머신러닝 기반 MS 오피스 워드 파일의 악성 매크로 탐지 및 분석

Abstract

Recently, various malicious codes such as ransomware have been distributed as hacking emails. In particular, word of MS office is a document that is widely used in various places such as schools and corporations. Currently, as more people work from home due to COVID-19, the number of people exchanging documents by e-mail is increasing. Accordingly, users with malicious purposes abuse the macro function of MS office word file and use it as a medium for malicious actions. MS office recognizes the damage caused by the use of malicious macros and is taking measures to display a warning window when using the macro. However, the number of damage cases is increasing every year, and there is a limit to reducing damage only with the warning window. Therefore, in this paper, the characteristics of various types of malicious macros are identified through analysis using base 64, oletools, and ProcessMonitor tools. In addition, we propose a technique for detecting malicious macros in MS office word by using the dataset for malicious macros for machine learning.