XLM4Detector: Multistage Deobfuscation and Semantic-Driven Excel 4.0 Macro Malware Detection

Excel 4.0 Macro leverages XLM code to directly invoke system APIs and automate complex tasks, making it a widely used tool in phishing attacks, advanced persistent threat (APT) campaigns, and Internet of Things (IoT) intrusions in recent years. By constructing various obfuscated macro malware, attackers can easily evade firewalls and detection systems, thereby achieving persistent attacks. However, existing XLM malware defense mechanisms lack in-depth analysis of XLM malware families and behaviors, failing to integrate multidimensional features and semantic relationships effectively. As a result, detection systems struggle to accurately identify malicious operations in real-world attacks, leading to low robustness and accuracy. To this end, we propose XLM4Detector, a novel Excel 4.0 Macro malware detection framework based on multistage deobfuscation and multiview semantic fusion. First, XLM4Detector integrates abstract syntax tree analysis, simulated execution, and regular expression matching to construct a multistage deobfuscation algorithm, enabling precise deobfuscation and XLM code extraction. Second, we introduce four feature extraction methods that capture fine-grained features at the word (string), token (function), abstract syntax tree, and semantic relationship levels. Then, we design four embedding representations (XlmWord2Vec, XlmToken2Vec, XlmAst2Vec, XlmRela2Vec) and employ a multiview semantic fusion algorithm for feature alignment. Finally, we develop an MHSA-CNN-BiGRU model to capture hierarchical semantic relationships, effectively enabling XLM malware behavior detection and family classification. Experimental results demonstrate that XLM4Detector effectively reconstructs obfuscated XLM source code and accurately detects XLM malware families and behaviors. It outperforms state-of-the-art methods in detection accuracy, robustness, and generalization. Our framework provides critical technical support for IoT security defense, malicious document detection, and APT tracking.