A document detection method and apparatus

Abstract

Embodiments of the present application disclose a document detection method and device, and relate to the technical field of network security. The method comprises: obtaining a malicious document set; parsing the malicious document set to obtain a loader function set of the malicious document; establishing a malicious loader function feature library according to the loader function set of the malicious document; parsing a to-be-detected document to obtain a loader function combination of the to-be-detected document; comparing the loader function combination of the to-be-detected document with the loader function combination of the malicious document in the malicious loader function feature library, and obtaining a detection result according to the comparison result. The document detection method and device provided by the present application do not depend on the characteristics of the shellcode instruction itself, but depend on the loading mode, i.e. the loader function, so that the detection and recognition of known and unknown shellcodes can be realized, thereby completing the detection of the to-be-detected document with a small amount of characteristics, increasing the detection efficiency, and reducing the resource occupation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a document detection method and apparatus. Background Technology

[0002] A compound document can be understood as a working document containing various information, including but not limited to text, charts, and multimedia, and is increasingly used in various collaborative work processes. Shellcode, on the other hand, is a piece of address-independent code executed to exploit software vulnerabilities. Attackers typically embed it within compound documents to attack user computers.

[0003] Currently, shellcode identification primarily relies on the signature patterns formed by shellcode commands. However, because shellcode can be freely modified and reconstructed, the number of signature patterns has exploded, making it impossible to effectively cover all malicious shellcode characteristics. Therefore, there is an urgent need for a more efficient and accurate detection method to identify shellcode in documents, protecting users' computers from attackers. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a document detection method and apparatus to solve the problem that existing recognition methods mainly rely on the characteristics of shellcode instructions themselves, resulting in low document recognition efficiency.

[0005] In a first aspect, embodiments of the present invention provide a document detection method, the method comprising:

[0006] Obtain a collection of malicious documents;

[0007] The malicious document set is parsed to obtain a set of malicious document loader functions; the set of malicious document loader functions includes combinations of loader functions from multiple malicious documents; the combinations of loader functions include API functions for memory allocation parameters, process operation parameters, and dynamic loading parameters;

[0008] Based on the set of malicious document loader functions, a malicious loader function signature library was established.

[0009] Parse the document to be detected to obtain the combination of loader functions for the document to be detected;

[0010] The detection result is obtained by comparing the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library.

[0011] Optionally, before parsing the document to be detected and obtaining the loader function combination of the document to be detected, the method further includes:

[0012] Determine the frequency of occurrence of each loader function in the set of loader functions of the malicious document;

[0013] The frequency of occurrence of the loader function determines whether to add the corresponding loader function to the preset loader function feature library.

[0014] Optionally, the specific combination of loader functions for parsing the document to be detected is as follows:

[0015] Parse the document to be detected to obtain loader functions for multiple documents to be detected;

[0016] Determine whether the loader function of each document to be detected is the same as the loader function in the preset loader function feature library;

[0017] If they are the same, then the loader function of the corresponding document to be detected is determined to be the target loader function;

[0018] The combination of loader functions for the document to be detected is obtained based on multiple target loader functions.

[0019] Optionally, the step of comparing the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library, and obtaining the detection result based on the comparison result, specifically involves:

[0020] Confirm, according to a preset order, whether the combination of loader functions in the document to be detected is the same as the combination of malicious loader functions in the malicious loader function feature library;

[0021] If they are the same, then generate the first detection result;

[0022] If they are different, a second detection result is generated.

[0023] Secondly, embodiments of the present invention provide a document detection device, the device comprising:

[0024] The acquisition unit retrieves a collection of malicious documents.

[0025] The parsing unit parses the malicious document set to obtain a set of malicious document loader functions; the set of malicious document loader functions includes combinations of loader functions from multiple malicious documents; the combinations of loader functions include API functions for memory allocation parameters, process operation parameters, and dynamic loading parameters;

[0026] Create a unit and build a malicious loader function signature library based on the set of malicious document loader functions;

[0027] The parsing unit also parses the document to be detected to obtain a combination of loader functions for the document to be detected;

[0028] The comparison unit compares the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library, and obtains the detection result based on the comparison result.

[0029] Optionally, the device further includes a confirmation unit, which is specifically used for:

[0030] Determine the frequency of occurrence of each loader function in the set of loader functions of the malicious document;

[0031] The frequency of occurrence of the loader function determines whether to add the corresponding loader function to the preset loader function feature library.

[0032] Optionally, the parsing unit is further specifically used for:

[0033] Parse the document to be detected to obtain loader functions for multiple documents to be detected;

[0034] Determine whether the loader function of each document to be detected is the same as the loader function in the preset loader function feature library;

[0035] If they are the same, then the loader function of the corresponding document to be detected is determined to be the target loader function;

[0036] The combination of loader functions for the document to be detected is obtained based on multiple target loader functions.

[0037] Optionally, the comparison unit is further specifically used for:

[0038] Confirm, according to a preset order, whether the combination of loader functions in the document to be detected is the same as the combination of malicious loader functions in the malicious loader function feature library;

[0039] If they are the same, then generate the first detection result;

[0040] If they are different, a second detection result is generated.

[0041] Thirdly, this disclosure also provides an electronic device, which includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the document detection method described in the first aspect above.

[0042] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the document detection method described in the first aspect.

[0043] This invention provides a document detection method and apparatus that extracts loader functions from malicious documents, establishes a malicious loader function feature library, and then compares the loader functions of the document to be detected with these features to identify whether shellcode exists in the document. The process does not rely on the features of the shellcode instructions themselves, but rather on their loading method, i.e., the loader function. This enables the detection and identification of both known and unknown shellcode, thereby achieving document detection with a small number of features, increasing document detection efficiency, and reducing resource consumption. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A flowchart of a document detection method provided in an embodiment of the present invention;

[0046] Figure 2 A flowchart illustrating a method for establishing a preset loader function feature library, provided in an embodiment of the present invention;

[0047] Figure 3 This is a schematic diagram of the structure of a document detection device provided in an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0049] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0050] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0051] The following is in conjunction with the appendix Figure 1 The solutions provided in the embodiments of the present invention will be described in detail below. Figure 1 This is a flowchart illustrating a document detection method according to an embodiment of the present invention. In this embodiment, the implementing entity is an electronic device. This electronic device can be a terminal device, such as a personal computer or desktop computer. It can also be a server. Figure 1 As shown, the method in this embodiment specifically includes the following steps:

[0052] Step 110: Obtain a collection of malicious documents.

[0053] The malicious document set in this application can be understood as a collection of known malicious document samples containing embedded shellcode by the attacker.

[0054] Preferably, the documents in this application are composite documents.

[0055] Step 120: Parse the malicious document set to obtain the set of malicious document loader functions.

[0056] Since shellcode in malicious documents requires execution privileges, its execution relies on a loader embedded by the attacker within the malicious document. The principle is to use the loader to allocate memory, load the shellcode into memory, and allow the machine to execute it. Therefore, it can be said that malicious documents all contain a loader for executing shellcode. The loader function can be understood as the loader's Application Programming Interface (API) function, which contains data describing the loader's execution behavior.

[0057] The process scans the set of malicious documents for all known malicious documents and extracts all loader functions from each document. A single document typically contains multiple loader functions, which together constitute the document's loader function set. Therefore, it's understandable that parsing each malicious document yields a loader function set for that document, and parsing the entire set of malicious documents results in a loader function set that includes loader function sets from multiple malicious documents. In other words, the loader function set for each malicious document contains loader function sets from multiple malicious documents, and each loader function set for a malicious document contains loader functions from multiple malicious documents.

[0058] In this application, the loader function combination includes, but is not limited to, API functions for allocating memory parameters, process operation parameters, and dynamic loading parameters.

[0059] Step 130: Establish a malicious loader function signature library based on the set of malicious document loader functions.

[0060] Generally, a single loader function is insufficient to determine whether a document is malicious. Therefore, it is necessary to establish a malicious loader function signature library based on the set of loader functions of malicious documents, and then use the combination of various loader functions in the malicious loader function signature library to make subsequent judgments on the documents to be detected.

[0061] Step 140: Parse the document to be detected to obtain the combination of loader functions for the document to be detected.

[0062] As stated above, since a document typically contains multiple loader functions, but not every loader function is a high-risk loader function that needs further identification, it would waste a lot of time to judge each loader function in the document to be detected one by one. Therefore, before determining whether the loader functions in the document to be detected are malicious, it is necessary to first screen all the extracted loader functions in the document to be detected, select the high-risk loader functions, and form a combination of loader functions in the document to be detected.

[0063] Therefore, before this step, you can also perform the following steps to create a pre-defined loader function feature library:

[0064] Step 210: Parse the malicious document set to obtain the set of malicious document loader functions.

[0065] This step is the same as step 110, and will not be repeated here.

[0066] Step 220: Determine the frequency of occurrence of each loader function in the set of loader functions of the malicious document.

[0067] Record the frequency of occurrence of each loader function in the set of loader functions for malicious documents.

[0068] Step 230: Determine whether to add the corresponding loader function to the preset loader function feature library based on the frequency of occurrence of the loader function.

[0069] If the frequency of a certain loader function in the set of loader functions of a malicious document is higher than the preset value set by the user, then the loader function can be considered a high-risk loader function, and the loader function will be added to the preset loader function signature library.

[0070] After obtaining the pre-defined loader function feature library, the document to be detected is parsed to obtain the loader functions of multiple documents. This involves scanning the document, extracting the loader functions, and determining whether each document's loader function matches those in the pre-defined feature library. If they match, the loader function is considered a high-risk loader function, and thus identified as a target loader function requiring further detection. Finally, based on all the obtained target loader functions, a combination of loader functions for the document to be detected is derived. This combination represents the high-risk loader functions that require further evaluation.

[0071] Step 150: Compare the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library, and obtain the detection result based on the comparison result.

[0072] The system checks whether the loader function combination of the document to be detected is the same as the loader function combination of malicious documents in the malicious loader function signature library, according to a preset order. If they are the same, it is considered that the shellcode embedded in the document to be detected has been identified by identifying the loader function, and a first detection result representing that the document to be detected is a malicious document is generated. If they are different, a second detection result representing that the document to be detected is not a malicious document is generated.

[0073] This application provides a document detection method that extracts loader functions from malicious documents, establishes a malicious loader function feature library, and then compares the loader functions of the document to be detected with these features to identify whether shellcode exists in the document. This process does not rely on the features of the shellcode instructions themselves, but rather on their loading method, i.e., the loader function. This enables the detection and identification of both known and unknown shellcode, thereby achieving document detection with a small number of features, increasing document detection efficiency and reducing resource consumption.

[0074] Accordingly, this application also provides a document detection device for implementing the above steps 110-150. Figure 3 This is a schematic diagram of a document detection device provided in an embodiment of this application, as shown below. Figure 3 As shown, the document detection device in this embodiment may include: an acquisition unit 310, a parsing unit 320, a creation unit 330, a comparison unit 340, and a confirmation unit 350.

[0075] Unit 310 was retrieved to obtain a collection of malicious documents.

[0076] The parsing unit 320 parses the malicious document set to obtain a set of malicious document loader functions; the set of malicious document loader functions includes a combination of loader functions from multiple malicious documents.

[0077] Create unit 330 and establish a malicious loader function signature library based on the set of malicious document loader functions;

[0078] The parsing unit 320 also parses the document to be detected to obtain a combination of loader functions for the document to be detected;

[0079] The comparison unit 340 compares the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library, and obtains the detection result based on the comparison result.

[0080] Optionally, the loader function combination includes API functions for memory allocation parameters, process operation parameters, and dynamic loading parameters.

[0081] Optionally, the device further includes a confirmation unit 350, which is specifically used for:

[0082] Determine the frequency of occurrence of each loader function in the set of loader functions of the malicious document;

[0083] The frequency of occurrence of the loader function determines whether to add the corresponding loader function to the preset loader function feature library.

[0084] Optionally, the parsing unit 320 is further specifically used for:

[0085] Parse the document to be detected to obtain loader functions for multiple documents to be detected;

[0086] Determine whether the loader function of each document to be detected is the same as the loader function in the preset loader function feature library;

[0087] If they are the same, then the loader function of the corresponding document to be detected is determined to be the target loader function;

[0088] The combination of loader functions for the document to be detected is obtained based on multiple target loader functions.

[0089] Optionally, the comparison unit 340 is further specifically used for:

[0090] Confirm, according to a preset order, whether the combination of loader functions in the document to be detected is the same as the combination of malicious loader functions in the malicious loader function feature library;

[0091] If they are the same, then generate the first detection result;

[0092] If they are different, a second detection result is generated.

[0093] The apparatus of this embodiment can be used to perform Figure 1 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0094] Accordingly, the document detection device provided in this embodiment of the invention can also be implemented using another structure. Figure 4 This is a schematic diagram of an embodiment of an electronic device provided by the present invention, which can realize the present invention. Figure 1 The process of the illustrated embodiment is as follows: Figure 4 As shown, the aforementioned electronic device may include: a housing 41, a processor 42, a memory 43, a circuit board 44, and a power supply circuit 45. The circuit board 44 is disposed within the space enclosed by the housing 41, and the processor 42 and memory 43 are mounted on the circuit board 44. The power supply circuit 45 supplies power to the various circuits or devices of the aforementioned electronic device. The memory 43 stores executable program code. The processor 42 reads the executable program code stored in the memory 43 to run a program corresponding to the executable program code, thereby executing the methods described in the foregoing embodiments.

[0095] For details on the specific execution process of the above steps by processor 42, and the steps further executed by processor 42 through running executable program code, please refer to the present invention. Figure 1 The description of the illustrated embodiments will not be repeated here.

[0096] The electronic device is a device that provides computing services. It consists of a processor, hard drive, memory, system bus, etc. The electronic device is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0097] It should be noted that, in this document, terms such as "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0099] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0100] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable storage medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable storage medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0101] More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable storage media can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0102] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof.

[0103] In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0104] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0105] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0106] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of the present invention.

Claims

1. A document detection method, characterized in that, The method includes: Obtain a collection of malicious documents; The malicious document set is parsed to obtain a set of malicious document loader functions; the set of malicious document loader functions includes combinations of loader functions from multiple malicious documents; the combinations of loader functions include API functions for memory allocation parameters, process operation parameters, and dynamic loading parameters; Based on the set of malicious document loader functions, a malicious loader function signature library was established. The method involves parsing the document to be detected to obtain a combination of loader functions for the document. Specifically, this involves: parsing the document to be detected to obtain multiple loader functions; determining whether each loader function is identical to a preset loader function feature library; if identical, identifying the corresponding loader function as a target loader function; and obtaining the combination of loader functions for the document based on the multiple target loader functions. Before parsing the document to be detected to obtain the combination of loader functions, the method further includes: determining the frequency of occurrence of each loader function in the malicious document's loader function set; and determining whether to add the corresponding loader function to a preset loader function feature library based on the frequency of occurrence of the loader functions. The detection result is obtained by comparing the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library. Specifically, the comparison of the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library and obtaining the detection result based on the comparison result involves: confirming whether the loader function combination of the document to be detected is the same as the malicious loader function combination in the malicious loader function feature library according to a preset order; if they are the same, a first detection result is generated; if they are different, a second detection result is generated.

2. A document detection device, characterized in that, The device includes: The acquisition unit retrieves a collection of malicious documents. The parsing unit parses the malicious document set to obtain a set of malicious document loader functions; the set of malicious document loader functions includes combinations of loader functions from multiple malicious documents; the combinations of loader functions include API functions for memory allocation parameters, process operation parameters, and dynamic loading parameters; Create a unit and build a malicious loader function signature library based on the set of malicious document loader functions; The parsing unit further parses the document to be detected to obtain a combination of loader functions for the document to be detected. Specifically, parsing the document to be detected to obtain a plurality of loader functions for the document to be detected; determining whether each loader function of the document to be detected is the same as a loader function in a preset loader function feature library; if they are the same, determining the corresponding loader function of the document to be detected as a target loader function; obtaining the combination of loader functions for the document to be detected based on the plurality of target loader functions; before parsing the document to be detected to obtain the combination of loader functions for the document to be detected, the unit further includes: determining the frequency of occurrence of each loader function in the malicious document's loader function set; determining whether to add the corresponding loader function to the preset loader function feature library based on the frequency of occurrence of the loader function. The comparison unit compares the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library, and obtains a detection result based on the comparison result. Specifically, the comparison of the loader function combination of the document to be detected with the loader function combination of malicious documents in the malicious loader function feature library and obtaining a detection result based on the comparison result involves: confirming whether the loader function combination of the document to be detected is the same as the malicious loader function combination in the malicious loader function feature library according to a preset order; if they are the same, a first detection result is generated; if they are different, a second detection result is generated.

3. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in claim 1.

4. A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the method of claim 1.

Images