{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T02:15:17Z","timestamp":1768529717205,"version":"3.49.0"},"reference-count":34,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2020,9,15]],"date-time":"2020-09-15T00:00:00Z","timestamp":1600128000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Malware detection of non-executables has recently been drawing much attention because ordinary users are vulnerable to such malware. Hangul Word Processor (HWP) is software for editing non-executable text files and is widely used in South Korea. New malware for HWP files continues to appear because of the circumstances between South Korea and North Korea. There have been various studies to solve this problem, but most of them are limited because they require a large amount of effort to define features based on expert knowledge. In this study, we designed a convolutional neural network to detect malware within HWP files. Our proposed model takes a raw byte stream as input and predicts whether it contains malicious actions or not. To incorporate highly variable lengths of HWP byte streams, we propose a new padding method and a spatial pyramid average pooling layer. We experimentally demonstrate that our model is not only effective, but also efficient.<\/jats:p>","DOI":"10.3390\/s20185265","type":"journal-article","created":{"date-parts":[[2020,9,15]],"date-time":"2020-09-15T10:24:09Z","timestamp":1600165449000},"page":"5265","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["Malware Detection of Hangul Word Processor Files Using Spatial Pyramid Average Pooling"],"prefix":"10.3390","volume":"20","author":[{"given":"Young-Seob","family":"Jeong","sequence":"first","affiliation":[{"name":"Department of Future Convergence Technology, Soonchunhyang University, Asan 31538, Korea"}]},{"given":"Jiyoung","family":"Woo","sequence":"additional","affiliation":[{"name":"Department of Future Convergence Technology, Soonchunhyang University, Asan 31538, Korea"}]},{"given":"SangMin","family":"Lee","sequence":"additional","affiliation":[{"name":"Electronics and Telecommunications Research Institute, 218, Gajeong-ro, Yuseong-gu, Daejeon 34129, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0732-5313","authenticated-orcid":false,"given":"Ah Reum","family":"Kang","sequence":"additional","affiliation":[{"name":"Department of Future Convergence Technology, Soonchunhyang University, Asan 31538, Korea"}]}],"member":"1968","published-online":{"date-parts":[[2020,9,15]]},"reference":[{"key":"ref_1","first-page":"86","article-title":"South Korea\u2019s Options in Responding to North Korean Cyberattacks","volume":"15","author":"Park","year":"2016","journal-title":"J. Inf. Warf."},{"key":"ref_2","unstructured":"Kim, C.W., and Polito, C. (2019). The Evolution of North Korean Cyber Threats, The Asan Institute for Policy Studies."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Jeong, Y.S., Woo, J., and Kang, A.R. (2019). Malware Detection on Byte Streams of Hangul Word Processor Files. Appl. Sci., 9.","DOI":"10.1155\/2019\/8485365"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1023\/A:1009715923555","article-title":"A Tutorial on Support Vector Machines for Pattern Recognition","volume":"2","author":"Burges","year":"1998","journal-title":"Data Min. Knowl. Discov."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"7247095","DOI":"10.1155\/2018\/7247095","article-title":"Detecting Malware with an Ensemble Method Based on Deep Neural Network","volume":"2018","author":"Yan","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"ref_6","first-page":"1","article-title":"Malware Detection on Byte Streams of PDF Files Using Convolutional Neural Networks","volume":"6","author":"Jeong","year":"2019","journal-title":"Secur. Commun. Netw."},{"key":"ref_7","unstructured":"Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C. (2018, January 2\u20137). Malware detection by eating a whole EXE. Proceedings of the Workshops of the Thirty-Second AAAI Conference on Artificial Intelligence, New Orleans, LA, USA."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1904","DOI":"10.1109\/TPAMI.2015.2389824","article-title":"Spatial Pyramid Pooling in Deep Convolutional Networks for Visual Recognition","volume":"37","author":"He","year":"2015","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_9","unstructured":"(2020, September 01). Norton. Available online: https:\/\/us.norton.com\/."},{"key":"ref_10","unstructured":"(2020, September 01). Kaspersky. Available online: https:\/\/www.kaspersky.co.kr\/."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Kolosnjaji, B., Zarras, A., Webster, G., and Eckert, C. (2016, January 5\u20138). Deep Learning for Classification of Malware System Call Sequences. Proceedings of the 29th Australasian Joint Conference on Artificial Intelligence, Hobart, Australia.","DOI":"10.1007\/978-3-319-50127-7_11"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-Term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2019\/8195395","article-title":"Malware Detection Based on Deep Learning of Behavior Graphs","volume":"2019","author":"Xiao","year":"2019","journal-title":"Math. Probl. Eng."},{"key":"ref_14","first-page":"3371","article-title":"Stacked Denoising Autoencoders: Learning Useful Representations in a Deep Network with a Local Denoising Criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"7","DOI":"10.1007\/978-3-319-73951-9_2","article-title":"Machine Learning Aided Static Malware Analysis: A Survey and Tutorial","volume":"70","author":"Shalaginov","year":"2018","journal-title":"Cyber Threat Intell. Adv. Inf. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Nath, H.V., and Mehtre, B.M. (2014, January 13\u201314). Static Malware Analysis Using Machine Learning Methods. Proceedings of the International Conference on Security in Computer Networks and Distributed Systems, Trivandrum, India.","DOI":"10.1007\/978-3-642-54525-2_39"},{"key":"ref_17","first-page":"3361","article-title":"SVM Based Effective Malware Detection System","volume":"6","author":"Ranveer","year":"2015","journal-title":"Int. J. Comput. Sci. Inf. Technol."},{"key":"ref_18","unstructured":"(2020, September 01). VXheavens. Available online: http:\/\/vx.netlux.org."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Morales-Molina, C.D., Santamaria-Guerrero, D., Sanchez-Perez, G., Toscano-Medina, K., Perez-Meana, H., and Hernandez-Suarez, A. (2018, January 14\u201316). Methodology for Malware Classification using a Random Forest Classifier. Proceedings of the IEEE International Autumn Meeting on Power, Electronics and Computing, Ixtapa, Mexico.","DOI":"10.1109\/ROPEC.2018.8661441"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1010933404324","article-title":"Random Forests","volume":"45","author":"Breiman","year":"2001","journal-title":"Mach. Learn."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Darus, F.M., Ahmad, N.A., and Ariffin, A.F.M. (2019, January 5\u20137). Android Malware Classification Using XGBoost On Data Image Pattern. Proceedings of the IEEE International Conference on Internet of Things and Intelligence System, Bali, Indonesia.","DOI":"10.1109\/IoTaIS47347.2019.8980412"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1023\/A:1011139631724","article-title":"Modeling the Shape of the Scene: A Holistic Representation of the Spatial Envelope","volume":"42","author":"Oliva","year":"2001","journal-title":"Int. J. Comput. Vis."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"4049","DOI":"10.1016\/j.aej.2018.10.008","article-title":"Deep Belief Networks-based framework for malware detection in Android systems","volume":"57","author":"Saif","year":"2018","journal-title":"Alex. Eng. J."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1527","DOI":"10.1162\/neco.2006.18.7.1527","article-title":"A fast learning algorithm for deep belief nets","volume":"18","author":"Hinton","year":"2006","journal-title":"Neural Comput."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"578","DOI":"10.1016\/j.cose.2018.05.010","article-title":"Early-stage malware prediction using recurrent neural networks","volume":"77","author":"Rhode","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Medsker, L., and Jain, L.C. (1999). Recurrent Neural Networks: Design and Applications, CRC Press.","DOI":"10.1201\/9781420049176"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., and Bengio, Y. (2014, January 25\u201329). Learning Phrase Representations using RNN Encoder\u2013Decoder for Statistical Machine Translation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing, Doha, Qatar.","DOI":"10.3115\/v1\/D14-1179"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-Based Learning Applied to Document Recognition","volume":"86","author":"Lecun","year":"1998","journal-title":"Proc. IEEE"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.eswa.2017.11.010","article-title":"Mining social lending motivations for loan project recommendations","volume":"111","author":"Yan","year":"2018","journal-title":"Expert Syst. Appl."},{"key":"ref_30","unstructured":"Ioffe, S., and Szegedy, C. (2015, January 7\u20139). Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. Proceedings of the 32nd International Conference on Machine Learning, Lille, France."},{"key":"ref_31","unstructured":"Maas, A.L., Hannun, A.Y., and Ng, A.Y. (2013, January 16\u201321). Rectifier Nonlinearities Improve Neural Network Acoustic Models. Proceedings of the 30th International Conference on Machine Learning, Atlanta, GA, USA."},{"key":"ref_32","unstructured":"Kingma, D.P., and Ba, J. (2015, January 7\u20139). Adam: A Method for Stochastic Optimization. Proceedings of the 3rd International Conference on Learning Representations, San Diego, CA, USA."},{"key":"ref_33","unstructured":"Jeon, Y., and Kim, J. (2018, January 13\u201316). Constructing Fast Network through Deconstruction of Convolution. Proceedings of the 32nd International Conference on Neural Information Processing Systems, Siem Reap, Cambodia."},{"key":"ref_34","first-page":"26","article-title":"Antivirus False Positives Alerts, Evading Malware Detection and Cyber-Security Issues","volume":"12","author":"Fragkos","year":"2013","journal-title":"J. Inf. Warf."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/18\/5265\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:10:08Z","timestamp":1760177408000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/18\/5265"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,9,15]]},"references-count":34,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2020,9]]}},"alternative-id":["s20185265"],"URL":"https:\/\/doi.org\/10.3390\/s20185265","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,9,15]]}}}