Detection method, system and storage medium of embedded office document

Abstract

The invention provides a detection method, system and storage medium of an embedded office document. The method comprises the steps that a process list is obtained, it is judged whether or not office-associated processes occur, if yes, a %TEMP% catalogue is monitored; it is monitored whether the %TEMP% catalogue has an add file or not, if yes, the office-associated processes is suspended, and theadd file is detected, if no, a process file is a normal file. The invention furthers provides a corresponding system to implement the method. According to the detection method, system and storage medium of the embedded office document, self-parsing operation of the office document is used, a released file is detected, a format of the office document does not need to be parsed, the influence of theoffice document confusion on detection can be effectively avoided, and the problem of the low detection rate due to the complexity of the document format is solved.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a detection method and system for an embedded office document. Background technique [0002] Due to the complexity of the Office document format, traditional security software mostly uses the Office file as a whole to match features when performing static detection. Very low, documents become more difficult to detect after they are obfuscated. If you use Office to parse first, and then analyze and detect embedded files, this solution is more complicated, the development cost is relatively high, and it is difficult to implement. However, when performing dynamic detection, since the triggering environments for different vulnerabilities in Office documents are different, if you want to conduct a complete detection, you need to prepare multiple environments for detection, which takes a lot of time and is difficult to complete in the user system. The detection effect of trad...

AI Technical Summary

Problems solved by technology

[0003] In view of the above problems, the present invention proposes a detection method, system and storage medium of an embedded office document. The method utilizes the self-parsing function of the embedded office document during execution to detect the released document and solve the problem of document Confusion and complex document formats are difficult to detect

Images