Malware Detection on Byte Streams of Hangul Word Processor Files
Source abstract
Abstract
While the exchange of data files or programs on the Internet grows exponentially, most users are vulnerable to infected files, especially to malicious non-executables. Due to the circumstances between South and North Korea, many malicious actions have recently been found in Hangul Word Processor (HWP) non-executable files because the HWP is widely used in schools, military facilities, and government institutions of South Korea. The HWP file usually has one or more byte streams that are often used for the malicious actions. Based on an assumption that infected byte streams have particular patterns, we design a convolutional neural network (CNN) to grasp such patterns. We conduct experiments on our prepared 534 HWP files, and demonstrate that the proposed CNN achieves the best performance compared to other machine learning models. As new malicious attacks keep emerging, we will keep collecting such HWP files and investigate better model structures.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
SCH Media Labs, Soonchunhyang University, Asan 31538, Korea
References (27)
Show source-provided references
1. A Tutorial on Support Vector Machines for Pattern Recognition10.1023/A:1009715923555 ↗
2. Random Forests10.1023/A:1010933404324 ↗
3. Medsker, L., and Jain, L.C. (1999). Recurrent Neural Networks: Design and Applications, CRC Press.10.1201/9781420049176 ↗
4. Gradient-Based Learning Applied to Document Recognition10.1109/5.726791 ↗
5. Hidost: A static machine-learning-based detector of malicious files
6. Cuan, B., Damien, A., Delaplace, C., and Valois, M. (2018, January 26–28). Malware Detection in PDF Files Using Machine Learning. Proceedings of the 15th International Conference on Security and Cryptography, Porto, Portugal.10.5220/0006884704120419 ↗
7. Smutz, C., and Stavrou, A. (2012, January 3–7). Malicious PDF detection using metadata and structural features. Proceedings of the 28th Annual Computer Security Applications Conference, Orlando, FL, USA.10.1145/2420950.2420987 ↗
8. Li, M., Liu, Y., Yu, M., Li, G., Wang, Y., and Liu, C. (2017, January 1–4). FEPDF: A Robust Feature Extractor for Malicious PDF Detection. Proceedings of the IEEE International Conference on Trust, Security and Privacy in Computing and Communications, Sydney, Australia.10.1109/Trustcom/BigDataSE/ICESS.2017.240 ↗
9. Simonyan, K., and Zisserman, A. (2015, January 7–9). Very Deep Convolutional Networks for Large-Scale Image Recognition. Proceedings of the 3rd International Conference on Learning Representations, San Diego, CA, USA.
10. Kim, H., and Jeong, Y.S. (2019). Sentiment Classification Using Convolutional Neural Networks. Appl. Sci., 9.10.3390/app9112347 ↗
11. Luong, T., Pham, H., and Manning, C.D. (2015, January 17–21). Effective Approaches to Attention-based Neural Machine Translation. Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, Lisbon, Portugal.10.18653/v1/D15-1166 ↗
12. Kolosnjaji, B., Zarras, A., Webster, G., and Eckert, C. (2016, January 5–8). Deep Learning for Classification of Malware System Call Sequences. Proceedings of the 29th Australasian Joint Conference on Artificial Intelligence, Hobart, Australia.10.1007/978-3-319-50127-7_11 ↗
13. Long Short-Term Memory10.1162/neco.1997.9.8.1735 ↗
14. Huang, W., and Stokes, J.W. (2016, January 7–8). MtNet: A Multi-Task Neural Network for Dynamic Malware Classification. Proceedings of the 13th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, San Sebastián, Spain.10.1007/978-3-319-40667-1_20 ↗
15. Zhou, H. (2018, January 14–16). Malware Detection with Neural Network Using Combined Features. Proceedings of the China Cyber Security Annual Conference, Beijing, China.10.1007/978-981-13-6621-5_8 ↗
16. Malware Detection Based on Deep Learning of Behavior Graphs10.1155/2019/8195395 ↗
17. Stacked Denoising Autoencoders: Learning Useful Representations in a Deep Network with a Local Denoising Criterion
18. Raff, E., Sylvester, J., and Nicholas, C. (2017, January 3). Learning the PE Header, Malware Detection with Minimal Domain Knowledge. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Dallas, TX, USA.10.1145/3128572.3140442 ↗
19. Saxe, J., and Berlin, K. (2015, January 20–22). Deep neural network based malware detection using two dimensional binary program features. Proceedings of the 10th International Conference on Malicious and Unwanted Software, Fajardo, PR, USA.10.1109/MALWARE.2015.7413680 ↗
20. Deep learning at the shallow end: Malware classification for non-domain experts10.1016/j.diin.2018.04.024 ↗
21. Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C. (2018, January 2–3). Malware detection by eating a whole EXE. Proceedings of the Workshops of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.
22. Malware Detection on Byte Streams of PDF Files Using Convolutional Neural Networks10.1155/2019/8485365 ↗
23. Dropout: A simple way to prevent neural networks from overfitting
24. Kingma, D.P., and Ba, J. (2015, January 7–9). Adam: A Method for Stochastic Optimization. Proceedings of the 3rd International Conference on Learning Representations, San Diego, CA, USA.
25. Cogswell, M., Ahmed, F., Girshick, R.B., Zitnick, L., and Batra, D. (2016, January 2–4). Reducing Overfitting in Deep Networks by Decorrelating Representations. Proceedings of the 4th International Conference on Learning Representations, San Juan, Puerto Rico.
26. He, K., Zhang, X., Ren, S., and Sun, J. (2015, January 7–13). Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification. Proceedings of the 2015 IEEE International Conference on Computer Vision, Santiago, Chile.10.1109/ICCV.2015.123 ↗
27. Ioffe, S., and Szegedy, C. (2015, January 6–11). Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. Proceedings of the 32nd International Conference on Machine Learning, Lille, France.