Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Pooling.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Non-executable malware detection is crucial as ordinary users are vulnerable.
• Hangul Word Processor (HWP) files are widely used in South Korea and are increasingly targeted by malware.
• Existing malware detection methods for HWP files often require extensive expert knowledge for feature engineering, limiting their scalability and efficiency.

Purpose of the Study:

• To design and evaluate a convolutional neural network (CNN) model for detecting malware within HWP files.
• To address the challenge of variable-length HWP file byte streams.
• To develop an efficient and effective malware detection solution that bypasses the need for manual feature extraction.

Main Methods:

• A convolutional neural network (CNN) was designed to process raw byte streams of HWP files.
• A novel padding method was developed to handle the variable lengths of HWP byte streams.
• A spatial pyramid average pooling layer was incorporated to enhance feature aggregation.

Main Results:

• The proposed CNN model demonstrated effectiveness in detecting malware within HWP files.
• The model proved to be efficient in its detection process.
• Experimental results validated the model's performance on real-world HWP data.

Conclusions:

• The developed CNN model offers a promising approach for HWP malware detection.
• The proposed techniques for handling variable-length inputs and feature aggregation improve detection accuracy and efficiency.
• This study contributes to enhanced cybersecurity measures for widely used document formats.