본문 바로가기
  • Home

HWP Malware Detection using Transformer

  • Journal of The Korea Society of Computer and Information
  • Abbr : JKSCI
  • 2025, 30(1), pp.87-97
  • Publisher : The Korean Society Of Computer And Information
  • Research Area : Engineering > Computer Science
  • Received : December 27, 2024
  • Accepted : January 20, 2025
  • Published : January 31, 2025

Gati Lother Martin 1 Young-Seob Jeong 2 Kang Ah Reum 3 Jiyoung Woo 1

1순천향대학교
2충북대학교
3배재대학교

Accredited

ABSTRACT

In this study, we perform static analysis on Hangul document-type malware files, including the extraction of scripts and shellcode, and carry out dynamic analysis based on the type of malware to identify characteristics of Hangul document-type malware files. Based on these characteristics, we learn information about Hangul document-type malware files and develop a deep learning-based detection model for them. Decoding streams in HWP files typically generate readable text composed mainly of JavaScript. We have proposed an effective document-based malware detection model using a transformer model that leverages an attention mechanism to capture dependencies between input and output. In this research, we differentiated Hangul-type malware provided by antivirus companies by document components (streams) and, after training on 17,265 instances, achieved an accuracy of over 96%.

Citation status

* References for papers published after 2023 are currently being built.

This paper was written with support from the National Research Foundation of Korea.