Office Document Embedding Detection for Zero-Day Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems rely on signature-based methods that are ineffective against new or zero-day attacks, particularly those using obfuscated macros and OLE objects in Microsoft Office documents, which are increasingly used to deliver malicious payloads.
Innovation Solution
A system utilizing machine learning and feature engineering to detect malicious macros and OLE objects in Microsoft Office documents without relying on known signatures, by training a supervised machine learning model with features derived from obfuscation techniques and characteristics of malicious code, and integrating this with network security systems to classify documents as safe, suspicious, or malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used, then detection accuracy for known malware is improved, but detection capability against new or zero-day attacks deteriorates
Solution Approach 1:
The patent transforms the detection approach from static signature matching to dynamic parameter analysis by extracting multiple features (macro properties, OLE object characteristics, document metadata) and using machine learning models to evaluate combinations of these parameters, enabling detection of previously unknown malware based on behavioral patterns rather than fixed signatures
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based detection system that uses supervised algorithms (Random Forest, Gradient Boosting, Neural Networks) to analyze feature vectors and predict maliciousness, substituting rule-based mechanics with adaptive computational intelligence
2Measurement precision
If machine learning models are trained with extensive feature engineering, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the complex detection task into distinct feature extraction modules (macro features, OLE object features, document features) and processes them separately before combining for classification, making the system more manageable and interpretable despite the large number of features
Solution Approach 2:
The patent introduces feature engineering as an intermediary layer between raw document data and machine learning models, where complex raw data is transformed into meaningful feature vectors that bridge the gap between unstructured document content and structured model input, simplifying the overall system architecture
3Reliability
If traditional malware detection systems are used, then security analysis is thorough, but processing time increases causing latency
Solution Approach 1:
The patent performs preliminary feature extraction and prepares feature vectors before actual classification occurs, pre-processing documents to extract relevant characteristics in advance so that the machine learning models can make rapid predictions without performing complex analysis during critical detection moments
Solution Approach 2:
The patent enables rapid classification by using trained machine learning models that can evaluate feature vectors quickly, skipping lengthy analysis steps that would be required for untrained or traditional systems, thus reducing latency while maintaining detection quality
Data Source
AI summary
The technology relates to cybersecurity attacks and cloud-based security, and specifically to detecting malicious embeddings in document destined for a networked system. Such embeddings can be delivered in the form of malicious macros and/or malicious OLE objects stored within document files. The technology intercepts a document that is compatible with an MS Office file format, finds embedded code, engineers at least five features that characterize the embedded code. The technology inputs the engineered features to a trained machine learning model and determines, as a threat level, a likelihood of malicious embedding from at least the engineered features of the embedded code. Based on the threat level, the technology can block the document with a malicious threat level, accept the document with a non-malicious threat level, and or isolate the document with a suspicious threat level.