Deep Defense Against Mal-Doc: Utilizing Transformer and SeqGAN for Detecting and Classifying Document Type Malware
Source abstract
Abstract
The prevalence of non-executable malware is on the rise, presenting a major threat to users, including major public institutions and corporations. While extensive research has been conducted on detecting malware threats, there is a noticeable gap in studying document-type malware compared with executable files. The proposed model will solve this gap by detecting and classifying document-type malware families using script codes, including tags, to write documents and script languages to execute malicious functions. These script codes offer insights into how the malware was constructed and operates on the victim’s system. Additionally, we leverage language models in our approach. Initially, we develop MalCode2Vec to learn associations between source codes and represent them as numeric vectors. Subsequently, we design a Transformer-based model for document malware detection and family classification. Detection is conducted at both the stream and file levels. To solve the class imbalance issue in the malware family, we utilize a generative adversarial network to generate malware samples. Our experimental domain focuses on the Hangul (Korean) word processor, a tool notably used by North Korea in targeting the South Korean government.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Future Convergence Technology, Soonchunhyang University, Asan 31538, Republic of Korea
Electronics and Telecommunications Research Institute, Daejeon 34129, Republic of Korea
Department of Information Security, Sejong University, Seoul 05006, Republic of Korea
Department of Computer Engineering, Chungbuk National University, Cheongju 28644, Republic of Korea
Department of Information Security, PaiChai University, Daejeon 35345, Republic of Korea
Funding
Korean government (MSIT) · Ministry of Education · Soonchunhyang University Research Fund
References (39)
Show source-provided references
1. Malware detection in pdf and office documents: A survey10.1080/19393555.2020.1723747 ↗
2. Fileless cyberattacks: Analysis and classification10.4218/etrij.2020-0086 ↗
3. SonicWall (2023). 2023 Sonicwall Cyber Threat Report, SonicWall.
4. Cybercrimes during COVID-19 Pandemic
5. COVID-19 pandemic cybersecurity issues10.1002/itl2.247 ↗
6. Mainka, C., Mladenov, V., and Rohlmann, S. (2021, January 21–24). Shadow Attacks: Hiding and Replacing Content in Signed PDFs. Proceedings of the 2019 Network and Distributed System Security Symposium, Internet Society, San Diego, CA, USA.10.14722/ndss.2021.24117 ↗
7. Kim, M.h. (2022). North korea’s cyber capabilities and their implications for international security. Sustainability, 14.10.3390/su14031744 ↗
8. Polito, C. (2023, May 17). The Evolution of North Korean Cyber Threats. Available online: https://www.jstor.org/stable/pdf/resrep20679.pdf.
9. Malicious code classification based on opcode sequences and textCNN network
10. Obfuscation detection in android applications using deep learning
11. Ito, R., and Mimura, M. (2019, January 1–2). Detecting unknown malware from ASCII strings with natural language processing techniques. Proceedings of the 2019 14th Asia Joint Conference on Information Security (AsiaJCIS), Kobe, Japan.10.1109/AsiaJCIS.2019.00-12 ↗
12. Rahali, A., and Akhloufi, M.A. (2023). MalBERTv2: Code Aware BERT-Based Model for Malware Identification. Big Data Cogn. Comput., 7.10.3390/bdcc7020060 ↗
13. Mikolov, T., Chen, K., Corrado, G., and Dean, J. (2013). Efficient estimation of word representations in vector space. arXiv.
14. Boosting training for PDF malware classifier via active learning10.1002/int.22451 ↗
15. Laskov, P., and Šrndić, N. (2011, January 5–9). Static detection of malicious JavaScript-bearing PDF documents. Proceedings of the 27th Annual Computer Security Applications Conference, Orlando, FL, USA.10.1145/2076732.2076785 ↗
16. Al-Taharwa, I.A., Lee, H.M., Jeng, A.B., Wu, K.P., Mao, C.H., Wei, T.E., and Chen, S.M. (2012, January 25–27). Redjsod: A readable javascript obfuscation detector using semantic-based analysis. Proceedings of the 2012 IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications, Liverpool, UK.10.1109/TrustCom.2012.235 ↗
17. Stokes, J.W., Agrawal, R., McDonald, G., and Hausknecht, M. (2019, January 12–14). Scriptnet: Neural static analysis for malicious javascript detection. Proceedings of the MILCOM 2019-2019 IEEE Military Communications Conference (MILCOM), Norfolk, VA, USA.10.1109/MILCOM47813.2019.9020870 ↗
18. Malware detection on byte streams of pdf files using convolutional neural networks10.1155/2019/8485365 ↗
19. Jeong, Y.S., Woo, J., Lee, S., and Kang, A.R. (2020). Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Pooling. Sensors, 20.10.3390/s20185265 ↗
20. Jeong, Y.S., Mswahili, M.E., and Kang, A.R. (2023). File-level malware detection using byte streams. Sci. Rep., 13.10.1038/s41598-023-36088-2 ↗
21. Corona, I., Maiorca, D., Ariu, D., and Giacinto, G. (2014, January 7). Lux0r: Detection of malicious pdf-embedded javascript code through discriminant analysis of api references. Proceedings of the 2014 Workshop on Artificial Intelligent and Security Workshop, Scottsdale, AZ, USA.10.1145/2666652.2666657 ↗
22. Detection of malicious javascript on an imbalanced dataset10.1016/j.iot.2021.100357 ↗
23. Choi, S., Bae, J., Lee, C., Kim, Y., and Kim, J. (2020). Attention-based automated feature extraction for malware analysis. Sensors, 20.10.3390/s20102893 ↗
24. Static Malware Detection Using Stacked BiLSTM and GPT-210.1109/ACCESS.2022.3179384 ↗
25. Rahali, A., and Akhloufi, M.A. (2021, January 17–20). MalBERT: Malware Detection using Bidirectional Encoder Representations from Transformers. Proceedings of the 2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Melbourne, Australia.10.1109/SMC52423.2021.9659287 ↗
26. HWP Malware Detection using Transformer
27. Attention is all you need
28. Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. Generative Adversarial Nets. Proceedings of the Advances in Neural Information Processing Systems.
29. Yu, L., Zhang, W., Wang, J., and Yu, Y. (2017, January 4–9). Seqgan: Sequence generative adversarial nets with policy gradient. Proceedings of the AAAI Conference on Artificial Intelligence, San Francisco, CA, USA.10.1609/aaai.v31i1.10804 ↗
30. Long short-term memory10.1162/neco.1997.9.8.1735 ↗
31. Malware detection method based on image analysis and generative adversarial networks10.1002/cpe.7170 ↗
32. Nair, V., and Hinton, G.E. (2010, January 21–24). Rectified linear units improve restricted boltzmann machines. Proceedings of the ICML, Haifa, Israel.
33. Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv.
34. Wager, S., Wang, S., and Liang, P. (2013). Dropout training as adaptive regularization. arXiv.
35. Mohammed, R., Rawashdeh, J., and Abdullah, M. (2020, January 7–9). Machine Learning with Oversampling and Undersampling Techniques: Overview Study and Experimental Results. Proceedings of the 2020 11th International Conference on Information and Communication Systems (ICICS), Irbid, Jordan.10.1109/ICICS49469.2020.239556 ↗
36. Learning from imbalanced data10.1109/TKDE.2008.239 ↗
37. Jeong, Y.S., Woo, J., and Kang, A.R. (2019). Malware detection on byte streams of hangul word processor files. Appl. Sci., 9.10.1155/2019/8485365 ↗
38. Adversarial examples: Opportunities and challenges
39. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (May, January 30). Towards deep learning models resistant to adversarial attacks. Proceedings of the International Conference on Learning Representations, Vancouver, BC, Canada.