# Malware Detection on Byte Streams of Hangul Word Processor Files
## 3 Proposed Method  
Our problem is to detect malicious actions within a given byte sequence of a target HWP file, and we design a convolutional neural network (CNN) as a solution to tackle the problem. Although employing the CNN means that we do not have to put much effort for feature definition, it is still important to understand the structure of the HWP file. That is, domain knowledge is still required to wisely define input data (e.g., input dimension) and design networks for better performance (e.g., accuracy). As shown in Figure 7, a HWP file may have multiple byte streams, where a benign stream does not contain any malicious actions, and a malicious stream has one or more malicious actions. The malicious actions are often scattered to multiple positions. By manual examination of the scattered malicious actions, we found that at least one of them has a particular malicious action (e.g., download from arbitrary links) while other remains usually support it in various ways (e.g., camouflaging by irrelevant functions, jump to the offset of malicious action). We also found that the length of a malicious action usually does not exceed 600 bytes. Based on these findings, we design a CNN to capture and summarize such patterns, as depicted in Figure 8.  
The input vector of the proposed CNN is a byte sequence of length \(S=600\). The input vector is firstly delivered to the embedding layer that projects each nominal value of the vector into a \(E\)-dimensional space. Formally, \(S\) dimensional input vector is projected into a \(E\times S\) matrix, where each \(i\)-th column vector corresponds to \(i\)-th byte of the input sequence. The embedding layer is widely adopted in the area of natural language processing because it incorporates semantic pattern of the nominal values. For example, the words 'buddy' and 'friend' will be close to each other in the embedding space (e.g., \(E\) dimensional space), whereas 'friend' and'enemy' will appear at totally different positions. Similar to this, the \(E\)-dimensional representation of our embedding layer will incorporate semantic patterns of the byte sequences. In this study, we found that the optimal \(E\) is 64.  
The \(E\times S\) matrix generated by the embedding layer is passed to the first convolutional layer. The convolutional layer has \(K_{1}\) convolutional filters, where the filter size is \(C_{1}\times E\). The convolutional filter slides from left to right of the \(E\times S\) matrix, and used to mask each \(E\times C_{1}\) matrix in order to find arbitrary local patterns. As each filter generates an output vector independently, different filters will probably capture different local patterns. The \(K_{1}\) output vectors generated by the first convolutional layer is then fed to the second convolutional layer. The second convolutional layer works similar to the first one, where it has \(K_{2}\) convolutional filters of size \(C_{2}\times 1\). The intuition behind the two consecutive convolutional layers is that the first layer captures local patterns of action functions (e.g., print, eval) and the second layer will generate high-level features by interpreting the relationship between the functions.  
The second convolutional layer generates \(K_{2}\) output vectors as high-level features, and they are passed to a pooling layer. Similarly to the convolutional layers, the pooling layer of size \(P\) slides through the given vectors, but it summarizes the vectors by picking the most promising (e.g., maximum) value amongst every \(P\) values. The outputs of the pooling layer are flattened to form a vector, which is delivered to two consecutive fully connected (FC) layers. These two layers are supposed to find relationships between the picked promising values, where they generate \(F_{1}\) and \(F_{2}\) dimensional vectors, respectively. Finally, the output layer takes the \(F_{2}\) dimensional vector as an input, and generates 2 dimensional vectors for the final decision.