효율적인 HWP 악성코드 탐지를 위한 데이터 유용성 검증 및 확보 기반 준지도학습 기법
Efficient Hangul Word Processor (HWP) Malware Detection Using Semi-Supervised Learning with Augmented Data Utility Valuation
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
정보통신기술(ICT) 고도화에 따라 PDF, MS Office, HWP 파일로 대표되는 전자 문서형 파일의 활용이 많아졌고, 공격자들은 이 상황을 놓치지 않고 문서형 악성코드를 이메일과 메신저를 통해 전달하여 감염시키는 피해사례가 많아졌다. 이러한 피해를 막고자 AI를 사용한 악성코드 탐지 연구가 진행되고 있으나, PDF나 MS-Office와 같이 전 세계적으로 활용성이 높은 전자 문서형 파일에 비해 주로 국내에서만 활용되는 HWP(한글 워드 프로세서) 문서 파일은 양질의 정상 또는 악성 데이터가 부족하여 지속되는 공격에 강건한 모델 생성에 한계점이 존재한다. 이러한 한계점을 해결하기 위해 기존 수집된 데이터를 변형하여 학습 데이터 규모를 늘리는 데이터 증강 방식이 제안되었으나, 증강된 데이터의 유용성을 평가하지 않아 불확실한 데이터를 모델 학습에 활용할 가능성이 있다. 본 논문에서는 HWP 악성코드 탐지에 있어 데이터의 유용성을 정량화하고 이에 기반하여 학습에 유용한 증강 데이터만을 활용하여 기존보다 우수한 성능의 AI 모델을 학습하는 준지도학습 기법을 제안한다.
Abstract
With the advancement of information and communication technology (ICT), the use of electronic document types such as PDF, MS Office, and HWP files has increased. Such trend has led the cyber attackers increasingly try to spread malicious documents through e-mails and messengers. To counter such attacks, AI-based methodologies have been actively employed in order to detect malicious document files. The main challenge in detecting malicious HWP(Hangul Word Processor) files is the lack of quality dataset due to its usage is limited in Korea, compared to PDF and MS-Office files that are highly being utilized worldwide. To address this limitation, data augmentation have been proposed to diversify training data by transforming existing dataset, but as the usefulness of the augmented data is not evaluated, augmented data could end up harming model’s performance. In this paper, we propose an effective semi-supervised learning technique in detecting malicious HWP document files, which improves overall AI model performance via quantifying the utility of augmented data and filtering out useless training data.
참고문헌 (28)
- J.H Son, "Learning Data augmentation Method for Effective Detection of HWP Malware", Korea Software Congress(KSC), pp.923~931 (2022)
- K.C Yeon, "Malicious factor analysis using HWP document format structure", MA, Department of Information Security, pp.2016
- T.C. Truong, "A survey on artificial intelligence in malware as next-generation threats", Mendel, 25(2), pp.27~34 (2019)
- H.C Cho, "A layered-wise data augmenting algorithm for small sampling data", Journal of Korean Society for Internet Information, 20(6), pp.65~72 (2020)
- J. Zhang, "Malware variant detection using opcode image recognition with small training sets", 2016 25th International Conference on Computer Communication and Networks(ICCCN), pp.1~9 (2016)
- R. Burks, "Data augmentation with generative models for improved malware detection: A comparative study", 2019 IEEE 10th Annual Ubiquitous Computing, Electronics &Mobile Communication Conference (UEMCON), pp.660~665 (2019)
- F.O Catak, "Data augmentation based malware detection using convolutional neural networks", PeerJ Comput, 7(e346), pp.1~26 (2021)
- N. Nissim, "ALDOCX : detection of unknown malicious microsoft office documents using designated active learning methods based on new structural feature extraction methodology", IEEE Transactions on Information Forensics and Security, 12(3), pp.631~646 (2016)
- S.W Kim, "Obfuscated VBA macro detection using machine learning", 2018 48th annual ieee, 2018, ~
- V. Koutsokostas, "Invoice# 31415 attached : Automated analysis of malicious Microsoft Office documents", Computers & Security, 114(102582), pp.1~13 (2022)
- S. Yang, "Approach using transforming structural data into image for detection of malicious MS-DOC files based on deep learning models", 2019Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), pp.28~32 (2019), IEEE
- H. Park, "MS Office Malicious Document Detection Based on CNN", Journal of the Korea Institute of Information Security &Cryptology, 32(2), pp.439~446 (2022)
- M. Mimura, "An improved method of detecting macro malware on an imbalanced dataset", IEEE Access, 8, pp.204709~204717 (2020)
- Y.S. Jeong, "File-level malware detection using byte streams", Sci Rep, 13(1), pp.8925~8931 (2023)
- Y.S Jeong, "Malware detection using byte streams of different file formats", IEEE Access, 10, pp.51041~51047 (2022)
- Y.S. Jeong, "Malware Detection on Byte Streams of Hangul Word Processor Files", Applied Sciences, 9(23), pp.1~13 (2019)
- L. Holmstrom, "Using additive noise in back-propagation training", IEEE transactions on neural networks, 3(1), pp.24~38 (1992)
- H. Zhang, "mixup: Beyond Empirical Risk Minimization", ICLR(Poster), pp.1~13 (2018)
- I. Goodfellow, "Generative adversarial networks", Communications of the ACM, 63(11), pp.139~144 (2020)
- L. Taylor, "Improving deep learning with generic data augmentation", 2018 IEEE symposium series on computational intelligence (SSCI), pp.1542~1547 (2018), IEEE
- D.J Marchette, "Using data images for outlier detection", Computational Statistics & Data Analysis, 43(4), pp.541~552 (2003)
- R. Kannan, "Outlier detection for text data", Proceedings of the 2017siam international conference on data mining. Society for Industrial and Applied Mathematics, pp.489~497 (2017)
- S. Ho, "Data Sanitization Approach to Mitigate Clean-Label Attacks Against Malware Detection Systems", MILCOM, pp.993~998 (2022)
- P. Porras, "Large-scale collection and sanitization of network security data:risks and challenges", NSPW, pp.57~64 (2006)
- R.H.L Sim, "Data valuation in machine learning:“ingredients”, strategies, and open challenges", Proc. IJCAI, pp.5607~5614 (2022)
- C. Courtnage, "Shapley-value data valuation for semi-supervised learning", Discovery Science: 24th International Conference, pp.94~108 (2021), Springer International Publishing