Using Sparse Composite Document Vectors to Classify VBA Macros

Abstract

To detect new macro malware, NLP-based detection methods have been proposed. These methods mainly use a Doc2vec model to represent the source code, which provides a vector space to classify malicious macros and benign ones. Recently, more sophisticated models outperform Doc2vec in performance and time complexity. However, there is no study to compare these language models for macro malware detection. In this paper, we focus on Sparse Composite Document Vectors (SCDV), which is a simple feature construction algorithm. To evaluate the performance for malware detection, we compare SCDV and other language models: Bag-of Words, Latent Semantic Indexing (LSI), Doc2vec. The experimental result with actual macro malware shows the most suitable language model for macro malware detection.