Macro Document Fingerprinting for Sandbox Resource Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious macros in documents are inefficient as they often require sending documents to sandbox environments for monitoring, wasting resources on benign documents, and failing to differentiate between malicious and benign documents without extensive analysis.
Innovation Solution
A processor determines the code fingerprint of a document and compares it to predefined cluster code fingerprints to classify the document as malicious, benign, or unknown, thereby deciding whether to send it to a sandbox environment for further analysis, reducing unnecessary resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all documents with macros are sent to sandbox environments for monitoring, then detection reliability is improved, but resource consumption and processing time increase significantly
Solution Approach 1:
The patent segments the document analysis process into two distinct stages: a fast preliminary analysis stage that filters out benign documents, and a comprehensive sandbox monitoring stage for suspicious documents only. This segmentation allows the system to maintain high detection reliability while improving processing efficiency by avoiding unnecessary sandbox analysis of benign documents.
Solution Approach 2:
The patent applies preliminary action by performing initial document analysis and classification before sending documents to the sandbox environment. Documents are pre-screened using analysis of their content, structure, and metadata to identify those worth submitting to sandbox monitoring, thereby avoiding waste of resources on obviously benign documents while maintaining detection reliability.
2Measurement precision
If extensive analysis is performed on all documents, then detection precision is improved, but energy consumption and resource usage increase
Solution Approach 1:
The patent applies local quality by applying different levels of analysis intensity to different documents based on their risk characteristics. High-priority documents receive comprehensive sandbox analysis while low-priority documents receive minimal or no sandbox analysis. This differentiated approach maintains detection precision for suspicious documents while reducing overall energy consumption.
Solution Approach 2:
The patent uses partial action by performing only the necessary level of analysis on each document. Instead of applying full sandbox monitoring to all documents, the system applies partial analysis (preliminary screening) to all documents and reserves excessive/comprehensive analysis (sandbox monitoring) only for documents that pass the preliminary filter, thereby optimizing energy consumption while maintaining detection precision.
3Reliability
If sandbox environments are used for every document, then false negatives are reduced, but the quantity of documents requiring analysis becomes unmanageable
Solution Approach 1:
The patent extracts and removes obviously benign documents from the sandbox analysis queue through preliminary filtering based on document characteristics, metadata, and risk indicators. This extraction of low-risk documents reduces the volume of documents requiring sandbox analysis while maintaining false negative reduction for the remaining high-risk documents that do undergo sandbox monitoring.
Data Source
AI summary
According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that may cause the processor to determine a code fingerprint of a document containing a macro, in which the code fingerprint corresponds to a functionality of the macro. The processor may also determine whether the code fingerprint of the document matches a cluster code fingerprint associated with a cluster of documents. Based on a determination that the code fingerprint matches the cluster code fingerprint associated with the cluster of documents, the processor may determine whether the cluster of documents has been identified as being malicious or benign. In addition, based on a determination that the cluster of documents has been identified as being malicious or benign, the processor may handle the document as being malicious or benign while preventing the document from being sent to a sandbox environment for detonation of the document.