RTF file analysis method and device

Abstract

The embodiment of the invention provides an RTF file analysis method and device. Relating to the technical field of data processing, The method comprises the following steps of: obtaining a sample; The method comprises the following steps: carrying out virus searching and killing on an RTF file; performing dimension reduction processing on an RTF file; Generating a target file, matching the presetheader identifier with characters in the target file; when it is determined that the target file contains the character matched with the preset head identifier; determining a domain operator corresponding to the preset head identifier from the target file, and finally, determining the characters in the domain operator corresponding to the preset head identifier as a target sub-file. Due to the fact that dimension reduction processing is firstly carried out on the RTF file, the content of the RTF file is simplified, interference of invalid characters is avoided when the target sub-file in theRTF file is detected, the detection difficulty is reduced, and meanwhile the detection accuracy is improved. By performing logic detection on the target sub-file, whether the target sub-file is a malicious file is determined, and the virus and attack defense capability is improved.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of data processing, and in particular to a method and device for parsing an RTF file. Background technique [0002] Currently popular attack techniques usually include a highly obfuscated Rich Text Format (RTF) file, and the content of this type of highly obfuscated RTF file is disorganized and irregular. When malicious object linking and embedding (OLE) files, compressed (zip) files, or vbe files are embedded in these RTFs, it is often difficult for anti-virus engines to detect them correctly because the files are highly confused. Therefore, it is impossible to further detect whether the embedded subfile is a malicious subfile. When the malicious sub-file runs on a normal device, it will disrupt the operation of the normal device and pose a threat to the security of the normal device. Contents of the invention [0003] In a highly obfuscated RTF file, it is often difficult for ...

AI Technical Summary

Problems solved by technology

[0003] In a highly obfuscated RTF file, it is often difficult for the anti-virus engine to correctly detect the subfile embedded in the RTF file, so it is also impossible to further detect whether the embedded subfile is a malicious subfile, which will cause the malicious subfile to disrupt the operation of normal devices. operation, which poses a threat to the security of normal equipment, the embodiment of the present invention provides a method and device for parsing RTF files

Images