## 5 Conclusions and Further Studies  
In this paper, we proposed a framework that effectively detects malicious documents by using only plaintext features of electronic documents via text analysis techniques. The proposed framework extracts only human-readable plaintext features from a given document, excluding executable binary, and applies it to classification methods to determine whether it is malicious. To this end, we used three feature extraction strategies and three classification methods in this paper. In addition, we verified the effectiveness of our proposed framework through a series of experiments, which showed that it achieved more than 98% accuracy in detecting malicious documents thanks to the appropriate combination of a feature extraction strategy and a classification method. As further studies, instead of simply using plaintext features, we improved detection performance by combining our framework with an existing signature-based detection technique for executable code. Adopting the ensemble methods [52; 53] could also improve the accuracy of our proposed framework even further. In addition, we also plan to consider and exploit the order of words to obtain more accurate classification. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & \multicolumn{2}{c}{**Model**} & \multicolumn{3}{c}{**HTML**} & \multicolumn{3}{c}{**XML**} & \multicolumn{3}{c}{**EML**} \\  & & **Acc.** & **Prec.** & **Rec.** & **Acc.** & **Prec.** & **Rec.** & **Acc.** & **Prec.** & **Rec.** \\ \hline \multirow{6}{*}{**Variant**} & **SVM** & 0.979 & 0.965 & **0.994** & 0.997 & **1.000** & 0.994 & 0.900 & 0.899 & 0.886 \\  & **DT** & 0.975 & 0.986 & 0.970 & 0.996 & 0.992 & **1.000** & 0.836 & 0.845 & 0.829 \\  & **DNN** & 0.987 & 0.998 & 0.980 & **1.000** & **1.000** & **1.000** & **0.965** & 0.964 & **1.000** \\ \cline{2-11}  & \multirow{2}{*}{**SVM**} & **SVM** & 0.934 & 0.952 & 0.914 & 0.991 & 0.990 & 0.992 & 0.875 & 0.889 & 0.838 \\  & & **DT** & 0.973 & 0.982 & 0.964 & 0.995 & 0.996 & 0.998 & 0.829 & 0.858 & 0.831 \\  & **DNN** & 0.982 & 0.994 & 0.970 & 0.997 & **1.000** & 0.998 & 0.946 & 0.975 & 0.920 \\ \cline{2-11}  & \multirow{2}{*}{**SVM**} & **SVM** & 0.936 & 0.954 & 0.916 & 0.990 & 0.988 & 0.992 & 0.831 & 0.828 & 0.826 \\  & & **DT** & 0.920 & 0.920 & 0.920 & 0.988 & 0.992 & 0.992 & 0.798 & 0.791 & 0.810 \\  & **DNN** & 0.973 & 0.996 & 0.950 & 0.980 & **1.000** & 0.992 & 0.770 & 0.919 & 0.962 \\ \hline \multirow{6}{*}{**SVM**} & **SVM** & 0.936 & 0.950 & 0.948 & 0.990 & 0.988 & 0.992 & 0.842 & 0.834 & 0.826 \\  & **DT** & 0.915 & 0.912 & 0.920 & 0.988 & 0.984 & 0.992 & 0.809 & 0.791 & 0.773 \\  & **DNN** & **0.995** & **1.000** & 0.992 & **1.000** & **1.000** & **1.000** & 0.885 & **1.000** & 0.784 \\ \hline \multirow{6}{*}{**SVM**} & **Model** & \multicolumn{3}{c}{**RTF**} & \multicolumn{3}{c}{**VBA**} \\  & & **Acc.** & **Prec.** & **Rec.** & **Acc.** & **Prec.** & **Rec.** & & \\ \hline \multirow{6}{*}{**SVM**} & **SVM** & **0.998** & 0.998 & 0.998 & 0.996 & 0.996 & 0.996 & \\  & **DT** & 0.997 & 0.998 & 0.996 & 0.991 & 0.992 & 0.992 & \\  & **DNN** & **0.998** & **1.000** & **1.000** & **1.000** & **1.000** & **1.000** & \\ \cline{2-11}  & \multirow{2}{*}{**SVM**} & **SVM** & 0.991 & 0.990 & 0.992 & 0.985 & 0.974 & 0.996 & \\  & **DT** & 0.996 & 0.996 & 0.996 & 0.984 & 0.984 & 0.984 & \\  & **DNN** & 0.993 & **1.000** & 0.992 & 0.993 & **1.000** & 0.992 & \\ \hline \multirow{6}{*}{**SVM**} & **SVM** & 0.966 & 0.972 & 0.960 & 0.982 & 0.984 & 0.980 & \\  & **DT** & 0.966 & 0.970 & 0.974 & 0.979 & 0.973 & 0.986 & \\ \cline{1-1}  & **DNN** & 0.952 & 0.952 & 0.958 & 0.924 & **1.000** & 0.968 & \\ \cline{1-1} \cline{2-11}  & \multirow{2}{*}{**SVM**} & **SVM** & 0.955 & 0.976 & 0.984 & 0.990 & 0.990 & 0.990 & \\ \cline{1-1}  & **DT** & 0.974 & 0.966 & 0.960 & 0.987 & 0.980 & 0.998 & \\ \cline{1-1}  & **DNN** & 0.985 & 0.990 & 0.982 & 0.996 & 0.996 & 0.996 & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classification accuracy, precision, and recall.