## 6 Conclusions  
Malware attacks have become a significant threat to information security, especially during a pandemic, when remote activities increase. Attackers frequently employ techniques like code obfuscation to evade detection. To combat these threats, advanced methods are needed to analyze their strategies and identify shared characteristics, such as code structure.  
Figure 15: PDF document object.  
In this study, we proposed methods to detect malicious cases in HWP document files. First, we developed document-type malware detection and a family classification system using Transformer to address emerging forms of malware. Transformer has been used for executable malware, but it has not been used for document-type malware, especially script codes. We demonstrate that Transformer, an attention-based model, works well in the detection tasks. Experiments were performed at both the stream- and file-level binary classification (i.e., detecting whether a stream or file is malicious or benign). The malware code sequences were embedded at the character and word levels using a pre-trained MalCode2 Vec embedding model. The efficiency was studied in terms of accuracy, precision, recall, and F1 score. Notably, the model utilizing MalCode2 Vec at the word level outperformed other approaches with an accuracy of 97.15% for the stream classification and 95.66% for the file-level classification.  
Second, we proposed the use of SeqGAN to resolve the class imbalance problem for malware family classification. We examined the generated samples that mimic the characteristics of the original families. They have the features of the families and improve the family classification performance. Third, we established the experimental framework for HWP files, which encompass various types. We performed the sample analyses based on malware families, emphasizing the features of each family.  
Moving forward, in our future research, we will focus on mitigating false negatives by increasing the number of malicious samples through advanced augmentation techniques. Additionally, we will focus on techniques that are used to distribute malware by exploiting the file vulnerabilities. By understanding their tactics and targets, we can take preventative measures. Additionally, we intend to learn more about developers' new approaches and traits using a time-stamped dataset. This will help us determine how frequently the proposed architecture should be updated to defend against bypass attempts and other vulnerabilities. Further, we plan to analyze the model against adversarial instances or code obfuscation methods that are frequently utilized by attackers.  
Conceptualization, S.-M.L., J.-H.K. and Y.-S.J.; methodology, G.L.M., S.-M.L., J.-H.K., Y.-S.J. and J.-W.; software, S.-M.L. and J.-H.K.; data curation, A.R.K.; writing--original draft preparation, G.L.M. and J.W.; writing--review and editing, G.L.M. and J.W.; funding acquisition, A.R.K. All authors have read and agreed to the published version of the manuscript.  
This work was supported by an Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by the Korean government (MSIT) (No. 2019-0-00026, ICT infrastructure protection against intelligent malware threats, the Basic Science Research Program partly supported this work through the National Research Foundation of Korea (NRF), funded by the Ministry of Education (No. NRF-2020R11A3056858) and in part by the Soonchunhyang University Research Fund.  
Not applicable.  
Data Availability Statement: Data will be made available on request.  
The authors declare no conflicts of interest.