Document detection method and device, and electronic device

Abstract

The application provides a document detection method, device and electronic equipment, including: performing dynamic analysis on a to-be-detected document to obtain a document analysis report; sequentially matching each word in the document analysis report with a word in a target word list to obtain a target word sequence that is matched successfully, wherein the target word list is determined based on each word in a historical document analysis report set; and inputting the target word sequence that is matched successfully into a classification model to obtain a classification result of the to-be-detected document. The application determines a target word list from a historical document analysis report, matches each word in a document analysis report with a word in the target word list to obtain a target word sequence that is matched successfully, and combines a classification model to realize classification of a to-be-detected document, thereby effectively improving the accuracy of detecting malicious documents.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a document detection method and device and electronic equipment. BACKGROUND

[0002] With the development of network technology, network security has always been the focus of users, and malicious documents can threaten network security.

[0003] A malicious document refers to an electronic document that performs malicious behavior on a user computer or other terminal without explicit user prompt or user permission, thereby infringing on the legitimate rights and interests of the user. Attackers mostly embed codes such as JavaScript and Macro in electronic documents to achieve their malicious purposes. Malicious document attacks pose risks to individuals and enterprises. After a successful attack on a computer, the attacker generally uses the computer as a stepping stone to move horizontally, attack other computers or facilities in the network, steal confidential data, or destroy important infrastructure. Therefore, how to accurately detect malicious documents is an important issue in the industry. SUMMARY

[0004] The present application provides a document detection method, device and electronic equipment to solve the problem of how to accurately detect malicious documents.

[0005] The present application provides a document detection method, comprising: performing dynamic analysis on a to-be-detected document to obtain a document analysis report; sequentially matching each word in the document analysis report with a word in a target word list to obtain a target word sequence that matches successfully, wherein the target word list is determined based on each word in a historical document analysis report set; and inputting the target word sequence that matches successfully into a classification model to obtain a classification result of the to-be-detected document.

[0006] According to the document detection method provided by the present application, before the step of performing dynamic analysis on a to-be-detected document to obtain a document analysis report, the method further comprises: obtaining an original document and analyzing a target byte in the original document, wherein the target byte is the first N bytes of the file header of the original document, and N is a positive integer; in the case that the target byte is a composite category, regarding the original document as a to-be-detected document; or, in the case that the target byte is a non-composite category, judging whether the non-composite category original document belongs to an Open XML document or a PDF document; and in the case that the non-composite category original document belongs to an Open XML document or a PDF document, regarding the original document as a to-be-detected document.

[0007] According to the document detection method provided by the application, the document to be detected is dynamically analyzed to obtain a document analysis report, including: dynamically executing the document to be detected in a virtual machine of a sandbox environment to obtain a first analysis report; deleting target information in the first analysis report to obtain a second analysis report, wherein the target information includes at least one of info information, signatures information, target information, screenshots information and all empty dictionaries; replacing characters in the second analysis report except numbers, letters and special characters with target characters, and replacing an IP address list in the second analysis report with the number of IP addresses in the IP address list to obtain a document analysis report.

[0008] According to the document detection method provided by the application, before the step of sequentially matching each word in the document analysis report with a word in a target word list to obtain a target word sequence with a matching success, the method further includes: counting word frequencies of each word in the historical document analysis report set; selecting M words with the highest word frequencies to generate the target word list, M being a positive integer.

[0009] According to the document detection method provided by the application, before the step of inputting the target word sequence with the matching success into a classification model to obtain a classification result of the document to be detected, the method further includes: obtaining a plurality of word sequence samples and a document category label corresponding to each word sequence sample, the document category label including a benign document label and a malicious document label; regarding a combination of each word sequence sample and the document category label as a training sample to obtain a plurality of training samples, and training the classification model by using the plurality of training samples.

[0010] According to the document detection method provided by the application, after the step of inputting the target word sequence with the matching success into a classification model to obtain a classification result of the document to be detected, the method further includes: in a case where the document analysis report is obtained, updating the historical document analysis report set based on a document analysis report of the document to be detected to generate a dynamic historical document analysis report set; counting word frequencies of each word in the dynamic historical document analysis report set; selecting M words with the highest word frequencies to update the target word list to obtain a new target word list, M being a positive integer.

[0011] According to the document detection method provided by the application, after the M words with the highest frequency are selected, the target word list is updated to obtain a new target word list, and in the case that there are Z words different from the target word list in the new target word list, a plurality of document analysis report samples are obtained from the dynamic historical document analysis report set, and a document category label corresponding to each document analysis report sample is obtained, the document category label includes a benign document label and a malicious document label, and Z is a positive integer; each word in each document analysis report sample is matched with the words in the new target word list in turn, and the word sequence corresponding to each document analysis report sample that matches successfully is obtained; the combination of the word sequence corresponding to each document analysis report sample and the document category label is taken as a training sample, a plurality of training samples are obtained, and the classification model is trained by using the plurality of training samples.

[0012] The application further provides a document detection device, comprising: a first analysis module, configured to perform dynamic analysis on a to-be-detected document to obtain a document analysis report; a matching module, configured to sequentially match each word in the document analysis report with a word in a target word list to obtain a target word sequence that matches successfully, wherein the target word list is determined based on each word in a set of historical document analysis reports; and a classification module, configured to input the target word sequence that matches successfully into a classification model to obtain a classification result of the to-be-detected document.

[0013] According to the document detection device provided by the application, the device further comprises:

[0014] The second analysis module is configured to obtain an original document and analyze a target byte in the original document, wherein the target byte is the first N bytes of a file header of the original document, and N is a positive integer; in the case that the target byte is a composite category, the original document is taken as a to-be-detected document; or in the case that the target byte is a non-composite category, it is judged whether the original document of the non-composite category belongs to an Open XML document or a PDF document; and in the case that the original document of the non-composite category belongs to the Open XML document or the PDF document, the original document is taken as the to-be-detected document.

[0015] According to the document detection device provided by the application, the first analysis module is specifically configured to:

[0016] Dynamically execute the to-be-detected document in a virtual machine of a sandbox environment to obtain a first analysis report; delete target information in the first analysis report to obtain a second analysis report, wherein the target information includes at least one of info information, signatures information, target information, screenshots information and all empty dictionaries; replace characters in the second analysis report except for numbers, letters and specific characters with target characters, and replace an IP address list in the second analysis report with a number of IP addresses in the IP address list to obtain a document analysis report.

[0017] According to the document detection device provided by the application, the device further comprises:

[0018] The first statistical module is configured to count word frequencies of respective words in the set of historical document analysis reports.

[0019] The generating module is configured to select M words with the highest word frequencies to generate the target word list, M being a positive integer.

[0020] According to the document detection device provided by the application, the device further comprises:

[0021] The first obtaining module is configured to obtain a plurality of word sequence samples and a document category label corresponding to each word sequence sample, the document category label including a benign document label and a malicious document label.

[0022] The first training module is configured to obtain a plurality of training samples by taking a combination of each word sequence sample and a document category label as a training sample, and train the classification model by using the plurality of training samples.

[0023] According to the document detection device provided by the application, the device further comprises:

[0024] The first updating module is configured to update the set of historical document analysis reports based on a document analysis report of the to-be-detected document to generate a dynamic set of historical document analysis reports when the document analysis report is obtained.

[0025] The second statistical module is configured to count word frequencies of respective words in the dynamic set of historical document analysis reports.

[0026] The second updating module is configured to select M words with the highest word frequencies to update the target word list to obtain a new target word list, M being a positive integer.

[0027] According to the document detection device provided by the application, the device further comprises:

[0028] The second acquisition module is configured to acquire a plurality of document analysis report samples from the dynamic historical document analysis report set and acquire a document category label corresponding to each document analysis report sample in a case where the new target word list contains Z words different from the target word list, the document category label including a benign document label and a malicious document label, and Z is a positive integer.

[0029] The matching module is further configured to sequentially match each word in each document analysis report sample with a word in the new target word list and acquire a word sequence corresponding to each document analysis report sample that is successfully matched.

[0030] The second training module is configured to obtain a plurality of training samples by taking the combination of the word sequence and the document category label corresponding to each document analysis report sample as a training sample and train the classification model by using the plurality of training samples.

[0031] The present application also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the document detection method according to any one of the above when executing the program.

[0032] The present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the steps of the document detection method according to any one of the above.

[0033] The present application also provides a computer program product comprising a computer program, wherein the computer program is executable on a processor to implement the steps of the document detection method according to any one of the above.

[0034] The document detection method, device and electronic device provided by the present application can effectively improve the accuracy of detecting malicious documents by determining a target word list from historical document analysis reports, matching each word in a document analysis report with a word in the target word list, acquiring a target word sequence that is successfully matched, and combining a classification model to classify a document to be detected. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the present application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0036] Figure 1 is a flowchart of the document detection method provided by the present application;

[0037] Figure 2 is a detailed flow block diagram of the document detection method provided by the present application;

[0038] Figure 3 is a structural schematic diagram of the document detection device provided by the present application;

[0039] Figure 4 is a structural schematic diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0041] The terms "first", "second" and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second" and the like are generally a category, and are not limited to the number of objects, for example, the first object can be one or more.

[0042] The document detection method, device and electronic device provided by the embodiments of the present application will be described in detail below with reference to the drawings, specific embodiments and application scenarios.

[0043] Figure 1 is a flow schematic diagram of the document detection method provided by the present application, as shown in Figure 1 , comprising:

[0044] Step 110: dynamically analyzing the to-be-detected document to obtain a document analysis report;

[0045] The to-be-detected document described in the embodiments of the present application is a document with a format within the detection range, such as a composite document, an Open XML document or a PDF document.

[0046] Specifically, the dynamic analysis of the to-be-detected document can be processing the to-be-detected document into a document analysis report convenient for document detection, or deleting part of the content in the to-be-detected document meaningless for document classification and obtaining a document analysis report, so as to perform subsequent operations.

[0047] The document analysis report described in the embodiments of the present application is a report containing all contents meaningful for subsequent document detection.

[0048] In step 120, each word in the document analysis report is matched with a word in a target word list in sequence, and a target word sequence with a matching success is obtained, wherein the target word list is determined based on each word in a historical document analysis report set;

[0049] The historical document analysis report set described in the embodiments of the present application includes a plurality of historical document analysis reports, each of which is obtained based on a corresponding historical document. The historical document can be a benign document or a malicious document. The historical document is dynamically analyzed to obtain the corresponding historical document analysis report.

[0050] Specifically, in the embodiments of the present application, the target word list can be determined based on the word frequency of each word in the historical document analysis report set.

[0051] Each word in the document analysis report is matched with a word in the target word list in sequence, and the matched words are arranged in sequence to generate a target word sequence. It can be understood that there can be repeated words in the target word sequence.

[0052] More specifically, the matched words can be arranged directly to generate the target word sequence, or each word in the target word list can have a corresponding ID, the ID corresponding to the matched word is added to a list first, and the target word sequence is generated according to the list after the matching is completed. The embodiments of the present application are not specifically limited.

[0053] Further, the maximum length of the target word sequence can be set to 200000, that is, the target word sequence can have at most 200000 words. In the case that the number of matched words reaches 200000, the matching will not be performed, or the matching will be continued but the matched words will not be added to the target word sequence. In the case that all words in the document analysis report are matched and the length of the target word sequence is less than 200000, 0 is used for padding.

[0054] In step 130, the matched target word sequence is input into a classification model to obtain a classification result of the document to be detected.

[0055] The classification model described in the embodiments of the present application can be a TextCNN model, or a model obtained by using k-max pooling instead of maximum pooling based on the TextCNN model. The embodiments of the present application are not specifically limited. Using k-max pooling can make the detection effect better.

[0056] Specifically, after the target word sequence is input into the classification model, the classification model first maps each word in the target word sequence into a vector through word embedding, for example, a 50-dimensional vector can be used to represent each word in the target word sequence. Therefore, for example, in the case where the maximum length of the target word sequence is 200000, the target word sequence will be converted into a 200000*50 vector matrix.

[0057] The vector matrix is subjected to feature extraction by using the convolution layer and the pooling layer in the classification model. In the case where k-max pooling is used, the first k strongest feature values after convolution are extracted, which can retain more abundant information. Then, all the output vectors of the pooling layer are spliced, and the output result is activated by using the Softmax function.

[0058] The output elements of the Softmax are 2, and the 2 output elements correspond to 2 classification results of benign documents and malicious documents respectively. Each output element will output a corresponding prediction probability. The maximum prediction probability is selected from the prediction probabilities output by the 2 output elements, and the classification result corresponding to the output element with the maximum prediction probability is determined as the classification result corresponding to the target word sequence. For example, if the prediction probability output by the second output element is the maximum, and the classification result corresponding to the second output element is a malicious document, it can be determined that the classification result corresponding to the target word sequence is a malicious document. That is, the document to be detected corresponding to the target word sequence is a malicious document.

[0059] In the embodiment of the present application, by determining the target word list from the historical document analysis report, matching each word in the document analysis report with the words in the target word list, obtaining the target word sequence with a matching success, and combining the classification model, the classification of the document to be detected is realized, which can effectively improve the accuracy of detecting malicious documents.

[0060] Optionally, before the dynamic analysis of the document to be detected is performed to obtain the document analysis report, the method further comprises:

[0061] obtaining an original document, and analyzing a target byte in the original document, wherein the target byte is the first N bytes of the file header of the original document, and N is a positive integer;

[0062] in the case where the target byte is a composite category, the original document is taken as the document to be detected;

[0063] or, in the case where the target byte is a non-composite category, it is judged whether the original document of the non-composite category belongs to an Open XML document or a PDF document;

[0064] in the case where the original document of the non-composite category belongs to an Open XML document or a PDF document, the original document is taken as the document to be detected.

[0065] The original document described in the embodiments of the present application can be a to-be-detected document or a document that does not need to be detected.

[0066] Specifically, the composite document is a diversified document, and in the embodiments of the present application, it is an Office composite document. The composite document generally has a fixed file header identifier, and therefore, the first N bytes of the file header can be used to determine whether the to-be-detected document is a composite document. For example, N can be 8.

[0067] If it is determined according to the first N bytes of the file header of the original document that the document is a composite document, the original document is a to-be-detected document.

[0068] In the case where it is determined that the original document is not a composite document, the original document can be parsed in the compressed document mode to determine whether the original document belongs to an Open XML document or a PDF document. If so, the original document is a to-be-detected document.

[0069] If the original document does not belong to any of the composite document, the Open XML document and the PDF document, the original document is a document that does not need to be detected. The document that does not need to be detected is not processed, and the document format that is not in the detection range can be directly output.

[0070] In the embodiments of the present application, by analyzing the original document to determine whether the original document is a to-be-detected document, only the to-be-detected document is subjected to subsequent operations, unnecessary operations can be avoided, and resource waste can be reduced.

[0071] Optionally, the dynamic analysis of the to-be-detected document to obtain a document analysis report comprises:

[0072] dynamically executing the to-be-detected document in a virtual machine in a sandbox environment to obtain a first analysis report;

[0073] deleting target information in the first analysis report to obtain a second analysis report, wherein the target information comprises at least one of info information, signatures information, target information, screenshots information and all empty dictionaries;

[0074] replacing characters other than numbers, letters and special characters in the second analysis report with target characters, and replacing an IP address list in the second analysis report with the number of IP addresses in the IP address list to obtain a document analysis report.

[0075] Specifically, in the embodiments of the present application, Cuckoo sandbox is used as a dynamic analysis environment, and Linux system is used as an analysis host. A Windows XP system virtual machine is installed in the Linux system as an analysis client.

[0076] The document to be detected is input into the client for dynamic execution for one minute to obtain a first analysis report. The first analysis report includes nine parts: info information, signatures information, target information, network information, dropped information, behavior information, debug information, screenshots information, strings information, and metadata information. Among them, the four parts of the info information, the signatures information, the target information, and the screenshots information are meaningless for the classification of the document. For example, the info part records platform and Cuckoo version information, but they are the same for all documents. And the empty dictionaries in each part are also meaningless for the classification of the document. Therefore, at least one of the info information, the signatures information, the target information, the screenshots information, and all empty dictionaries can be selected to be deleted to obtain a second analysis report.

[0077] Further, the characters other than numbers, letters, and specific characters in the second analysis report, and IP addresses are also meaningless for the classification of the document. In order to facilitate the extraction of words in the analysis report, the above two can be selected to be replaced.

[0078] The specific character described in the embodiments of the present application can be a dot “.” in English. Considering that the number may contain a decimal point, the dot is retained.

[0079] Specifically, for example: the characters other than numbers, letters, and specific characters can be space characters, and the target character can be *. The space character is replaced by *, and the words can be well extracted from the analysis report based on *, or the analysis report is divided into individual words according to *. The IP address list in the second analysis report is replaced by the number of IP addresses in the IP address list, for example: IP: 2 is replaced by IP: [1.1.1.1 2.2.2.2]. After the replacement, a document analysis report is obtained.

[0080] In the embodiments of the present application, the contents meaningless for the classification of the document in the first analysis report are deleted or replaced, which can not only facilitate the extraction of words in the document analysis report, but also reduce the workload of subsequent word matching, and make the matched target word sequence meaningful for the classification of the document, so that the classification result obtained by the classification model is more accurate, and the accuracy of detecting malicious documents is further improved.

[0081] Optionally, before the step of sequentially matching each word in the document analysis report with the words in the target word list to obtain a target word sequence that matches successfully, the method further includes:

[0082] counting word frequencies of each word in the historical document analysis report set;

[0083] selecting M words with the highest word frequencies to generate the target word list, M being a positive integer.

[0084] Specifically, the appearance frequencies of each word in the historical document analysis report set can be counted, and a word frequency table can be constructed, and the top M words with the highest frequencies can be selected from the word frequency table to generate the target word list, for example, M can be 5000.

[0085] In the embodiments of the present application, the target word list can be generated based on the appearance frequencies of each word in the historical document analysis report set, which can realize the determination of the target word list without manual features, thereby reducing the complexity of constructing the target word list.

[0086] Optionally, before the matching successful target word sequence is input into the classification model to obtain the classification result of the to-be-detected document, the method further includes:

[0087] obtaining a plurality of word sequence samples and a document category label corresponding to each word sequence sample, the document category label including a benign document label and a malicious document label;

[0088] combining each word sequence sample and the document category label as a training sample, obtaining a plurality of training samples, and training the classification model by using the plurality of training samples.

[0089] The plurality of word sequence samples described in the embodiments of the present application can specifically be that a plurality of historical document analysis reports are selected from the historical document analysis report set as a plurality of document analysis report samples, and each word in each document analysis report sample is sequentially matched with a word in the target word list to obtain a plurality of matching successful word sequence samples. Also, the matching successful word sequence can be stored as a historical word sequence set after the matching of all the previous document analysis reports is completed, and a plurality of word sequence samples are selected from the historical word sequence set.

[0090] The document category label corresponding to each word sequence sample is known and is labeled by the document category label. The document category label includes a benign document label and a malicious document label.

[0091] Further, the combination of each word sequence sample and the document category label is taken as a training sample, that is, each word sequence sample with a document category label is taken as a training sample, thereby obtaining a plurality of training samples. After obtaining the plurality of training samples, the plurality of training samples are sequentially input into the classification model, that is, the word sequence sample and the document category label in each training sample are simultaneously input into the classification model, the model parameters in the classification model are adjusted according to each output result of the classification model, and finally the training process of the classification model is completed.

[0092] In the embodiment of the application, the combination of each word sequence sample and the document category label is taken as a training sample, a plurality of training samples are obtained, and the classification model is trained by using the plurality of training samples, so that the classification model learns the features of the word sequence corresponding to different document categories, which is beneficial to detecting the document type of the to-be-detected document by using the trained classification model.

[0093] Optionally, after the target word sequence with the matching success is input into the classification model to obtain the classification result of the to-be-detected document, the method further includes:

[0094] In the case where the document analysis report is obtained, the historical document analysis report set is updated based on the document analysis report of the to-be-detected document to generate a dynamic historical document analysis report set;

[0095] The word frequencies of each word in the dynamic historical document analysis report set are counted;

[0096] M words with the highest word frequencies are selected, the target word list is updated to obtain a new target word list, and M is a positive integer.

[0097] Specifically, after obtaining the classification result of the to-be-detected document, the obtained document analysis report of the to-be-detected document is added to the historical document analysis report set to generate a dynamic historical document analysis report set.

[0098] The word frequencies of each word in the obtained document analysis report of the to-be-detected document are updated in the word frequency table. For example, the word frequency table counts the number of occurrences of each word, and updating the word frequency table is to modify the number of occurrences of the corresponding word. M words with the highest word frequencies are selected from the new word frequency table to update the target word frequency table, and M can be 5000.

[0099] The M words with the highest word frequencies in the new word frequency table can be the same as or different from the M words with the highest word frequencies in the old word frequency table. That is, the new target word frequency table can be the same as or different from the old target word frequency table.

[0100] More specifically, each time a document analysis report of a different document to be detected is obtained, the document analysis report is added to the historical document analysis report set, i.e., the dynamic historical document analysis report set changes each time a document analysis report is obtained.

[0101] Moreover, each time a document analysis report of a different document to be detected is obtained, frequency statistics are performed and the target word list is updated. The updated target word list can be the same as or different from the target word list before the update.

[0102] In the embodiments of the present application, the target word list is updated according to the word frequency each time a document to be detected is obtained, so that the non-artificial characteristic word dictionary is kept updated, and the updating process is simple, and the target word list is kept effective.

[0103] Optionally, after the M words with the highest word frequency are selected and the target word list is updated to obtain a new target word list, the method further includes:

[0104] In a case where there are Z words in the new target word list that are different from the target word list, a plurality of document analysis report samples are obtained from the dynamic historical document analysis report set, and a document category label corresponding to each document analysis report sample is obtained, the document category label including a benign document label and a malicious document label, and Z is a positive integer;

[0105] Each word in each document analysis report sample is sequentially matched with a word in the new target word list, and a word sequence corresponding to each document analysis report sample that matches successfully is obtained.

[0106] A combination of the word sequence corresponding to each document analysis report sample and the document category label is taken as a training sample, a plurality of training samples are obtained, and the classification model is trained using the plurality of training samples.

[0107] Specifically, in a case where there are a plurality of words in the new target word list that are different from the original target word list, if the previous classification model is still used, the accuracy rate can be seriously reduced, and Z can be 100. It can be understood that the new target word list mentioned here can be a target word list obtained after the original target word list is updated a plurality of times.

[0108] The plurality of document analysis report samples are reselected and matched with the new target word list respectively to obtain a word sequence corresponding to each document analysis report sample. The document category label corresponding to each document analysis report sample is the document category label of the corresponding word sequence.

[0109] The word sequence corresponding to each document analysis report sample and the document category label are taken as a training sample, and the classification model is retrained through multiple training samples.

[0110] In the embodiment of the application, the classification model is retrained in the case that there are Z words different from the target word list in the new target word list, effectively improving the ability of the classification model to deal with unknown samples, and further improving the accuracy of malicious document detection.

[0111] Figure 2 The detailed flowchart of the document detection method provided by the application is shown in FIG. 1, which includes: Figure 2

[0112] Start inputting the original document, perform original document format recognition, perform dynamic analysis and analysis report preprocessing on the original document in a sandbox environment, obtain a first analysis report through dynamic analysis, delete or replace meaningless content for document classification through analysis report preprocessing, and obtain a document analysis report. On the one hand, the words in the document analysis report are matched with the target word list to generate a target word sequence, which is input into the classification model to obtain an output result. On the other hand, in the update module, the word frequency table is updated based on the document analysis report, and then the target word list is updated. In the case that there are Z words different from the original target word list in the new target word list, the classification model is retrained according to the new word list, and the original classification model is replaced for subsequent document classification.

[0113] The document detection method of the application can realize unified detection of Office composite documents, Open XML documents and PDF documents, avoids dependence on a feature dictionary, can well improve the detection accuracy, and reaches 99.05%. When facing unknown samples, the accuracy of the traditional method based on the feature dictionary decreases by 12.48%, and the accuracy of the method decreases by 0.09%. The method has better robustness and generalization ability, and is more beneficial to solve actual security problems.

[0114] The document detection device provided by the application is described below, and the document detection device described below can be correspondingly referred to the document detection method described above.

[0115] Figure 3 The structural diagram of the document detection device provided by the application is shown in FIG. 2, which includes: Figure 3 ​As shown, the device comprises: a first analysis module 310, a matching module 320 and a classification module 330; the first analysis module 310 is configured to perform dynamic analysis on a to-be-detected document to obtain a document analysis report; the matching module 320 is configured to sequentially match each word in the document analysis report with a word in a target word list to obtain a target word sequence that is successfully matched, wherein the target word list is determined based on each word in a historical document analysis report set; and the classification module 330 is configured to input the target word sequence that is successfully matched into a classification model to obtain a classification result of the to-be-detected document.

[0116] Optionally, the device further comprises:

[0117] a second analysis module configured to obtain an original document and analyze a target byte in the original document, wherein the target byte is the first N bytes of a file header of the original document, and N is a positive integer; in a case where the target byte is a composite category, the original document is taken as a to-be-detected document; or in a case where the target byte is a non-composite category, it is determined whether the non-composite category original document belongs to an Open XML document or a PDF document; and in a case where the non-composite category original document belongs to the Open XML document or the PDF document, the original document is taken as the to-be-detected document.

[0118] Optionally, the first analysis module is specifically configured to:

[0119] perform the to-be-detected document in a virtual machine in a sandbox environment to obtain a first analysis report; delete target information in the first analysis report to obtain a second analysis report, wherein the target information comprises at least one of info information, signatures information, target information, screenshots information and all empty dictionaries; replace characters other than numbers, letters and special characters in the second analysis report with a target character, and replace an IP address list in the second analysis report with a number of IP addresses in the IP address list to obtain a document analysis report.

[0120] Optionally, the device further comprises:

[0121] a first statistical module configured to count word frequencies of each word in the historical document analysis report set;

[0122] a generation module configured to select M words with the highest word frequencies to generate the target word list, and M is a positive integer.

[0123] Optionally, the device further comprises:

[0124] The first obtaining module is configured to obtain a plurality of word sequence samples and a document category label corresponding to each word sequence sample, wherein the document category label comprises a benign document label and a malicious document label.

[0125] The first training module is configured to obtain a plurality of training samples by taking each word sequence sample and the document category label as a training sample, and train the classification model by using the plurality of training samples.

[0126] Optionally, the apparatus further comprises:

[0127] The first updating module is configured to update the historical document analysis report set based on the document analysis report of the to-be-detected document to generate a dynamic historical document analysis report set when the document analysis report is obtained.

[0128] The second statistical module is configured to count word frequencies of each word in the dynamic historical document analysis report set.

[0129] The second updating module is configured to select M words with the highest word frequencies, update the target word list to obtain a new target word list, and M is a positive integer.

[0130] Optionally, the apparatus further comprises:

[0131] The second obtaining module is configured to obtain a plurality of document analysis report samples from the dynamic historical document analysis report set and obtain a document category label corresponding to each document analysis report sample when there are Z words different from the target word list in the new target word list, wherein the document category label comprises a benign document label and a malicious document label, and Z is a positive integer.

[0132] The matching module is further configured to sequentially match each word in each document analysis report sample with a word in the new target word list, and obtain a word sequence corresponding to each document analysis report sample that matches successfully.

[0133] The second training module is configured to obtain a plurality of training samples by taking the word sequence corresponding to each document analysis report sample and the document category label as a training sample, and train the classification model by using the plurality of training samples.

[0134] The document detection apparatus provided by the embodiments of the present application can determine a target word list from historical document analysis reports, match each word in a document analysis report with a word in the target word list, obtain a target word sequence that matches successfully, and combine a classification model to classify a to-be-detected document, thereby effectively improving the accuracy of detecting malicious documents.

[0135] Figure 4This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a document detection method, which includes: dynamically analyzing the document to be detected to obtain a document analysis report; sequentially matching each word in the document analysis report with words in a target word list to obtain a successfully matched target word sequence, wherein the target word list is determined based on words in a historical document analysis report set; and inputting the successfully matched target word sequence into a classification model to obtain a classification result for the document to be detected.

[0136] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the document detection method provided by the above methods. The method includes: performing dynamic analysis on the document to be detected to obtain a document analysis report; sequentially matching each word in the document analysis report with words in a target word list to obtain a successfully matched target word sequence, wherein the target word list is determined based on each word in a historical document analysis report set; and inputting the successfully matched target word sequence into a classification model to obtain a classification result for the document to be detected.

[0138] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements a document detection method provided by any of the above methods, the method comprising: performing dynamic analysis on a document to be detected to obtain a document analysis report; sequentially matching each word in the document analysis report with a word in a target word list to obtain a target word sequence that is successfully matched, wherein the target word list is determined based on each word in a set of historical document analysis reports; and inputting the target word sequence that is successfully matched into a classification model to obtain a classification result of the document to be detected.

[0139] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0140] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0141] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some technical features; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A document detection method characterized by, The method comprises the following steps: performing dynamic analysis on the to-be-detected document to obtain a document analysis report; sequentially matching each word in the document analysis report with a word in a target word list to obtain a successfully matched target word sequence, wherein the target word list is determined based on each word in a historical document analysis report set; inputting the successfully matched target word sequence into a classification model to obtain a classification result of the to-be-detected document; wherein the step of performing dynamic analysis on the to-be-detected document to obtain a document analysis report comprises: dynamically executing the to-be-detected document in a virtual machine of a sandbox environment to obtain a first analysis report; deleting target information in the first analysis report to obtain a second analysis report, wherein the target information comprises at least one of info information, signatures information, target information, screenshots information and all empty dictionaries; replacing characters other than numbers, letters and special characters in the second analysis report with a target character, and replacing an IP address list in the second analysis report with the number of IP addresses in the IP address list to obtain a document analysis report.

2. The document detection method of claim 1, wherein, Before the step of performing dynamic analysis on the to-be-detected document to obtain a document analysis report, the method further comprises: obtaining an original document and analyzing target bytes in the original document, wherein the target bytes are the first N bytes of the file header of the original document, and N is a positive integer; in the case that the target bytes belong to a composite category, taking the original document as the to-be-detected document; or, in the case that the target bytes belong to a non-composite category, determining whether the non-composite category original document belongs to an Open XML document or a PDF document; in the case that the non-composite category original document belongs to an Open XML document or a PDF document, taking the original document as the to-be-detected document.

3. The document detection method of claim 1, wherein, Before the step of sequentially matching each word in the document analysis report with a word in a target word list to obtain a successfully matched target word sequence, the method further comprises: counting the word frequency of each word in the historical document analysis report set; selecting M words with the highest word frequency to generate the target word list, and M is a positive integer.

4. The document detection method of claim 1, wherein, Before the step of inputting the successfully matched target word sequence into a classification model to obtain a classification result of the to-be-detected document, the method further comprises: obtaining a plurality of word sequence samples and a document category label corresponding to each word sequence sample, wherein the document category label comprises a benign document label and a malicious document label; combining each word sequence sample and the document category label to obtain a training sample, obtaining a plurality of training samples, and training the classification model using the plurality of training samples.

5. The document detection method of claim 1, wherein, After the step of inputting the successfully matched target word sequence into a classification model to obtain a classification result of the to-be-detected document, the method further comprises: in the case that the document analysis report is obtained, updating the historical document analysis report set based on the document analysis report of the to-be-detected document to generate a dynamic historical document analysis report set; count word frequencies of each word in the dynamic historical document analysis report set; select M words with the highest word frequencies, update the target word list to obtain a new target word list, M being a positive integer.

6. The document detection method of claim 5, wherein, After the step of selecting M words with the highest word frequencies and updating the target word list to obtain a new target word list, the method further includes: in a case where there are Z words different from the target word list in the new target word list, obtaining a plurality of document analysis report samples from the dynamic historical document analysis report set, and obtaining a document category label corresponding to each document analysis report sample, the document category label including a benign document label and a malicious document label, Z being a positive integer; sequentially matching each word in each document analysis report sample with a word in the new target word list to obtain a word sequence corresponding to each document analysis report sample that matches successfully; combining the word sequence corresponding to each document analysis report sample and the document category label as a training sample, obtaining a plurality of training samples, and training the classification model using the plurality of training samples.

7. A document detecting apparatus characterized by comprising: The method includes: a first analysis module configured to perform dynamic analysis on a to-be-detected document to obtain a document analysis report; a matching module configured to sequentially match each word in the document analysis report with a word in a target word list to obtain a target word sequence that matches successfully, wherein the target word list is determined based on each word in a historical document analysis report set; a classification module configured to input the target word sequence that matches successfully into a classification model to obtain a classification result of the to-be-detected document. The apparatus is further configured to: perform the to-be-detected document in a virtual machine of a sandbox environment to obtain a first analysis report; delete target information in the first analysis report to obtain a second analysis report, wherein the target information includes at least one of info information, signatures information, target information, screenshots information, and all empty dictionaries; replace characters other than numbers, letters, and special characters in the second analysis report with target characters, and replace an IP address list in the second analysis report with a number of IP addresses in the IP address list to obtain a document analysis report.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps of the document detection method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the document detection method according to any one of claims 1 to 6.

Images