Machine Learning Detection of Malicious MS Office OLE Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems rely on signature-based methods, which are ineffective against new or obfuscated malware, particularly in Microsoft Office documents, leading to increased network resource usage and decreased throughput, as they struggle to detect malicious macros and OLE objects without pre-classified signatures.
Innovation Solution
A system and method using feature engineering and supervised machine learning to predict malicious content in Microsoft Office documents, classifying documents as safe, suspicious, or malicious without relying on known signatures, by extracting features from historical data and training a machine learning model to identify obfuscated macros and OLE objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then detection accuracy for known malware is improved, but detection capability for new or obfuscated malware deteriorates
Solution Approach 1:
The patent transforms the detection approach from signature-based (static parameter matching) to feature-based machine learning (dynamic parameter analysis). Instead of relying on pre-defined malware signatures, the system extracts multiple features from document metadata, macros, and OLE objects, then uses a trained machine learning model to evaluate these features and predict maliciousness. This parameter transformation enables detection of both known and unknown malware variants.
2Reliability
If signature databases are maintained and updated, then detection of known malware is improved, but network resource usage and processing time increase
Solution Approach 1:
The system performs preliminary feature extraction and analysis during the detection process, preparing data in advance for machine learning evaluation. By pre-processing document features (metadata, macros, OLE objects) before the actual classification decision, the system reduces the computational burden during critical detection moments, improving both reliability and throughput.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based classification system. Instead of mechanically comparing document signatures against database entries, the system uses trained algorithms to evaluate extracted features and predict maliciousness, reducing dependency on large signature databases and improving processing efficiency.
3Measurement precision
If detailed threat analysis and sandboxing are performed, then detection of obfuscated malware is improved, but processing time and resource consumption increase
Solution Approach 1:
The system applies partial analysis by focusing on the most indicative features (metadata, macros, OLE objects) rather than performing complete sandbox execution for all documents. The machine learning model evaluates these partial features to make rapid classification decisions, achieving high detection accuracy for obfuscated malware without the time cost of full sandboxing for every document.
Data Source
AI summary
The technology disclosed relates to cybersecurity attacks and cloud-based security. A method and apparatus is provided for detecting documents with embedded threats in the form of malicious Object Linking & Embedding (OLE) objects. The technology disclosed detects obfuscated malicious code using a trained machine learning model to predict documents having malicious code without a known signature. The technology disclosed can thus predict which documents include signatureless malicious code. Feature engineering is used to define a set of features for detecting malicious macros and malicious OLE objects, based on features selected from a list of known characteristics and attributes possessed by files that have historically indicated malicious content. The selected features are used to train a supervised machine learning model, which is used to classify documents as safe, suspicious, or malicious.