A method for detecting malicious documents, an electronic device, and a readable storage medium.

Abstract

This invention provides a method for detecting malicious documents, an electronic device, and a readable storage medium. The method includes: performing memory dump analysis on the document to be detected to obtain memory difference features; inputting the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information; wherein the preset malicious document detection model is trained using the memory difference features of malicious documents and the memory difference features of normal documents. The purpose of this invention is to address the shortcomings of existing malicious document detection methods, which result in low accuracy in detecting malicious documents.

Description

Technical Field

[0001] This invention relates to the field of computer detection technology, and in particular to a method for detecting malicious documents, an electronic device, and a readable storage medium. Background Technology

[0002] With the rapid development of electronic information technology, electronic documents are increasingly widely used in daily life, and the security problems they bring are gradually being exposed. More and more attackers are embedding malicious code or objects into documents to achieve their attack goals. To increase the success rate of attacks, attackers generally use social engineering techniques to spread malicious documents and lure users to open them. Once a user opens the document, malicious behavior will be automatically executed, including engaging in abnormal network communication, using obfuscated macro scripts to download and install malware from external sources, and using links or other clickable embedded malicious items. Attacks using documents as attack vectors are becoming increasingly rampant, posing significant risks to individuals and businesses and seriously threatening confidentiality and security. Therefore, researching methods for detecting malicious documents is essential.

[0003] Existing malicious document detection methods are mainly divided into two categories: static detection and dynamic detection. Among them, dynamic detection methods expose the malicious behavior of documents more directly by executing the documents. Based on the different sources of features, dynamic detection methods can be divided into the following categories: (1) Detection methods based on operating system data: Researchers use virtual environments such as sandboxes to execute documents and extract information such as application programming interface methods and their parameters, network connections, etc., as dynamic features. (2) Detection methods based on process memory data: Researchers extract dump memory files and analyze the data in memory to discover malicious documents. (3) Detection methods based on side-channel data: Analyze the status of electronic devices by monitoring physical power consumption and electromagnetic emission.

[0004] Currently, the existing malicious document detection methods have the following problems: (1) Only system application interfaces related to the operation of malicious documents can be captured from the operating system, and the call relationship between application interfaces is lacking, which leads to the neglect of important malicious behaviors (information) in memory, affecting the detection effect and resulting in low accuracy of malicious document detection. (2) Existing memory data-based detection methods only dump the memory state once during sample operation, which is difficult to fully cover the critical period of malicious sample operation. (3) Some methods only dump process memory and cannot handle the situation of multi-process collaborative processing. Attackers can evade detection by transferring malicious behavior to child processes. (4) Researchers usually perform secondary analysis of memory or represent it in the form of images. However, secondary analysis is very time-consuming, and image representation is difficult to handle noise information in memory. Moreover, neither of these methods can effectively handle multiple memory files, making it difficult for existing methods to effectively represent and efficiently process multiple memory files. Summary of the Invention

[0005] This invention provides a malicious document detection method, an electronic device, and a readable storage medium to address the shortcomings of existing malicious document detection methods, which result in low accuracy in detecting malicious documents.

[0006] This invention provides a method for detecting malicious documents, comprising:

[0007] The document to be tested is subjected to memory dump analysis to obtain the memory difference characteristics of the document to be tested;

[0008] The memory difference features of the document to be detected are input into a preset malicious document detection model to obtain detection result information;

[0009] The preset malicious document detection model is trained using the memory difference features of malicious documents and the memory difference features of normal documents as samples, and with the labels corresponding to the memory difference features of malicious documents and normal documents respectively.

[0010] Furthermore, the step of performing memory dump analysis on the document to be detected to obtain the memory difference characteristics of the document to be detected includes:

[0011] The document to be detected is memory-dumped at fixed time intervals to obtain memory dump files of the document at multiple times.

[0012] Collect character information from the memory dump file of the document to be detected at each moment;

[0013] The memory difference characteristics of two adjacent character information are obtained by calculating the phase difference between the two adjacent character information.

[0014] The memory difference features of all adjacent pairs of character information are merged to obtain the memory difference features of the document to be detected.

[0015] Further, the step of performing memory dumping of the document to be detected at fixed time intervals to obtain a memory dump file of the document to be detected includes:

[0016] The document to be tested is dumped into memory at fixed time intervals using a memory dumping method to obtain a memory dump file of the document to be tested.

[0017] Furthermore, the memory dumping method includes an application programming interface (API) method.

[0018] Furthermore, the step of performing memory dumping of the document to be detected at fixed time intervals to obtain memory dump files of the document at multiple moments includes:

[0019] A memory dumping method is used. When the document to be detected is dumped into memory at fixed time intervals, the application programming interface method is hooked to obtain the parameter information of the application programming interface method.

[0020] The parameter information of the application interface method and the document to be detected are combined and dumped into memory at fixed time intervals to obtain a memory dump file of the document to be detected.

[0021] Furthermore, when the document to be detected is memory-dumped at fixed time intervals, the area of ​​the document to be detected that is memory-dumped includes the stack segment.

[0022] Furthermore, before inputting the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information, the method further includes: training the preset malicious document detection model.

[0023] The memory difference features of malicious documents and normal documents are used as samples to be vectorized and represented, resulting in vectors of memory difference features of malicious documents and vectors of memory difference features of normal documents.

[0024] The vectors of memory difference features of malicious documents and normal documents, along with the corresponding labels for the memory difference features of malicious documents and normal documents, are trained using a Long Short-Term Memory (LSTM) network classifier model to obtain a pre-defined malicious document detection model.

[0025] The present invention also provides a malicious document detection device, comprising:

[0026] The analysis module analyzes the document to be detected and obtains the memory difference characteristics of the document to be detected;

[0027] The detection module inputs the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information;

[0028] The malicious document detection model is trained using memory difference features of malicious documents and memory difference features of normal documents.

[0029] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the malicious document detection method as described above.

[0030] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the malicious document detection method as described above.

[0031] This invention provides a malicious document detection method, electronic device, and readable storage medium. By training a pre-defined malicious document detection model using memory difference features of malicious and normal documents, it effectively reduces the difficulty of data processing and the training cost of the malicious document detection model. Furthermore, by utilizing memory difference features, it can more comprehensively and intuitively discover malicious behavior in malicious documents, improving the classification accuracy of the malicious document detection model; and by detecting memory difference features of the document to be detected, it improves the accuracy of malicious document detection. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating a malicious document detection method provided by the present invention;

[0034] Figure 2 This is a flowchart of a malicious document detection device provided by the present invention;

[0035] Figure 3 This is a schematic diagram of the structure of an electronic device provided by the present invention;

[0036] Figure 4 This is a flowchart illustrating the malicious document detection method of the present invention, which uses a sandbox for operation.

[0037] Figure label:

[0038] 110: Analysis module; 120: Detection module; 210: Processor; 220: Communication interface; 230: Memory; 240: Communication bus. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0040] The following is combined Figure 1 The present invention describes a method for detecting malicious documents, comprising the following steps:

[0041] S1. Perform memory dump analysis on the document to be detected to obtain the memory difference characteristics of the document to be detected.

[0042] In this invention, the document to be detected can refer to commonly used office documents, such as DOC, DOCX and other Office types and PDF documents.

[0043] S2. Input the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information.

[0044] The pre-defined malicious document detection model is trained using the memory difference features of malicious documents and normal documents as samples, and is trained with the labels corresponding to the memory difference features of malicious documents and normal documents respectively.

[0045] In this embodiment, when running this invention, the Cuckoo sandbox can be used as the dynamic analysis environment, the Linux system as the host for memory dump analysis, and a Windows XP virtual machine installed on the Linux system as the client for memory dump analysis. The system receives user-inputted documents to be analyzed, allowing up to 12 documents to be analyzed simultaneously via the Linux system. The documents to be analyzed are input into the client for dynamic execution, with the execution time set to one minute. When the target process in the Cuckoo sandbox starts running the document to be analyzed, the target process is first suspended, the memory dump service is injected into the process space and started, and the target process is resumed. At this time, the memory dump service dumps the memory state of the process in the background at 500-second intervals. The memory dump service terminates when the process lifecycle ends. After the document to be analyzed finishes execution, multiple sets of memory dump files are obtained, grouped by process and ordered by time.

[0046] The pre-defined malicious document detection model is trained using memory difference features of both malicious and normal documents. Memory difference features allow for a more comprehensive and intuitive detection of malicious behavior within malicious documents. Using the memory difference features of the document to be detected by this model not only effectively reduces the difficulty of data processing and the training cost of the malicious document detection model, but also improves the classification accuracy of the model.

[0047] Specifically, in step S1, the document to be detected undergoes memory dump analysis to obtain the memory difference characteristics of the document, including the following steps:

[0048] The document to be tested is subjected to memory dump analysis to obtain the memory difference characteristics of the document; including:

[0049] A memory dumping method is employed, where the document under test is dumped from memory at fixed time intervals during execution on the client machine, resulting in memory dump files at multiple points in time. This memory dumping method is implemented using an Application Programming Interface (API) function. For example, the MiniDumpWriteDump API function is used. Furthermore, when dumping the document from memory at fixed time intervals, the dumped area includes the stack segment. Additionally, by hooking the CreateProcess API used to create processes, operations on all processes related to the document under test can be implemented.

[0050] Collect character information from the memory dump file of the document to be tested at each time step. The character information can be collected using the `strings` function, and the character information is counted as a set.

[0051] The difference between character information at two adjacent time points is calculated to obtain the memory difference feature after the difference between the two character information. This feature is used to represent the running status of the document to be detected between two adjacent time points.

[0052] The memory difference features of all adjacent pairs of character information are merged to obtain the memory difference features of the document to be detected.

[0053] This invention employs an application programming interface (API) method for memory dumping, focusing only on the stack segment of the dumped memory region of the document under test. The stack region, containing the stack segment, dynamically changes during the execution of the document under test through a "push-pop" mechanism. Furthermore, the memory region contains unallocated space and preloaded information. The unallocated space is useless, while the preloaded information remains unchanged throughout the entire sample execution. This means the stack segment can more effectively represent the execution process of the document under test. Compared to traditional methods that extract the entire process memory space or the complete virtual machine memory, this method reduces the size of the extracted memory file.

[0054] Compared to secondary analysis using existing methods, which typically analyze the entire memory of a virtual machine, resulting in large memory files, long processing times, and the need to process irrelevant regions containing unallocated space and preloaded information when converting to images, this invention reduces processing complexity and time, thereby lowering the difficulty of data processing.

[0055] Meanwhile, by distinguishing between normal and malicious documents through memory difference features derived from the difference between two adjacent character information, this method only calculates the memory difference features between two consecutive time points, rather than directly utilizing memory information from all states. This essentially eliminates noise in the extracted memory dump files. This reduces the training cost of the malicious document detection model and improves its classification accuracy. Furthermore, multiple memory dump analyses can be performed on the documents to be detected at fixed time intervals, avoiding the problem of only dumping the memory state once, which makes it difficult to completely cover malicious documents. This achieves maximum coverage of the documents to be detected within a certain time frame.

[0056] To further improve the accuracy of document detection, this embodiment involves dumping the document to be detected into memory at fixed time intervals to obtain a memory dump file of the document; it also includes:

[0057] The application programming interface (API) methods are hooked to obtain their parameter information. This parameter information is then combined with the document to be tested for memory dump analysis to obtain the memory dump file of the document to be tested.

[0058] When the target process executing the document under test calls the system API CreateProcess (i.e., when creating a child process), the API function is hooked to obtain the parameter information of the API function and the basic information of the process. Then, using APIMiniDumpWriteDump as the memory dumping method, the memory dumping service is injected into the process space. This allows the parameter information of the application interface method to be analyzed together with the document under test through memory dumping. This prevents malicious documents from being transferred through malicious information to evade detection, thereby achieving a full-coverage dump of all memory related to the document under test and improving the accuracy of document detection.

[0059] In step S2, the preset malicious document detection model is trained using the memory difference features of malicious documents and normal documents as samples, and with the labels corresponding to the memory difference features of malicious documents and normal documents respectively. This includes:

[0060] The memory difference features of malicious documents and normal documents are used as samples to perform vectorization representation, resulting in vectors of memory difference features of malicious documents and vectors of memory difference features of normal documents.

[0061] The vectors of memory difference features of malicious documents and normal documents, along with the corresponding labels for the memory difference features of malicious documents and normal documents, are trained using a Long Short-Term Memory (LSTM) classifier model to obtain a pre-defined malicious document detection model.

[0062] Specifically, the memory difference features of both malicious and normal documents are vectorized to obtain vectors of memory difference features for both types of documents. This includes:

[0063] Meaningless character information is removed from the memory difference features of malicious documents and normal documents. The top 20,000 most frequently occurring characters are extracted and used as the character table for the Long Short-Term Memory network classifier model. Then, the memory difference features of both malicious and normal documents are vectorized to obtain the vectors of the memory difference features of malicious documents and normal documents.

[0064] This invention utilizes a Long Short-Term Memory (LSTM) network classifier model to train the memory difference features of malicious documents and normal documents, thereby effectively reducing the training cost of the classification model and improving the accuracy of detecting malicious documents. At the same time, by calculating the memory difference features between the states at two different time points, instead of directly using the memory information of all states, the noise in the extracted memory dump file is essentially eliminated, thus achieving noise removal.

[0065] Compared with existing malicious document detection methods, the malicious document detection method of the present invention extracts memory difference features, which can more comprehensively and intuitively discover the malicious behavior of the document to be detected, and improve the classification accuracy to 99.27%.

[0066] The malicious document detection method and apparatus provided by the present invention are described below. The malicious document detection apparatus described below can be referred to in correspondence with the malicious document detection method described above.

[0067] like Figure 2 As shown, a malicious document detection device according to the present invention includes: an analysis module 110 and a detection module 120.

[0068] The analysis module 110 analyzes the document to be detected and obtains the memory difference characteristics of the document to be detected.

[0069] The detection module 120 inputs the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information.

[0070] The malicious document detection model is trained using memory difference features of malicious documents and memory difference features of normal documents.

[0071] This invention analyzes the document to be detected through the analysis module 110 to obtain its memory difference features. Using a pre-set malicious document detection model, it derives detection results, thus enabling the detection of the document. This not only effectively reduces the difficulty of data processing and the training cost of the malicious document detection model, but also, through memory difference features, allows for a more comprehensive and intuitive discovery of malicious behavior within the document, improving the accuracy of the malicious document detection model's classification. Furthermore, by detecting the memory difference features of the document to be detected, the accuracy of malicious document detection is enhanced.

[0072] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3As shown, the electronic device may include: a processor 210, a communications interface 220, a memory 230, and a communication bus 240, wherein the processor 210, the communications interface 220, and the memory 230 communicate with each other via the communication bus 240. The processor 210 can invoke logical instructions in the memory 230 to execute a malicious document detection method, which includes:

[0073] S1. Perform memory dump analysis on the document to be detected to obtain the memory difference characteristics of the document to be detected;

[0074] S2. Input the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information;

[0075] The preset malicious document detection model is trained using memory difference features of malicious documents and memory difference features of normal documents.

[0076] Furthermore, the logical instructions in the aforementioned memory 230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0077] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform a malicious document detection method provided by the methods described above, the method comprising:

[0078] S1. Perform memory dump analysis on the document to be detected to obtain the memory difference characteristics of the document to be detected;

[0079] S2. Input the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information;

[0080] The preset malicious document detection model is trained using memory difference features of malicious documents and memory difference features of normal documents.

[0081] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious documents, characterized in that, include: The document to be tested is subjected to memory dump analysis to obtain the memory difference characteristics of the document to be tested; The memory difference features of the document to be detected are input into a preset malicious document detection model to obtain detection result information; The preset malicious document detection model is trained using the memory difference features of malicious documents and the memory difference features of normal documents as samples, and with the labels corresponding to the memory difference features of malicious documents and the memory difference features of normal documents respectively. The step of performing memory dump analysis on the document to be detected to obtain memory difference characteristics of the document to be detected includes: The document to be detected is memory-dumped at fixed time intervals to obtain memory dump files of the document at multiple times. Collect character information from the memory dump file of the document to be detected at each moment; The memory difference characteristics of two adjacent character information are obtained by calculating the phase difference between the two adjacent character information. The memory difference features of all adjacent pairs of character information are merged to obtain the memory difference features of the document to be detected.

2. The malicious document detection method according to claim 1, characterized in that, The step of performing memory dumping of the document to be detected at fixed time intervals to obtain a memory dump file of the document to be detected includes: The document to be tested is dumped into memory at fixed time intervals using a memory dumping method to obtain a memory dump file of the document to be tested.

3. The malicious document detection method according to claim 2, characterized in that, The memory dumping method includes an application programming interface (API) method.

4. The malicious document detection method according to claim 3, characterized in that, The step of performing memory dumping of the document to be detected at fixed time intervals to obtain memory dump files of the document at multiple moments includes: A memory dumping method is used. When the document to be detected is dumped into memory at fixed time intervals, the application programming interface method is hooked to obtain the parameter information of the application programming interface method. The parameter information of the application interface method and the document to be detected are combined and dumped into memory at fixed time intervals to obtain a memory dump file of the document to be detected.

5. The malicious document detection method according to claim 1, characterized in that, When the document to be detected is dumped into memory at fixed time intervals, the area of ​​the document to be detected that is dumped into memory includes the stack segment.

6. The malicious document detection method according to claim 1, characterized in that, Before inputting the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection results, the method further includes: training the preset malicious document detection model. The memory difference features of malicious documents and normal documents are used as samples to be vectorized and represented, resulting in vectors of memory difference features of malicious documents and vectors of memory difference features of normal documents. The vectors of memory difference features of malicious documents and normal documents, along with the corresponding labels for the memory difference features of malicious documents and normal documents, are trained using a Long Short-Term Memory (LSTM) network classifier model to obtain a pre-defined malicious document detection model.

7. A malicious document detection device, characterized in that, include: The analysis module analyzes the document to be detected and obtains the memory difference characteristics of the document to be detected; The detection module inputs the memory difference features of the document to be detected into a preset malicious document detection model to obtain detection result information; Among them, the malicious document detection model is trained by the memory difference features of malicious documents and the memory difference features of normal documents; The analysis module includes: The document to be detected is memory-dumped at fixed time intervals to obtain memory dump files of the document at multiple times. Collect character information from the memory dump file of the document to be detected at each moment; The memory difference characteristics of two adjacent character information are obtained by calculating the phase difference between the two adjacent character information. The memory difference features of all adjacent pairs of character information are merged to obtain the memory difference features of the document to be detected.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the malicious document detection method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the malicious document detection method as described in any one of claims 1 to 6.

Images