A malicious document detection method, device, storage medium and equipment

Abstract

This application provides a method, apparatus, storage medium, and device for detecting malicious documents. In this method, after constructing a function call sequence based on code information within the document to be detected, the functions are labeled using behavioral purpose classification tags and behavioral means classification tags from a preset tag library. This transforms the disordered function call sequence into machine learning features of a defined dimension. A trained detection model then processes these machine learning features to determine whether the document to be detected is malicious. Thus, by performing static extraction and detection on the call sequence, malicious document detection is achieved while effectively reducing system performance overhead.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and more specifically, to a method, apparatus, storage medium, and device for detecting malicious documents. Background Technology

[0002] Office documents are widely used in the daily office work of enterprises and institutions, and are an important part of internet documents. Macros are an important functional extension of Office documents and are frequently used. Hackers also often exploit this feature to embed malicious macro code in Office documents for cyberattack purposes.

[0003] Malicious Office document detection is crucial for network information security. Currently, relevant technologies for detecting malicious Office documents mainly extract features of malicious documents through dynamic methods that simulate code execution, thereby clustering malicious documents. However, this method requires simulating a real environment, which consumes significant resources. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, storage medium and device for detecting malicious documents, aiming to solve the problem of high resource consumption in the detection methods for malicious Office documents in related technologies.

[0005] Firstly, an embodiment of this application provides a method for detecting malicious documents, comprising:

[0006] Extract code information from the document to be detected, and use the code information to construct a function call sequence;

[0007] After the function call sequence is tagged based on a preset tag library, the function call sequence is converted into target features according to the tagged tags; wherein, the preset tag library records keywords for matching each tag in the behavior purpose category and keywords for matching each tag in the behavior means category;

[0008] The target features are input into the trained detection model to determine whether the document to be detected is a malicious document. The detection model is trained based on benign document samples and malicious document samples. The features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library.

[0009] In the above implementation process, after constructing a function call sequence based on the code information within the document to be detected, the functions are labeled using behavioral purpose classification tags and behavioral means classification tags from a pre-set tag library. This transforms the disordered function call sequence into machine learning features of a defined dimension. A trained detection model then processes these machine learning features to determine whether the document to be detected is malicious. In this way, by performing static extraction and detection on the call sequence, malicious document detection is achieved while effectively reducing system performance overhead.

[0010] Furthermore, in some embodiments, extracting the code information within the document to be detected includes:

[0011] The file containing the code information of the document to be detected is parsed according to the parsing method corresponding to the type of the document to be detected.

[0012] In the above implementation process, a specific method for extracting code information from a document is provided.

[0013] Furthermore, in some embodiments, before parsing the file storing code information within the document to be detected according to the parsing method corresponding to the type of the document to be detected, the following steps are included:

[0014] If the document to be tested is Office 2007 or a later version of Office 2007, find the Override child node of the ContentType node in the root directory of the compressed package of the document to be tested, and then determine the location of the file used to store the code information in the document to be tested based on the value of the Override child node.

[0015] In the above implementation process, considering that malicious Office 2007+ documents can evade parsing by modifying the filename of the file containing the code information, the location of the file containing the code information is determined by finding the Override child node for the Office 2007+ document to be detected, thereby achieving effective parsing of the malicious Office 2007+ document.

[0016] Furthermore, in some embodiments, constructing the function call sequence using the code information includes:

[0017] The code information is scanned to obtain function units within the code;

[0018] Construct a function call sequence based on the calling relationship corresponding to the function unit.

[0019] In the above implementation process, a specific method for constructing the function call sequence is provided, namely, first scanning the code information to obtain the function units in the code, and then constructing the function call sequence according to the calling relationship corresponding to the function units.

[0020] Furthermore, in some embodiments, the labels in the behavioral purpose classification include network connection classification labels, write permission operation classification labels, execution permission operation classification labels, system environment variable classification labels, operating system library call classification labels, and shell operation classification labels;

[0021] The tags in the behavior categorization include obfuscation, automatic execution, and window hiding.

[0022] In the above implementation process, subcategories of behavioral target classification and behavioral means classification are provided. Through these nine categories, features that can be effectively extracted to accurately determine whether a document is malicious can be identified.

[0023] Furthermore, in some embodiments, the step of converting the function call sequence into target features based on the marked labels includes:

[0024] Based on the labels in the behavioral purpose classification contained in the labels of the function call sequence markers, a call sequence matrix is ​​generated, and then the call sequence matrix is ​​converted into a first feature;

[0025] A second feature is generated based on the number of keywords corresponding to each tag in the behavior means classification that are hit in the function call sequence;

[0026] The target feature is constructed based on the first feature and the second feature.

[0027] In the above implementation process, when converting the function call sequence into machine learning features, the behavioral purpose classification label and the behavioral means classification label are processed separately, which helps to prevent the machine learning model from overfitting and reduce system performance overhead.

[0028] Further, in some embodiments, generating a call sequence matrix based on the labels in the behavioral purpose classification included in the labels of the function call sequence markers, and then converting the call sequence matrix into a first feature, includes:

[0029] Using the labels in the behavioral purpose category contained in the labels of the function call sequence, replace the original function names in the function call sequence, and generate a call sequence matrix based on the replaced function call sequence;

[0030] The call sequence matrix is ​​converted into a first feature using either row-major or column-major order.

[0031] In the above implementation process, a specific method is provided to transform an unordered call sequence into machine learning features with a defined dimension.

[0032] Secondly, an embodiment of this application provides a malicious document detection device, comprising:

[0033] The construction module is used to extract code information from the document to be detected and to construct a function call sequence using the code information;

[0034] The conversion module is used to label the function call sequence based on a preset label library, and then convert the function call sequence into target features according to the labeled labels; wherein, the preset label library records keywords for matching each label in the behavior purpose category, and keywords for matching each label in the behavior means category;

[0035] The determination module is used to input the target features into the trained detection model to determine whether the document to be detected is a malicious document; the detection model is trained based on benign document samples and malicious document samples, and the features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library.

[0036] Thirdly, an electronic device provided in this application includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any of the first aspects.

[0037] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in any of the first aspects.

[0038] Fifthly, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in any of the first aspects.

[0039] Other features and advantages disclosed in this application will be set forth in the following description, or some features and advantages may be inferred from the description or determined without doubt, or may be learned by practicing the above-described technology disclosed in this application.

[0040] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A flowchart illustrating a malicious document detection method provided in this application embodiment;

[0043] Figure 2 A schematic diagram illustrating the workflow of a machine learning-based malicious Office detection scheme based on tag function calls, provided in an embodiment of this application;

[0044] Figure 3 A schematic diagram of an original call sequence diagram provided for an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of the function call sequence obtained by replacing the original function names in the original call sequence diagram with mapped labels and removing the labels in the behavior means classification, as provided in the embodiments of this application.

[0046] Figure 5 This is a schematic diagram of a call sequence matrix provided in an embodiment of this application;

[0047] Figure 6 A block diagram of a malicious document detection device provided in an embodiment of this application;

[0048] Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0050] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0051] As described in the background section, existing methods for detecting malicious Office documents suffer from high resource consumption. Therefore, this application provides a malicious document detection scheme to address these issues.

[0052] The embodiments of this application will be described below:

[0053] like Figure 1 As shown, Figure 1 This is a flowchart illustrating a malicious document detection method provided in an embodiment of this application. The method can be applied to a terminal or server. The terminal can be various electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. The server can be a single server or a distributed server cluster composed of multiple servers. The terminal or server provides a document processing environment, which includes software and hardware components. The software component mainly includes an operating system, such as Windows or Linux, while the hardware component mainly includes computing resources and storage resources, such as a CPU (Central Processing Unit), memory, and hard disk. It should be noted that the terminal / server can also be implemented as multiple software programs or software modules, or as a single software program or software module; this application does not impose any limitations on this.

[0054] The method includes:

[0055] In step 101, extract the code information from the document to be detected, and use the code information to construct a function call sequence;

[0056] The document to be detected in this step can be an Office document, such as a Word document or a PDF document, that needs to be detected for malicious documents. A function call sequence can be considered a representation of the function call relationship in code, including the function name of the calling function, the function name of the called function, and the order of function calls. Its presentation can be a sequence diagram, a tuple, etc.

[0057] In this embodiment, the function call sequence is constructed using code information within the document to be detected. This code information can be the location where malicious code may be embedded. Since the document to be detected is an Office document, the code information here can refer to VBA (Visual Basic for Applications) code and P-code (Performance-cache Code, the compiled form of VBA code). In practical applications, Office documents are usually divided into two types: Office 97-2003 and Office 2007+. Office 97-2003 documents are Compound File Binary Format (CFBF) documents, belonging to OLE (Object Linking and Embedding) files; while Office 2007+ documents follow the OOXML (OfficeOpen XML) standard and belong to OOXML files. These two file types differ in the location of object attributes within the document and the parsing method. Therefore, in some embodiments, extracting code information from the document to be detected mentioned in this step may include: parsing the file storing the code information of the document to be detected according to the parsing method corresponding to the type of the document to be detected. Specifically, the type of the document to be detected can be determined by reading the file's Magic. Generally, if the first 8 bytes of the file are "D0 CF 11E0 A1 B1 1A E1", then the document to be detected is an Office 97-2003 document; if the first two bytes of the file are "PK", then the document to be detected is an Office 2007+ document. In Office 97-2003 documents, VBA code and P code are generally stored in the document's Module Stream, while in Office 2007+ documents, VBA code and P code are generally stored in the vbaProject.bin file. Thus, by parsing the Module Stream or vbaProject.bin file storing the VBA code and P code according to the document type, the code information of the document to be detected can be extracted.

[0058] Furthermore, experiments revealed that malicious Office 2007+ documents can evade parsing by modifying the filename of vbaProject.bin. Therefore, in some embodiments, if the document to be detected is Office 2007 or a later version, the Override child node of the ContentType node is located in the root directory of the compressed file containing the document. The location of the file storing the code information within the document is then determined based on the value of the Override child node. In other words, when locating the file storing VBA and P code in an Office 2007+ document, the Override child node can be found in the [Content_Types].xml file in the zip root directory. This child node is actually the tag "Override PartName," which defines the content type corresponding to a specific fragment file. The value of this tag indicates the location of the corresponding VBA and P code. Based on this method, malicious Office 2007+ documents can be effectively parsed.

[0059] Furthermore, the step of constructing a function call sequence using the code information mentioned above may include: scanning the code information to obtain function units in the code; and constructing a function call sequence based on the call relationships corresponding to the function units. Specifically, in code, functions generally begin with "Sub" and end with "End Sub". Therefore, the code is divided into function units by marking them with their original function names based on "Sub" and "EndSub". In VBA code, the syntax for function calls is generally to directly reference the function name, while in P code, the syntax for function calls is generally to call the function name with "ArgsCall". Based on these two syntaxes, the original function call sequence diagram can be obtained.

[0060] In step 102, after tagging the function call sequence based on a preset tag library, the function call sequence is converted into target features according to the tagged tags; wherein, the preset tag library records keywords for matching each tag in the behavior purpose category and keywords for matching each tag in the behavior means category;

[0061] Considering that function names are randomly obfuscated in the code, making the randomness of function names meaningless, and that the call sequence of malicious documents is usually variable and unpredictable, this embodiment marks functions with specific tags, uses obfuscation technology to extract valid tags from the document to be detected, and uses the tags to replace the complex and variable original function call sequence, so as to normalize the call sequence and transform the disordered call sequence into machine learning features.

[0062] Specifically, the preset tag library mentioned in this step is a pre-built tag library that records keywords for matching tags in the "behavioral purpose" category and keywords for matching tags in the "behavioral means" category. In other words, when the function call sequence of the document to be detected matches a keyword corresponding to a certain tag, that tag is used to mark the function call sequence. The keywords here are special function keywords within the functions, categorized according to behavioral purpose and behavioral means. As the names suggest, keywords corresponding to the behavioral purpose category are related to the attacker's possible attack objectives, such as network connection or performing permission operations, while keywords corresponding to the behavioral means category are related to the actions the attacker uses to achieve their attack objectives, such as obfuscation or window hiding. This facilitates the extraction of features that can be used to accurately determine whether a document is malicious.

[0063] In some embodiments, the tags in the behavior purpose category may include network connection category tags, write permission operation category tags, execution permission operation category tags, system environment variable category tags, operating system library call category tags, and shell operation category tags; the tags in the behavior means category include obfuscation category tags, automatic execution category tags, and window hiding category tags. That is, the tags in the preset tag library are divided into nine categories, where network connection, write permission operation, execution permission operation, system environment variable, operating system library call, and shell operation categories are marked as behavior purpose categories, while obfuscation, automatic execution, and window hiding categories are marked as behavior means categories. Each category corresponds to one tag. For example, "Connections" is a keyword related to network connections; if a function contains the keyword "Connections," then the function is marked with the network connection category tag "webconnect_tag." Similarly, "Replace" is a keyword related to obfuscation functionality; if a function contains the keyword "Replace," then the function is marked with the obfuscation category tag "obfuscation_tag." All function units in the code are marked using these nine category tags. It should be noted that a function can have multiple tag tags, and a tag tag can be shared by multiple functions. Of course, in other embodiments, the tags in the preset tag library can be set differently according to the needs of the actual scenario.

[0064] Further, in some embodiments, the step of converting the function call sequence into target features based on the labeled tags may include: generating a call sequence matrix based on the tags of the behavioral purpose category included in the labels of the labeled function call sequence, and then converting the call sequence matrix into a first feature; generating a second feature based on the number of keywords corresponding to each tag in the behavioral means category that the function call sequence hits; and constructing target features based on the first feature and the second feature. That is, when converting the function call sequence into machine learning features, the behavioral purpose category tags and the behavioral means category tags are processed separately. Specifically, the behavioral purpose category tags are used to generate the call sequence matrix. To reduce the complexity of the call sequence matrix and the number of redundant features, when a function contains a tag in the behavioral means category, that tag is ignored during the generation of the call sequence matrix. When a function only contains a tag in the behavioral means category, the next called function containing a behavioral purpose category tag is directly searched, thereby achieving the elimination of behavioral means category tags from the call sequence. Based on the six categories of labels in the aforementioned behavioral purpose classification, a 6*6 two-dimensional matrix can be constructed, with each dimension's vector representing a behavioral purpose classification label. Then, based on the function labels in the function call sequence, the two-dimensional matrix is ​​constructed, and this two-dimensional matrix is ​​then converted into a fixed-dimensional feature, thus obtaining the first feature.

[0065] Furthermore, the first feature can be obtained as follows: The original function names in the function call sequence are replaced with the labels from the behavioral purpose categories included in the labels of the function call sequence markers, and a call sequence matrix is ​​generated based on the replaced function call sequence; the call sequence matrix is ​​then converted into the first feature in a row-major or column-major manner. That is, the original function names in the function call sequence are replaced with behavioral purpose category labels to generate the call sequence matrix. For example, the network connection category label, write permission operation category label, execute permission operation category label, system environment variable category label, operating system library call category label, and shell operation category label are represented as A, B, C, D, E, and F respectively. When the original function call sequence contains keywords corresponding to the shell operation category label in the calling function AutoOpen(), and the called function zFcKWSPrk() contains keywords corresponding to the network connection category label, keywords corresponding to the write permission operation category label, and shell operation category label, the first feature is obtained. If the keywords correspond to the classification labels, then in the function call sequence, the original function name of the calling function can be replaced with F_func, and the original function name of the called function can be replaced with A_func, B_func, F_func. Correspondingly, the replaced function call sequence becomes F_func→A_func, B_func, F_func. Then, a call sequence matrix can be generated based on the replaced function call sequence. In this call sequence matrix, the values ​​in the 1st row, 6th column, 2nd row, 6th column, and 6th row, 6th column are 1, and the values ​​in all other positions are 0. Finally, following either row-major or column-major order, the call sequence matrix can be converted into a first feature with a dimension of 36. Of course, in other embodiments, this first feature can also be obtained in other ways. For example, the calling function can be converted into a column vector according to the behavioral purpose classification label, and the called function can be converted into a row vector according to the behavioral purpose classification label. The first feature is then obtained by multiplying the column vector and the row vector.

[0066] This embodiment separately marks the behavior means classification labels in the function call sequence as features to reduce the feature dimensionality generated by the call sequence. This helps prevent overfitting in subsequent machine learning models and reduces system performance overhead. Specifically, the frequency of each label in the behavior means classification is counted. If the function contains the keyword "StrReverse" corresponding to the obfuscation classification label, the count of the obfuscation classification label is incremented by 1. Subsequently, whenever the function or other functions within the document hit one of the keywords corresponding to the obfuscation classification label, the count of the obfuscation classification label is incremented by 1. If the function does not contain any keyword corresponding to the window hiding classification label, the window hiding classification is marked as 0. Finally, based on the number of keywords corresponding to each label in the behavior means classification that the function call sequence hits, a second feature with a dimension of 3 can be generated.

[0067] After obtaining the first and second features, the two features can be merged into the target feature by using Concat or Add, thereby obtaining machine learning features that can characterize the code situation of the document to be detected.

[0068] In step 103, the target features are input into the trained detection model to determine whether the document to be detected is a malicious document. The detection model is trained based on benign document samples and malicious document samples. The features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library.

[0069] The detection model mentioned in this step is a machine learning model. The training samples for this model include benign and malicious document samples. The features of these two types of document samples are also extracted based on steps 101 and 102. A fixed number of features corresponding to these training samples, transformed from the call sequence matrix constructed from the behavioral purpose classification labels, and the quantitative features composed of the behavioral means classification labels are input together into a machine learning classification algorithm for training. This machine learning classification algorithm includes, but is not limited to, decision trees, support vector machines, and gradient boosting decision trees. After parameter tuning and training, the model is optimized and then output as a detection model. In this way, the detection model can learn to classify the document to be detected based on its target features, i.e., to determine whether the document to be detected is benign or malicious. For a detailed description of the training process, please refer to the introduction of the corresponding machine learning algorithm in related technologies; this application will not elaborate on it further.

[0070] Optionally, the output value of the detection model is a floating-point number between 0 and 1. After inputting the target features into the detection model, if the output value of the detection model is greater than or equal to a threshold, the document to be detected is determined to be a malicious document; otherwise, the document to be detected is determined to be a benign document. This threshold can be set according to the balance of the training samples. For example, when the number of benign document samples and malicious document samples are equal, the threshold can be set to 0.5. Of course, in other embodiments, the threshold can also be set differently according to the needs of the actual scenario.

[0071] In this embodiment, after constructing a function call sequence based on the code information within the document to be detected, the functions are labeled using behavioral purpose classification labels and behavioral means classification labels from a preset label library. This transforms the disordered function call sequence into machine learning features of a defined dimension. A trained detection model then processes these machine learning features to determine whether the document to be detected is malicious. Thus, by performing static extraction and detection on the call sequence, malicious document detection is achieved while effectively reducing system performance overhead.

[0072] To provide a more detailed explanation of the solution in this application, a specific embodiment is described below:

[0073] In the field of network information security, the detection of malicious Office documents is crucial. Existing methods for detecting malicious Office documents mainly include dynamic and static detection methods. Dynamic detection methods, due to their need to simulate real-world environments, incur significant performance overhead. Static detection methods, particularly those based on rule bases, typically rely on prior knowledge and cannot detect unknown samples. Therefore, this embodiment provides a machine learning-based malicious Office document detection scheme based on tag function calls. The workflow of this scheme is as follows: Figure 2 As shown, it includes:

[0074] S201, Function call to extract training samples; this step specifically includes the following S2011 to S2015:

[0075] S2011. Determine whether the input Office document is an OLE file or an OOXML file. Specifically, after the file is input, first read the file's Magic. If the first 8 bytes of the file are "D0 CF11E0 A1 B1 1A E1", it proves that it is an Office 97-2003 document. If the first two bytes are "PK", it proves that it is an Office 2007+ document.

[0076] S2012, Extract the VBA and P code from the document; specifically, parse the Module Stream or vbaProject.bin that stores the VBA and P code, depending on the document type;

[0077] S2013. Obtain the unified representation of the code; specifically, process the code as follows: if both P code and VBA code exist, take the VBA code for subsequent processing; if only VBA code exists, take only the VBA code; if only P code exists, disassemble the P code to obtain the assembled code, mark it as DisAsm_p-code, and take DisAsm_p-code for subsequent processing.

[0078] S2014. Extract original function units from the document; specifically, scan the code obtained in S2013 to obtain function units in the code. It should be noted that in the code, functions generally start with Sub and end with End Sub. Therefore, the code is divided into function units based on Sub and End Sub, using the original function names as markers.

[0079] S2015. Obtain the original call sequence diagram based on the call relationship corresponding to the original function unit; specifically, in VBA code, the syntax for function calls is to directly reference the function name; in DisAsm_p-code, the syntax for function calls is to call the function name using ArgsCall. Obtain the original call sequence diagram of the function based on these two syntaxes.

[0080] S202. Using labeling, the function call sequence is transformed into fixed-dimensional features based on the behavioral purpose classification labels, and the behavioral means classification labels are labeled separately as features; this step specifically includes the following S2021 to S2022:

[0081] S2021. Analyze the special function keywords in the analysis function, classify them, and then build a tag library. Specifically, keywords such as "Mid", "Left", "Right", "StrReverse", "Xor", "ChrB", "ChrW", "Chr", "Replace", and "Hex" are all related to obfuscation functions, so these keywords are classified into the obfuscation category and marked as obfuscation_tag. Similarly, keywords such as "webclient", "net", "Socket", "Connections", and "WorkbookConnection" are all related to network connections, so these keywords are classified into the network connection category and marked as webconnect_tag. In addition, there are nine other categories: auto_tag (automatic execution), writeAction_tag (write permission operation), runAction_tag (execution permission operation), sysEnv_tag (system environment variable), osdllCall_tag (operating system library call), hideWindow_tag (window hiding), and shell_tag (shell operation). Of these nine categories, network connection, write permission operation, execution permission operation, system environment variable, operating system library call, and shell operation belong to the behavioral purpose category; while obfuscation, automatic execution, and window hiding belong to the behavioral means category.

[0082] S2022. The acquired function units are tagged with function tags according to the self-built tag library. Specifically, all function units in the code are tagged with nine categories of tags. For example, if a function contains the keyword "Connections", then the function is tagged as webconnect_tag. It should be noted that a function can have multiple tags, and a tag can be shared by multiple functions.

[0083] S2023. Obtain the call sequence of the labeled functions and convert it into fixed-dimensional features. Specifically, replace the original function names in the original call sequence graph obtained in step S201 with the labels that have been mapped to each function unit in step S2022. Then, generate a call sequence matrix based on the function call sequence that has been replaced with labels. In this process, in order to reduce the complexity of the call sequence matrix and reduce the number of redundant features, the behavior means classification labels are removed when generating the call sequence matrix. After that, convert it into features with a fixed number of 36 in a row-first or column-first manner.

[0084] To illustrate with an example: For a given Office document, scanning its code reveals the function units AutoOpen() and zFcKWSPrk(), resulting in... Figure 3 The original call sequence diagram is shown below. When tagged, the function `AutoOpen()` contains the keyword "AutoOpen" from the `auto_tag` category, the keywords "Right", "Left", and "Mid" from the `obfuscation_tag` category, and the keywords "shell" and "exe" from the `shell_tag` category. Meanwhile, the function `zFcKWSPrk()` contains the keywords "Right", "Left", and "Chr" from the `obfuscation_tag` category, the keyword "http" from the `webconnect_tag` category, the keyword "DownloadFile" from the `writeAction_tag` category, and the keyword "shell_t" from the `shell_tag` category. In the `ag` function, the keyword "shell" is used for ease of representation. The tags `writeAction_tag`, `runAction_tag`, `shell_tag`, `webconnect_tag`, `sysEnv_tag`, `osdllCall_tag`, `obfuscation_tag`, `hideWindow_tag`, and `auto_tag` are labeled A, B, C, D, E, F, G, H, and I, respectively. Correspondingly, the function `AutoOpen()` is labeled C_func, G_func, and I_func, while the function `zFcKWSPrk()` is labeled A_func, C_func, D_func, and G_func. After replacing the original function names in the original call sequence diagram with the mapped tags and removing the tags from the behavior method categories, the result is as follows: Figure 4 The function call sequence shown below, followed by the generation of, is as follows: Figure 5 The call sequence matrix shown is ultimately converted into 36 features in row-major order, namely [0,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0];

[0085] S2024. Classify and label obfuscation, window hiding, and automatic execution behaviors as separate features; specifically, the features corresponding to the behavior categories are obtained by counting the number of times each tag appears in the category; for example, if a function contains the keyword "StrReverse", the obfuscation_tag_num of the obfuscation category is incremented by 1. After that, if the function or other functions in the document hit one of the obfuscation_tag keywords, the obfuscation_tag_num of the obfuscation category is incremented by 1.

[0086] S203. Train the sample features using a machine learning classification algorithm to obtain a detection model. Specifically, input the fixed number of features transformed from the call sequence constructed by the behavior purpose classification label and the quantitative features composed of the behavior means classification into the machine learning classification algorithm for training. The machine learning classification algorithm is not limited to decision tree, support vector machine, gradient boosting decision tree, etc. Then, adjust the parameters and train until the performance reaches the optimal level, and output the detection model. During training, the training sample features of the detection model come from 9000 benign Office documents and 9000 malicious Office documents in a public dataset.

[0087] S204. Determine whether the Office document to be detected is a malicious document based on the detection model. Specifically, extract the fixed number of features of the call sequence transformation constructed by the behavior purpose classification label of the Office document to be detected and the quantitative features composed of the behavior means classification. Then input the features into the detection model. If the output value of the detection model is greater than or equal to 0.5, the Office document to be detected is determined to be a malicious document; otherwise, the Office document to be detected is determined to be a benign document.

[0088] The solution in this application performs static extraction and detection of call sequences, reducing system overhead. Furthermore, it labels functions with specific tags, using obfuscation techniques to extract valid tags from samples with meaningless function names. These tags replace the complex and varied original function call sequences, normalizing them and transforming the disordered sequence into machine learning features with a defined dimension. This enables machine learning-based detection of malicious Office documents, including the detection of unknown samples. Additionally, it separately processes obfuscation methods and window hiding methods within the document's function call sequences, reducing the feature dimensionality generated by the call sequences. This helps prevent overfitting of the machine learning model and reduces system performance overhead.

[0089] Corresponding to the embodiments of the aforementioned methods, this application also provides embodiments of a malicious document detection device and a terminal for its application:

[0090] like Figure 6 As shown, Figure 6 This is a block diagram of a malicious document detection device provided in an embodiment of this application. The device includes:

[0091] Module 61 is used to extract code information from the document to be detected and to construct a function call sequence using the code information;

[0092] The conversion module 62 is used to label the function call sequence based on a preset label library, and then convert the function call sequence into target features according to the labeled labels; wherein, the preset label library records keywords for matching each label in the behavior purpose category and keywords for matching each label in the behavior means category;

[0093] The determination module 63 is used to input the target features into the trained detection model to determine whether the document to be detected is a malicious document; the detection model is trained based on benign document samples and malicious document samples, and the features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library.

[0094] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0095] This application also provides an electronic device, please refer to [link to application]. Figure 7 , Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of this application. The electronic device may include a processor 710, a communication interface 720, a memory 730, and at least one communication bus 740. The communication bus 740 is used to enable direct communication between these components. In this embodiment, the communication interface 720 of the electronic device is used for signaling or data communication with other node devices. The processor 710 may be an integrated circuit chip with signal processing capabilities.

[0096] The processor 710 described above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor, or the processor 710 can be any conventional processor.

[0097] The memory 730 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The memory 730 stores computer-readable instructions, and when these computer-readable instructions are executed by the processor 710, the electronic device can perform the aforementioned operations. Figure 1 The various steps involved in the method implementation examples.

[0098] Alternatively, the electronic device may also include a storage controller and an input / output unit.

[0099] The memory 730, storage controller, processor 710, peripheral interface, and input / output unit are electrically connected directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses 740. The processor 710 is used to execute executable modules stored in the memory 730, such as software function modules or computer programs included in electronic devices.

[0100] The input / output unit is used to provide users with the ability to create tasks and to set optional start periods or preset execution times for those tasks, thereby enabling user-server interaction. The input / output unit may be, but is not limited to, a mouse and keyboard.

[0101] Understandable. Figure 7 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 7 The more or fewer components shown, or having the same Figure 7 The different configurations shown. Figure 7 The components shown can be implemented using hardware, software, or a combination thereof.

[0102] This application also provides a storage medium storing instructions. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described again here.

[0103] This application also provides a computer program product that, when run on a computer, causes the computer to perform the method described in the method embodiment.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0105] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0106] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0107] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0108] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0109] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method of malicious document detection, characterized by, include: Extract code information from the document to be detected, and use the code information to construct a function call sequence; After the function call sequence is tagged based on a preset tag library, the function call sequence is converted into target features according to the tagged tags; wherein, the preset tag library records keywords for matching each tag in the behavior purpose category and keywords for matching each tag in the behavior means category; The target features are input into the trained detection model to determine whether the document to be detected is a malicious document; the detection model is trained based on benign document samples and malicious document samples, and the features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library; The step of converting the function call sequence into target features based on the marked labels includes: Based on the labels in the behavioral purpose classification contained in the labels of the function call sequence markers, a call sequence matrix is ​​generated, and then the call sequence matrix is ​​converted into a first feature; A second feature is generated based on the number of keywords corresponding to each tag in the behavior means classification that are hit in the function call sequence; The first feature and the second feature are combined to obtain the target feature.

2. The method of claim 1, wherein, The extraction of code information from the document to be detected includes: The file containing the code information of the document to be detected is parsed according to the parsing method corresponding to the type of the document to be detected.

3. The method of claim 2, wherein, Before parsing the file storing code information within the document to be detected according to the parsing method corresponding to the type of the document to be detected, the following steps are included: If the document to be tested is Office 2007 or a later version of Office 2007, find the Override child node of the ContentType node in the root directory of the compressed package of the document to be tested, and then determine the location of the file used to store the code information in the document to be tested based on the value of the Override child node.

4. The method of claim 1, wherein, The construction of the function call sequence using the code information includes: The code information is scanned to obtain function units within the code; Construct a function call sequence based on the calling relationship corresponding to the function unit.

5. The method of claim 1, wherein, The tags in the behavioral purpose classification include network connection category tags, write permission operation category tags, execute permission operation category tags, system environment variable category tags, operating system library call category tags, and shell operation category tags; The tags in the behavior categorization include obfuscation, automatic execution, and window hiding.

6. The method of claim 5, wherein, The step of generating a call sequence matrix based on the labels in the behavioral purpose classification contained in the labels of the function call sequence tags, and then converting the call sequence matrix into a first feature, includes: Using the labels in the behavioral purpose category contained in the labels of the function call sequence, replace the original function names in the function call sequence, and generate a call sequence matrix based on the replaced function call sequence; The call sequence matrix is ​​converted into a first feature using either row-major or column-major order.

7. A malicious document detection apparatus characterized by comprising: include: The construction module is used to extract code information from the document to be detected and to construct a function call sequence using the code information; The conversion module is used to label the function call sequence based on a preset label library, and then convert the function call sequence into target features according to the labeled labels; wherein, the preset label library records keywords for matching each label in the behavior purpose category, and keywords for matching each label in the behavior means category; The determination module is used to input the target features into the trained detection model to determine whether the document to be detected is a malicious document; the detection model is trained based on benign document samples and malicious document samples, and the features of the benign document samples and the features of the malicious document samples are obtained based on the preset tag library; The conversion module is specifically used to: generate a call sequence matrix based on the tags in the behavioral purpose category contained in the tags of the function call sequence markers, and then convert the call sequence matrix into a first feature; generate a second feature based on the number of keywords corresponding to each tag in the behavioral means category that the function call sequence hits; and merge the first feature and the second feature to obtain the target feature.

8. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 6.

9. An electronic device, comprising: It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as claimed in any one of claims 1 to 6.

Images