[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119413-en":3,"doc-seo-119413-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119413,687197207057,"Sage","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","MIRAGE - A VBA MACRO EMULATOR FORBEHAVIORAL ANALYSIS POWERED BYMACHINE LEARNING - Dissertation","Microsoft Office documents being utilized for malware distribution pose a growing risk, and malicious Office-document macros have increased in prevalence. Prior work shows machine learning can detect threats using static document properties, yet static features limit access to behavioral details needed to classify macro activity as benign or malicious. This study builds and validates a VBA emulator and a behavioral analysis machine learning classifier using 1,000 VBA macros, enabling technology-specific emulator design for behavioral extraction and improved detection methodology powered by machine learning.","Fall 10-2024  \n# Mirage:A VBA Macro Emulator for Behavioral Analysis Poweredby Machine Learning\n\nCorey Mathew Hartman  \nFollow this and additional works at:https://scholar.dsu.edu/theses  \n# MIRAGE:A VBA MACRO EMULATOR FORBEHAVIORAL ANALYSIS POWERED BYMACHINE LEARNING\n\nA dissertation submitted to Dakota State University in partial fulfillment of therequirements for the degree of  \nDoctor of Philosophy  \nin  \nCyber Operations  \nOctober,182024  \nBy  \nCorey Mathew Hartman  \nDissertation Committee:Dr.Michael HamDr.Austin O'BrienDr.Matthew Bradley  \nBeacom College of Computer and Cyber Sciences  \n# DISSERTATIONAPPROVAL FORM\n\nThis dissertation is approved as a credible and independent investigation by a candidate for the Doctor ofPhilosophy degree and is acceptable for meeting the dissertation requirements for this degree.Acceptance ofthis dissertation does not imply that the conclusions reached by the candidate are necessarily the conclusionsof the major department or university.  \nCorey Hartman                      \nStudent Name:__  \nDissertation Title:  \nMirage:A VBA Macro Emulator for Behavioral Analysis Powered by Machine Learning  \nDocuSigned by:  \nublby (lowuiu       \nDate:10/25/2024   \nGraduate Office Verification:  \n-F44C8D9E621C417...  \nDocuSigned by:Dissertation Chair/Co-Chair:_Miduaul 4Date:10/26/2024Print Name:Michael Ham      499B29D70C7542A...  \nDissertation Chair/Co-Chair:               \nDate:         \nPrint Name:                            \n-DocuSigned by:Committee Member:乙万  \n10/26/2024  \nDate:_  \nPrint Name:Austin o Bre3CA282F45...  \nSigned by:Committee Member:Mafluw BradluyPrint Name:Matthew Bradfey92749AE470..  \nDate:  \n10/28/2024   \nCommittee Member:                 \nDate:                \nPrint Name:                            \nCommittee Member:                                    \nDate:                \nPrint Name:              \n## ABSTRACT\n\nMicrosoft Office documents being utilized for the distribution of malware has become anincreasing problem,and in recent years the utilization of malware distributed throughmalicious Microsoft Office documents has seen an increase.Current research has foundmachine learning algorithms to be effective in the detection of malicious Office documentsby the use of static document properties for a method of detection.However,this providesthe author of such malicious Office document macros control of the parameters utilizedin machine learning techniques for detection,and by utilizing static macro properties,this does not allow for the extraction of behavioral details which are important in theclassification of an Office document’s macros,whether it be benign or malicious.In thisstudy the creation and validation of a VBA emulator and a behavioral analysis machinelearning classifier is performed through the utilization of 1,000 VBA macros,allowing fora foundation to be formalized in the design of technology specific emulators,designedspecifically for behavioral data extraction and analysis,thus providing insight into thebehavior of an Office document's macro(s)allowing for better detection methodologiesto be created powered by machine learning algorithms,and preventing static propertiesfrom being altered to evade current detection methods.  \n# TABLE OF CONTENTS\n\nii  \nAbstract  \nTable of Contents  \nList of Tables  \nxix  \nList of Figures  \nList of Equations  \nxl  \nChapter 1:  \nIntroduction  \n1  \n1.1 Background…………………………………………………………………………………………………………………………………1  \n1.2 Problem Statement……………………………………………………………  \n.. .. ………………………………2  \n1.3 Research Objectives …………………………………………………………………………  \n. ……………………………………5  \n1.3.1 Research Outcomes……………………………………………  \n……………………………………………………6  \n1.4 Research Questions…………………………………………………………………  \n…………………………………………………………8  \n1.4.1 Main Question ………………………………………………………  \n…………………………………………8  \n1.4.2 Additional Questions ………………………………………………………………………………………………8  \n1.5 Theoretical Framework ………………………………………………………………………………………………………………………9  \n………………………………………………10  \n1.6 Purpose of the S","cbCaiqIWueJzS3ms","https://ap.wps.com/l/cbCaiqIWueJzS3ms","pdf",23968196,1,975,"English","en",105,"# Chapter 1: Introduction\n## Background\n## Problem Statement\n## Research Objectives\n## Research Questions\n## Theoretical Framework\n## Purpose of the Study\n## Significance of the Study\n## Scope, Limitations, and Deliminations\n## Definitions\n# Chapter 2: Literature Review\n## Literature Review Methodology\n## Malware Detection\n## Behavioral Analysis\n## Dynamic Analysis Evasion\n## Macro Obfuscation\n## Malicious Macro Detection\n## Explainable AI\n## Anti-Virus Labeling","[{\"question\":\"Why are static properties insufficient for detecting Office document macros?\",\"answer\":\"Static document and macro properties enable detection, but they do not provide behavioral details needed to classify macros as benign or malicious.\"},{\"question\":\"What does this research contribute?\",\"answer\":\"It creates and validates a VBA emulator and a behavioral analysis machine learning classifier to extract and analyze macro behavior for improved detection.\"},{\"question\":\"How is the emulator and classifier validated?\",\"answer\":\"Validation uses 1,000 VBA macros, forming a foundation for designing technology-specific emulators focused on behavioral data extraction and analysis.\"}]","MIRAGE - A VBA MACRO EMULATOR FORBEHAVIORAL ANALYSIS POWERED BYMACHINE LEARNING - Dissertation | PDF",1785724168,2457,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"mirage-a-vba-macro-emulator-for-behavioral-analysis-powered-by-machine-learning-dissertation","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/mirage-a-vba-macro-emulator-for-behavioral-analysis-powered-by-machine-learning-dissertation/119413/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are static properties insufficient for detecting Office document macros?","Question",{"text":75,"@type":76},"Static document and macro properties enable detection, but they do not provide behavioral details needed to classify macros as benign or malicious.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What does this research contribute?",{"text":80,"@type":76},"It creates and validates a VBA emulator and a behavioral analysis machine learning classifier to extract and analyze macro behavior for improved detection.",{"name":82,"@type":73,"acceptedAnswer":83},"How is the emulator and classifier validated?",{"text":84,"@type":76},"Validation uses 1,000 VBA macros, forming a foundation for designing technology-specific emulators focused on behavioral data extraction and analysis.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]