Efficient Malware Detection in HWP Byte Sequences Using Pooling-Based Model

As data exchange over wired and wireless networks continues to increase, the damage caused by malicious activities hidden in the data is also rising. In particular, malicious actions embedded in document files (e.g., PDF, HWP) are not only difficult to detect, but users are often careless when opening such files, making them highly vulnerable to malicious actions in documents. This study proposes a novel deep learning model that directly analyzes byte sequences to detect malicious actions embedded in HWP documents. Most previously proposed detection models have relied on convolutional neural networks, whereas our model uses no convolutional layers and employs two pooling layers instead. For the experiments, we constructed a new dataset by sampling byte sequences from HWP files, and our model achieved a 63.54% macro F1 score that is better than other existing models. This result demonstrates that our model is not only efficient but also achieves higher malware detection performance, implying that our model is more practical for real-world malware detection services, as we encounter numerous document files in everyday use.