# Malware Detection on Byte Streams of Hangul Word Processor Files
## 2 Background
### Neural Networks for Malware Detection  
Deep neural network is drawing attention mainly for two reasons: (1) it automatically extracts features without much effort of domain experts, and (2) it has shown its superior performance (i.e., accuracy) over other machine learning models in many tasks such as object recognition [9], text classification [10], and machine translation [11]. There have been few studies that apply the neural networks to malware detection. The studies are basically based on two distinct analysis ways: dynamic analysis and static analysis. The studies of dynamic analysis are conducted under the binary run in a virtual environment (e.g., virtual box). For example, [PERSON] et al. [12] proposed to combine long short-term memory (LSTM) [13] with convolutional filters in order to classify malware types, where the features were obtained from API call sequences through the virtual environment. [PERSON] and [PERSON] [14] also utilized the API calls and original function calls to define 114 features. They proposed two distinct models for malware detection and malware type classification, respectively, and insisted that sharing parameters of the two models improves the overall performance. In [15], the recurrent neural network (RNN) is employed to capture sequential patterns of abnormal behavior of executables. [PERSON] et al. [16] proposed a deep learning framework of stacked auto-encoders (SAE) [17] that utilizes behavioral patterns to detect malware. These studies of dynamic analysis commonly require a virtual environment to simulate the executables, and it is difficult to reproduce their works because different analysis is usually conducted on a different non-public emulation environment. There were studies of static analysis that define features obtainable without running the malicious codes. [PERSON] et al. [18] defined features of 300 raw-bytes of the PE-header of each file, and feed them to the neural networks to detect malicious actions. This work showed that the neural networks have a potential to interpret the raw-bytes and generate high-level representation without much effort of feature engineering. [PERSON] and [PERSON] [19] defined a fixed-length feature vector based on a histogram of byte entropy values, and feed them to train the neural networks. [PERSON] et al. [20] proposed CNN-BiLSTM architecture, where the CNN captures local patterns and the bi-directional LSTM (BiLSTM) layer finds sequential dependencies between the found patterns. [PERSON] et al. [21] derived a feature vector from the  
Figure 5: Example of a decompressed macro stream in a malicious HWP file. Figure 6: Example of a Visual Basic for Application (VBA) macro code in a malicious HWP file. entire byte sequence of each file, and designed a shallow convolutional neural network. The shallow network takes input sequence of extraordinary length (e.g., 1-2 M length), and insisted that the network will be available to variable length of byte sequence; however, it is still not be applicable to any longer sequences (e.g., 3-4 M lengths). All of these studies of static analysis commonly aimed at detecting malicious actions of executables. There have been only a few studies of static analysis to detect malicious actions of non-executables. [PERSON] et al. (2018) recently designed a shallow convolutional neural network (CNN) to analyze the byte sequences of PDF files. They assumed that there must be scattered patterns representing malicious actions of byte sequences, and chose to employ the CNN because the CNN is known to be effective in capturing local promising patterns. Inspired by the study, we design a CNN to capture arbitrary patterns of malicious actions by analyzing the byte sequences of HWP files. The biggest difference between ([PERSON] et al., 2018) and this study is the different characteristics of target files (HWP files versus PDF files).