Explainable Detection of Obfuscated Malicious PowerShell Scripts Using CodeBERT, Random Forest, and Multi-Method SHAP Explainable Detection of Obfuscated Malicious PowerShell Scripts Using CodeBERT, Random Forest, and Multi-Method SHAP

This dataset contains the complete supplementary materials for the paper "Explainable Detection of Obfuscated Malicious PowerShell Scripts Using CodeBERT, Random Forest, and Multi-Method SHAP," including source code, trained model weights, and a complete dataset of 20,000 PowerShell scripts.**Data Generation and Processing:**The dataset comprises 20,000 PowerShell scripts (10,000 malicious, 10,000 benign) spanning 16 obfuscation types across four categories: encoding (Base64, hexadecimal, octal, binary, binary XOR, ASCII substitution, SecureString, compression), string manipulation (concatenation, reordering, reversing, tick insertion), helper functions (splitting, replacement, random case), and multi-layer combinations. For each obfuscation type, exactly 625 malicious and 625 benign scripts are included.Scripts were sourced from six public repositories (PowerShell Gallery, GitHub, Invoke-Obfuscation, PowerSploit, MalwareBazaar, VirusTotal), collected between January 2020 and December 2025. Obfuscation was programmatically applied using custom Python scripts, with each transformation validated for functional equivalence to the original script. Quality control included SHA-256 exact-duplicate removal, MinHash near-duplicate filtering (Jaccard similarity > 0.85), UTF-8/UTF-16 encoding validation, and length filtering (50-50,000 characters). No geographical filtering was applied.**File Descriptions:**1. **`code/` folder** – Complete source code for CodeBERT fine-tuning, Random Forest training, five SHAP explanation methods (Frequency SHAP, Attention-Based SHAP, Layer Integrated Gradients, Tree SHAP, Kernel SHAP), validation metrics computation, and the 7-panel SOC analyst dashboard. A `requirements.txt` file and Dockerfile are included for full reproducibility.2. **`model_weights/` folder** – Fine-tuned CodeBERT model weights (3.4 GB), including `pytorch_model.bin`, `config.json`, tokenizer files, and configuration. The model was fine-tuned on a Tesla T4 GPU with a fixed random seed (42). Loading instructions are provided in the README.md file.3. **`dataset/` folder** – Complete dataset of 20,000 PowerShell scripts organized into 16 obfuscation type subfolders (each containing `malicious/` and `benign/` subfolders, each with 625 scripts). A `labels_full.csv` file provides ground truth labels, obfuscation type, and category for all scripts.4. **`supplementary/` folder** – Additional results including confusion matrices for all models, per-obfuscation-type F1 scores, validation metrics (inter-method correlation, faithfulness, stability, MITRE ATT&CK alignment), and SHAP visualizations.**Data Completeness:**No missing data exists. All 20,000 scripts are complete, validated, and fully functional. All scripts are in UTF-8 encoded `.ps1` format, with individual file sizes ranging from 2 KB to 50 KB. The total dataset size is approximately 3.45 GB (including model weights).**Access Restriction:**Due to the sensitive nature of malicious payloads, access to the full 20,000-script dataset is restricted. Bona fide academic researchers may request access by contacting the corresponding author. Users must sign a data usage agreement prohibiting malicious use, redistribution, or commercialization. This access control mechanism ensures responsible data sharing while preventing misuse.**Usage Notes:**This dataset is designed for reproducible evaluation of PowerShell obfuscation detection models. The `labels_full.csv` file enables straightforward integration with machine learning pipelines. To reproduce the experiments, users should install the dependencies in `requirements.txt` and run the provided Python scripts. A Docker container is also available for full reproducibility. Researchers may use this dataset to benchmark detection performance across obfuscation types and to validate explainability methods.**Authors:**- Akberet Tsegay Abebe (Aksum University, Ethiopia; Mekelle University, Ethiopia) — Corresponding Author, ORCID: 0009-0006-8651-576X- Dr. Assefa Tesfay Abreha (Mekelle University, Ethiopia) — Main Advisor- Dr. Shishay Welay Gebregiyorgis (Mekelle University, Ethiopia) — Co-Advisor**License:** Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)**Required Citation:** Abebe, A. T., Abreha, A. T., & Gebregiyorgis, S. W. (2026). Supplementary Materials: Explainable Detection of Obfuscated Malicious PowerShell Scripts [Data set]. Science Data Bank. doi.org DOI] This dataset contains the complete supplementary materials for the paper "Explainable Detection of Obfuscated Malicious PowerShell Scripts Using CodeBERT, Random Forest, and Multi-Method SHAP," including source code, trained model weights, and a complete dataset of 20,000 PowerShell scripts.**Data Generation and Processing:**The dataset comprises 20,000 PowerShell scripts (10,000 malicious, 10,000 benign) spanning 16 obfuscation types across four categories: encoding (Base64, hexadecimal, octal, binary, binary XOR, ASCII substitution, SecureString, compression), string manipulation (concatenation, reordering, reversing, tick insertion), helper functions (splitting, replacement, random case), and multi-layer combinations. For each obfuscation type, exactly 625 malicious and 625 benign scripts are included.Scripts were sourced from six public repositories (PowerShell Gallery, GitHub, Invoke-Obfuscation, PowerSploit, MalwareBazaar, VirusTotal), collected between January 2020 and December 2025. Obfuscation was programmatically applied using custom Python scripts, with each transformation validated for functional equivalence to the original script. Quality control included SHA-256 exact-duplicate removal, MinHash near-duplicate filtering (Jaccard similarity > 0.85), UTF-8/UTF-16 encoding validation, and length filtering (50-50,000 characters). No geographical filtering was applied.**File Descriptions:**1. **`code/` folder** – Complete source code for CodeBERT fine-tuning, Random Forest training, five SHAP explanation methods (Frequency SHAP, Attention-Based SHAP, Layer Integrated Gradients, Tree SHAP, Kernel SHAP), validation metrics computation, and the 7-panel SOC analyst dashboard. A `requirements.txt` file and Dockerfile are included for full reproducibility.2. **`model_weights/` folder** – Fine-tuned CodeBERT model weights (3.4 GB), including `pytorch_model.bin`, `config.json`, tokenizer files, and configuration. The model was fine-tuned on a Tesla T4 GPU with a fixed random seed (42). Loading instructions are provided in the README.md file.3. **`dataset/` folder** – Complete dataset of 20,000 PowerShell scripts organized into 16 obfuscation type subfolders (each containing `malicious/` and `benign/` subfolders, each with 625 scripts). A `labels_full.csv` file provides ground truth labels, obfuscation type, and category for all scripts.4. **`supplementary/` folder** – Additional results including confusion matrices for all models, per-obfuscation-type F1 scores, validation metrics (inter-method correlation, faithfulness, stability, MITRE ATT&CK alignment), and SHAP visualizations.**Data Completeness:**No missing data exists. All 20,000 scripts are complete, validated, and fully functional. All scripts are in UTF-8 encoded `.ps1` format, with individual file sizes ranging from 2 KB to 50 KB. The total dataset size is approximately 3.45 GB (including model weights).**Access Restriction:**Due to the sensitive nature of malicious payloads, access to the full 20,000-script dataset is restricted. Bona fide academic researchers may request access by contacting the corresponding author. Users must sign a data usage agreement prohibiting malicious use, redistribution, or commercialization. This access control mechanism ensures responsible data sharing while preventing misuse.**Usage Notes:**This dataset is designed for reproducible evaluation of PowerShell obfuscation detection models. The `labels_full.csv` file enables straightforward integration with machine learning pipelines. To reproduce the experiments, users should install the dependencies in `requirements.txt` and run the provided Python scripts. A Docker container is also available for full reproducibility. Researchers may use this dataset to benchmark detection performance across obfuscation types and to validate explainability methods.**Authors:**- Akberet Tsegay Abebe (Aksum University, Ethiopia; Mekelle University, Ethiopia) — Corresponding Author, ORCID: 0009-0006-8651-576X- Dr. Assefa Tesfay Abreha (Mekelle University, Ethiopia) — Main Advisor- Dr. Shishay Welay Gebregiyorgis (Mekelle University, Ethiopia) — Co-Advisor**License:** Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0)**Required Citation:** Abebe, A. T., Abreha, A. T., & Gebregiyorgis, S. W. (2026). Supplementary Materials: Explainable Detection of Obfuscated Malicious PowerShell Scripts [Data set]. Science Data Bank. doi.org DOI]