Efficient Malware Detection in HWP Byte Sequences Using Pooling-Based Model
Source abstract
Abstract
As data exchange over wired and wireless networks continues to increase, the damage caused by malicious activities hidden in the data is also rising. In particular, malicious actions embedded in document files (e.g., PDF, HWP) are not only difficult to detect, but users are often careless when opening such files, making them highly vulnerable to malicious actions in documents. This study proposes a novel deep learning model that directly analyzes byte sequences to detect malicious actions embedded in HWP documents. Most previously proposed detection models have relied on convolutional neural networks, whereas our model uses no convolutional layers and employs two pooling layers instead. For the experiments, we constructed a new dataset by sampling byte sequences from HWP files, and our model achieved a 63.54% macro F1 score that is better than other existing models. This result demonstrates that our model is not only efficient but also achieves higher malware detection performance, implying that our model is more practical for real-world malware detection services, as we encounter numerous document files in everyday use.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Spam and Phishing Detection · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Engineering, Chungbuk National University, Cheongju 28644, Republic of Korea
Funding
the Ministry of Education
References (31)
Show source-provided references
1. Piersigilli, P., Citroni, R., Mangini, F., and Frezza, F. (2025). Electromagnetic Techniques Applied to Cultural Heritage Diagnosis: State of the Art and Future Prospective: A Comprehensive Review. Appl. Sci., 15.10.3390/app15126402 ↗
2. A Tutorial on Support Vector Machines for Pattern Recognition10.1023/A:1009715923555 ↗
3. Accurate predictions on small data with a tabular foundation model10.1038/s41586-024-08328-6 ↗
4. Random Forests10.1023/A:1010933404324 ↗
5. Wang, Y., Wu, H., and Nettleton, D. (2023, January 10–16). Stability of Random Forests and Coverage of Random-Forest Prediction Intervals. Proceedings of the 37th Conference on Neural Information Processing Systems, New Orleans, LA, USA.
6. Ferry, J., Fukasawa, R., Pascal, T., and Vidal, T. (2024, January 21–27). Trained random forests completely reveal your dataset. Proceedings of the 41st International Conference on Machine Learning, Vienna, Austria.
7. Chen, T., and Guestrin, C. (2016, January 13–17). XGBoost: A Scalable Tree Boosting System. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.10.1145/2939672.2939785 ↗
8. Bohacek, M., and Bravansky, M. (2024, January 21). When XGBoost Outperforms GPT-4 on Text Classification: A Case Study. Proceedings of the 4th Workshop on Trustworthy Natural Language Processing, Mexico City, Mexico.10.18653/v1/2024.trustnlp-1.5 ↗
9. Medsker, L., and Jain, L.C. (1999). Recurrent Neural Networks: Design and Applications, CRC Press.10.1201/9781420049176 ↗
10. Hybrid RNN Based Text Classification Model for Unstructured Data10.1007/s42979-024-03091-x ↗
11. Gradient-Based Learning Applied to Document Recognition10.1109/5.726791 ↗
12. A Deep Convolutional Neural Network for Time Series Classification with Intermediate Targets10.1007/s42979-023-02159-4 ↗
13. Malware Detection on Byte Streams of PDF Files Using Convolutional Neural Networks10.1155/2019/8485365 ↗
14. Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C. (2018, January 2–7). Malware detection by eating a whole EXE. Proceedings of the Workshops of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA.
15. Jeong, Y.S., Woo, J., Lee, S., and Kang, A.R. (2020). Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Pooling. Sensors, 20.10.3390/s20185265 ↗
16. Jeong, Y.S., Mswahili, M.E., and Kang, A.R. (2023). File-level malware detection using byte streams. Sci. Rep., 13.10.1038/s41598-023-36088-2 ↗
17. CAG-Malconv: A Byte-Level Malware Detection Method With CBAM and Attention-GRU10.1109/TNSM.2024.3424565 ↗
18. Chung, J., Gulcehre, C., Cho, K., and Bengio, Y. (2014, January 12–13). Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling. Proceedings of the NIPS 2014 Deep Learning and Representation Learning Workshop, Montreal, QC, Canada.
19. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017, January 4–9). Attention is All you Need. Proceedings of the Advances in Neural Information Processing Systems 30, Long Beach, CA, USA.
20. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2–7). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Minneapolis, MN, USA.
21. Rahali, A., and Akhloufi, M.A. (2021, January 17–20). MalBERT: Using Transformers for Cybersecurity and Malicious Software Detection. Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics, Melbourne, Australia.
22. Nichols, T., Zemlanicky, J., Luo, Z., Li, Q., and Zheng, J. (2024, January 29–30). Image-based PDF Malware Detection Using Pre-trained Deep Neural Networks. Proceedings of the 12th International Symposium on Digital Forensics and Security, San Antonio, TX, USA.10.1109/ISDFS60797.2024.10527343 ↗
23. Zhong, W., and Zhang, X. (2024, January 24–27). Multi-Level Generative Pretrained Transformer for Improving Malware Detection Performance. Proceedings of the 7th International Conference on Artificial Intelligence and Big Data, Chengdu, China.10.1109/ICAIBD62003.2024.10604442 ↗
24. Radford, A., Narasimhan, K., Salimans, T., and Sutskever, I. (2025, October 01). Improving Language Understanding by Generative Pre-Training. Available online: https://cdn.openai.com/research-covers/language-unsupervised/language_understanding_paper.pdf.
25. Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. (2025, October 01). Language Models are Unsupervised Multitask Learners. Available online: https://cdn.openai.com/better-language-models/language_models_are_unsupervised_multitask_learners.pdf.
26. Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., and Askell, A. (2025, October 01). Language Models are Few-Shot Learners. Available online: https://arxiv.org/abs/2005.14165.
27. Katharopoulos, A., Vyas, A., Pappas, N., and Fleuret, F. (2020, January 13–18). Transformers are RNNs: Fast Autoregressive Transformers with Linear Attention. Proceedings of the 37th International Conference on Machine Learning, Virtual Event.
28. Gu, A., and Dao, T. (2024). Mamba: Linear-Time Sequence Modeling with Selective State Spaces. arXiv.
29. Jeong, Y.S., Woo, J., and Kang, A.R. (2019). Malware Detection on Byte Streams of Hangul Word Processor Files. Appl. Sci., 9.10.1155/2019/8485365 ↗
30. Kingma, D.P., and Ba, J. (2015, January 7–9). Adam: A Method for Stochastic Optimization. Proceedings of the 3rd International Conference on Learning Representations, San Diego, CA, USA.
31. He, K., Zhang, X., Ren, S., and Sun, J. (2015, January 7–13). Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification. Proceedings of the 2015 IEEE International Conference on Computer Vision, Santiago, Chile.10.1109/ICCV.2015.123 ↗