Macroprogram confusion detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a macroprogram confusion detection method and device, electronic equipment and a computer storage medium, and the method comprises the steps: extracting keywords of a to-be-detected macroprogram, and obtaining malicious keywords and normal keywords; respectively using a first identifier and a second identifier to replace the malicious keyword and the normal keyword to obtain a replaced macro program; and converting the replaced macro program into a target picture, and inputting the target picture into a pre-trained detection model for detection to obtain a detection result. According to the embodiment of the invention, whether the to-be-detected macroprogram is processed by the confusion technology can be quickly determined, and the detection efficiency is improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a macro program confusion detection method, device, electronic equipment and computer storage medium. Background technique [0002] Office type files are widely used in the daily office activities of enterprises and institutions, and macro programs, as an important function extension of Office type files, are also frequently used. Among them, the macro virus that hosts the macro program of Office type files is mixed in the normal files involved in daily office work. Because of its better concealment and higher attack success rate, it is often used by hackers in network attacks. Extensive use. [0003] In order to avoid the detection and killing of antivirus software, macro viruses usually adopt obfuscation technology; it can be seen that the important challenge of macro virus detection is how to resist obfuscation technology; obfuscation technology is a techno...

AI Technical Summary

Problems solved by technology

[0003] In order to avoid the detection and killing of antivirus software, macro viruses usually adopt obfuscation technology; it can be seen that the important challenge of macro virus detection is how to resist obfuscation technology; obfuscation technology is a technology of program conversion, which can retain the malicious behavior of malicious programs while modifying The appearance of the program makes the anti-virus software unrecognizable and increases the risk of network security; in particular, the attack in the form of attaching confusing macro viruses to phishing emails has become the main attack method of the attacker

Images