Malware Detection in Electronic Documents via Binary Vector Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus solutions face challenges in detecting malicious software integrated in electronic documents, such as Excel spreadsheets and PDFs, without compromising user privacy or requiring extensive computational resources.
Innovation Solution
A method and system for detecting malicious software in electronic documents involves detecting executable code, extracting metadata and characteristics, creating a binary vector, and comparing it with pre-classified vectors in a database to determine the presence of malware, all while preserving user privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus solutions analyze the entire document to detect malware, then detection reliability is improved, but user privacy is compromised and computational load increases
Solution Approach 1:
The patent segments the document analysis into two distinct parts: extracting only the executable code (macro/JavaScript) from the document, and analyzing this extracted code separately from the rest of the document content. This segmentation allows malware detection to proceed without exposing or transmitting sensitive document information, thus resolving the contradiction between detection reliability and user privacy protection
Solution Approach 2:
The patent extracts the executable code component from the document for analysis. By taking out only the potentially malicious code portion and analyzing it in isolation, the system achieves reliable malware detection without requiring access to or transmission of the entire document, thereby preserving user privacy while maintaining detection effectiveness
2Measurement precision
If conventional antivirus solutions send entire documents to scanners for analysis, then detection accuracy is improved, but computational resources and transmission bandwidth are consumed
Solution Approach 1:
The patent extracts only the executable code from the document for analysis, eliminating the need to process the entire document. This extraction approach maintains detection accuracy by focusing analysis on the relevant malicious components while dramatically reducing computational load and data transmission requirements compared to analyzing complete documents
3Reliability
If users send documents to conventional scanners for malware checking, then security verification is improved, but control over confidential information is lost
Solution Approach 1:
The patent extracts and analyzes only the executable code locally or in a controlled manner, allowing users to verify document security without transmitting confidential information. This approach maintains security verification reliability while preserving user control over sensitive document content
Solution Approach 2:
The patent introduces an intermediary analysis process that works with extracted code characteristics rather than the original document. This intermediary approach enables security verification while acting as a barrier that prevents direct exposure of confidential information to external scanning systems
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to the detection of malicious software in electronic documents and comprises: detecting an executable code in the electronic document provided to a client module; extracting information from the electronic document comprising the executable code and metadata of the electronic document; creating a binary vector associated with the electronic document; comparing, in a classifier module (200), the binary vector with one or more groups of vectors previously classified and stored in a database (400); classifying the vector in one of the groups, where each group has associated therewith a verdict about the presence of malicious software; and determining that the document contains malicious software depending on the verdict associated with the group in which its associated vector has been classified.