96.2. Direct URL to data: data.mendeley.com/datasets/pfvvrydk96/2 |
| Resource | Link |
|---|---|
| Primary data source repository (PDF Association Stressful Corpus) | labs.pdfa.org/stressful-corpus |
| Feature dataset (Mendeley Data) | data.mendeley.com/datasets/pfvvrydk96/2 |
| PDF document repository (Zenodo) | doi.org/10.5281/zenodo.20256786 |
The feature dataset is provided in CSV format, where each row corresponds to a PDF document and includes:
- A unique file identifier (e.g.,
PDF_00001) - 21 extracted features
- A binary class label (
0= clean PDF,1= steganographic PDF)
Each row in the CSV dataset is linked to its corresponding PDF document through this unique file identifier, enabling direct traceability between the feature dataset and the original PDF files. The corresponding clean and steganographic PDF documents are provided separately through the Zenodo repository to facilitate reproducibility, feature verification, and future PDF steganalysis research.
| Property | Value |
|---|---|
| Dataset Name | StegPDF-21 |
| Total Samples | 19,372 |
| Clean PDFs | 9,621 |
| Stego PDFs | 9,751 |
| Engineered Features | 25 |
| Classes | 2 |
| Labels | Clean (0), Stego (1) |
StegPDF-21/
│
├── extraction.py
├── stego_generation.py
├── README.md
├── LICENSE
Stego PDF documents were generated using multiple embedding strategies:
- Metadata Hiding
- Invisible (White) Text Insertion
- Text Spacing Manipulation
- Zero-Width Unicode Characters
- PDF Comment Injection
- Unused PDF Objects
- Stream Padding
- Embedded Image Steganography
The dataset contains 25 engineered features extracted from each PDF document.
- File Size
- Page Count
- Object Count
- Average Objects per Page
- Orphan Object Count
- Orphan Object Depth
- Unused Object Ratio
- Cross Reference Gap Score
- Structural Complexity Score
- Page Object Distribution Entropy
- Metadata Length
- Metadata Key Count
- Custom Metadata Key Count
- Metadata Value Entropy
- Zero Width Unicode Density
- Invisible Text Ratio
- Character Spacing Deviation
- Whitespace Run Variance
- Text-to-Nontext Ratio
- Comment Object Count
- Comment Length Ratio
- Padding Byte Ratio
- Image Count
- Image Entropy Delta
- Image Size Anomaly
The repository provides an automated feature extraction pipeline:
PDF Document
│
▼
PDF Parsing
│
▼
Metadata Analysis
│
▼
Structure Analysis
│
▼
Text Analysis
│
▼
Image Analysis
│
▼
Feature Engineering
│
▼
CSV Dataset
The dataset was evaluated using representative machine learning classifiers.
| Classifier | Accuracy | Precision | Recall | F1-score | ROC-AUC |
|---|---|---|---|---|---|
| Logistic Regression | 0.6487 | 0.6459 | 0.6688 | 0.6572 | 0.7111 |
| Gaussian Naïve Bayes | 0.6024 | 0.6838 | 0.3910 | 0.4975 | 0.6901 |
| Support Vector Machine | 0.7428 | 0.7685 | 0.6999 | 0.7326 | 0.8239 |
| Random Forest | 0.7978 | 0.8137 | 0.7761 | 0.7945 | 0.8799 |
| XGBoost | 0.8109 | 0.8290 | 0.7867 | 0.8073 | 0.8900 |
| LightGBM | 0.8083 | 0.8302 | 0.7785 | 0.8035 | 0.8922 |
The benchmark experiments followed a standardized evaluation protocol:
- Stratified 70:30 Train-Test Split
- Stratified 5-Fold Cross Validation
- Optuna Hyperparameter Optimization
- Median Pruner
- Independent Test Evaluation
Performance metrics include:
- Accuracy
- Precision
- Recall
- F1-score
- ROC-AUC
Python ≥ 3.10
Required packages:
numpy
pandas
PyPDF2
pikepdf
scikit-learn
xgboost
lightgbm
optuna
joblib
matplotlib
seaborn
Install dependencies:
pip install -r requirements.txtpython stego_generation.pypython extraction.pyThe extracted features are automatically stored as:
output/features_25_FINAL.csv
StegPDF-21 can be used for:
- PDF Steganography Detection
- Machine Learning Research
- Digital Forensics
- Cybersecurity Research
- Explainable AI
- Benchmark Dataset Evaluation
- Feature Selection
- Classification Research
If you use this dataset in your research, please cite:
Amaan Hamid et al.
StegPDF-21: A Benchmark Dataset for PDF Steganography Detection.
Data in Brief.
(Under Review)
This project is licensed under the Apache License 2.0.
See the LICENSE file for details.
Mohd. Amaan Hamid
M.Sc. Cyber Security Researcher
Research Interests:
- PDF Steganography
- Digital Forensics
- Machine Learning
- Explainable AI
- Cybersecurity
GitHub: github.com/amn2905
This dataset was developed to facilitate reproducible research in PDF steganography detection and digital document forensics by providing a standardized benchmark for evaluating machine learning models.