A detection method, device, electronic device and storage medium for macro viruses

Abstract

An embodiment of the present invention discloses a method, device, electronic device and medium for detecting macro viruses, which relates to the field of computer security technology and can improve the generality of the macro virus detection method. The method includes: detecting whether there is macro code in a target document; if there is macro code in the target document, determining the difference between the column numbers of a first non-empty cell and a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row of a table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, determining that there is a macro virus in the target document. The technical solution provided by the embodiment of the present invention is applicable to detecting macro viruses in documents.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method, apparatus, electronic device and storage medium for detecting macro viruses. Background Art

[0002] A macro virus refers to a malicious instruction sequence written in a macro language and stored in a data file or a data file template. When a user opens a data file infected with a macro virus or operates on a data file infected with a macro virus and activates the macro code, the virus will be activated and run, thus causing security hazards to the computer.

[0003] The existing method for detecting macro viruses is to perform static analysis on data files using anti-virus software, decompose and identify the structure of data files using the compound data file format, extract the signature codes of all macros in the data files, and compare and match the signature codes of all macros in the extracted data files with the signature codes of macro viruses in the virus library. If there is a match, the matching macro will be cleared. However, in practical applications, the method of detecting macro viruses by performing static analysis on data files using anti-virus software requires the anti-virus software to be able to recognize and analyze the structures of all data files. However, since different application programs have different data file structures, this method is very difficult to implement in practical applications. Therefore, the existing method for identifying macro viruses has the technical problem of poor generality. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, apparatus, electronic device and storage medium for detecting macro viruses, which can improve the generality of the macro virus detection method.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting a macro virus, the method comprising:

[0006] Detecting whether there is macro code in a target document;

[0007] If there is macro code in the target document, determining a difference between a column number of a first non-empty cell and a column number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table in the target document, and cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, determining that there is a macro virus in the target document;

[0008] Or,

[0009] If there is macro code in the target document, determine the difference between the row number of the first non-empty cell and the row number of the second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column of the table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document.

[0010] Optionally, the detecting whether there is macro code in the target document includes:

[0011] Judge whether there is macro code in the target document according to the suffix name of the target document.

[0012] Optionally, the detecting whether there is macro code in the target document includes:

[0013] Use a macro code extraction tool to extract macro code from the target document to generate an extraction result;

[0014] Based on the extraction result, judge whether there is macro code in the target document.

[0015] Optionally, the determining the difference between the column number of the first non-empty cell and the column number of the second non-empty cell in the target document includes:

[0016] Obtain the column number of the first non-empty cell, and detect whether the first cell separated from the first non-empty cell by one cell is non-empty;

[0017] If the first cell is non-empty, determine the first cell as the second non-empty cell;

[0018] If the first cell is empty, detect whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell;

[0019] If the second cell is non-empty, determine the second cell as the second non-empty cell;

[0020] Based on the column number of the first non-empty cell and the column number of the second non-empty cell, determine the difference between the two.

[0021] Optionally, after determining that there is a macro virus in the target document, the method further includes:

[0022] Generate an alarm message and display the alarm message to the user.

[0023] In a second aspect, an embodiment of the present invention provides a macro virus detection device, including:

[0024] A detection module, configured to detect whether there is macro code in a target document;

[0025] A first determination module, configured to, if there is macro code in the target document, determine the difference between the column number of a first non-empty cell and the column number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells;

[0026] A first determination module, configured to, if the difference is greater than a preset threshold, determine that there is a macro virus in the target document;

[0027] Or,

[0028] A second determination module, configured to, if there is macro code in the target document, determine the difference between the row number of a first non-empty cell and the row number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in a table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells;

[0029] A second determination module, configured to, if the difference is greater than a preset threshold, determine that there is a macro virus in the target document.

[0030] Optionally, the detection module is specifically configured to:

[0031] Judge whether there is macro code in the target document according to the suffix name of the target document.

[0032] Optionally, the detection module is specifically configured to:

[0033] Use a macro code extraction tool to extract macro code from the target document to generate an extraction result;

[0034] Based on the extraction result, judge whether there is macro code in the target document.

[0035] Optionally, the first determination module is specifically configured to:

[0036] Obtain the column number of the first non-empty cell, and detect whether a first cell separated from the first non-empty cell by one cell is non-empty;

[0037] If the first cell is non-empty, determine the first cell as the second non-empty cell;

[0038] If the first cell is empty, check whether the second cell, which is separated from the first cell by one cell, is non-empty; the second cell and the first non-empty cell are on both sides of the first cell.

[0039] If the second cell is non-empty, determine the second cell as the second non-empty cell.

[0040] Based on the column numbers of the first non-empty cell and the second non-empty cell, determine the difference between the two.

[0041] Optionally, the device further includes:

[0042] An alarm module, configured to generate an alarm message and display the alarm message to the user.

[0043] In a third aspect, an embodiment of the present invention provides an electronic device, which includes a housing, a processor, a memory, a circuit board, and a power supply circuit. The circuit board is disposed inside the space surrounded by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is configured to supply power to each circuit or device of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program codes by reading the executable program codes stored in the memory, and is configured to execute the macro virus detection method provided by any embodiment of the present invention.

[0044] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the macro virus detection method provided by any embodiment of the present invention.

[0045] The macro virus detection method, device, electronic device and storage medium provided by the embodiments of the present invention can detect whether there is macro code in a target document; if there is macro code in the target document, the difference between the column numbers of the first non-empty cell and the second non-empty cell is determined in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document; or, if there is macro code in the target document, the difference between the row numbers of the first non-empty cell and the second non-empty cell is determined in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document. In this way, by detecting the spacing between adjacent non-empty cells in the table in the document, specifically, it can be the difference in row numbers or column numbers of non-empty cells, and comparing the above difference with the preset threshold, when the above difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of users for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to the tables in any document and has good generality. Therefore, compared with the prior art, it can improve the generality of the macro virus detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0047] Figure 1 It is a flowchart of a macro virus detection method provided by an embodiment of the present invention;

[0048] Figure 2 It is an example diagram of data placement of a macro virus in a document;

[0049] Figure 3 It is a flowchart of another macro virus detection method provided by an embodiment of the present invention;

[0050] Figure 4 It is a structural diagram of a macro virus detection device provided by an embodiment of the present invention;

[0051] Figure 5 Schematic diagram of another macro virus detection device provided by an embodiment of the present invention;

[0052] Figure 6 Schematic diagram of an electronic device provided by an embodiment of the present invention. Specific embodiments

[0053] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0054] It should be clear that the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0055] An embodiment of the present invention provides a method for detecting a macro virus, which can be executed by a macro virus detection device implemented by software and / or hardware. Refer to Figure 1 , and the method may include:

[0056] S11, detecting whether there is macro code in the target document;

[0057] In this step, the target document refers to the document to be currently detected for whether it carries a macro virus. The embodiments of the present invention can detect target documents in various scenarios. For example, documents transmitted and processed in scenarios such as emails, intranet SMB (Server Message Block) file sharing, FTP (File Transfer Protocol), and HTTP (HyperText Transfer Protocol) file transfer are not limited in the embodiments of the present invention.

[0058] The macro code in the embodiments of the present invention refers to an instruction sequence allowed to be used by a programming language in a data file. A macro virus refers to a malicious instruction sequence written in a macro language and stored in a document file or a document file template. When a user opens a document infected with a macro virus or operates on a document infected with a macro virus and activates the macro code, the macro virus will be activated and run, thus posing a security risk. Macro code is a prerequisite for the existence of a macro virus. Therefore, this step first detects whether there is macro code in the target document. If there is no macro code in the document, then there cannot be a macro virus, and the subsequent detection of the macro virus will be meaningless.

[0059] Specifically, according to the received detection instruction, information about the target document can be obtained from the instruction, and then whether there is macro code in the target document can be detected.

[0060] After detecting the macro code in the target document, if the target document contains macro code, there may be a macro virus in the target document and further detection is required. Specifically, step S12 can be executed.

[0061] S12. Determine the difference between the column number of the first non-empty cell and the column number of the second non-empty cell in the target document.

[0062] Wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells.

[0063] If the difference is greater than a preset threshold, execute the following step S13.

[0064] S13. Then determine that there is a macro virus in the target document.

[0065] For ease of description, steps S12 and S13 are combined for elaboration.

[0066] According to the normal operation behavior habits of users for documents, in order to facilitate the viewing and processing of data in the table, users will centrally place the data in the table. At most, according to actual needs, there are a small number of empty cells left between non-empty cells in the table, and there will be no situation where the data is placed at a particularly large distance from other data, that is, there will be no situation where a non-empty cell is at a particularly large distance from other non-empty cells. Contrary to the above operation habits of users, in order to avoid its characteristics being detected by relevant anti-virus software, the macro virus will place the data containing its characteristics in a certain cell in the table. For example Figure 2 As shown, the macro virus will create the file C:\ProgramData\qJjOgwQt.sct and execute the corresponding code using mshta.exe and store it in cell B577. The Auto_open label of the document is set to cell B37 which is blank. When the macro code in the table is started, it will sequentially execute the code in each cell of this column downward, so the content in B577 will be executed, thus causing a security hazard to the computer.

[0067] When a macro virus places data in a table, to prevent users from discovering the data including its characteristics placed in the table during the use of the table, the data including its characteristics is usually placed in a position far from other non-empty cells containing data in the table. For example, in a table, the area where users place data ranges from row number 1 to 50 and column number 1 to 50. To avoid the data it places in the table from being discovered, the macro virus will place this data in a position far from the above area. For example, in a cell with row number 500 and column number 500.

[0068] It can be understood that if two non-empty cells in the same row of a table are directly adjacent and there is no cell between them, this situation conforms to the user's operation habit and does not conform to the way the macro virus places data. Therefore, it can be directly determined that it cannot be inferred that the table contains a macro virus. Therefore, in the embodiments of the present invention, this situation can be directly ignored, and only the two non-empty cells with empty cells in the middle need to be detected.

[0069] In an implementation manner of the embodiments of the present invention, it is possible to detect whether there is a situation where the distance between a non-empty cell and its adjacent non-empty cell (referring to two non-empty cells with only empty cells between them) in each row of the table exceeds a preset threshold, so as to detect whether there is a macro virus. Specifically, the difference in column numbers of two adjacent non-empty cells can be detected and compared with the preset threshold.

[0070] The preset threshold can be set accordingly according to the actual situation. For example, in a table in the area where data is normally stored, if in each row, the number of consecutive empty cells does not exceed 10, it means that the difference in column numbers between two adjacent non-empty cells is not greater than 10. The above preset threshold can be set to 10. If the difference in column numbers of two adjacent non-empty cells is greater than 10, it is sufficient to show that this way of placing data does not conform to the user's operation habit. Therefore, it can be determined that there is data placed by a macro virus in the table, and thus it can be judged that there is a macro virus in the table.

[0071] The macro virus detection method provided by the embodiments of the present invention can detect whether there is macro code in a target document; if there is macro code in the target document, the difference between the column number of a first non-empty cell and the column number of a second non-empty cell is determined in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document. In this way, by detecting the difference in column numbers between adjacent non-empty cells in the same row in the document and comparing the difference with the preset threshold, when the difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of users for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to tables in any document and has good versatility. Therefore, compared with the prior art, it can improve the versatility of the macro virus detection method.

[0072] Optionally, in an embodiment of the present invention, in step S11, the detecting whether there is macro code in the target document may include: judging whether there is macro code in the target document according to the suffix name of the target document.

[0073] Specifically, taking an EXCEL table as an example, for an EXCEL table containing macro code, its suffix name is.xlam or.xlsm. Therefore, it is possible to quickly judge whether there is macro code in the EXCEL table through the suffix name of the target document.

[0074] In addition to the above method of detecting macro code using the suffix name of the document, in an embodiment of the present invention, in step S11, the detecting whether there is macro code in the target document may include: using a macro code extraction tool to extract macro code from the target document to generate an extraction result; and judging whether there is macro code in the target document based on the extraction result.

[0075] In the embodiments of the present invention, it is possible to judge whether a target file contains macro code. Specifically, it is possible to try to use a macro code extraction tool, such as oletools, to extract macro code line by line from the target file. If the macro code can be extracted, it can be determined that the target file contains macro code. If the extraction fails, it can be determined that the target file does not contain macro code, and there is no need to perform subsequent operations on the target file.

[0076] Specifically, it is possible to detect whether the field value in [Content_Types].xml is: ContentType = "application / vnd.ms-office.vbaProject". For Excel 4.0 macros, it is possible to detect whether it is: ContentType = "application / vnd.ms-excel.macrosheet+xml", and at the same time check whether there are worksheets in the macrosheets folder.

[0077] Optionally, in an embodiment of the present invention, the determination of the difference between the column numbers of the first non-empty cell and the second non-empty cell in the target document may include: obtaining the column number of the first non-empty cell, and detecting whether the first cell separated from the first non-empty cell by one cell is non-empty; if the first cell is non-empty, then determining the first cell as the second non-empty cell; if the first cell is empty, then detecting whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are located on both sides of the first cell; if the second cell is non-empty, then determining the second cell as the second non-empty cell; based on the column numbers of the first non-empty cell and the second non-empty cell, determining the difference between the two.

[0078] In an embodiment of the present invention, it is necessary to calculate the distance between any two adjacent non-empty cells on the same row in the table to achieve a comprehensive and thorough detection of the table. Therefore, the first non-empty cell here can be any non-empty cell in the table. Through the first non-empty cell, the second non-empty cell adjacent to it in the row direction can be found, and on this basis, the distance between the two can be obtained. Specifically, after determining the first non-empty cell, it is possible to detect whether the cell separated from the first non-empty cell by one cell is a non-empty cell. If so, it can be determined that the first cell is the second non-empty cell adjacent to the first non-empty cell. If not, according to the above method, continue to detect whether the next cell is non-empty along the same direction as the first cell, and repeat the above steps until the non-empty cell adjacent to the first non-empty cell (i.e., the second non-empty cell) is found. Using the above method, it is possible to quickly and accurately determine the non-empty cell adjacent to any non-empty cell.

[0079] Optionally, in an embodiment of the present invention, after determining that there is a macro virus in the target document, the macro virus detection method provided by the embodiments of the present invention may further include: generating an alarm message and presenting the alarm message to the user.

[0080] In an embodiment of the present invention, when a macro virus exists in a table, an alarm message can be generated, and the alarm message is transmitted to the user terminal and displayed, so that the user can promptly remove the macro virus to eliminate potential safety hazards.

[0081] In addition to detecting the macro virus by using the spacing between adjacent non-empty cells in the same row of the table, the spacing between adjacent non-empty cells in the same column of the table can also be used to detect the macro virus. Please refer to Figure 3 , and the following is a detailed description. The method for detecting a macro virus provided by the embodiment of the present invention may include:

[0082] S21, detecting whether there is macro code in the target document;

[0083] In the embodiment of the present invention, the implementation process of step S21 is the same as that of step S11 in the above method embodiment, and will not be elaborated here.

[0084] S22, if there is macro code in the target document, determining the difference between the row numbers of the first non-empty cell and the second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column of the table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells;

[0085] If the difference is greater than a preset threshold, execute the following step S23.

[0086] S23, then it is determined that there is a macro virus in the target document.

[0087] For ease of description, steps S22 and S23 are combined for elaboration.

[0088] According to the normal operation behavior habits of users for documents, in order to facilitate viewing and processing of data in the table, users will centrally place the data in the table. At most, according to actual needs, there are a small number of empty cells left between non-empty cells in the table, and there will be no situation where the data is placed at a particularly large distance from other data, that is, there will be no situation where a non-empty cell is at a particularly large distance from other non-empty cells. Contrary to the above operation habits of users, in order to avoid its characteristics being detected by relevant anti-virus software, a macro virus will place the data containing its characteristics in a certain cell of the table.

[0089] When a macro virus places data in a table, in order to prevent users from discovering the data including its characteristics placed in the table during the use of the table, the data including its characteristics is usually placed in a location far from other non-empty cells containing data in the table. For example, in the table, the area where the user places data ranges from row number 1 to 50 and column number 1 to 50. In order to prevent the data it places in the table from being discovered, the macro virus will place this data in a location far from the above area. For example, in a cell with row number 500 and column number 500.

[0090] It can be understood that if two non-empty cells in the same column of the table are directly adjacent and there are no cells between them, this situation conforms to the user's operation habit and does not conform to the way the macro virus places data. Therefore, it can be directly determined that it cannot be inferred that the table contains a macro virus. Therefore, in the embodiments of the present invention, this situation can be directly ignored, and only two non-empty cells with empty cells in the middle need to be detected.

[0091] In an implementation manner of the embodiments of the present invention, it is possible to detect whether there is a situation where the distance between a non-empty cell and its adjacent non-empty cell (referring to two non-empty cells with only empty cells between them) in each column of the table exceeds a preset threshold, so as to detect whether there is a macro virus. Specifically, the column number difference between two adjacent non-empty cells can be detected and compared with the preset threshold.

[0092] The preset threshold can be set accordingly according to the actual situation. For example, if in the area where data is normally stored in a table, in each column, when the number of consecutive empty cells does not exceed 10, it means that if the row number difference between two adjacent non-empty cells is not greater than 10. The above preset threshold can be set to 10. If the row number difference between two adjacent non-empty cells is greater than 10, it is sufficient to show that this way of placing data does not conform to the user's operation habit. Therefore, it can be determined that there is data placed by a macro virus in the table, and thus it can be determined that there is a macro virus in the table.

[0093] The macro virus detection method provided by the embodiments of the present invention can detect whether there is macro code in a target document; if there is macro code in the target document, the difference between the row number of the first non-empty cell and the row number of the second non-empty cell is determined in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document. In this way, by detecting the difference in row numbers between non-empty cells in the same column in the document and comparing the above difference with the preset threshold. When the above difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of users for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to the tables in any document and has good versatility. Therefore, compared with the prior art, it can improve the versatility of the macro virus detection method.

[0094] Optionally, in an embodiment of the present invention, in step S21, the detecting whether there is macro code in the target document may include: judging whether there is macro code in the target document according to the suffix name of the target document.

[0095] Specifically, taking an EXCEL table as an example, for an EXCEL table containing macro code, its suffix name is.xlam or.xlsm. Therefore, it can be judged whether there is macro code in the EXCEL table through the suffix name of the target document.

[0096] In addition to the above method of detecting macro code using the suffix name of the document, in an embodiment of the present invention, in step S21, the detecting whether there is macro code in the target document may include: using a macro code extraction tool to extract macro code from the target document to generate an extraction result; based on the extraction result, judging whether there is macro code in the target document.

[0097] In the embodiments of the present invention, it can be judged whether a target file contains macro code. Specifically, it can be attempted to use a macro code extraction tool, such as oletools, to extract macro code line by line from the target file. If the macro code can be extracted, it can be determined that the target file contains macro code. If the extraction fails, it can be determined that the target file does not contain macro code, and there is no need to perform subsequent operations on the target file.

[0098] Specifically, it is possible to detect whether the field value in [Content_Types].xml is: ContentType = "application / vnd.ms-office.vbaProject". For Excel 4.0 macros, it is possible to detect whether it is: ContentType = "application / vnd.ms-excel.macrosheet+xml", and at the same time check whether there are worksheets in the macrosheets folder.

[0099] Optionally, in an embodiment of the present invention, the difference between the row number of the first non-empty cell and the row number of the second non-empty cell determined in the target document may include: obtaining the row number of the first non-empty cell, and detecting whether the first cell separated from the first non-empty cell by one cell is non-empty; if the first cell is non-empty, determining the first cell as the second non-empty cell; if the first cell is empty, detecting whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are located on both sides of the first cell; if the second cell is non-empty, determining the second cell as the second non-empty cell; based on the row number of the first non-empty cell and the row number of the second non-empty cell, determining the difference between the two.

[0100] In an embodiment of the present invention, it is necessary to calculate the spacing between any two adjacent non-empty cells in the same column of the table to achieve a comprehensive and thorough detection of the table, thereby improving the detection effect. Therefore, the first non-empty cell here can be any non-empty cell in the table. Through the first non-empty cell, the second non-empty cell adjacent to it in the column direction can be found, and on this basis, the spacing between the two can be obtained. Specifically, after determining the first non-empty cell, it is possible to detect whether the cell separated from the first non-empty cell by one cell in the column direction is a non-empty cell. If so, it can be determined that the first cell is the second non-empty cell adjacent to the first non-empty cell. If not, according to the above method, continue to detect whether the next cell is non-empty along the same direction as the first cell, and repeat the above steps until the non-empty cell adjacent to the first non-empty cell (i.e., the second non-empty cell) is found. By using the above method, it is possible to quickly and accurately determine the non-empty cell adjacent to any non-empty cell in the column direction.

[0101] Optionally, in an embodiment of the present invention, after determining that there is a macro virus in the target document, the macro virus detection method provided by the embodiments of the present invention may further include: generating an alarm message and presenting the alarm message to the user.

[0102] In an embodiment of the present invention, when a macro virus exists in a table, an alarm message can be generated, transmitted to a user terminal, and displayed, so that the user can remove the macro virus and eliminate potential safety hazards.

[0103] Correspondingly, as Figure 4 shown, an embodiment of the present invention further provides a macro virus detection device 4, including:

[0104] A detection module 41, configured to detect whether there is macro code in a target document;

[0105] A first determination module 42, configured to, if there is macro code in the target document, determine a difference between a column number of a first non-empty cell and a column number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table of the target document, and cells between the first non-empty cell and the second non-empty cell are empty cells;

[0106] A first determination module 43, configured to determine that there is a macro virus in the target document if the difference is greater than a preset threshold.

[0107] The macro virus detection device provided by the embodiment of the present invention can detect whether there is macro code in a target document; if there is macro code in the target document, determine a difference between a column number of a first non-empty cell and a column number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table of the target document, and cells between the first non-empty cell and the second non-empty cell are empty cells; determine that there is a macro virus in the target document if the difference is greater than a preset threshold. In this way, by detecting the difference in column numbers between adjacent non-empty cells in the same row in the document and comparing the difference with a preset threshold. When the difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of the user for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to tables in any document and has good versatility. Therefore, compared with the prior art, it can improve the versatility of the macro virus detection method.

[0108] Optionally, the detection module 41 is specifically configured to:

[0109] Judge whether there is macro code in the target document according to the suffix name of the target document.

[0110] Optionally, the detection module 41 is specifically configured to:

[0111] Extract macro code from the target document using a macro code extraction tool to generate an extraction result;

[0112] Based on the extraction result, determine whether there is macro code in the target document.

[0113] Optionally, the first determination module 42 is specifically configured to:

[0114] Obtain the column number of the first non-empty cell, and detect whether the first cell that is one cell apart from the first non-empty cell is non-empty;

[0115] If the first cell is non-empty, determine the first cell as the second non-empty cell;

[0116] If the first cell is empty, detect whether the second cell that is one cell apart from the first cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell;

[0117] If the second cell is non-empty, determine the second cell as the second non-empty cell;

[0118] Based on the column numbers of the first non-empty cell and the second non-empty cell, determine the difference between the two.

[0119] Optionally, the device 4 further includes:

[0120] An alarm module, configured to generate an alarm message and display the alarm message to the user.

[0121] In addition, as Figure 5 shown, another macro virus detection device 5 provided by an embodiment of the present invention includes:

[0122] A detection module 51, configured to detect whether there is macro code in a target document;

[0123] A second determination module 52, configured to, if there is macro code in the target document, determine the difference between the row numbers of the first non-empty cell and the second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in a table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells;

[0124] A second determination module 53, configured to determine that there is a macro virus in the target document if the difference is greater than a preset threshold.

[0125] The macro virus detection device provided by the embodiment of the present invention can detect whether there is macro code in the target document; if there is macro code in the target document, the difference between the row number of the first non-empty cell and the row number of the second non-empty cell is determined in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document. In this way, by detecting the difference in row numbers between non-empty cells in the same column in the document and comparing the above difference with the preset threshold. When the above difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of users for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to the tables in any document and has good versatility. Therefore, compared with the prior art, it can improve the versatility of the macro virus detection method.

[0126] Optionally, the detection module 51 is specifically configured to:

[0127] Judge whether there is macro code in the target document according to the suffix name of the target document.

[0128] Optionally, the detection module 51 is specifically configured to:

[0129] Use a macro code extraction tool to extract macro code from the target document to generate an extraction result;

[0130] Based on the extraction result, judge whether there is macro code in the target document.

[0131] Optionally, the second determination module 52 is specifically configured to:

[0132] Obtain the row number of the first non-empty cell, and detect whether the first cell separated from the first non-empty cell by one cell is non-empty;

[0133] If the first cell is non-empty, determine the first cell as the second non-empty cell;

[0134] If the first cell is empty, detect whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell;

[0135] If the second cell is non-empty, determine the second cell as the second non-empty cell;

[0136] Based on the row number of the first non-empty cell and the row number of the second non-empty cell, determine the difference between the two.

[0137] Optionally, the apparatus 5 further includes:

[0138] An alarm module, configured to generate an alarm message and present the alarm message to the user.

[0139] The two macro virus detection apparatuses provided by the embodiments of the present invention and the foregoing two macro virus detection methods belong to the same inventive concept. For technical details not described in the macro virus detection apparatus, reference may be made to the relevant descriptions in the foregoing macro virus detection methods, which will not be elaborated herein.

[0140] Correspondingly, an embodiment of the present invention further provides an electronic device. Figure 6 It is a schematic structural diagram of an embodiment of the electronic device of the present invention and can implement the present invention Figure 1 Or Figure 3 The process of the illustrated embodiment. As Figure 6 Shown, the above electronic device may include: a housing 31, a processor 32, a memory 33, a circuit board 34, and a power supply circuit 35. Among them, the circuit board 34 is disposed inside the space enclosed by the housing 31, and the processor 32 and the memory 33 are disposed on the circuit board 34; the power supply circuit 35 is configured to supply power to each circuit or device of the above electronic device; the memory 33 is used to store executable program codes; the processor 32 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 33, and is configured to execute the method described in any of the foregoing embodiments.

[0141] The specific execution process of the above steps by the processor 32 and the steps further executed by the processor 32 by running the executable program code may be referred to the description of the embodiments of the present invention Figure 1 Or Figure 3 Shown, which will not be elaborated herein.

[0142] The electronic device exists in various forms, including but not limited to:

[0143] (1) Mobile communication devices: These devices are characterized by having mobile communication functions and mainly aim to provide voice and data communications. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones, etc.

[0144] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have the characteristic of mobile Internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as iPad.

[0145] (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable in-vehicle navigation devices.

[0146] (4) Servers: Devices that provide computing services. The composition of a server includes a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but due to the need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc.

[0147] (5) Other electronic devices with data interaction functions.

[0148] In addition, an embodiment of the present invention also provides a computer program medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method provided by any embodiment of the present invention. Therefore, the corresponding beneficial technical effects can also be achieved, which have been described above and will not be repeated here.

[0149] The macro virus detection method, device, electronic device, and storage medium provided by the embodiments of the present invention can detect whether there is macro code in a target document; if there is macro code in the target document, determine the difference between the column numbers of a first non-empty cell and a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, determine that there is a macro virus in the target document; or, if there is macro code in the target document, determine the difference between the row numbers of a first non-empty cell and a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in the table of the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, determine that there is a macro virus in the target document. In this way, by detecting the spacing between adjacent non-empty cells in the table of the document, specifically, it can be the difference in row numbers or column numbers of non-empty cells, and compare the above difference with a preset threshold. When the above difference is greater than the preset threshold, it can be known that the way of storing data in the target document does not conform to the normal operation behavior habits of users for the document, so it can be determined that there is a macro virus in the target document. This solution is applicable to the tables in any document and has good versatility. Therefore, compared with the prior art, it can improve the versatility of the macro virus detection method. In addition, the embodiments of the present invention can quickly determine whether there is macro code in the target document according to the suffix name of the target document. The embodiments of the present invention can also use a macro code extraction tool to extract macro code from the target document and determine whether there is macro code in the target document according to the extraction result. The embodiments of the present invention also provide a specific method for quickly finding the second non-empty cell adjacent to a first non-empty cell. When detecting that there is a macro virus in the target document, the embodiments of the present invention can generate an alarm message and send it to the customer for the user to promptly remove the macro virus.

[0150] It should be noted that in this text, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or device comprising said element.

[0151] In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects and indicates that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects before and after.

[0152] Each embodiment in this specification is described in a related manner. For the same or similar parts between the embodiments, reference can be made to each other, and the differences between each embodiment and other embodiments are emphasized.

[0153] In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple. For the relevant parts, reference can be made to the description of the method embodiments.

[0154] For the convenience of description, the above device is described by dividing its functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be realized in the same or multiple software and / or hardware.

[0155] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through a computer program. The program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the above method embodiments. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0156] As described above, it is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for detecting macro viruses, characterized in that, The method includes: Detecting whether there is macro code in the target document; If there is macro code in the target document, determining the difference between the column number of the first non-empty cell and the column number of the second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row of the table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; if the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document; The determining the difference between the column number of the first non-empty cell and the column number of the second non-empty cell in the target document includes: Obtaining the column number of the first non-empty cell and detecting whether the first cell separated from the first non-empty cell by one cell is non-empty; If the first cell is non-empty, determining the first cell as the second non-empty cell; If the first cell is empty, detecting whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell; If the second cell is non-empty, determining the second cell as the second non-empty cell; Based on the column number of the first non-empty cell and the column number of the second non-empty cell, determining the difference between the two; Or, If there is macro code in the target document, determining the difference between the row number of the first non-empty cell and the row number of the second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column of the table in the target document, and the cells between the first non-empty cell and the second non-empty cell are empty cells; If the difference is greater than a preset threshold, it is determined that there is a macro virus in the target document; The determining the difference between the row number of the first non-empty cell and the row number of the second non-empty cell in the target document includes: obtaining the row number of the first non-empty cell, detecting whether the first cell separated from the first non-empty cell by one cell is non-empty; if the first cell is non-empty, determining the first cell as the second non-empty cell; if the first cell is empty, detecting whether the second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell; if the second cell is non-empty, determining the second cell as the second non-empty cell; based on the row number of the first non-empty cell and the row number of the second non-empty cell, determining the difference between the two.

2. The method according to claim 1, wherein The detecting whether there is macro code in the target document includes: Judging whether there is macro code in the target document according to the suffix name of the target document.

3. The method according to claim 1, wherein The detecting whether there is macro code in the target document includes: Using a macro code extraction tool to extract macro code from the target document to generate an extraction result; Based on the extraction result, judging whether there is macro code in the target document.

4. The method according to any one of claims 1 to 3, characterized in that After determining that there is a macro virus in the target document, the method further includes: Generating an alarm message and presenting the alarm message to the user.

5. A detection device for macro viruses, characterized in that, The apparatus includes: A detection module, configured to detect whether there is macro code in a target document; A first determination module, configured to, if there is macro code in the target document, determine a difference between a column number of a first non-empty cell and a column number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same row in a table in the target document, and cells between the first non-empty cell and the second non-empty cell are empty cells; A first determination module, configured to determine that there is a macro virus in the target document if the difference is greater than a preset threshold; The first determination module is specifically configured to: Obtain the column number of the first non-empty cell, and detect whether a first cell separated from the first non-empty cell by one cell is non-empty; If the first cell is non-empty, determine the first cell as the second non-empty cell; If the first cell is empty, detect whether a second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell; If the second cell is non-empty, determine the second cell as the second non-empty cell; Determine a difference between them based on the column number of the first non-empty cell and the column number of the second non-empty cell; Or, A second determination module, configured to, if there is macro code in the target document, determine a difference between a row number of a first non-empty cell and a row number of a second non-empty cell in the target document; wherein, the first non-empty cell and the second non-empty cell are two cells in the same column in a table in the target document, and cells between the first non-empty cell and the second non-empty cell are empty cells; A second determination module, configured to determine that there is a macro virus in the target document if the difference is greater than a preset threshold; The second determination module is specifically configured to: obtain the row number of the first non-empty cell, detect whether a first cell separated from the first non-empty cell by one cell is non-empty; if the first cell is non-empty, determine the first cell as the second non-empty cell; if the first cell is empty, detect whether a second cell separated from the first cell by one cell is non-empty; the second cell and the first non-empty cell are on both sides of the first cell; if the second cell is non-empty, determine the second cell as the second non-empty cell; determine a difference between them based on the row number of the first non-empty cell and the row number of the second non-empty cell.

6. The device according to claim 5, characterized in that, The detection module is specifically configured to: Judge whether there is macro code in the target document according to the suffix name of the target document.

7. The device according to claim 5, wherein The detection module is specifically configured to: Use a macro code extraction tool to extract macro code from the target document to generate an extraction result; Judge whether there is macro code in the target document based on the extraction result.

8. The device according to any one of claims 5 to 7, characterized in that, The device further includes: An alarm module, configured to generate an alarm message and display the alarm message to the user.

9. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit. Wherein, the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to each circuit or device of the above-mentioned electronic device; the memory is used to store executable program codes; the processor runs a program corresponding to the executable program codes by reading the executable program codes stored in the memory, and is used to execute the method according to any one of the preceding claims 1 to 4.

10. A computer program medium, characterized in that, A computer program is stored thereon, characterized in that when the program is executed by the processor, the method according to any one of claims 1 to 4 is implemented.

Images