ErenAta00/turkish-phishsoc-50k

Turkish PhishSOC-50K

Turkish PhishSOC-50K is a synthetic Turkish phishing and SOC-reasoning dataset for defensive email-security research. It is designed for models that classify emails, identify observable security indicators, explain the decision, and recommend a SOC action.

All examples are defanged. Domains use .example.invalid; the dataset contains no real people, organizations, live URLs, real attachments, operational phishing infrastructure, or real OSINT.

Summary

Purpose

This dataset is built for Turkish defensive cybersecurity workflows where a model should do more than output benign or malicious.

It supports:

• —phishing and benign email classification,
• —SOC-style rationale generation,
• —observable indicator extraction,
• —recommended-action prediction,
• —supervised fine-tuning,
• —DPO/preference optimization,
• —shortcut-learning and hard-negative evaluation.

Files

data/
  master_train.jsonl
  master_validation.jsonl
  sft_train_messages.jsonl
  sft_validation_messages.jsonl
  dpo_train.jsonl
  dpo_validation.jsonl

README.md

Format

The master records include:

• —label
• —attack_vector
• —risk_level
• —cognitive_vector
• —context_input
• —input_text
• —email_surface
• —soc_answer
• —quality_annotations

The SFT export uses chat-style messages. The DPO export uses prompt, chosen, and rejected preference pairs aligned to the same underlying examples.

Fine-Tuning Readiness

The dataset can be used directly with JSON-aware loaders such as datasets.load_dataset("json", ...).

• —For SFT, use data/sft_train_messages.jsonl and data/sft_validation_messages.jsonl.
• —For DPO, use data/dpo_train.jsonl and data/dpo_validation.jsonl.
• —The escaped quotes and newline markers shown in the Hugging Face Data Viewer are normal JSON string rendering, not a training issue.
• —The assistant targets are structured JSON strings by design, so the model learns to return parseable SOC decisions.

Quick Load

from datasets import load_dataset

dataset = load_dataset(
    "json",
    data_files={
        "train": "data/master_train.jsonl",
        "validation": "data/master_validation.jsonl",
    },
)

Quality Control

The release passed local checks for:

• —split integrity and leakage,
• —annotation consistency,
• —shortcut-heavy feature balance,
• —lexical diversity,
• —DPO rejected-answer calibration,
• —hard-negative coverage,
• —defanged safety constraints.

Final deep QC reports zero blocker, major, and minor issues. One non-blocking watch note remains: two large benign vectors, Legitimate-HR and Legitimate-IT, have higher intra-vector lexical similarity than the rest of the set.

Intended Use

Allowed:

• —defensive phishing detection research,
• —Turkish SOC-assistant training,
• —SFT/LoRA and DPO experiments,
• —controlled academic benchmarking.

Not allowed:

• —phishing campaign generation,
• —credential harvesting,
• —targeting real people or organizations,
• —live-domain phishing simulation,
• —offensive social-engineering automation.

Limitations

This is a synthetic dataset. It should not be used as proof of real inbox performance by itself. Real-world transfer should be measured with a separate anonymized out-of-distribution benchmark.

License

Released under CC BY-NC 4.0.

Citation

@misc{turkish_phishsoc_50k_2026,
  title = {Turkish PhishSOC-50K: A Synthetic Turkish Phishing and SOC Reasoning Dataset},
  year = {2026},
  language = {Turkish},
  note = {Defanged synthetic defensive cybersecurity dataset with master, SFT, and DPO exports}
}