Method and device for detecting and killing macro virus

Abstract

The invention discloses a method and device for detecting and killing a macro virus. The method comprises the steps that safety equipment analyzes the document structure of a document to be detected and killed through a processor of calculation equipment; the document structure comprises a category structure corresponding to a data stream of the document; macro codes are extracted from the document to be detected and killed according to the document structure obtained through analyzing; the macro codes extracted by the processor are matched with behavior codes in a behavior code library; the behavior codes are used for representing the macro codes for achieving fixed virus behaviors; whether the document to be detected and killed infects the macro virus is judged according to the matching result; the repairing process is conducted on the document to be detected and killed according to the document structure obtained through analyzing. The method and device for killing the macro virus can improve the detection capability of an unknown macro virus, have the good anti-virus effect, can comprehensively extract the macro codes from the document to be detected and killed, and can carry out repairing processing on various kinds of documents which are infected by the macro virus and need to be detected and killed.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a method and device for checking and killing macro viruses. Background technique [0002] With the popularization of computers and the development of mobile Internet, the era of network information has come. As a form of information, viruses have the characteristics of reproduction, infection, and destruction, threatening the information security of users. Computer documents, that is, files produced by word editing software such as WORD, EXCEL, PPT, etc., are widely used by people, and macro viruses, as a new type of virus dedicated to destroying computer document information security, have gradually entered people's sight. [0003] Because the macro virus is hidden in the data file, and the script syntax it uses is flexible, there are many ways to write a function, so it is very difficult to identify whether a file has a macro virus. [0004] The anti-virus methods adopt...

AI Technical Summary

Problems solved by technology

[0005] However, due to the infection and outbreak of the macro virus first, the anti-virus comes later; and the macro language is a kind of script, which can produce variants with a slight modification, and can even modify itself during the propagation process, changing once every time it is propagated; therefore, the existing It is difficult for technology to keep up with the speed of macro virus changes, basically no ability to detect and kill unknown macro viruses, and the anti-virus effect is poor

Images