A method, device, electronic device and storage medium for detecting document information security

Abstract

The present invention provides a method, device, electronic device and storage medium for detecting document information security. The method includes: in response to receiving a document to be detected, obtaining the document attribute information of the document to be detected; performing format legality verification on the document attribute information of the document to be detected to obtain a corresponding format legality verification result; performing encoding verification processing on the document attribute information of the document to be detected to obtain a corresponding encoding verification result; and obtaining and outputting a security detection result of the document to be detected according to the format legality verification result and the encoding verification result. The security detection result obtained by the present invention makes up for the drawback that the current document office software cannot detect hidden sensitive information in the document, enables users to more easily judge the origin and compliance of the document, effectively responds to the attack form of hiding sensitive information in the document attributes, and makes up for the deficiencies of the existing detection means.

Description

Background Art

[0002] In network attacks, most phishing attacks spread malware through malicious documents as carriers. Malicious documents are documents that have the risk of releasing implanted malicious code. Malicious documents are generally in the transmission stage of the network attack chain. At present, the detection methods for malicious documents mainly focus on the extraction and analysis of VBA macro codes, but some network attackers have adopted the means of hiding sensitive information outside the VBA macro code to evade the current document detection. Therefore, the existing security detection methods for malicious documents are no longer applicable to the current network attack methods. Summary of the invention

[0003] In view of this, the present invention provides a document information security detection method, device, electronic device and storage medium, which at least partially solve the technical problem of incomplete sensitive information detection in the prior art. The technical solution adopted by the present invention is:

[0004] According to one aspect of the present application, a document information security detection method is provided, comprising:

[0005] In response to the received document to be detected, obtaining document attribute information of the document to be detected;

[0006] Performing format legality verification on the document attribute information of the document to be detected, and obtaining the corresponding format legality verification result;

[0007] Performing coding verification processing on the document attribute information of the document to be detected to obtain a corresponding coding verification result;

[0008] Based on the format legality verification results and encoding verification results, the security detection results of the document to be detected are obtained and output.

[0009] In an exemplary embodiment of the present application, in response to receiving a document to be detected, obtaining document attribute information of the document to be detected includes:

[0010] The format of the received document to be detected is parsed to obtain the corresponding document attribute information.

[0011] In an exemplary embodiment of the present application, the document attribute information of the document to be detected is subjected to format legality verification to obtain a corresponding format legality verification result, including:

[0012] If the document attribute information of the document to be detected does not conform to the corresponding legal format, the illegal format is determined as the corresponding format legality verification result, and the illegal format record information of the corresponding document attribute information is stored in the preset detection result list; otherwise, the legal format is determined as the corresponding format legality verification result.

[0013] In an exemplary embodiment of the present application, encoding verification processing is performed on the document attribute information of the document to be detected, and the corresponding encoding verification result is obtained, including:

[0014] Performing encoding recognition processing on the document attribute information of the document to be detected to determine the corresponding encoding algorithm;

[0015] According to the encoding algorithm, decoding processing is performed on the corresponding document attribute information of the document to be detected to obtain the corresponding attribute decoding information;

[0016] Performing sensitive string verification processing on the attribute decoding information to obtain the corresponding attribute sensitive strings, and storing the corresponding attribute sensitive strings in a preset detection result list;

[0017] Performing sensitive function name verification processing on the attribute decoding information to obtain the corresponding attribute sensitive function names, and storing the corresponding attribute sensitive function names in a preset detection result list;

[0018] Determining the encoding verification result of the document to be detected according to the attribute sensitive strings and attribute sensitive function names.

[0019] In an exemplary embodiment of the present application, determining the encoding verification result of the document to be detected according to the attribute sensitive strings and attribute sensitive function names includes:

[0020] If the attribute sensitive string exists in the preset threat string list, then assign a value to the attribute sensitive string to obtain the corresponding string attribute value;

[0021] If the attribute sensitive function name exists in the preset threat function name list, then assign a value to the attribute sensitive function name to obtain the corresponding function name attribute value;

[0022] Adding all the string attribute values and all the function name attribute values to obtain the total threat attribute value;

[0023] If the total threat attribute value is greater than the preset threat attribute threshold, then determine that the encoding is abnormal as the encoding verification result; otherwise, determine that the encoding is normal as the encoding verification result.

[0024] In an exemplary embodiment of the present application, obtaining the security detection result of the document to be detected according to the format legal verification result and the encoding verification result and outputting it includes:

[0025] If the encoding verification result is that the encoding is abnormal, or the format legal verification result is that the format is illegal, then determine that there is a risk as the security detection result of the document to be detected; otherwise, determine that there is no risk as the security detection result of the document to be detected;

[0026] Outputting the security detection result and the preset detection result list.

[0027] In an exemplary embodiment of the present application, after the step of obtaining and outputting the security detection result of the document to be detected according to the format legal verification result and the encoding verification result, the document information security detection method further includes:

[0028] If the security detection result shows a risk, an alarm message is generated and output.

[0029] A document information security detection device includes:

[0030] A document response module, configured to obtain the document attribute information of the document to be detected in response to the received document to be detected;

[0031] A format verification module, configured to perform a format legality verification on the document attribute information of the document to be detected to obtain a corresponding format legality verification result;

[0032] An encoding verification module, configured to perform an encoding verification process on the document attribute information of the document to be detected to obtain a corresponding encoding verification result;

[0033] A result output module, configured to obtain and output the security detection result of the document to be detected according to the format legality verification result and the encoding verification result.

[0034] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program segment is stored, and the at least one instruction or the at least one program segment is loaded and executed by a processor to implement the above-mentioned document information security detection method.

[0035] According to one aspect of the present application, an electronic device is provided, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0036] The present invention has at least the following beneficial effects:

[0037] By extracting the document attribute information of the document to be detected, the present invention performs a format legality verification on each document attribute information of the document to be detected to obtain a corresponding format legality verification result, and then performs an encoding verification process on each document attribute information to check whether sensitive information is hidden in the content of the document attribute information to obtain a corresponding encoding verification result. Then, according to the format legality verification result and the encoding verification result, the security detection result of the document to be detected is obtained and output, making up for the drawback that the current document office software cannot detect sensitive information hidden in the document, enabling users to more easily judge the origin and compliance of the document, effectively coping with the attack form of hiding sensitive information in the document attributes, and making up for the deficiencies of existing detection means. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0039] Figure 1 It is a flowchart of the document information security detection method provided by the embodiments of the present invention;

[0040] Figure 2 It is a block diagram of the document information security detection device provided by the embodiments of the present invention. Detailed implementation manners

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present invention.

[0042] Currently, most phishing attacks spread malware through malicious documents. When users receive malicious documents and open them, there is a risk of being implanted with Trojans, ransomware, etc. Therefore, when users receive files or documents sent from the outside, it is necessary to perform security detection on the files or documents to determine whether there are security risks.

[0043] Currently, the detection methods for malicious documents mainly focus on the extraction and analysis methods of VBA macro codes. By extracting and analyzing sensitive information in the VBA macro codes, the existing risks are obtained. However, from the current information security samples, some network attackers have adopted means to hide sensitive information outside the VBA macro codes to avoid the current document detection. Since the sensitive information is not in the VBA macro codes, the existing security detection methods for malicious documents cannot detect the sensitive information hidden in the documents by network attackers. Document attributes are one of the means used by network attackers. Document attributes mainly include document revision numbers, managers, version numbers, etc. When document office software (such as office) generates a document, these attribute values will be automatically filled in a fixed format according to the system configuration information and the user's editing behavior, but when opening a document, the legality of these attribute values will not be strictly checked. In addition, when document office software and resource managers display document attributes, there are problems such as a narrow display area and incomplete display of long attribute contents, which also makes it difficult for ordinary users to see the abnormal information hidden in the attributes, and the existing malicious document detection means do not cover the dimension of document attribute compliance.

[0044] Under normal circumstances, users use attributes such as author, company, revision number, and remarks to mark the origin and editing revisions of documents. However, the sensitive information hidden in the document attributes by cyber attackers has no such natural semantics, but is a means for them to construct malicious documents. Therefore, using the attribute domain of the document to hide sensitive information is regarded as an abnormal behavior. Therefore, a method for analyzing document attributes to detect hidden information in documents needs to be proposed.

[0045] The described method for detecting document information security, as Figure 1 shown, includes:

[0046] Step S100: In response to the received document to be detected, obtain the document attribute information of the document to be detected;

[0047] The document to be detected is an externally sent document received by the user. This document can be an office document. Since the present invention needs to detect and process the document attributes, when the user receives the document to be detected, it is necessary to first extract the document attribute information of the document to be detected.

[0048] Further, in step S100, in response to the received document to be detected, obtaining the document attribute information of the document to be detected includes:

[0049] Step S110: Perform format parsing on the received document to be detected to obtain the corresponding document attribute information.

[0050] Step S200: Perform format legal verification on the document attribute information of the document to be detected to obtain the corresponding format legal verification result;

[0051] Perform format parsing on the received document to be detected, such as parsing office document formats such as OpenXML, CFB, and RTF, and extract document attribute information such as title, subject, tag, category, remarks, author, last save author, revision number, program name, version number, company, manager, creation time, save time, total edit time, and content status. Then, perform format legal verification on each extracted document attribute information to verify the legality of each document attribute information and check whether the format of each document attribute information is legal.

[0052] Further, in step S200, performing format legal verification on the document attribute information of the document to be detected to obtain the corresponding format legal verification result includes:

[0053] Step S210: If the document attribute information of the document to be detected does not conform to the corresponding legal format, determine that the format is illegal as the corresponding format legal verification result, and store the format illegal record information of the corresponding document attribute information in the preset detection result list; otherwise, determine that the format is legal as the corresponding format legal verification result.

[0054] Perform format legal verification on each document attribute information of the document to be detected extracted, to obtain the corresponding format legal verification result. For example, if the document attribute information is the revision number, and the legal revision number is a decimal digit. If the revision number of the document to be detected is a non - numeric string, the format legal verification result of the revision number of the document to be detected is illegal, and insert the information of illegal revision number format into the preset detection result list to indicate that the format of the revision number is illegal and there is an abnormality. On the contrary, if the revision number of the document to be detected is a decimal digit, the format legal verification result of the revision number of the document to be detected is legal. If the format is legal, there is no need to store record information in the detection result list.

[0055] The detection result list is a table stored in the user server. If there is any illegal document attribute information, add a corresponding record in the detection result list for the user to view. The detection result list stores the record information of all document attribute information with illegal formats of the document to be detected.

[0056] Step S300: Perform encoding verification processing on the document attribute information of the document to be detected, to obtain the corresponding encoding verification result;

[0057] Step S200 is to perform format legal verification on the document attribute information of the document to be detected. Regardless of whether the format of the document attribute information is legal, perform Step S300, that is, perform encoding verification on each document attribute information. Encoding verification is to detect the content of each document attribute information to verify whether there are any abnormal situations in all document attribute information.

[0058] Furthermore, in Step S300, performing encoding verification processing on the document attribute information of the document to be detected to obtain the corresponding encoding verification result includes:

[0059] Step S310: Perform encoding recognition processing on the document attribute information of the document to be detected to determine the corresponding encoding algorithm;

[0060] Step S320: According to the encoding algorithm, perform decoding processing on the corresponding document attribute information of the document to be detected to obtain the corresponding attribute decoding information;

[0061] Step S330: Perform sensitive string verification processing on the attribute decoding information to obtain the corresponding attribute sensitive strings, and store the corresponding attribute sensitive strings in a preset detection result list;

[0062] Step S340: Perform sensitive function name verification processing on the attribute decoding information to obtain the corresponding attribute sensitive function names, and store the corresponding attribute sensitive function names in a preset detection result list;

[0063] Step S350: Determine the encoding verification result of the document to be detected based on the attribute sensitive strings and attribute sensitive function names.

[0064] In the step of performing encoding verification processing on the document attribute information of the document to be detected, first identify the encoding value of each document attribute information to check whether it has the characteristics of encoding algorithms such as Base64 or hexadecimalization to determine the corresponding encoding algorithm, and then decode the corresponding document attribute information according to the identified encoding algorithm to obtain the attribute decoding information. Each document attribute information corresponds to an attribute decoding information. Then, perform sensitive string detection on each attribute decoding information for powershell scripts, cmd commands, URLs, executable file names, file paths, etc., and sensitive function name detection for New-Object, DownloadFile, DownloadString, Start-Process, Run, Shell, etc., to obtain the attribute sensitive strings and attribute sensitive function names of each attribute decoding information respectively. Then, store the attribute sensitive strings and attribute sensitive function names of all attribute decoding information in the detection result list for the user to view and analyze.

[0065] Further, in step S350, determining the encoding verification result of the document to be detected based on the attribute sensitive strings and attribute sensitive function names includes:

[0066] Step S351: If the attribute sensitive string exists in the preset threat string list, assign a value to the attribute sensitive string to obtain the corresponding string attribute value;

[0067] Step S352: If the attribute sensitive function name exists in the preset threat function name list, assign a value to the attribute sensitive function name to obtain the corresponding function name attribute value;

[0068] Step S353: Add all the string attribute values and all the function name attribute values to obtain the total threat attribute value;

[0069] Step S354: If the total threat attribute value is greater than the preset threat attribute threshold, determine that the encoding is abnormal as the encoding verification result; otherwise, determine that the encoding is normal as the encoding verification result.

[0070] The user server stores a threat string list and a threat function name list. The threat string list records strings with security risks, and the threat function name list records function names with security risks. Moreover, the strings and function names in the threat string list and the threat function name list have corresponding risk values to represent the risk indices of the corresponding strings and function names. The larger the risk value, the higher the security risk of the corresponding string or function name. Compare the attribute sensitive strings and attribute sensitive function names of each attribute decoding information with the threat string list and the threat function name list respectively. If they do not exist in the threat string list and the threat function name list, it indicates that the security coefficient of the corresponding attribute decoding information is relatively high. If they exist in the threat string list and the threat function name list, it indicates that the security coefficient of the corresponding attribute decoding information is relatively low. And assign the risk value in the threat string list or the threat function name list to the corresponding attribute sensitive string or attribute sensitive function name for suspiciousness assessment assignment. After comparing all the attribute decoding information, add up the risk values of the attribute sensitive strings and attribute sensitive function names of all the attribute decoding information to obtain the total threat attribute value. The total threat attribute value represents the risk coefficient of the document to be detected. The higher the total threat attribute value, the higher the risk of the document to be detected being implanted with malware.

[0071] Step S400: Obtain and output the security detection result of the document to be detected according to the format legal verification result and the encoding verification result;

[0072] Further, in step S400, obtaining and outputting the security detection result of the document to be detected according to the format legal verification result and the encoding verification result includes:

[0073] Step S410: If the encoding verification result is that there is an encoding anomaly, or the format legal verification result is that the format is illegal, then determine the existence of risk as the security detection result of the document to be detected; otherwise, determine the non - existence of risk as the security detection result of the document to be detected;

[0074] Step S420: Output the security detection result and a preset detection result list.

[0075] Step S500: If the security detection result is the existence of risk, then generate and output an alarm message.

[0076] After obtaining the security detection result, the security detection result and the current detection result list are output. If the total threat attribute value is greater than the preset threat attribute threshold, it indicates that the security risk of the document to be detected has reached the alarm state to remind the user to perform security operations. The detection result list records all the document attribute information with illegal formats, the attribute sensitive strings, and the attribute sensitive function names of all attribute decoding information in the document to be detected. All the document attribute information is presented to the user or analyst in a more readable way such as a web report, and the document attribute information with anomalies in the detection result list is highlighted in different colors, and the alarm information is displayed at a prominent position for easy viewing by the user.

[0077] The present invention extracts the document attribute information of the document to be detected, verifies the legality of the format of each document attribute information of the document to be detected to obtain the corresponding format legality verification result, then performs encoding verification processing on each document attribute information to check whether sensitive information is hidden in the content of the document attribute information to obtain the corresponding encoding verification result, and then obtains the security detection result of the document to be detected according to the format legality verification result and the encoding verification result. The security detection result is presented to the user in a readable form such as a list, making up for the drawback that the current document office software cannot detect sensitive information hidden in the document, enabling the user to more easily judge the origin and compliance of the document, effectively coping with the attack form of hiding sensitive information in the document attributes, and making up for the deficiencies of the existing detection means.

[0078] The present invention provides a lightweight method for document information security detection, focusing on the legality of document attributes to detect abnormal document attribute values, effectively coping with the new forms of current malicious documents, making up for the deficiency of only focusing on VBA macro code to detect malicious documents, and presenting complex document attributes in a way such as a web report, superimposing the detected abnormal information, enabling the user to more intuitively judge the true origin and compliance of the document, avoiding blindly opening malicious documents, providing more dimensional judgment information for identifying malicious documents, helping to discover unknown threats, and not relying on environments such as document office software and sandboxes, being applicable to a variety of application scenarios, and can be used as an independent tool or embedded as a module in other security detection products.

[0079] A document information security detection device 100, as Figure 2 shown, includes:

[0080] A document response module 110, configured to obtain the document attribute information of the document to be detected in response to the received document to be detected;

[0081] A format verification module 120, configured to verify the legality of the format of the document attribute information of the document to be detected to obtain the corresponding format legality verification result;

[0082] The encoding verification module 130 is used to perform encoding verification processing on the document attribute information of the document to be detected, and obtain the corresponding encoding verification result;

[0083] The result output module 140 is used to obtain the security detection result of the document to be detected according to the format legal verification result and the encoding verification result, and output it.

[0084] Among them, the document response module 110 is also used for:

[0085] Perform format parsing on the received document to be detected, and obtain the corresponding document attribute information.

[0086] Among them, the format verification module 120 is also used for:

[0087] If the document attribute information of the document to be detected does not conform to the corresponding legal format, then determine that the format is illegal as the corresponding format legal verification result, and store the format illegal record information of the corresponding document attribute information in the preset detection result list; otherwise, determine that the format is legal as the corresponding format legal verification result.

[0088] Among them, the encoding verification module 130 is also used for:

[0089] Perform encoding recognition processing on the document attribute information of the document to be detected, and determine the corresponding encoding algorithm;

[0090] According to the encoding algorithm, perform decoding processing on the corresponding document attribute information of the document to be detected, and obtain the corresponding attribute decoding information;

[0091] Perform sensitive string inspection processing on the attribute decoding information, obtain the corresponding attribute sensitive string, and store the corresponding attribute sensitive string in the preset detection result list;

[0092] Perform sensitive function name inspection processing on the attribute decoding information, obtain the corresponding attribute sensitive function name, and store the corresponding attribute sensitive function name in the preset detection result list;

[0093] According to the attribute sensitive string and the attribute sensitive function name, determine the encoding verification result of the document to be detected;

[0094] If the attribute sensitive string exists in the preset threat string list, then assign a value to the attribute sensitive string to obtain the corresponding string attribute value;

[0095] If the attribute sensitive function name exists in the preset threat function name list, then assign a value to the attribute sensitive function name to obtain the corresponding function name attribute value;

[0096] Add up all the string attribute values and all the function name attribute values to obtain the total threat attribute value;

[0097] If the total value of the threat attributes is greater than the preset threat attribute threshold, then determine that the encoding is abnormal as the encoding verification result; otherwise, determine that the encoding is normal as the encoding verification result.

[0098] Among them, the result output module 140 is further configured to:

[0099] If the encoding verification result is that the encoding is abnormal, or the format legal verification result is that the format is illegal, then determine that there is a risk as the security detection result of the document to be detected; otherwise, determine that there is no risk as the security detection result of the document to be detected;

[0100] Output the security detection result and the preset detection result list.

[0101] An embodiment of the present invention also provides a computer program product, which includes program code. When the program product runs on an electronic device, the program code is used to cause the electronic device to execute the steps in the methods according to various exemplary embodiments of the present invention described above in this specification.

[0102] In addition, although the steps of the methods in the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be executed in this specific order, or that all the steps shown must be executed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc.

[0103] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be implemented by software, or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the methods according to the embodiments of the present disclosure.

[0104] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0105] Those skilled in the art to which the present invention pertains can understand that various aspects of the present invention can be implemented as a system, a method, or a program product. Therefore, various aspects of the present invention can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to as "circuit", "module", or "system" here.

[0106] An electronic device according to this embodiment of the present invention. The electronic device is merely an example and should not impose any limitations on the functions and usage scope of the embodiments of the present invention.

[0107] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: at least one of the above-mentioned processors, at least one of the above-mentioned memories, and a bus connecting different system components (including the memory and the processor).

[0108] Wherein, the memory stores program codes, and the program codes can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present invention described in the "Exemplary Method" section above of this specification.

[0109] The memory may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) and / or a cache memory, and may further include a read-only memory (ROM).

[0110] The memory may also include a program / utility having a set (at least one) of program modules. Such program modules include, but are not limited to: an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0111] The bus may represent one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any bus structure in a variety of bus structures.

[0112] The electronic device may also communicate with one or more external devices (such as a keyboard, a pointing device, a Bluetooth device, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device, and / or communicate with any device that enables the electronic device to communicate with one or more other computing devices (such as a router, a modem, etc.). Such communication may be carried out through an input / output (I / O) interface. And, the electronic device may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through the bus. It should be understood that although not shown in the figure, other hardware and / or software modules may be used in combination with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0113] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0114] In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium, on which a program product capable of implementing the above method of this specification is stored. In some possible implementation manners, various aspects of the present invention can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of this specification.

[0115] The program product can adopt any combination of one or more readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0116] The computer-readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, which carries the readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device.

[0117] The program code included on the readable medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0118] Program code for performing the operations of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and also including conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, executed as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or, alternatively, can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0119] In addition, the above-mentioned drawings are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present invention, and are not for limiting purposes. It is easy to understand that the processes shown in the above-mentioned drawings do not indicate or limit the chronological order of these processes. Additionally, it is also easy to understand that these processes can be executed, for example, synchronously or asynchronously in multiple modules.

[0120] It should be noted that although several modules or units of a device for action execution are mentioned in the above detailed description, such a division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more of the above-described modules or units can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0121] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A method for detecting the security of document information, characterized in that, Including: In response to the received document to be detected, obtain the document attribute information of the document to be detected; Perform format legality verification on the document attribute information of the document to be detected to obtain the corresponding format legality verification result; Perform encoding verification processing on the document attribute information of the document to be detected to obtain the corresponding encoding verification result; Obtain the security detection result of the document to be detected according to the format legality verification result and the encoding verification result and output it; Among them, performing encoding verification processing on the document attribute information of the document to be detected to obtain the corresponding encoding verification result includes: Perform encoding recognition processing on the document attribute information of the document to be detected to determine the corresponding encoding algorithm; According to the encoding algorithm, perform decoding processing on the corresponding document attribute information of the document to be detected to obtain the corresponding attribute decoding information; Perform sensitive string verification processing on the attribute decoding information to obtain the corresponding attribute sensitive string, and store the corresponding attribute sensitive string in a preset detection result list; Perform sensitive function name verification processing on the attribute decoding information to obtain the corresponding attribute sensitive function name, and store the corresponding attribute sensitive function name in a preset detection result list; Determine the encoding verification result of the document to be detected according to the attribute sensitive string and the attribute sensitive function name.

2. The method according to claim 1, characterized in that, In response to the received document to be detected, obtaining the document attribute information of the document to be detected includes: Perform format parsing on the received document to be detected to obtain the corresponding document attribute information.

3. The method according to claim 1, wherein Performing format legality verification on the document attribute information of the document to be detected to obtain the corresponding format legality verification result includes: If the document attribute information of the document to be detected does not conform to the corresponding legal format, determine that the format is illegal as the corresponding format legality verification result, and store the format illegal record information of the corresponding document attribute information in a preset detection result list; otherwise, determine that the format is legal as the corresponding format legality verification result.

4. The method according to claim 1, wherein Determining the encoding verification result of the document to be detected according to the attribute sensitive string and the attribute sensitive function name includes: If the attribute sensitive string exists in a preset threat string list, assign a value to the attribute sensitive string to obtain the corresponding string attribute value; If the attribute sensitive function name exists in a preset threat function name list, assign a value to the attribute sensitive function name to obtain the corresponding function name attribute value; Add all the string attribute values and all the function name attribute values to obtain the total threat attribute value; If the total threat attribute value is greater than a preset threat attribute threshold, determine that the encoding is abnormal as the encoding verification result; otherwise, determine that the encoding is normal as the encoding verification result.

5. The method according to claim 4, wherein Obtaining the security detection result of the document to be detected according to the format legality verification result and the encoding verification result and outputting it includes: If the encoding verification result indicates an encoding anomaly, or the format legality verification result indicates an illegal format, then determine that there is a risk as the security detection result of the document to be detected; otherwise, determine that there is no risk as the security detection result of the document to be detected; Output the security detection result and a preset detection result list.

6. The method according to claim 1, wherein After the step of obtaining and outputting the security detection result of the document to be detected according to the format legality verification result and the encoding verification result, the method further includes: If the security detection result indicates a risk, then generate and output an alarm message.

7. A document information security detection device, characterized in that, It includes: A document response module, configured to obtain the document attribute information of the document to be detected in response to the received document to be detected; A format verification module, configured to perform a format legality verification on the document attribute information of the document to be detected to obtain a corresponding format legality verification result; An encoding verification module, configured to perform an encoding verification process on the document attribute information of the document to be detected to obtain a corresponding encoding verification result; A result output module, configured to obtain and output the security detection result of the document to be detected according to the format legality verification result and the encoding verification result; Among them, performing an encoding verification process on the document attribute information of the document to be detected to obtain a corresponding encoding verification result includes: Performing an encoding identification process on the document attribute information of the document to be detected to determine a corresponding encoding algorithm; According to the encoding algorithm, performing a decoding process on the corresponding document attribute information of the document to be detected to obtain corresponding attribute decoding information; Performing a sensitive string verification process on the attribute decoding information to obtain a corresponding attribute sensitive string, and storing the corresponding attribute sensitive string in a preset detection result list; Performing a sensitive function name verification process on the attribute decoding information to obtain a corresponding attribute sensitive function name, and storing the corresponding attribute sensitive function name in a preset detection result list; Determining the encoding verification result of the document to be detected according to the attribute sensitive string and the attribute sensitive function name.

8. A non-transitory computer-readable storage medium storing at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1-6.

9. An electronic device, characterized in that, It includes a processor and the non-transitory computer-readable storage medium described in claim 8.

Images