How Can an AI Unmask Dangerous Office Documents?

Microsoft Office documents are among the most used tools worldwide, but also the most exploited by cybercriminals. Traditionally, antivirus software looks for known signatures or rules, yet new malware changes quickly and evades these methods. Recent research proposes an alternative: using large language models (LLM) to analyze the textual content of Office files. First, the text is extracted from the OOXML document, then the LLM scans it for suspicious indicators, such as hidden macros or abnormal network instructions. The advantage is that the model does not need predefined signatures: it can recognize never‑seen‑before patterns. Experiments with Claude 3.5 Sonnet showed that, with a few hundred pages of training data, the model identifies indicators in 5‑9 seconds, generating a static analysis report. The average cost is $0.19 per request and the F1 score reaches 0.929, demonstrating high precision. This approach could become an effective support for antivirus software, expanding defense against emerging threats and reducing reliance on traditional signatures.

The proposed approach relies on static analysis, i.e., examining the file without executing it. After extracting the textual content from the OOXML package (essentially a ZIP archive containing XML and resources), the text is converted into a format readable by the language model. The prompt sent to Claude 3.5 Sonnet includes instructions to identify typical malware patterns, such as network API calls, PowerShell usage, or obfuscated VBA code sequences. The model, trained on massive text corpora, possesses encyclopedic knowledge of programming syntax and obfuscation techniques, allowing it to recognize even unknown variants. In tests, the model analyzed 1,200 documents, half of them malicious, achieving a precision of 93% and recall of 92%, with an F1 of 0.929. The average response time (5‑9 s) is competitive compared to traditional machine‑learning classifiers, which require more complex preprocessing. The cost of $0.19 per request is sustainable for a cloud service, especially considering the reduction in false negatives. However, the approach has limits: it depends on the quality of extracted text (documents with binary content or non‑textual images may slip through) and on the model's ability to handle long prompts. Future developments could integrate multimodal analysis (text + images) and employ more efficient models to lower costs and latency, turning the LLM into a true co‑pilot for cybersecurity suites.