# Malware Detection on Byte Streams of Hangul Word Processor Files
## 4 Experiment  
As there is no available public dataset of HWP files, we prepared 534 HWP files (benign: 79, malicious: 455) for experiments. Unlike the benign HWP files, the malicious HWP files use various strategies to attack; so we collected more malicious data to incorporate such diversity. We believe that our dataset covers diverse ways of malicious attacks, and hope that the dataset will help many other  
Figure 8: Graphical representation of the proposed convolutional neural network (CNN). Figure 7: Malicious actions within byte streams of HWP files. related studies. We sampled a set of streams from the HWP files through the Algorithm 1, where \(\mathbf{D}\) refers to the set of HWP files, \(K\) is the number of sampling for malicious case, and \(L\) is the number of sampling for benign case. The sampled streams have the same length \(S=600\). The statistic of the sampled data is described in Table 2. For every experiment in this study, we employ precision, recall, F1 score, and accuracy for measurement, and take 10-fold cross validation. We used a machine having Intel(R) Core(TM) i7-7700 CPU 3.60 GHz, two Geforce GTX 1080 Ti, and 16 GB RAM. ```
Result: The set of sampled streams \(\mathbf{R}\) \(S\leftarrow\) 600; \(K\gets\) 20; \(L\leftarrow\) 3; \(i\gets\) 0; \(\mathbf{R}\leftarrow\) empty list []; while\(i\
eq|\mathbf{D}|\)do\(d\leftarrow\mathbf{D}_{i}\); if\(d\) is maliciousthen\(m_{index}\leftarrow\)sequence index of malicious action; Sample \(K\) randomly chosen indices \(I_{malicious}\) between [\(m_{index}\), \(m_{index}\)+400]; for\(k\leftarrow\) each index of \(I_{malicious}\)do\(R\).append(\(d\)[k, k + \(S\)]);  end if else Sample \(L\) randomly chosen indices \(I_{benign}\) between [0, \(|\mathbf{D}|-S\)]; for\(k\leftarrow\) each index of \(I_{benign}\)do\(R\).append(\(d\)[k, k + \(S\)]);  end if  end for \(i\gets i+1\);  end while
```  
**Algorithm 1**Sampling benign or malicious streams  
We define the raw values of the byte streams as features, meaning that each data instance is represented as an \(S\) dimensional feature vector. Because the values of the feature vector are nominal values, we generate a dictionary of the nominal values and transform the values of feature vectors into the dictionary indices. Assuming that we have a dictionary [0: 'FF', 1: 'FE', 2: 'BC', 3: '0A'], a byte sequence ['FF', 'FE', '0A', 'FF'] will be transformed into a vector [0, 1, 3, 0]. Formally, the set of sampled byte streams \(\mathbf{R}\) generated from the Algorithm 1 is transformed into the set of feature vectors \(\mathbf{F}\) using the dictionary. We compare our proposed CNN with several traditional machine learning models such as Gaussian naive bayes (GNB), logistic regression (LR), and random forest (RF). The GNB is a naive bayes classifier with Gaussian distribution, that allows to adjust to unseen values. The LR is a probabilistic classifier using linear combination of independent variables. The RF is a kind of ensemble model that generates final result by incorporating results of multiple decision trees. Through a grid search, we optimize the parameter settings of the models as described in Table 3. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Total** & **Malicious** & **Benign** \\ \hline
13,181 & 7031 & 6150 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Statistics of sampled data. For our CNN model, by grid searching, we found that the optimal structure is as follows: \(E=256\), \(C_{1}=3\), \(C_{2}=3\), \(K_{1}=32\), \(K_{2}=64\), \(P=100\), \(F_{1}=32\), and \(F_{2}=32\). We define a cost function as a cross entropy over the output layer, and the total number of trainable parameters is 70,178. The training recipe can be summarized as follows: (1) L2 gradient clipping with 0.4, (2) drop-out [23] with a keeping probability 0.5 for the fully connected layers, (3) [PERSON]'s optimizer [24] with an initial learning rate 0.001, and (4) a mini-batch size = 100.