A file detection method and device, electronic equipment and storage medium

Abstract

The application discloses a file detection method and device, electronic equipment and a storage medium, wherein the method comprises: constructing a first fuzzy hash library, a second fuzzy hash library and a third fuzzy hash library; the first fuzzy hash library is a fuzzy hash library corresponding to the macro program of a macro virus file, the second fuzzy hash library is a fuzzy hash library corresponding to the text of the macro virus file, and the third fuzzy hash library is a fuzzy hash library corresponding to the macro program of a normal file; and the first fuzzy hash library, the second fuzzy hash library and the third fuzzy hash library are used to detect a to-be-detected file, so as to determine whether the to-be-detected file is a macro virus file.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a document detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Microsoft Office documents are a common document type used by governments, businesses, and individuals. Macro viruses targeting office documents are frequently found in phishing software and are a key focus of cybersecurity products. Traditional antivirus systems store the characteristics of macro viruses (distinguishing code snippets) in a virus rule base, using this base to identify known macro viruses. However, macro viruses, as script programs, have low mutation costs; after mutation, they can easily deviate from the known virus characteristics in the rule base. Therefore, how to detect macro viruses and their variants is an important task in antivirus research. Summary of the Invention

[0003] To address the aforementioned technical problems, embodiments of this application provide a document detection method, apparatus, electronic device, and storage medium.

[0004] This application provides a document detection method, the method comprising:

[0005] Construct a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library; the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the main text of the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file;

[0006] The file to be detected is analyzed using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to determine whether the file to be detected is a macro virus file.

[0007] In an optional embodiment of this application, the construction of the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library includes:

[0008] Calculate the fuzzy hash value of the macro program in at least one macro virus sample file, and construct a first fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each macro virus sample file;

[0009] Calculate the fuzzy hash value of the text of at least one macrovirus sample file, and construct a second fuzzy hash library based on the calculated fuzzy hash values ​​of the text of each macrovirus sample file;

[0010] Calculate the fuzzy hash value of the macro program in at least one normal sample file, and construct a third fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each normal sample file.

[0011] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file includes:

[0012] Determine a first fuzzy hash value, wherein the first fuzzy hash value is the fuzzy hash value of the macro program of the file to be detected;

[0013] Based on whether there exists a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value, it is determined whether the file to be detected is a macro virus and / or a normal file.

[0014] In an optional embodiment of this application, determining whether the file to be detected is a macro virus and / or a normal file based on whether there is a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value includes:

[0015] Determine whether there exists a fuzzy hash value in the first fuzzy hash database that satisfies a first condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a macro virus file; if it does not exist, determine whether there exists a fuzzy hash value in the first fuzzy hash database that satisfies a second condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a normal file.

[0016] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file further includes:

[0017] If the first fuzzy hash library cannot determine the file, then the third fuzzy hash library contains a fuzzy hash value whose similarity to the first fuzzy hash value meets the third condition. If such a fuzzy hash value exists, then the file to be detected is determined to be a normal file.

[0018] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file further includes:

[0019] If it is determined that the third fuzzy hash library cannot make a judgment, then a second fuzzy hash value is determined, and the second fuzzy hash value is the fuzzy hash value of the body of the file to be detected;

[0020] Determine whether there exists a fuzzy hash value in the second fuzzy hash library that satisfies the fourth condition in terms of similarity to the second fuzzy hash value. If it exists, then determine that the file to be detected is a suspected macro virus file.

[0021] In one optional embodiment of this application, each fuzzy hash value in the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library is calculated using the similarity digest hashing algorithm sdhash.

[0022] This application embodiment also provides a document detection device, the device comprising:

[0023] A construction unit is used to construct a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library; wherein, the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the text in the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file.

[0024] The detection unit is used to perform virus detection on the file to be detected using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library, and to determine whether the file to be detected is a macro virus file.

[0025] In one optional embodiment of this application, the construction unit is specifically used to: calculate the fuzzy hash value of the macro program of at least one macro virus sample file, and construct a first fuzzy hash library based on the calculated fuzzy hash value of the macro program of each macro virus sample file;

[0026] Calculate the fuzzy hash value of the text of at least one macrovirus sample file, and construct a second fuzzy hash library based on the calculated fuzzy hash values ​​of the text of each macrovirus sample file;

[0027] Calculate the fuzzy hash value of the macro program in at least one normal sample file, and construct a third fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each normal sample file.

[0028] In an optional embodiment of this application, the detection unit is specifically used to: determine a first fuzzy hash value, wherein the first fuzzy hash value is the fuzzy hash value of the macro program of the file to be detected; and determine whether the file to be detected is a macro virus and / or a normal file based on whether there is a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value.

[0029] In an optional embodiment of this application, the detection unit is specifically used to: determine whether there exists a fuzzy hash value in the first fuzzy hash library that satisfies a first condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a macro virus file; if it does not exist, determine whether there exists a fuzzy hash value in the first fuzzy hash library that satisfies a second condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a normal file.

[0030] In an optional embodiment of this application, the detection unit is further specifically used to: if it cannot be determined based on the first fuzzy hash library, then determine that there exists a fuzzy hash value in the third fuzzy hash library that satisfies the third condition of similarity with the first fuzzy hash value; if such a fuzzy hash value exists, then determine that the file to be detected is a normal file.

[0031] In an optional embodiment of this application, the detection unit is further specifically configured to: if it is determined that the third fuzzy hash library cannot determine the file, then determine a second fuzzy hash value, wherein the second fuzzy hash value is the fuzzy hash value of the body of the file to be detected; determine whether there is a fuzzy hash value in the second fuzzy hash library that satisfies the fourth condition of similarity with the second fuzzy hash value, and if so, determine that the file to be detected is a suspected macro virus file.

[0032] In one optional embodiment of this application, each fuzzy hash value in the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library is calculated using the similarity digest hashing algorithm sdhash.

[0033] This application also provides an electronic device, which includes a memory and a processor. The memory stores computer-executable instructions, and the processor can implement the methods described in the above embodiments when it executes the computer-executable instructions in the memory.

[0034] This application also provides a computer storage medium storing executable instructions, which, when executed by a processor, implement the methods described in the above embodiments.

[0035] The technical solution of this application embodiment constructs a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library. The first fuzzy hash library is the fuzzy hash library corresponding to the macro program of a macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the body text of a macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of a normal file. By using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to detect the file to be detected, it is possible to determine whether the file to be detected is a macro virus file through a fine-grained detection method. Attached Figure Description

[0036] Figure 1 A flowchart illustrating the document detection method provided in this application embodiment;

[0037] Figure 2 A schematic diagram illustrating the antivirus capability building phase provided in an embodiment of this application;

[0038] Figure 3 A flowchart for document detection provided in this application embodiment;

[0039] Figure 4 This is a schematic diagram of the structural composition of the document detection device provided in the embodiments of this application. Detailed Implementation

[0040] In order to gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for reference and illustration only and are not intended to limit the embodiments of this application.

[0041] The following is an explanation of key terms related to the embodiments of this application:

[0042] VBA (Visual Basic for Applications) is a scripting language extension based on the Visual Basic language. It is mainly used to extend the functionality of Windows applications and is commonly used in Microsoft Office software.

[0043] Macro malware refers to malicious macro programs or files containing embedded malicious macro programs that can harm computers or networks. Macro programs generally refer to VBA programs used in Microsoft Office software.

[0044] A hash is an algorithm that transforms an input of arbitrary length into an output of fixed length.

[0045] Fuzzy hashing is an algorithm for comparing file similarity. It divides the file content into multiple fragments, calculates a hash value for each fragment, and concatenates these hash values ​​to form a fuzzy hash value. String similarity comparison algorithms can be used to determine the similarity between two fuzzy hash values, thereby determining the similarity between two files.

[0046] Similarity digest hashing (sdhash) is an open-source implementation of fuzzy hashing.

[0047] To enable the detection of macro virus files, the embodiments of this application provide the following solutions.

[0048] Option 1: Machine Learning-Based Approach. Specifically, feature engineering is first performed to extract lexical, syntactic, and Office file structure features from a large number of virus and normal files (these features form a feature vector that abstractly represents the file). Then, this feature vector is used to train a model capable of distinguishing between virus and normal files. Finally, this model is used to predict whether the file being tested is a macro virus. Because feature engineering in machine learning abstracts the file structure, and this abstraction can represent various file variants, this machine learning-based approach has the ability to detect variant macro viruses. The drawback of this approach is that the effectiveness of macro virus detection heavily depends on the quality of the training set and the quality of the feature engineering. On the one hand, if the training set contains dirty data—that is, if virus files are mistakenly trained as normal files or vice versa—the accuracy of the model's prediction will be severely affected. On the other hand, if the quality of the features selected in the feature engineering is low and cannot effectively represent the characteristics of virus and normal files, it will lead to model non-convergence or overfitting, ultimately affecting the accuracy of the model's prediction and resulting in false positives or false negatives.

[0049] Feature engineering abstracts VBA code into feature vectors, transforming the training and prediction of VBA samples into the training and prediction of their feature vectors. Its effectiveness depends on the quality of the feature engineering. Common feature engineering techniques include extracting word information through lexical analysis, extracting syntax tree information through syntactic analysis, matching against lists of highly suspicious keywords compiled by virus analysis experts, and calculating information entropy. The drawback of this approach is that its effectiveness depends on the quality of the feature engineering. Furthermore, automated feature engineering cannot meet the requirements of industrial applications—for example, converting VBA to images and then automatically performing feature engineering and training on the images using convolutional neural network algorithms often results in a high false positive rate.

[0050] Option 2: Virus Rule-Based Approach. Specifically, virus analysts manually analyze virus samples to extract virus rules that can detect the virus, and add these rules to a virus rule database. The antivirus system then uses this database to detect the files being tested. During rule extraction, regular expressions and other rule expressions containing wildcards can be used to represent multiple structurally similar variant viruses with a single rule. The main drawback of this approach is the high cost and low efficiency of manual rule extraction.

[0051] Option 3: Virus Hash Value Based Approach. Specifically, a hash algorithm is used to calculate the hash value of the virus and add it to a virus hash database. When detecting a file, if the hash value of the file being tested exists in the virus hash database, the file is considered a virus. In the scenario of detecting Office files, since files may be frequently modified, fuzzy hash values ​​can be used, and the detection process is slightly modified accordingly: if a fuzzy hash value similar to that of the file being tested exists in the virus fuzzy hash database, the file is considered a virus. The drawback of this approach is that it does not detect the VBA and body parts of the Office file, meaning that different Office files composed of the same malicious VBA but different body parts cannot be determined for similarity using this approach.

[0052] Based on the problems of the above three solutions, the following is a solution proposed in this application to detect whether the file to be detected is a macro virus file.

[0053] This application calculates three databases for macro virus files and normal Microsoft Office files based on VBA and the text itself, respectively. This allows for a file detection and removal process based on these three databases, which, compared to the method in Solution 3 above that only calculates one full-text database, can improve the detection effect with finer granularity.

[0054] Figure 1 This is a flowchart illustrating the document detection method provided in the embodiments of this application, such as... Figure 1 As shown, the method includes the following steps:

[0055] Step 101: Construct the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library.

[0056] In this embodiment of the application, the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the body text of the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file.

[0057] In an optional embodiment of this application, step 101 can be implemented through the following process:

[0058] Calculate the fuzzy hash value of the macro program in at least one macro virus sample file, and construct a first fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each macro virus sample file;

[0059] Calculate the fuzzy hash value of the text of at least one macrovirus sample file, and construct a second fuzzy hash library based on the calculated fuzzy hash values ​​of the text of each macrovirus sample file;

[0060] Calculate the fuzzy hash value of the macro program of at least one normal sample file, and construct a third fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs of each normal sample file.

[0061] In this embodiment, the file to be detected, whether it is a macro virus file or a normal file, can contain two parts: macro programs and text. For example, a Word document contains the text content, such as the text, images, tables, etc. displayed on each page of the Word document; the macro program is the sequence of commands used in the document. For normal files, their macro programs do not contain macro viruses. For macro virus files, macro virus files contain computer viruses residing in the macros of the document. Once such a document is opened, the macros will be executed, the macros residing in the document will be activated, and damage will be caused to the computer.

[0062] In this embodiment of the application, the construction process of the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library can be referred to as the antivirus capability construction stage. In this stage, three databases, namely the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library, are constructed using known file samples (such as Microsoft Office sample text). Here, the sample files include macro virus sample files and normal sample files, wherein the normal sample files are sample files that do not contain macro viruses.

[0063] In one optional embodiment of this application, each fuzzy hash value in the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library is calculated using the similarity digest hashing algorithm sdhash.

[0064] The sdhash algorithm can be used to detect known macro viruses and their variants. For example, if this application can detect a known macro virus x, and a variant y is generated by performing a backward rotation substitution operation on all the letters in all variable names of x (i.e., replacing abc with bcd, and xyz with yza), then this application can still detect the variant macro virus y.

[0065] For example, with Figure 2The diagram illustrating the stages of antivirus capability development is used to explain the construction method and process of the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library in the embodiments of this application.

[0066] Step 201: Calculate the fuzzy hash value of the macro virus VBA part using the sdhash algorithm.

[0067] Specifically, for each known macro virus file, a macro sdhash is calculated, and the calculated sdhash value is entered into the macro sdhash black database, which corresponds to the first fuzzy hash database in the embodiments of this application.

[0068] Step 202: Calculate the fuzzy hash value of the macro virus body using the sdhash algorithm.

[0069] Specifically, for each known macro virus file, the sdhash is calculated in the body text, and the calculated sdhash value is entered into the body text sdhash black database, which corresponds to the second fuzzy hash database in the embodiments of this application.

[0070] Step 203: Calculate the fuzzy hash value of the VBA part of a normal Office file using the sdhash algorithm.

[0071] Specifically, the macro sdhash is calculated for each known white Office file (i.e., normal Office file), and the calculated sdhash value is entered into the macro sdhash white library, which corresponds to the third fuzzy hash library in the embodiments of this application.

[0072] It should be noted that, in the selection of fuzzy hashing algorithms, in addition to the sdhash algorithm, the embodiments of this application may also use the ssdeep algorithm or other fuzzy hashing algorithms.

[0073] Step 102: Use the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to detect the file to be detected and determine whether the file to be detected is a macro virus file.

[0074] Specifically, based on the three fuzzy hash libraries built during the antivirus capability development phase, they can be used according to... Figure 3 The file detection process shown examines the file to be detected and ultimately determines whether it is a macro virus file or a normal file.

[0075] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file includes:

[0076] Determine a first fuzzy hash value, wherein the first fuzzy hash value is the fuzzy hash value of the macro program of the file to be detected;

[0077] Based on whether there exists a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value, it is determined whether the file to be detected is a macro virus and / or a normal file.

[0078] Here, it is understood that, depending on the specific conditions set, the embodiments of this application can determine the status of the file to be detected by judging whether the similarity meets certain conditions (i.e., whether the file to be detected is a normal file and / or a macro virus file), or by judging whether the similarity does not meet certain conditions. Both of the above limiting methods are within the protection scope of this application.

[0079] For example, if the specific condition is that the similarity is greater than a certain threshold, the file to be detected can be determined to be a macro virus file based on the existence of a fuzzy hash value in the first fuzzy hash library that satisfies the condition. If the specific condition is that the similarity is less than or equal to a certain threshold, the file to be detected can be determined to be a macro virus file based on the absence of a fuzzy hash value in the first fuzzy hash library that satisfies the condition. In the following embodiments, whether the first, second, third, and fourth conditions are met can also be understood in a similar manner, and the failure to meet the corresponding conditions can be used as the basis for judging the file to be detected.

[0080] In an optional embodiment of this application, the scheme for determining whether the file to be detected is a macro virus and / or a normal file based on whether there is a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value can be implemented in the following way:

[0081] Determine whether there exists a fuzzy hash value in the first fuzzy hash database that satisfies a first condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a macro virus file; if it does not exist, determine whether there exists a fuzzy hash value in the first fuzzy hash database that satisfies a second condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a normal file.

[0082] Here, the first fuzzy hash library contains fuzzy hash values ​​whose similarity to the first fuzzy hash value satisfies the first condition. Specifically, this means that there exists a hash value in the first fuzzy hash library whose similarity to the first fuzzy hash value is greater than the first threshold. For example, for the sdhash algorithm, which is a standard algorithm with a standard threshold range, the similarity can be set as needed within the corresponding threshold range. For example, if the standard threshold range is 0-100, and the similarity between two hash values ​​is 50, then it means that the two hash values ​​are highly similar. Here, the similarity greater than the first threshold (i.e., the similarity satisfies the first condition) can specifically mean that the similarity is greater than 50.

[0083] Similarly, the first fuzzy hash library contains fuzzy hash values ​​whose similarity to the first fuzzy hash value satisfies the second condition. Specifically, the first fuzzy hash library contains a hash value whose similarity to the first fuzzy hash value is less than the second threshold. For example, for the sdhash algorithm, which is a standard algorithm with a standard threshold range, the high and low similarity can be set according to requirements within the corresponding threshold range. For example, if the standard threshold range is 0-100, then if the similarity between two hash values ​​is 20, it means that the similarity between the two hash values ​​is low. Here, the similarity less than the second threshold (i.e., the similarity satisfies the second condition) can specifically mean that the similarity is less than 20.

[0084] Specifically, such as Figure 3 As shown in step 301, the sdhash value v of the VBA (i.e., the macro program of the file to be detected) is calculated and the macro sdhash black database is queried. If v has a high similarity with a certain fuzzy hash value in the macro sdhash black database (e.g., similarity greater than or equal to 50), then the file to be detected is determined to be a macro virus file or a macro virus file with slight modifications (i.e., reported as malicious); if v has a low similarity with a certain value in the macro sdhash black database (e.g., similarity less than 50 but greater than 0), then step 302 is executed.

[0085] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file further includes:

[0086] If the first fuzzy hash library cannot determine the file, then the third fuzzy hash library contains a fuzzy hash value whose similarity to the first fuzzy hash value meets the third condition. If such a fuzzy hash value exists, then the file to be detected is determined to be a normal file.

[0087] Here, the third fuzzy hash library contains fuzzy hash values ​​whose similarity to the first fuzzy hash value meets the third condition. Specifically, it means that there is a hash value in the third fuzzy hash library whose similarity to the first fuzzy hash value is greater than the third threshold. The meaning of the third threshold can be understood with reference to the meaning of the first threshold. Its value can be flexibly set according to the needs, and will not be elaborated here.

[0088] Specifically, such as Figure 3 As shown in step 302, the VBA sdhash is calculated and the macro sdhash whitelist is queried. That is, the VBA sdhash value v in the file to be detected is calculated and the macro sdhash whitelist is queried. If v has a high similarity with a certain value in the macro sdhash whitelist, the file to be detected is determined to be a normal and non-toxic file (i.e., it is reported as whitelisted); if v has a zero similarity with all values ​​in the macro sdhash whitelist, then step 303 is executed.

[0089] In an optional embodiment of this application, the step of using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to perform virus detection on the file to be detected and determine whether the file to be detected is a macro virus file further includes:

[0090] If it is determined that the third fuzzy hash library cannot make a judgment, then a second fuzzy hash value is determined, and the second fuzzy hash value is the fuzzy hash value of the body of the file to be detected;

[0091] Determine whether there exists a fuzzy hash value in the second fuzzy hash library that satisfies the fourth condition in terms of similarity to the second fuzzy hash value. If it exists, then determine that the file to be detected is a suspected macro virus file.

[0092] Here, the second fuzzy hash library contains fuzzy hash values ​​whose similarity to the second fuzzy hash value satisfies the fourth condition. Specifically, it means that there is a hash value in the second fuzzy hash library whose similarity to the second fuzzy hash value is greater than the fourth threshold. The value of the fourth threshold can also be understood with reference to the meaning of the first threshold. Its value can be flexibly set according to the needs, and will not be elaborated here.

[0093] Specifically, such as Figure 3 As shown in step 303, the sdhash value v of the main text of the file to be detected is calculated and the sdhash black database of the main text is queried. If v has a high similarity to a certain value in the sdhash black database of the main text, the file to be detected is determined to be a suspected macro virus file (i.e. reported as suspicious).

[0094] In one optional embodiment of this application, if it is determined that the file to be detected is a suspected macro virus file, a computer virus analysis tool can be further used to detect whether the file to be detected is a macro virus file.

[0095] Specifically, such as Figure 3 As shown in step 304, if the file to be detected is determined to be a suspected macro virus file, the malicious behavior detection process of a computer virus analysis tool (such as a sandbox system) is used to perform dynamic virus detection on the file to be detected.

[0096] It should be noted that, for Figure 3 In steps 301 to 304, since the malice of macro viruses exists in VBA, step 301 can determine whether the file to be detected is a known macro virus or its slight variations when the fuzzy hash similarity between the VBA of the file to be detected and the VBA of a known macro virus is high or zero; however, when the fuzzy hash similarity is low, the certainty of identification is low, and step 302 needs to be introduced. Step 302 can determine whether the VBA in the file to be detected is normal when the fuzzy hash similarity between the VBA of the file to be detected and the VBA in a known normal file is high; however, when the fuzzy hash similarity is low or zero, the certainty of identification is low, and step 303 needs to be introduced. Step 303: If the fuzzy hash similarity between the text of the file to be detected and the text of a known macro virus is low or zero, it can be determined that no known macro virus uses the same text, and therefore the file to be detected is determined to be a normal file; otherwise, if the text of the file to be detected is similar to the text of a known macro virus, and the VBA of the file to be detected also has a low similarity to the VBA of a known macro virus, then the file to be detected is considered a suspected macro virus file, and can enter the sandbox detection process to perform further dynamic analysis on the file to be detected to determine whether it is a macro virus file.

[0097] The technical solution of this application embodiment constructs a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library. The first fuzzy hash library is the fuzzy hash library corresponding to the macro program of a macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the body text of a macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of a normal file. By using the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library to detect the file to be detected, it is determined whether the file to be detected is a macro virus file. This allows for the detection of macro viruses and their variants through a fine-grained detection method, achieving the purpose of detecting known macro viruses and their variants.

[0098] Figure 4 This is a schematic diagram of the structural composition of the document detection device provided in the embodiments of this application, as shown below. Figure 4 As shown, the document detection device includes:

[0099] The construction unit 401 is used to construct a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library; wherein, the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the body of the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file.

[0100] The detection unit 402 is used to perform virus detection on the file to be detected using the first fuzzy hash library, the second fuzzy hash library and the third fuzzy hash library, and to determine whether the file to be detected is a macro virus file.

[0101] In one optional embodiment of this application, the construction unit 401 is specifically used for:

[0102] Calculate the fuzzy hash value of the macro program in at least one macro virus sample file, and construct a first fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each macro virus sample file;

[0103] Calculate the fuzzy hash value of the text of at least one macrovirus sample file, and construct a second fuzzy hash library based on the calculated fuzzy hash values ​​of the text of each macrovirus sample file;

[0104] Calculate the fuzzy hash value of the macro program in at least one normal sample file, and construct a third fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each normal sample file.

[0105] In an optional embodiment of this application, the detection unit 402 is specifically used to: determine a first fuzzy hash value, wherein the first fuzzy hash value is the fuzzy hash value of the macro program of the file to be detected; and determine whether the file to be detected is a macro virus and / or a normal file based on whether there is a fuzzy hash value in the first fuzzy hash library that meets the similarity condition with the first fuzzy hash value.

[0106] In an optional embodiment of this application, the detection unit 402 is specifically used to: determine whether there exists a fuzzy hash value in the first fuzzy hash library that satisfies a first condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a macro virus file; if it does not exist, determine whether there exists a fuzzy hash value in the first fuzzy hash library that satisfies a second condition in terms of similarity to the first fuzzy hash value; if it exists, determine that the file to be detected is a normal file.

[0107] In an optional embodiment of this application, the detection unit 402 is further specifically used to: if it cannot be determined based on the first fuzzy hash library, then determine that there exists a fuzzy hash value in the third fuzzy hash library that satisfies the third condition of similarity with the first fuzzy hash value; if such a fuzzy hash value exists, then determine that the file to be detected is a normal file.

[0108] In an optional embodiment of this application, the detection unit 402 is further specifically used for: if it is determined that the third fuzzy hash library cannot make a judgment, then determining a second fuzzy hash value, wherein the second fuzzy hash value is the fuzzy hash value of the body of the file to be detected; determining whether there is a fuzzy hash value in the second fuzzy hash library that satisfies the fourth condition of similarity with the second fuzzy hash value, and if so, determining that the file to be detected is a suspected macro virus file.

[0109] In one optional embodiment of this application, each fuzzy hash value in the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library is calculated using the similarity digest hashing algorithm sdhash.

[0110] Those skilled in the art should understand that Figure 4 The functions of each unit in the document detection device shown can be understood by referring to the relevant description of the document detection method mentioned above. Figure 4 The functions of each unit in the document detection device shown can be implemented by a program running on a processor or by specific logic circuits.

[0111] This application also provides an electronic device, which includes a memory and a processor. The memory stores computer-executable instructions, and the processor can implement the file detection method described in the above embodiments when it executes the computer-executable instructions in the memory.

[0112] This application also provides a computer storage medium storing executable instructions, which, when executed by a processor, implement the file detection method described in the above embodiments.

[0113] The technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed methods and smart devices can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0115] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0116] In addition, each functional unit in the various embodiments of this application can be integrated into a second processing unit, or each unit can be a separate unit, or two or more units can be integrated into a unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0117] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A document detection method, characterized in that, The method includes: Construct a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library; the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the main text of the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file; Determine the first fuzzy hash value, where the first fuzzy hash value is the fuzzy hash value of the macro program in the file to be detected; If there is no fuzzy hash value in the first fuzzy hash library that satisfies the first and second conditions in terms of similarity to the first fuzzy hash value, then it is determined whether there is a fuzzy hash value in the third fuzzy hash library that satisfies the third condition in terms of similarity to the first fuzzy hash value. If there is no fuzzy hash value in the third fuzzy hash library that satisfies the third condition in terms of similarity to the first fuzzy hash value, then the second fuzzy hash value is determined, and the second fuzzy hash value is the fuzzy hash value of the body of the file to be detected; Determine whether there exists a fuzzy hash value in the second fuzzy hash library that satisfies the fourth condition in terms of similarity to the second fuzzy hash value. If it exists, then determine that the file to be detected is a suspected macro virus file.

2. The method according to claim 1, characterized in that, The construction of the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library includes: Calculate the fuzzy hash value of the macro program in at least one macro virus sample file, and construct a first fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs in each macro virus sample file; Calculate the fuzzy hash value of the text of at least one macrovirus sample file, and construct a second fuzzy hash library based on the calculated fuzzy hash values ​​of the text of each macrovirus sample file; Calculate the fuzzy hash value of the macro program of at least one normal sample file, and construct a third fuzzy hash library based on the calculated fuzzy hash values ​​of the macro programs of each normal sample file.

3. The method according to claim 1, characterized in that, The method further includes: If it is determined that there exists a fuzzy hash value in the first fuzzy hash database that satisfies the first condition of similarity with the first fuzzy hash value, then the file to be detected is determined to be a macro virus file; if there is no fuzzy hash value in the first fuzzy hash database that satisfies the first condition of similarity with the first fuzzy hash value, then it is determined that there exists a fuzzy hash value in the first fuzzy hash database that satisfies the second condition of similarity with the first fuzzy hash value, and if so, the file to be detected is determined to be a normal file.

4. The method according to claim 1, characterized in that, The method further includes: If the third fuzzy hash library contains a fuzzy hash value whose similarity to the first fuzzy hash value meets the third condition, then the file to be detected is determined to be a normal file.

5. The method according to any one of claims 1 to 4, characterized in that, Each fuzzy hash value in the first fuzzy hash library, the second fuzzy hash library, and the third fuzzy hash library is calculated using the similarity digest hashing algorithm sdhash.

6. A document detection device, characterized in that, The device includes: A construction unit is used to construct a first fuzzy hash library, a second fuzzy hash library, and a third fuzzy hash library; wherein, the first fuzzy hash library is the fuzzy hash library corresponding to the macro program of the macro virus file, the second fuzzy hash library is the fuzzy hash library corresponding to the body text of the macro virus file, and the third fuzzy hash library is the fuzzy hash library corresponding to the macro program of the normal file; The detection unit is configured to determine a first fuzzy hash value, which is the fuzzy hash value of the macro program in the file to be detected; if there is no fuzzy hash value in the first fuzzy hash library that satisfies both a first and a second condition in terms of similarity to the first fuzzy hash value, then determine whether there is a fuzzy hash value in the third fuzzy hash library that satisfies a third condition in terms of similarity to the first fuzzy hash value; if there is no fuzzy hash value in the third fuzzy hash library that satisfies the third condition in terms of similarity to the first fuzzy hash value, then determine a second fuzzy hash value, which is the fuzzy hash value of the body text of the file to be detected; and determine whether there is a fuzzy hash value in the second fuzzy hash library that satisfies a fourth condition in terms of similarity to the second fuzzy hash value. If such a fuzzy hash value exists, then the file to be detected is determined to be a suspected macro virus file.

7. An electronic device, characterized in that, The electronic device includes a memory and a processor, wherein the memory stores computer-executable instructions, and the processor, when executing the computer-executable instructions in the memory, can implement the method of any one of claims 1 to 5.

8. A computer storage medium, characterized in that, The storage medium stores executable instructions that, when executed by a processor, implement the method of any one of claims 1 to 5.

Images