Detection method, system and storage medium of embedded office documents

Abstract

The present invention proposes a detection method, system and storage medium for an embedded office document. The method includes: obtaining a process list, judging whether there is an office-related process, and if so, monitoring the %TEMP% directory; monitoring the %TEMP% directory Whether there is a new file, if yes, suspend the office related process, and detect the new file, otherwise, the process file is a normal file. The invention also presents a corresponding system for implementing the method. By inventing the self-parsing operation of the office document, the released file is detected without parsing the office document format, which can effectively avoid the influence of the office document confusion on the detection, and at the same time solve the problem of detection due to the complexity of the document format The problem of low yield.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a detection method and system for an embedded office document. Background technique [0002] Due to the complexity of the Office document format, traditional security software mostly uses the Office file as a whole to match features when performing static detection. Very low, documents become more difficult to detect after they are obfuscated. If you use Office to parse first, and then analyze and detect embedded files, this solution is more complicated, the development cost is relatively high, and it is difficult to implement. However, when performing dynamic detection, since the triggering environments for different vulnerabilities in Office documents are different, if you want to conduct a complete detection, you need to prepare multiple environments for detection, which takes a lot of time and is difficult to complete in the user system. The detection effect of trad...

AI Technical Summary

Problems solved by technology

[0003] In view of the above problems, the present invention proposes a detection method, system and storage medium of an embedded office document. The method utilizes the self-parsing function of the embedded office document during execution to detect the released document and solve the problem of document Confusion and complex document formats are difficult to detect

Images