# Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords
## 4 Machine Learning Method with Combined Features
### Feature Extraction
#### 4.2.1 Obfuscation Features  
It is important to clarify that our focus is on detecting malicious macros, not obfuscated ones. While we list six categories of obfuscation techniques in Section 2, some of these obfuscations are often essential for attackers who do not want the malicious documents to be easily detected by antivirus software. For example, malicious commands can be obfuscated by split, encoding, or embedding obfuscation. If the attacker also wants to conceal suspicious method calls, call obfuscation is essential. To detect malicious macros, it is unnecessary and challenging to extract features from all forms of obfuscation. Instead, we focus on commonly used obfuscations by attackers, including split, encoding, and call obfuscation. When extracting obfuscation features, the following principles are followed: (1) they should be clear and simple, requiring no complex analysis of macro semantics, and (2) they must be resistant to adversarial attacks. For instance, previous studies have considered the length of comments in macros as an obfuscation feature [2,20]. However, since adding comments to macros makes it easy for attackers to create adversarial samples, we argue that this feature lacks robustness. Therefore, we decided to remove comments before feature extraction. Symbols for convenience in understanding our proposed features are introduced in Table 3. The features and their descriptions are presented in Table 4. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Label** & **Benign** & **Malicious** \\ \hline number & 2939 & 13,734 \\ Details of document type & DOC 644, DOCX 26, XLS 1607, XLSX 662 & DOC 11,025, DOCX 1340, XLS 1012, XLSX 240, PPT 5, PPTX \\  & XLSX 662 & 5, others 107 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Details of purified dataset from Vasilios. \begin{table}
\begin{tabular}{c c} \hline \hline
**Label** & **Malicious** \\ \hline number & 2885 \\ Details of document type & doc 1537, docx 58, xls 1193, xlsx 16, ppt 13, others 68 \\ Details of obfuscation & Obfuscated 1358, non-obfuscated 1527 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: New malicious samples collected from Virustotal. From the perspective of attackers, they can choose to limit the obfuscated malicious code to a single line, a single procedure, or multiple procedures within a macro. Therefore, we need to extract obfuscation features for each of these three cases. Detecting coding obfuscation and split obfuscation in a single line can be achieved through the evaluation of F1-F5 values, which indicate the complexity of the line. F1 represents the maximum line length, while F2 and F5 represent the maximum number of split operators and strings within a line. When split obfuscation is used, the values of F2 and F5 in malicious macros are more likely to be higher than those in benign ones. Therefore, we use F2 and F5 to identify split obfuscation. F3 represents the maximum number of arithmetic operators that can occur in a line. Figure 5 illustrates that arithmetic operations are sometimes used in coding obfuscation to conceal malicious intent. F4 represents the maximum number of left parentheses adjacent to a word within a line. The left parenthesis adjacent to a word indicates a procedure call. This feature represents the count of procedure calls in a line, including conversion functions, mathematical functions, and string functions used in coding obfuscation. To identify obfuscation within a single procedure, the use of F1-F5 is ineffective when an attacker disassembles the obfuscated code line by line throughout the procedure. F6-F10 were implemented to address this issue. Features F6-F9 are similar to F2-F5, but their scope was changed from a line to a procedure. These features may reflect both split obfuscation and coding obfuscation within a procedure. Additionally, F10 identifies the maximum number of assignment operators (\"=\") present in procedures. If a line is broken down into multiple lines, more assignment operators will be used.