Unveiling Hidden Threats in Word Documents: A Hybrid Approach to Malware Classification

Malicious Word documents have emerged as a highly effective attack vector in modern cyber threats. Despite the presence of numerous protection mechanisms, current detection methods frequently exhibit shortcomings, particularly when confronted with documents that exploit vulnerabilities through embedded malicious content. These threats often evade antivirus systems by employing subtle alterations in document behavior, making them challenging to detect. This highlights the critical need for more sophisticated detection techniques capable of identifying such advanced and evasive threats. To address this issue, we propose a hybrid approach that extracts a comprehensive set of features manifesting during attack scenarios. Our method leverages sandbox environments to monitor potential infection attempts in real-time during the execution of programs. By capturing dynamic behaviors within the sandbox, our approach effectively detects the subtle behavioral changes in documents that traditional methods often fail to identify. We employ various machine learning classifiers to assess the performance of our proposed system. The evaluation of these classifiers is conducted using established metrics, including Accuracy, Precision, Recall, and F1-Score. These metrics confirm the efficacy of our approach in accurately classifying malicious documents and highlight its effectiveness.