# Malicious Office Macro Detection: Combined Features with Obfuscation and Suspicious Keywords
## 3 Related Work  
In recent years, many researchers have focused on detecting malicious JavaScript code in PDF documents through static analysis [3; 4; 5; 6; 7] or dynamic analysis [8; 9; 10]. However, there are still few studies on detecting malicious Office macros. Most of these research studies focus on machine-learning-based static detection, and some recent related works are described below.  
[PERSON] et al. [11; 12; 13] utilized natural language processing (NLP) techniques to extract vocabularies from macros by treating them as text. They then employed word embedding, latent semantic indexing (LSI), and other methods to extract feature vectors for training machine learning models in order to detect malicious macros. The effectiveness of these models in detecting new samples over time was experimentally analyzed. [PERSON] et al. [14] extracted structural features from DOCX documents and used machine learning to identify malicious DOCX documents. Utilizing active learning with the assistance of experts, the system achieved a 94.44% detection rate with a low false alarm rate of 0.19%. The main limitation of the research is that it only applies to DOCX documents. [PERSON] et al. [2] investigated VBA macro obfuscation in Office documents. They categorized VBA macro obfuscation techniques into four types and introduced a feature set for effectively detecting obfuscation. However, they clarified that their study is aimed at detecting obfuscation, not malicious macros. While obfuscation techniques are implemented to protect intellectual property rights, it is imperative to differentiate between malicious and obfuscated macro detection. Failing to do so will result in an increased occurrence of false alarms when using obfuscation characteristics to detect malicious macros. [PERSON] et al. [15] analyzed a significant number of Office documents that contained VBA macros. They used 40 suspicious keywords as features to identify malicious macros. The machine learning model, random forest, achieved an accuracy of 97.5%. However, it appears that these features do not adequately cover certain malicious macros that utilize new keywords, let alone unknown ones in the future.  
Other than VBA source code, [PERSON] et al. [16] concentrated on the compiled version of VBA source code, known as p-code, and introduced a machine-learning-based approach for identifying malicious macro documents. The detection is performed by extracting n-gram features from p-code sequences, and the classification accuracy is 96.3% on 158 experimental samples. [PERSON] et al. [17] adopted 2-g features and obfuscation features from p-code to identify malicious documents. They also increased the number of document samples to 20,196. The experiments showed an accuracy of 98.8 percent. As XL4 macros in Excel have become significant attack vectors, [PERSON] et al. [18] introduced SYMBEXCEL, which utilizes symbolic execution to automatically de-obfuscate and analyze these macros. This enables users to extract Indicators of Compromise (IoCs) and other vital forensic information reliably.  
Figure 7: Example of call obfuscation. (**a**) Example of a macro before call obfuscation. (**b**) Example of a macro after call obfuscation.