Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Poolingopen access
- Authors
- Jeong, Young-Seob; Woo, Jiyoung; Lee, SangMin; Kang, Ah Reum
- Issue Date
- Sep-2020
- Publisher
- Multidisciplinary Digital Publishing Institute (MDPI)
- Keywords
- malware detection; Hangul Word Processor; HWP; spatial pyramid pooling; spatial pyramid average pooling; convolutional neural network; stretch padding
- Citation
- Sensors, v.20, no.18
- Journal Title
- Sensors
- Volume
- 20
- Number
- 18
- URI
- https://scholarworks.bwise.kr/sch/handle/2021.sw.sch/2492
- DOI
- 10.3390/s20185265
- ISSN
- 1424-8220
1424-3210
- Abstract
- Malware detection of non-executables has recently been drawing much attention because ordinary users are vulnerable to such malware. Hangul Word Processor (HWP) is software for editing non-executable text files and is widely used in South Korea. New malware for HWP files continues to appear because of the circumstances between South Korea and North Korea. There have been various studies to solve this problem, but most of them are limited because they require a large amount of effort to define features based on expert knowledge. In this study, we designed a convolutional neural network to detect malware within HWP files. Our proposed model takes a raw byte stream as input and predicts whether it contains malicious actions or not. To incorporate highly variable lengths of HWP byte streams, we propose a new padding method and a spatial pyramid average pooling layer. We experimentally demonstrate that our model is not only effective, but also efficient.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - SCH Media Labs > Department of Big Data Engineering > 1. Journal Articles
![qrcode](https://api.qrserver.com/v1/create-qr-code/?size=55x55&data=https://scholarworks.bwise.kr/sch/handle/2021.sw.sch/2492)
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.