An Office document detection method, apparatus, device, and readable storage medium.
By converting Office files into a tree structure and replacing node data to generate an updated tree, the problem of time-consuming, labor-intensive, and costly detection in existing technologies is solved, and fast and accurate malicious feature detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SANGFOR TECH INC
- Filing Date
- 2021-06-21
- Publication Date
- 2026-07-17
Smart Images
Figure CN115577354B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to an Office document detection method, apparatus, device, and readable storage medium. Background Technology
[0002] Currently, malicious features in Office files are generally identified through manual detection and sandbox detection. Manual detection requires human analysis of the relevant code and content of the Office file, a time-consuming and labor-intensive process. Furthermore, the quality of the extracted malicious features depends heavily on the analytical skills and experience of the technical personnel, making it difficult to extract newer malicious features. Sandbox detection requires the Office file to run in a virtualized, isolated environment, which places high demands on performance and cost.
[0003] Therefore, how to quickly and accurately detect malicious features in Office files under low performance conditions is a problem that needs to be solved by those skilled in the art. Summary of the Invention
[0004] In view of this, the purpose of this application is to provide a method, apparatus, device, and readable storage medium for detecting Office files, so as to quickly and accurately detect malicious features in Office files under low performance conditions. The specific solution is as follows:
[0005] Firstly, this application provides a method for detecting Office files, including:
[0006] Obtain the Office file to be tested;
[0007] If the Office file is a black file, then convert the Office file into a structure tree;
[0008] Replace the data at any node in the structure tree with any white data to obtain an updated tree;
[0009] If the updated tree does not contain malicious data, then the data at that node is recorded as a malicious feature in the malicious database.
[0010] Preferably, converting the Office file into a structure tree includes:
[0011] The Office files are parsed to obtain multiple data warehouses;
[0012] The data flow in each data warehouse is identified as a tree node, and the tree nodes are connected to obtain the structure tree.
[0013] Preferably, before determining the data stream in each data warehouse as a tree node, the method further includes:
[0014] The data stream in each data warehouse is divided into multiple data blocks according to the preset sector size.
[0015] Preferably, the step of replacing the data at any node in the structure tree with arbitrary white data to obtain an updated tree includes:
[0016] Identify replaceable data blocks within the data at that node;
[0017] The arbitrary white data is used to replace the partial data block to obtain the updated tree.
[0018] Preferably, the step of replacing the partial data block with the arbitrary white data to obtain the updated tree includes:
[0019] Determine the type of the aforementioned data blocks;
[0020] Query the target white data corresponding to the type in the preset replacement library;
[0021] The target white data is used to replace the partial data block to obtain the updated tree.
[0022] Preferably, it further includes:
[0023] In the case that the updated tree contains malicious data, and / or after the data at the node is recorded as a malicious feature to the malicious database, the node that has been replaced in the tree structure is identified as a detected node, and other nodes other than the detected node are identified in the tree structure. The data at the other nodes is replaced with arbitrary white data to obtain a new updated tree.
[0024] Preferably, it further includes:
[0025] The malicious database was used to detect unknown Office files.
[0026] Preferably, if any one of the multiple antivirus engines determines that the Office file contains malicious data, then the Office file is determined to be a malicious file.
[0027] Secondly, this application provides an Office document detection device, comprising:
[0028] The acquisition module is used to acquire the Office file to be detected;
[0029] A conversion module is used to convert the Office file into a structure tree if the Office file is a black file;
[0030] The replacement module is used to replace the data at any node in the structure tree with arbitrary white data to obtain an updated tree;
[0031] The recording module is used to record the data at the node as a malicious feature to the malicious database if the update tree does not contain malicious data.
[0032] Thirdly, this application provides an electronic device, comprising:
[0033] Memory, used to store computer programs;
[0034] A processor is used to execute the computer program to implement the aforementioned disclosed Office file detection method.
[0035] Fourthly, this application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned disclosed Office file detection method.
[0036] As can be seen from the above scheme, this application provides an Office file detection method, including: obtaining the Office file to be detected; if the Office file is a black file, converting the Office file into a structure tree; replacing the data at any node in the structure tree with arbitrary white data to obtain an updated tree; if the updated tree does not contain malicious data, recording the data at that node as a malicious feature in a malicious database.
[0037] As can be seen, this application targets malicious Office files, converts them into a tree structure, and replaces data at any node in the tree structure with arbitrary white data to obtain an updated tree. If the resulting updated tree does not contain malicious data, it indicates that the malicious file has been converted into a white file after the replacement, meaning that the replaced data is the reason why the Office file was a malicious file. Therefore, this data is recorded as malicious features in a malicious database. This application does not require running the Office file; it can detect malicious features based on a static Office file, and it does not care whether the malicious features are known. Therefore, new malicious features can be recorded. Furthermore, it does not require setting up a virtualized isolation environment for running Office files, resulting in lower performance and cost requirements. Therefore, this application can quickly and accurately detect malicious features in Office files under relatively low performance conditions.
[0038] Correspondingly, the Office document detection device, equipment, and readable storage medium provided in this application also have the above-mentioned technical effects. Attached Figure Description
[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0040] Figure 1 This is a flowchart of an Office document detection method disclosed in this application;
[0041] Figure 2 This application discloses a data flow diagram in an Office file;
[0042] Figure 3 This is a flowchart of another Office document detection method disclosed in this application;
[0043] Figure 4 This is a schematic diagram of an Office document detection device disclosed in this application;
[0044] Figure 5 This is a schematic diagram of an electronic device disclosed in this application;
[0045] Figure 6 This is a schematic diagram of another electronic device disclosed in this application. Detailed Implementation
[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0047] Currently, manual detection requires human analysis of the relevant code and content of Office files, a time-consuming and labor-intensive process. Furthermore, the quality of extracted malicious features depends heavily on the analytical skills and experience of the technicians, making it difficult to extract novel malicious features. Sandbox detection requires Office files to run in a virtualized, isolated environment, resulting in high performance and cost requirements. Therefore, this application provides an Office file detection solution that can quickly and accurately detect malicious features in Office files under lower performance conditions.
[0048] See Figure 1 As shown in the figure, this application discloses an Office file detection method, including:
[0049] S101. Obtain the Office file to be tested.
[0050] Office documents are also known as compound documents. Examples include: RTF (Rich Text Format) files; binary files from Word 97 to Word 2003; XML-based files with macros enabled from Word 2019, Word 2016, Word 2013, Word 2010, and Office Word 2007; the default XML-based files from Word 2019, Word 2016, Word 2013, Word 2010, and Office Word 2007; Strict configuration files conforming to Open XML standards (such as ISO / IEC 29500); portable documents (such as PDFs); PostScript-based files; binary files from Excel 97 to Excel 2003; binary files from Excel 5.0 / 95; XML-based files with macros enabled from Excel 2019, Excel 2016, Excel 2013, Excel 2010, and Office Excel 2007; and files from Excel 2019, Excel 2016, Excel 2013, Excel 2010, and Office... Excel 2007's default XML-based file; the default format for PowerPoint 97 to Office PowerPoint 2003; presentations including Visual Basic for Applications (VBA) code; and the default XML-based file for PowerPoint 2019, PowerPoint 2016, PowerPoint 2013, PowerPoint 2010, and Office PowerPoint 2007.
[0051] S102. If the Office file is a black file, convert the Office file into a structure tree.
[0052] In one specific implementation, multiple antivirus engines can be used to detect Office files. For example, if an antivirus engine detects malicious data in an Office file, it can be determined that the Office file is a malicious file, and steps S102-S104 are then executed. If the antivirus engine does not detect malicious data in the Office file, the detection engine is changed, and another antivirus engine is used to detect it, until all the preset antivirus engines have detected the Office file.
[0053] If all antivirus engines detect that the Office file does not contain malicious data, then the Office file can be determined to be a clean file, and it can be discarded. Alternatively, it can be marked as a clean file.
[0054] For black files, a structure tree is constructed using their corresponding executable code and file content to convert Office files into a structure tree.
[0055] S103. Replace the data at any node in the tree structure with any white data to obtain the updated tree.
[0056] When replacing data at any node in the tree structure, you can replace all the data at that node or only a portion of the data at that node.
[0057] S104. If the updated tree does not include malicious data, then the data at that node is recorded as a malicious feature in the malicious database.
[0058] Correspondingly, an antivirus engine can be used to determine whether the update tree contains malicious data. It is important to note that the same antivirus engine used to detect the Office file in step S102 should be used to evaluate the update tree at this stage.
[0059] This embodiment targets malicious Office files, converting them into a structure tree and replacing data at any node in the structure tree with arbitrary white data to obtain an updated tree. If the updated tree does not contain malicious data, it indicates that the malicious file has been converted into a white file after the replacement, meaning that the replaced data is the cause of the Office file being malicious. Therefore, this data is recorded as malicious features in a malicious database. This process filters out malicious features from the malicious Office files, completing the static detection of Office files. Static detection refers to checking for malicious features in a document without running it. Malicious features can include code features, document content features, structural features, etc.
[0060] In one specific implementation, if replacing data at any node in the tree structure with arbitrary white data results in an updated tree containing malicious data, it indicates that the black file remains a black file even after the replacement. In this case, it cannot be determined whether the replaced data is the cause of the Office file being a black file, as the replaced data could be malicious or simply white data.
[0061] It should be noted that multiple malicious features in an Office file can be independent or interconnected. For example, an Office file may contain three malicious features: A, B, and C. All three must be present simultaneously for the Office file to cause damage to the system. Therefore, if A is replaced, the antivirus engine will classify the Office file as a legitimate file because B and C will not cause damage. Further detection can then be performed on other nodes in the corresponding tree structure of the Office file to identify malicious features B and C (assuming A, B, and C are located at different nodes in the tree structure).
[0062] Of course, if A, B, and C are independent malicious features, then if A is replaced, the Office file will still be identified as a black file by the antivirus engine. In this case, it cannot be determined whether the replaced A is malicious data or legitimate data, resulting in a missed detection of malicious features. This situation is generally acceptable. Further testing can then be conducted on other nodes in the tree structure.
[0063] In one specific implementation, if the updated tree includes malicious data, and / or after the data at the node is recorded as a malicious feature to the malicious database, the node that has been replaced in the tree structure is identified as a detected node, and other nodes other than the detected nodes are identified in the tree structure. The data at the other nodes is replaced with arbitrary white data to obtain a new updated tree.
[0064] The malicious features recorded in the malicious database include known malicious features and unknown malicious features. This database can then be used to detect whether an unknown Office file is legitimate or malicious. Specifically, strings in the unknown Office file can be matched against malicious features in the database. If a string in the unknown Office file matches a certain malicious feature, the Office file can be determined to be malicious. The specific string matching process can refer to existing related technologies, and will not be elaborated upon in this embodiment.
[0065] As can be seen, this application embodiment does not require running Office files; it can detect malicious features based on static Office files, regardless of whether the malicious features are known, thus allowing for the recording of new malicious features. Furthermore, it eliminates the need for setting up a virtualized isolation environment for running Office files, resulting in lower performance and cost requirements. Therefore, this application can quickly and accurately detect malicious features in Office files under relatively low performance conditions.
[0066] The structure tree generation and data replacement processes provided in this application can be referred to the following description:
[0067] In one specific implementation, converting an Office file into a tree structure includes: parsing the Office file to obtain multiple data warehouses; identifying the data flow in each data warehouse as tree nodes; and connecting the tree nodes to obtain the tree structure. The data warehouse includes various data flows. Taking an xls file as an example, multiple data warehouses can be determined based on the file's document structure. The various data flows in a particular data warehouse may include: component object flow, control flow, data space storage, document summary information flow, etc., as detailed in [reference needed]. Figure 2 .
[0068] In one specific implementation, before determining the data stream in each data warehouse as a tree node, the method further includes: dividing the data stream in each data warehouse into multiple data blocks according to a preset sector size. That is, before each data stream becomes a tree node, it is first divided into data blocks of a preset sector size, so that the data at each node of the tree structure can be stored in data blocks of the preset sector size, facilitating data replacement. For example, only one or a few data blocks at a certain node can be replaced to complete the data replacement at that node. Of course, all the data at that node can also be replaced to complete the data replacement at that node.
[0069] In one specific implementation, replacing data at any node in the tree structure with arbitrary white data to obtain an updated tree includes: determining replaceable data blocks in the data at that node; replacing the data blocks with arbitrary white data to obtain an updated tree.
[0070] The preset replacement library can pre-store various types of blank data, such as garbled characters and functions. Blank data refers to normal data that does not contain malicious data and will not interfere with or disrupt the normal operation of files or the system. It should be noted that when performing data replacement, you can prioritize selecting data similar to the object to be replaced (i.e., a portion of the data at the node) from the preset replacement library. For example, if the object to be replaced is a function, then select a function from the preset replacement library to replace it.
[0071] In one specific implementation, replacing a portion of data blocks with arbitrary white data to obtain an update tree includes: determining the type of the partial data blocks; querying a preset replacement library for target white data corresponding to the type; and replacing the partial data blocks with the target white data to obtain the update tree. The types of the partial data blocks include, for example, characters or functions.
[0072] When replacing data at any node in the tree structure, you can replace all the data at that node or only a portion of it. By continuously replacing data and obtaining black and white tags, malicious features in malicious files can be detected.
[0073] See Figure 3 As shown in the figure, this application discloses an Office file detection scheme, which includes several steps such as file parsing, content replacement, and tag acquisition.
[0074] During file parsing, the file is parsed according to the specific format of the composite file, thereby generating the corresponding structure tree.
[0075] Taking an xls file as an example, the following can be parsed from top to bottom of the tree structure:
[0076] OLESSRoot->OLESSHeader, FAT, DirectoryEntries->...;
[0077] ExcelBinaryDocuments->ExcelBinaryDocument->BIFFRecords->BIFFRecord_General->...etc.
[0078] After generating the tree structure, a mapping relationship can be established between the data at the tree node and the data in the replacement dataset based on the data type at the tree node. Based on the mapping relationship, the data used to replace the content of that node can be determined. For example, the Ftab structure can only be replaced with other function content, including the function name and a valid parameter queue; a practical example is replacing the binary signature 0x1101 of the RUN() function with 0x0035 of GOTO().
[0079] After the replacement, the data from multiple nodes in the new tree structure can generate a new composite file. This new composite file is then detected by antivirus software to determine whether it is a malicious or legitimate file. This process is equivalent to "using an antivirus engine to determine whether the updated tree contains malicious data" in the above embodiment.
[0080] Please see Figure 3 The algorithm replaces the content of each node in the tree structure and detects the resulting composite file, thereby identifying malicious features within the file. If the content at a node can be replaced, it indicates that the file tag (white or black tag) remains unchanged after replacement; conversely, if the content at a node cannot be replaced, it indicates that the file tag changes after replacement. Through continuous replacement and acquisition of black and white tags, the content of nodes that cannot be replaced represents the malicious features within the malicious file.
[0081] This embodiment can automatically detect malicious features in malicious Office files, reducing the time cost of manual intervention. For malicious Office files containing vulnerabilities or XLM macros (such as Excel 4.0), it can improve the detection efficiency and accuracy of these two types of malicious Office files while reducing time costs.
[0082] The following describes an Office file detection device provided in an embodiment of this application. The Office file detection device described below and the Office file detection method described above can be referred to each other.
[0083] See Figure 4 As shown in the figure, this application discloses an Office document detection device, including:
[0084] Module 401 is used to acquire the Office file to be detected;
[0085] The conversion module 402 is used to convert Office files into a structure tree if the Office file is a black file;
[0086] Replacement module 403 is used to replace the data at any node in the tree structure with arbitrary white data to obtain an updated tree;
[0087] The recording module 404 is used to record the data at the node as a malicious feature to the malicious database if the updated tree does not contain malicious data.
[0088] In one specific implementation, the conversion module includes:
[0089] The parsing unit is used to parse Office files to obtain multiple data warehouses;
[0090] The generation unit is used to identify the data flow in each data warehouse as a tree node and connect the tree nodes to obtain a tree structure.
[0091] In one specific implementation, it further includes:
[0092] The partitioning module is used to divide the data stream in each data warehouse into multiple data blocks according to a preset sector size.
[0093] In one specific implementation, the replacement module includes:
[0094] A determining unit is used to identify replaceable data blocks from the data at that node.
[0095] Replacement units are used to replace parts of data blocks with arbitrary white data to obtain an updated tree.
[0096] In one specific embodiment, the replacement unit includes:
[0097] Determine the sub-unit to identify the type of a portion of the data block;
[0098] The query sub-unit is used to query the target white data corresponding to the type in the preset replacement library;
[0099] The replacement sub-unit is used to replace a portion of the data block with the target white data to obtain the updated tree.
[0100] In one specific implementation, it further includes:
[0101] The traversal module is used to identify the replaced nodes in the tree structure as detected nodes if the updated tree contains malicious data. It also identifies other nodes in the tree structure besides the detected nodes and replaces the data at other nodes with arbitrary white data to obtain a new updated tree.
[0102] In one specific implementation, it further includes:
[0103] The detection module is used to detect unknown Office files using a malicious database.
[0104] In one specific implementation, if any one of the multiple antivirus engines determines that an Office file contains malicious data, then the Office file is determined to be a black file.
[0105] For more detailed information on the working process of each module and unit in this embodiment, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.
[0106] As can be seen, this embodiment provides an Office file detection device that can quickly and accurately detect malicious features in Office files under low performance conditions.
[0107] The following describes an electronic device provided in an embodiment of this application. The electronic device described below can be referred to in conjunction with the Office document detection method and apparatus described above.
[0108] See Figure 5 As shown in the figure, an embodiment of this application discloses an electronic device, including:
[0109] Memory 501 is used to store computer programs;
[0110] Processor 502 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.
[0111] Please refer to Figure 6 , Figure 6This is a schematic diagram of another electronic device provided in this embodiment. This electronic device can vary significantly due to differences in configuration or performance. It may include one or more central processing units (CPUs) 322 (e.g., one or more processors) and a memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 342 or data 344. The memory 332 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the data processing device. Furthermore, the central processing unit 322 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the electronic device 301.
[0112] Electronic device 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341. Examples include Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.
[0113] exist Figure 6 In this context, application 342 may be a program that performs the Office document detection method, and data 344 may be data required or generated for performing the Office document detection method.
[0114] The steps in the Office file detection method described above can be implemented by the structure of an electronic device.
[0115] The following describes a readable storage medium provided in an embodiment of this application. The readable storage medium described below can be referred to in conjunction with the Office document detection method, apparatus and device described above.
[0116] A readable storage medium is provided for storing a computer program, wherein the computer program, when executed by a processor, implements the Office file detection method disclosed in the foregoing embodiments. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0117] The terms “first,” “second,” “third,” “fourth,” etc., used in this application (if applicable) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, or apparatus that includes a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, or apparatus.
[0118] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.
[0119] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0120] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of readable storage medium known in the art.
[0121] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for detecting Office documents, characterized in that, include: Obtain the Office file to be tested; If the Office file is a black file, then convert the Office file into a structure tree; Replace the data at any node in the structure tree with any white data to obtain an updated tree; If the updated tree does not contain malicious data, then the data at that node is recorded as a malicious feature in the malicious database.
2. The Office file detection method according to claim 1, characterized in that, The step of converting the Office file into a structure tree includes: The Office files are parsed to obtain multiple data warehouses; The data flow in each data warehouse is identified as a tree node, and the tree nodes are connected to obtain the structure tree.
3. The Office file detection method according to claim 2, characterized in that, Before determining the data streams in each data warehouse as tree nodes, the process also includes: The data stream in each data warehouse is divided into multiple data blocks according to the preset sector size.
4. The Office file detection method according to claim 3, characterized in that, The step of replacing the data at any node in the structure tree with arbitrary white data to obtain an updated tree includes: Identify replaceable data blocks within the data at that node; The arbitrary white data is used to replace the partial data block to obtain the updated tree.
5. The Office file detection method according to claim 4, characterized in that, The step of replacing the portion of the data block with the arbitrary white data to obtain the updated tree includes: Determine the type of the aforementioned data blocks; Query the target white data corresponding to the type in the preset replacement library; The target white data is used to replace the partial data block to obtain the updated tree.
6. The Office document detection method according to any one of claims 1 to 5, characterized in that, Also includes: In the case that the updated tree contains malicious data, and / or after the data at the node is recorded as a malicious feature to the malicious database, the node that has been replaced in the tree structure is identified as a detected node, and other nodes other than the detected node are identified in the tree structure. The data at the other nodes is replaced with arbitrary white data to obtain a new updated tree.
7. The Office document detection method according to any one of claims 1 to 5, characterized in that, Also includes: The malicious database was used to detect unknown Office files.
8. An Office document detection device, characterized in that, include: The acquisition module is used to acquire the Office file to be detected; A conversion module is used to convert the Office file into a structure tree if the Office file is a black file; The replacement module is used to replace the data at any node in the structure tree with arbitrary white data to obtain an updated tree; The recording module is used to record the data at the node as a malicious feature to the malicious database if the update tree does not contain malicious data.
9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the Office file detection method as described in any one of claims 1 to 7.
10. A readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the Office file detection method as described in any one of claims 1 to 7.