Malware Detection in Word Documents Using Machine Learning

Abstract

Word documents are one of the most widely used types of documents and are used every day by millions of people to share information over the internet, mostly as attachments to mail. According to the Internet Security Threat Report, 2019 by Symantec, 48% of malicious email attachments were MS Office files in 2018. Therefore there is an urgent need for fast and accurate detection of Word document malware. In this work, we propose a method to detect malicious office files with high accuracy. We first apply the static analysis method and achieve the most top detection accuracy of 97.13% using a Random Forest classifier. Then we apply a dynamic analysis method as it helps to get vital information to detect obfuscated and packed malware where the static approach is not as efficient. We achieve the highest detection accuracy of 99.11% with the Random Forest classifier for a dynamic approach. Finally, we combine both the approaches static and dynamic and use a hybrid method to detect Word document malware. Our hybrid method achieves the highest detection accuracy of 99.57% using Random Forest classifier.