Detecção e Classificação de Documentos contendo Macros Maliciosas com base em Processamento de Linguagem Natural

Macros are functions written in Visual Basic for automation withinMS Office documents. On the one hand, macros bring many facilitiesto home users and organizations. On the other hand, they havealso stimulated the arise of macro viruses (malware that exploitmacros to infect users loading compromised documents, spreadsheets,and presentations). Those viruses may delete data and stealinformation, and have been causing losses of billions of dollars inglobal attacks. Although more prevalent in the 1990s and 2000s,macro viruses resurged in the last decade and continue to threatcurrent MS Windows/Office users. In this article, we present a naturallanguage processing-based pipeline to detect macros in MSOffice documents and classify them in malicious or benign. Usingbyte2vec as document representation, we outperform the state-ofthe-art in Macro detection, reaching over 99% of Precision-RecallArea Under Curve (PRAUC) metric for four out of seven evaluatedclassifiers (and over 98% PRAUC in the remaining three classifiers).