Malware Detection on Byte Streams of Hangul Word Processor Files

Abstract

While the exchange of data files or programs on the Internet grows exponentially, most users are vulnerable to infected files, especially to malicious non-executables. Due to the circumstances between South and North Korea, many malicious actions have recently been found in Hangul Word Processor (HWP) non-executable files because the HWP is widely used in schools, military facilities, and government institutions of South Korea. The HWP file usually has one or more byte streams that are often used for the malicious actions. Based on an assumption that infected byte streams have particular patterns, we design a convolutional neural network (CNN) to grasp such patterns. We conduct experiments on our prepared 534 HWP files, and demonstrate that the proposed CNN achieves the best performance compared to other machine learning models. As new malicious attacks keep emerging, we will keep collecting such HWP files and investigate better model structures.

Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Pooling

“…Their CNN model achieved an F1 score of 98.48–98.65%, which was superior to other machine learning models. In [ 3 ], a CNN model was proposed for malware detection of HWP files, wherein the input length is assumed to be 600 bytes. This was the first study of malware detection for HWP files using only byte streams, and achieved an F1 score of 93.33–93.45%.…”

“…The previous studies that applied a CNN model to byte streams were successful in some sense, but may not be useful when the byte streams are very long. For example, we may have to run the model proposed in [ 3 ] numerous times (about hundreds times) to make a decision for a single file. Indeed, we found that the mean stream length of PDF files of [ 6 ] is about 600, whereas the mean stream length of HWP files used in [ 3 ] is about 350,000–710,000 with a standard deviation of 2,000,000–4,000,000.…”

“…For example, we may have to run the model proposed in [ 3 ] numerous times (about hundreds times) to make a decision for a single file. Indeed, we found that the mean stream length of PDF files of [ 6 ] is about 600, whereas the mean stream length of HWP files used in [ 3 ] is about 350,000–710,000 with a standard deviation of 2,000,000–4,000,000. This implies that we may need to run the model of [ 3 ] about 580–1180 times for each byte stream, as it is assumed that the input length is 600 bytes.…”

“…The malicious HWP files contain byte streams of executable code, shell code, or script code. The byte streams with malicious actions convey different patterns compared to benign byte streams, so it is possible to detect malware by analyzing the byte stream patterns as described in [ 3 ].…”

“…Some studies used deep learning models to extract meaningful features from byte streams to accurately detects malicious actions. These studies have a common limitation in that their models are not efficient [ 3 , 5 , 6 , 7 ]. That is, the models are often too complex, so they take a long time to analyze numerous suspicious files.…”