Risk detection method, device and readable storage medium for rich text documents

Abstract

The present application discloses a method, device and readable storage medium for detecting risks of rich text documents, which are used to solve the problem of inaccurate methods for detecting risks of rich text documents in the prior art. The method comprises: locating a first data stream in a rich text document; wherein the first data stream is data between a start symbol before a set first control word and an end symbol matching the start symbol; reading a read bit attribute of a control word in the first data stream, deleting or retaining data after the control word in the first data stream based on the read bit attribute, and obtaining first data; wherein, when the read bit attribute is deletion, it indicates deleting data after the corresponding control word to the next adjacent control word; and determining that the rich text document is at risk based on embedded objects or links in the first data.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a risk detection method, device and readable storage medium for rich text documents. Background Art

[0002] Rich Text Format (RTF) is a document that uses ASCII as the encoding format. RTF documents can be parsed by a variety of parsers. Since different parsers have different understandings of the content that is not strictly required (or not detailed enough) in the RTF document specification, the parsing results obtained will also be different. This difference allows attackers to insert malicious objects into RTF documents and confuse their string streams, thereby bypassing ordinary third-party parsing tools and achieving the purpose of static anti-detection.

[0003] Therefore, the methods for detecting risks of rich text documents in the prior art are inaccurate. Summary of the invention

[0004] The present application provides a method, device and readable storage medium for detecting risks of rich text documents, so as to solve the problem of inaccurate methods for detecting risks of rich text documents in the prior art.

[0005] In a first aspect, the present application provides a risk detection method for a rich text document, the method comprising:

[0006] In the rich text document, locate a first data stream; wherein the first data stream is data between a start character before a set first control word and an end character matching the start character;

[0007] Reading a read bit attribute of a control word in the first data stream, deleting or retaining data after the control word in the first data stream based on the read bit attribute, to obtain first data; wherein, when the read bit attribute is delete, it indicates deleting data after the corresponding control word to the next adjacent control word;

[0008] Based on the embedded objects or links in the first data, it is determined that the rich text document has risks.

[0009] The above operation determines and deletes the obfuscated content in the first data stream by reading the read bit attribute of the control word in the first data stream, thereby solving the problem that the rich text document cannot be detected normally after the malicious object obfuscates the rich text document, that is, solving the problem of inaccurate methods for detecting risks in rich text documents.

[0010] In a possible implementation manner, the first control word is objdata.

[0011] In a possible implementation manner, before locating the first data stream in the rich text document, the method includes:

[0012] Detecting whether a rich text document contains basic malicious features; wherein the basic malicious features refer to malicious features identified by any security parsing software;

[0013] If so, it is determined that the rich text document is at risk; if not, the first data stream is located.

[0014] By detecting basic malicious features, the efficiency of detecting risks in rich text documents can be improved. In a possible implementation, the basic malicious features include: non-compliant header flags, suspicious document creators and last modifiers, control words appearing within a set range before or after the header, unexpected control words, the number of consecutive control words exceeding a first threshold, the number of times a specific character is used exceeding a second threshold, the length of a control word exceeds a third threshold, and an unexpected character appears between two hexadecimal characters.

[0015] In a possible implementation manner, the reading of the read bit attribute of the control word in the first data stream includes:

[0016] When the read bit attribute of any control word is read to be empty, based on the traceability of the read bit attribute, the read bit attribute of the control word closest to the control word is traced back in sequence until the read bit attribute of the control word is determined; wherein the traceability means that the read bit attribute of the control word is the same as the read bit attribute of the closest, same-level control word or upper-level control word.

[0017] In a possible implementation manner, determining that the rich text document has a risk based on an embedded object or link in the first data includes:

[0018] When the first data includes the embedded object or link that is not parsed by the conventional parsing method, it is determined that the first data stream includes obfuscated content, and it is determined that the rich text document has a risk.

[0019] In a second aspect, the present application provides a risk detection device for a rich text document, the device comprising:

[0020] Positioning unit: used for positioning a first data stream in a rich text document; wherein the first data stream is data between a start character before a set first control word and an end character matching the start character;

[0021] A reading unit; used for reading the read bit attribute of the control word in the first data stream, deleting or retaining the data after the control word in the first data stream based on the read bit attribute, to obtain the first data; wherein, when the read bit attribute is delete, it indicates to delete the data after the corresponding control word to the next adjacent control word;

[0022] A determination unit is configured to determine whether the rich text document has a risk based on an embedded object or link in the first data.

[0023] In a possible implementation manner, the device also includes a basic unit, which is specifically used to detect whether a rich text document contains basic malicious features; wherein the basic malicious features refer to malicious features identified by any security parsing software; if so, it is determined that the rich text document is at risk; if not, the first data stream is located.

[0024] In a possible implementation manner, the reading unit is specifically used to, when the read bit attribute of any control word is read to be empty, trace back the read bit attribute of the control word closest to the any control word in sequence based on the traceability of the read bit attribute, until the read bit attribute of any control word is determined; wherein the traceability means that the read bit attribute of any control word is the same as the read bit attribute of the closest, same-level control word or upper-level control word.

[0025] In a third aspect, the present application further provides a readable storage medium, comprising:

[0026] Memory,

[0027] The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium performs the method described in the first aspect and any possible implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of a risk detection method for rich text documents provided in this application;

[0029] Figure 2 A comparison diagram of the first data stream provided in this application before and after obfuscation;

[0030] Figure 3 A schematic diagram of the structure of a risk detection device for a rich text document provided in this application. DETAILED DESCRIPTION

[0031] In response to the problem of inaccurate methods for detecting risks of RTF documents in the above-mentioned prior art, the embodiments of the present application propose a risk detection method for rich text documents based on the current obfuscation means of inserting malicious objects into RTF documents: after locating the first data stream in the rich text document, the read bit attribute of the control word in the first data stream is read and parsed to determine whether the content in the rich text document is obfuscated, that is, it is determined that the rich text document contains obfuscated content and there is a risk.

[0032] It should be noted that in this application, all rich text format documents are collectively referred to as rich text documents.

[0033] The following explains the technical terms used in the embodiments of this application:

[0034] Rich text format document: It refers to a cross-platform office document using ASCII as the encoding format, which can be opened on various software supporting the ASCII encoding format. For example, office software such as Word and WPS.

[0035] Control word: It is a basic component unit of an RTF document, consisting of a formatted string name. Control words are used to define the content to be output in the document. A control word starts with a forward slash \ followed by an English string as the control word name. The numeric characters after the control word name are control word parameters. Generally, the format of a control word is as follows:

[0036] \<ASCII English character><ASCII numeric character><space / line feed><data stream (optional)>.

[0037] For example: \rtlch\fcs1\af31507; This example contains three control words, namely \rtlch, \fcs, and \af. Among them, the parameter of \fcs is 1, and the parameter of \af is 31507.

[0038] For example: \objdata 0105000002000000…; The control word in this example is \objdata, which has no parameter, followed by a space, and the subsequent 01050… is the corresponding data stream.

[0039] Hexadecimal character (string): It refers to an ASCII character with a range of 0 - 9, a - f, or A - F. One character represents 4 bits, and two characters represent 1 byte. For example, the string "313233" represents 0x31, 0x32, and 0x33.

[0040] To better understand the above technical solution, the technical solution of this application will be described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of this application and the specific features in the embodiments are detailed descriptions of the technical solution of this application, rather than limitations on the technical solution of this application. Without conflict, the technical features in the embodiments of this application and the embodiments can be combined with each other.

[0041] Please refer to Figure 1 , this application provides a risk detection method for rich text documents to solve the problem that the method for detecting risks in rich text documents in the prior art is inaccurate. The method can specifically include the following implementation steps:

[0042] Step 101: Locate the first data stream in the rich text document.

[0043] The first data stream is data between a start symbol before a set first control word and an end symbol matching the start symbol.

[0044] The start symbol in the embodiment of the present application may be “{”, and the end symbol is the matching “}”.

[0045] In the embodiment of the present application, the first control word may be set to be objdata.

[0046] It should be noted that, before locating the first data stream, it is possible to first detect whether the rich text document contains basic malicious features, wherein the basic malicious features refer to malicious features that can be identified by any security analysis software.

[0047] Basic malicious features include non-compliant header flags, suspicious document creators and last modifiers, control words appearing within a set range before or after the header, unexpected control words, the number of consecutive control words exceeding the first threshold, the number of times a specific character is used exceeding the second threshold, the length of the control word exceeding the third threshold, and unexpected characters appearing between two hexadecimal characters.

[0048] Specifically, an irregular header tag means that the header of a rich text document includes numbers other than 1, such as 2, 3, 4, etc. The header tag of a normal RTF document that does not pose a risk must include {\rtf1, indicating that the version of the RTF document is RTF 1.X.

[0049] Suspicious document creator and last modifier: The document creator and last modifier fields are empty, or the fields are a collection of former names of malicious documents, or heterogeneous names. Heterogeneous names include high-authority user names, security company names, etc. The creator and last modifier of a normal RTF document that does not pose a risk are author control words or operation control words.

[0050] Control words appear within the set range before or after the header: for example, pict, page, objdata, object, objocx, objw, objautlink, etc.

[0051] Unexpected control words: refers to control words that start with a slash and have the same format as a control word, but are unrecognizable. Unexpected control words often interfere with the parsing of hexadecimal characters.

[0052] The number of times a specific character is used exceeds the second threshold: The specific character mainly refers to the number of times a specific character in the first data stream is used that exceeds the second threshold. In the embodiment of the present application, the first data stream is the objdata data stream, and the specific characters are spaces and tabs. It can be set that when the number of times spaces and tabs are used exceeds 20 times in any objdata data stream, it is determined that the RTF document contains basic malicious features.

[0053] The length of the control word exceeds the third threshold: the control word includes the control word name and the control word parameter. When the control word parameter exists, the third threshold is set to 252 in the embodiment of the present application; when the control word parameter does not exist, the control word only includes the control word name, and the embodiment of the present application sets the third threshold to 254.

[0054] Unexpected characters appear between two hexadecimal characters: The expected characters between two hexadecimal characters are spaces and newlines, and the unexpected control characters between two hexadecimal characters are characters other than spaces and newlines, such as curly braces, slashes, invisible characters, commas, periods, etc.

[0055] In an embodiment of the present application, if a rich text document is detected to contain any of the above basic malicious features, it can be determined that the rich text document is risky and there is no need to execute step 101; otherwise, step 101 is executed on the rich text document after the detection is completed.

[0056] Step 102: Read the read bit attribute of the control word in the first data stream, and delete or retain the data after the control word in the first data stream based on the read bit attribute to obtain first data.

[0057] When the read bit attribute is delete, it indicates that the data after the corresponding control word to the next adjacent control word is deleted.

[0058] Specifically, if there is no risk in the RTF document, the first data stream does not contain meaningless data (characters), that is, when parsing the first data stream, the read bit attributes of all control words are defaulted to be retained. The embedded objects and links in the first data stream are represented by hexadecimal characters, and the obfuscation means used by the malicious object are mainly implemented for the embedded objects or link objects in the first data stream. Therefore, the character types used for obfuscation by the malicious object are hexadecimal characters, that is, the deletion or retention data indicated by the read bit attribute is mainly used to judge whether to retain or delete hexadecimal characters. If the malicious object does not adopt obfuscation means, then the conventional detection method can determine that the rich text document has risks by detecting basic malicious features. When the malicious object uses obfuscation means to process the first data stream, there is a possibility that the malicious features cannot be parsed. Therefore, based on the read bit attribute of each control word, it is determined whether to retain the data between the control word and the next control word, the meaningless characters obfuscated by the malicious object in the first data stream can be deleted, prompting the malicious object hidden around the meaningless characters by obfuscation means to be exposed.

[0059] It should be noted that due to confusion, the starting position or ending position of the hexadecimal character may not be directly identified, so the embodiment of the present application parses the data in the first data stream sequentially one by one, and after each control word is identified, it is determined whether to retain the parsing result of the data after the control word based on the read bit attribute of the control word.

[0060] The read bit attribute is traceable. When the read bit attribute of any control word is read to be empty, based on the traceability of the read bit attribute, the read bit attribute of the control word closest to the control word is traced back in sequence until the read bit attribute of any control word is determined; wherein, the traceability means that the read bit attribute of any control word is the same as the read bit attribute of the closest control word of the same level or the upper level control word. It can be seen that if the read bit attribute of the current control word in a certain sub-data group is empty, the data between the control word and the next control word can be parsed according to the read bit attribute of the previous control word in the group.

[0061] The following is a detailed description of the read bit attributes and the data groups at the same level:

[0062] "{}" represents a data group, and multiple "{}" data groups can be nested in "{}". If there are multiple or multiple layers of "{}" between "{}", the "{}" between the first "{" and the "}" that appear symmetrically with it are called sub-data groups.

[0063] For example, the following is a snippet from the objdata data stream:

[0064] {…\objdata…<\nameA…{\nameB\…\nameC…\nameD…\nameE……\nameI…\nameJ…\nameK…\nameL}\nameM…\nameN>…}, the above {…\objdata…<\nameA…{\nameB\…\nameC…\nameD…\nameE……\nameI…\nameJ…\nameK…\nameL}\nameM…\nameN>…} is a data group; among them, {\nameB…\nameL} is a secondary sub-data group for nameA, nameM and nameN, nameA, nameM and nameN are control words of the upper-level data group for {\nameB…\nameL}, and nameA, nameM and nameN are in a peer relationship. Because the read bit attributes of the control word include reserved, deleted, and empty (not queried), the read bit attributes of objdata are correspondingly reserved. When parsing this fragment, the traceability of the read bit attributes should meet the following requirements:

[0065] For the sub-data group, the resolution of the data between nameB and nameC depends on the read-bit attribute of nameB; the resolution of the data between nameC and nameD depends on the read-bit attribute of nameC; the resolution of the data between nameD and nameE depends on the read-bit attribute of nameD; and so on.

[0066] If the read attribute of nameK is empty, then trace back to nameJ. If the read attribute of nameJ is empty, then trace back to nameI. And so on. In the current group, the furthest traceable is nameB.

[0067] If the read bit attribute of nameB is empty, it should step out of the group and trace back to the previous level control word nameA that is closest to the group.

[0068] If the read bit attribute of nameM is empty, then trace back to the nearest control word of the same level, nameA; if the read bit attribute of nameA is empty, similarly, trace back to the nearest control word of the same level.

[0069] After determining the read bit attribute of the control word in objdata, it can be determined whether to retain the parsing result of the data after the control word. For the data included after the control word, the data type of the data can be identified after reading and the corresponding parsing rules can be determined to be used. Therefore, when the data after the control word includes multiple data types, the parsing method can jump in sequence based on the parsing rules corresponding to the data types after the control word. The control word includes a control word name and a control word parameter. That is to say, during the parsing process, "\" is a control word mark. When encountering English letters after "\", it is recognized that the control word name is read, and the control word parsing rules are used; if the number after the control word is adjacent to the control word, it is recognized that the control word parameter is read, and the control word parsing rules are used; if the number after the control word is not adjacent to the control word name or the control word parameter, and the two are separated by a space or other symbol, it is recognized that a hexadecimal character is read, and the hexadecimal character parsing rules are used.

[0070] For example, there is a fragment <\objdata 16089846e2e33\efg{\abc0000}45715541>, in which "\" is read to determine that the data following it is a control word, and then objdata is read, and objdata is parsed based on the control word parsing rule to determine that objdata is the first control word, and its read bit attribute is to retain the subsequent data information; then 16089846e2e3 is read, because 16089846e2e33 and objdata are not adjacent to each other and there is a space, then 16089846e2e33 is determined to be a hexadecimal character, that is, it is parsed and retained based on the hexadecimal character parsing rule; similarly, efg is parsed based on the control word parsing rule, and the read bit attribute of efg can be determined at the same time; further, "\" is read to determine that the next one is a control word, then abc is read and it is determined whether the subsequent data is retained. Further, 0000} is read in sequence. When} is read, it is determined that the secondary data group {\abc0000} ends, where 0000 is adjacent to abc, so 0000 is determined to be the control word parameter of abc. Then 45715541 is read. Since the start and end characters "{}" separate 45715541 from the control word efg, if the read bit attribute of efg is reserved, it is determined that 45715541 is parsed and retained based on the hexadecimal character rules; if the read bit attribute of efg is deleted, it is determined to delete the parsing result of 45715541; if the read bit attribute of efg is empty, then according to the traceability of the read bit attribute, the read bit attribute of objdata is read as reserved, and it is determined that 45715541 is parsed and retained based on the hexadecimal character rules.

[0071] Based on the above method, the control words and character strings used for obfuscation by the malicious object can be determined and deleted, and then the next step is executed; on the contrary, if the fragment is risky and the read bit attribute is not considered during parsing, the read bit attribute of the fragment is retained by default, and the fragment <\objdata16089846e2e33\efg{\abc0000}45715541> is directly parsed. Then, the first data contains the parsing result of all the data in the fragment, and the formulas and other contents included in the result cannot be normally reflected due to the risk of obfuscation.

[0072] Step 103: Based on the embedded objects or links in the first data, determine whether the rich text document has risks.

[0073] The first data stream is used to store embedded objects or links, such as formula editors and scripting languages, which can be used by attackers to insert malicious objects. Therefore, in the embodiment of the present application, the parsing result (first data) of the first data stream can be used to determine whether the RTF document has risks.

[0074] Because the embodiment of the present application is implemented after the conventional detection method cannot read the RTF document normally, or does not detect the risk in the RTF document, that is, in the conventional parsing result, no embedded object or link is parsed; and by deleting the meaningless data after the control word whose read bit attribute is deleted in the first data stream, the first data obtained contains the embedded object or link, then it can be determined that the reason why the conventional parsing method cannot read the RTF document normally is that the first data stream has anti-detection function after obfuscation, and the first data stream includes obfuscated content. According to the obfuscation means of inserting malicious objects into the RTF document, it can be determined that there is a risk in the RTF document.

[0075] Furthermore, malicious detection may be performed again on the first data, that is, to determine whether an embedded object or link of the first data has malicious features, and then determine whether there is a risk.

[0076] This method can improve the efficiency of statically detecting risks in RTF documents.

[0077] The following is a further description of the method provided in the embodiment of the present application based on specific examples:

[0078] (I) The following is a fragment of the first data stream that has not been obfuscated:

[0079] {\objdata

[0080] d0200dl5020000000b0000006551754174694f4e2e3300

[0081] Since the control word objdata is followed by a carriage return character,

[0082] d0200dl5020000000b0000006551754174694f4e2e3300 is a hexadecimal character. By parsing the hexadecimal string, we can get that d0200d15 indicates the Ole version, which can be any value; 02000000 indicates format_id. Here, it is 02000000, which represents an embedded object. 0b000000 is a flag. 6551754174694f4e2e3300 is the Class name, which is an ascii string ending with 0. Here, it is the "eQuAtiON.3" string, which means that the embedded object is Formula Editor 3.

[0083] It should be noted here that when setting format_id, it can only be set to 0x00000001 or 0x00000002, otherwise the object header is invalid. Among them, 0x00000001 is 010000000; 0x00000002 is 02000000, which means an embedded object.

[0084] (II) After the above fragments are obfuscated into malicious objects, one possible form is:

[0085] {\objdata

[0086] d0200dl502{00\mlim\{454416270WEVAspvztr454416270}{\macc\}}00000b0000006551754174694f4e2e3300

[0087] like Figure 2 As shown, in the above fragment, the character string 02000000 indicating format_id is separated by a left bracket “{” and \mlim\{454416270WEVAspvztr454416270}{\macc\}}.

[0088] In the conventional parsing process, when the "{" after 02 is read, if the security parsing software cannot recognize it, the sub-data group {00\mlim\{454416270WEVAspvztr454416270}{\macc\}} starting with "{" will be deleted, which will cause the 00 to be lost and cannot form a meaningful format_id. If the parsing continues, because the conventional parsing method does not consider the read bit attribute of the control word for the first data stream, all characters are saved by default, and the string after the control word mlim is saved, which causes the string with format_id 02000000 to be interrupted, and still cannot form a meaningful format_id. In the process of parsing the data stream, it is necessary to determine the start of reading and locating the embedded object after parsing the format id; when the format id cannot be parsed normally, the embedded object cannot be located and parsed normally, which causes the first data stream to fail to parse normally.

[0089] When the method in the embodiment of the present application is used to parse based on the read bit attribute of the control word, when reading mlim, it is determined that mlim is a control word, and it is further determined that the read bit attribute of the control word mlim is deleted, then the parsing result of the subsequent hexadecimal string is deleted, and the string used for obfuscation can be deleted. It can be seen that in the parsing process of the first data, after the content used for obfuscation is determined to be deleted through the read bit attribute, the format id can be successfully parsed, and then 6551754174694f4e2e3300 can be read. According to the analysis of the fragments without risks in the first part of this example, it can be known that 6551754174694f4e2e3300 is parsed to find that the embedded object is the formula editor 3. Compared with the conventional parsing method, the embedded object obtained by parsing the obfuscated first data stream fragment in the second part of this example using this solution is the formula editor 3. Therefore, it can be determined that the embedded object is obfuscated. According to the common obfuscation methods of malicious objects, it can be determined that the first data stream is at risk, that is, the RTF document is at risk.

[0090] It is worth noting that in this case, the regular format ID in the RTF document is obfuscated as one of the obfuscation methods for malicious objects; in addition, the malicious code hexadecimal string Shellcode can also be obfuscated and inserted. In this case, the detection can also be completed according to the above steps to determine that the RTF document where the Shellcode is located is at risk.

[0091] Based on the same inventive concept, a risk detection device for rich text documents is provided in an embodiment of the present application. Figure 1 The risk detection method for the rich text document shown in the figure corresponds to the specific implementation of the device. The specific implementation of the device can refer to the description of the aforementioned method embodiment part, and the repeated parts will not be repeated. Figure 3 , the device comprises:

[0092] Positioning unit 201: used to position a first data stream in a rich text document; wherein the first data stream is data between a start symbol before a set first control word and an end symbol matching the start symbol.

[0093] Specifically, the first control word is set to objdata.

[0094] A reading unit 202 is used to read the read bit attribute of the control word in the first data stream, and delete or retain the data after the control word in the first data stream based on the read bit attribute to obtain the first data; wherein, when the read bit attribute is deletion, it indicates deletion of the data after the corresponding control word to the next adjacent control word.

[0095] Specifically, the read bit attribute has traceability. When the read bit attribute of any control word is read to be empty, based on the traceability of the read bit attribute, the read bit attribute of the control word closest to the control word is traced back in sequence until the read bit attribute of the control word is determined; wherein the traceability means that the read bit attribute of the control word is the same as the read bit attribute of the closest control word of the same level or the upper level control word.

[0096] Determining unit 203: is used to determine whether the rich text document has risks based on the embedded objects or links in the first data.

[0097] Specifically, when the first data includes the embedded object or link that is not parsed by the conventional parsing method, it is determined that the first data stream includes obfuscated content, and it is determined that the rich text document has a risk.

[0098] The device for risk detection of rich text documents also includes a basic unit, which is specifically used to detect whether the rich text document contains basic malicious features; wherein the basic malicious features refer to malicious features identified by any security parsing software; if so, it is determined that the rich text document is at risk; if not, the first data stream is located.

[0099] Specifically, basic malicious features include: non-compliant header flags, suspicious document creators and last modifiers, control words appearing within a set range before or after the header, unexpected control words, the number of consecutive control words exceeding a first threshold, the number of times a specific character is used exceeding a second threshold, the length of a control word exceeding a third threshold, and unexpected characters appearing between two hexadecimal characters.

[0100] Based on the same inventive concept, the embodiment of the present application further provides a readable storage medium, including:

[0101] Memory,

[0102] The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium completes the risk detection method for rich text documents as described above.

[0103] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0104] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0105] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a universal serial bus flash disk (Universal Serial Bus flash disk), a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a disk or an optical disk, and other media that can store program codes.

[0108] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A risk detection method for rich text documents, characterized in that: The method comprises: In the rich text document, locate a first data stream; wherein the first data stream is data between a start character before a set first control word and an end character matching the start character; Reading a read bit attribute of a control word in the first data stream, deleting or retaining data after the control word in the first data stream based on the read bit attribute, to obtain first data; wherein the read bit attribute is an attribute used to determine whether to retain data from after the corresponding control word to the next adjacent control word, and the read bit attribute is one of delete, retain, and blank. When the read bit attribute is delete, it indicates to delete the data from after the corresponding control word to the next adjacent control word; Based on the embedded objects or links in the first data, it is determined that the rich text document has risks.

2. The method according to claim 1, characterized in that The first control word is objdata.

3. The method according to claim 2, characterized in that The step of locating the first data stream in the rich text document includes: Detecting whether a rich text document contains basic malicious features; wherein the basic malicious features refer to malicious features identified by any security parsing software; If so, it is determined that the rich text document is at risk; if not, the first data stream is located.

4. The method according to claim 3, characterized in that The basic malicious features include: non-compliant header flags, suspicious document creators and last modifiers, control words appearing within a set range before or after the header, unexpected control words, the number of consecutive control words exceeding a first threshold, the number of times a specific character is used exceeding a second threshold, the length of a control word exceeding a third threshold, and unexpected characters appearing between two hexadecimal characters.

5. The method according to any one of claims 1 to 4, characterized in that: The reading of the read bit attribute of the control word in the first data stream includes: When the read bit attribute of any control word is read to be empty, based on the traceability of the read bit attribute, the read bit attribute of the control word closest to the control word is traced back in sequence until it is determined that the read bit attribute of any control word is not empty; wherein the traceability means that the read bit attribute of any control word is the same as the read bit attribute of the closest, same-level control word or upper-level control word.

6. The method according to claim 5, characterized in that The determining that the rich text document has a risk based on the embedded object or link in the first data includes: When the first data includes the embedded object or link that is not parsed by the conventional parsing method, it is determined that the first data stream includes obfuscated content, and it is determined that the rich text document has a risk.

7. A risk detection device for rich text documents, characterized in that: The device comprises: Positioning unit: used for positioning a first data stream in a rich text document; wherein the first data stream is data between a start character before a set first control word and an end character matching the start character; A reading unit; used for reading a read bit attribute of a control word in the first data stream, deleting or retaining data after the control word in the first data stream based on the read bit attribute, and obtaining first data; wherein the read bit attribute is an attribute used to determine whether to retain data from after the corresponding control word to the next adjacent control word, and the read bit attribute is one of delete, retain, and blank. When the read bit attribute is delete, it indicates to delete the data from after the corresponding control word to the next adjacent control word; A determination unit is configured to determine whether the rich text document has a risk based on an embedded object or link in the first data.

8. The device according to claim 7, characterized in that The device also includes a basic unit, which is specifically used to detect whether a rich text document contains basic malicious features; wherein the basic malicious features refer to malicious features identified by any security parsing software; if so, it is determined that the rich text document is at risk; if not, the first data stream is located.

9. The device according to claim 7 or 8, characterized in that The reading unit is specifically used for tracing back the read bit attributes of the control words closest to the control word in sequence, based on the traceability of the read bit attributes, when the read bit attribute of any control word is read to be empty, until it is determined that the read bit attribute of any control word is not empty; wherein the traceability means that the read bit attribute of any control word is the same as the read bit attribute of the closest, same-level control word or upper-level control word.

10. A readable storage medium, characterized in that: include: Memory, The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium implements the method according to any one of claims 1 to 6.

Images