# Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords
## 4 Machine Learning Method with Combined Features
### Data Collection and Pre-Processing  
To compare with previous studies, we use the same dataset from Vasilios [19], comprising 2968 benign Office documents and 15,570 malicious Office documents, all of which are macro-based. The benign samples are collected from 726 governmental and 1010 educational sites across various countries and institutions. Meanwhile, the malicious samples originate from three well-known repositories: AppAny, Virusign, and Malshare.  
In the pre-processing phase, we extract the VBA macros from the available samples and remove those that do not meet our requirements, as shown in the subsequent section. Subsequently, we label the remaining data for training and testing. To extract macros from Office documents, we utilize Oletools, an open-source Python-based tool, which is also used for extracting suspicious keywords.  
Malicious samples disarmed  
After conducting a preliminary analysis of the macros in this dataset, we discovered that several malicious macros contain the message \"Macro code was removed by Symantec Disarm\". This suggests that the malicious part of the macros has been removed, and therefore it may not be appropriate to classify them as malicious. To confirm this, the malicious samples were rescanned by ClamAV antivirus software (Software version 0.103.10, Virus database updated at 16 September 2021). After scanning, 14,064 samples were identified as malicious, and the remaining 1506 samples were removed from the dataset of malicious samples.  
Excel 4.0 macro samples  
As Excel 4.0 macros differ significantly from VBA macros, detecting Excel 4.0 macros is beyond the scope of our method. Therefore, we excluded pure Excel 4.0 macros to achieve more accurate results and retained samples that contained both VBA and Excel 4.0 macros. We acquired 171 samples with malicious Excel 4.0 macros and found no Excel 4.0 macros in benign samples.  
Samples unable to parse with Oletools  
It is noteworthy that certain malicious samples cannot be parsed successfully using Oletools. These samples appear to be intentionally designed to exploit the weaknesses of Oletools and evade detection. This highlights the strategic maneuvers and countermeasures in the ongoing battle between attackers and defenders. A total of 155 malicious samples could not be parsed by Oletools. However, the tool is able to successfully parse all benign samples.  
We still find some samples without macros and discard them.  
After pre-processing, our final dataset contains 2939 benign samples and 13,734 malicious samples that include VBA macros. Table 1 presents the breakdown of document types  
Figure 8: Typical steps of a machine-learning-based model.  
and quantities of both benign and malicious samples. As shown in Table 1, Excel documents are the main format containing benign macros, whereas Word documents are preferred by attackers with malicious intentions. We believe this is because Word documents are more appealing than Excel documents in phishing emails. In addition, there are various other types of malicious documents, such as Office Publisher files, encrypted documents with CDFV2.  
It is common knowledge that malicious samples tend to mutate over time. Therefore, a suitable detection model must be capable of adapting to this change. To evaluate the model's robustness, we obtained a batch of new malicious documents containing macros from VirusTotal. These documents were submitted after the publication of the previous dataset. All of these samples have been identified as malicious by more than 10 antivirus software in VirusTotal. We collected 2885 malicious samples between 25 February 2021 and 20 May 2022. More details about this dataset can be found in Table 2. Using the labeling information provided by Virustotal, as can be seen from the table, nearly half of the malicious samples are obfuscated. For convenience, we will refer to the first dataset as Dataset1 and the second dataset as Dataset2.