The application discloses a method for de-
obfuscation and
feature extraction of
phishing documents and application thereof in
attack detection, wherein the de-
obfuscation comprises obtaining obfuscated
macro code of the
phishing document, constructing a hint
engineering template by using a pre-trained
language model, analyzing an obfuscated
logic structure and generating de-
obfuscation rules and restoration strategies; the obfuscated
macro code is structured into an
abstract syntax tree by using an analysis tool, typical obfuscated patterns are matched based on a
regular expression, function execution
simulation and
cell reference analysis are combined, preliminary restoration of the structure, restoration of
control flow semantics and operation path construction are realized; according to the de-obfuscation rules and the
abstract syntax tree, the obfuscated structure is converted into readable
macro statements, a macro code
instruction sequence without obfuscated
semantics is generated, and a semantic sequence after de-obfuscation is output. The
feature extraction comprises extraction of word features, Token features,
abstract syntax tree features and relationship features. The application breaks through the
bottleneck of traditional
phishing attack detection and difficulty in identification of obfuscated documents, and improves the detection accuracy of phishing document attacks.