RTF File Inspection System Using Heuristic Weight Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microsoft Rich Text Format (RTF) files are increasingly used in phishing attacks due to their ability to host various objects and vulnerabilities, posing a risk to network security as they can link to external malicious code, making it essential for network security solutions to perform deep inspection and classification.
Innovation Solution
A system and method that intercepts RTF files, parses them to identify objects, applies heuristic checks to increase a cumulative weight based on specific criteria, and takes protective actions such as quarantining based on classification, including checking for shellcode, embedded files, encryption, and other malicious indicators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep inspection of RTF files is performed to detect malicious objects and heuristics, then detection accuracy improves, but processing time and system complexity increase
Solution Approach 1:
The inspection system divides the RTF file analysis into multiple independent heuristic checks (e.g., checking for shellcode, embedded files, encryption, overlay data, MS-OOXML files, MS-CFB files). Each heuristic operates as a separate module that can process different aspects of the file simultaneously, improving detection accuracy while managing processing time through parallelization.
Solution Approach 2:
The system applies a cumulative weight approach where multiple heuristics are checked against the RTF file. Not all heuristics need to be fully executed to reach a classification decision - the system accumulates weight values from matching heuristics and compares against thresholds to classify files as clean, suspicious, or malicious, allowing for efficient partial evaluation.
2Reliability
If multiple heuristic checks are applied to RTF files to classify them accurately, then classification reliability improves, but device complexity increases
Solution Approach 1:
The inspection system is designed as a multi-functional platform that can detect various types of malicious content within RTF files including shellcode, embedded files, encryption, overlay data, and multiple file formats (MS-OOXML, MS-CFB). A single system performs diverse detection functions through a unified heuristic framework, reducing the need for separate specialized tools and managing complexity through consolidation.
Solution Approach 2:
The system uses parameter-based classification where different heuristics contribute weight values to a cumulative score. The classification reliability is improved by adjusting parameters such as weight values assigned to different heuristics and threshold values for classification decisions. This allows flexible tuning of the system to achieve desired reliability levels while maintaining a manageable complexity structure.
Data Source
AI summary
Mechanisms, which can include systems, method, and media, for protecting network devices from malicious rich text format (RTF) files are provided, the mechanisms comprising: intercepting an RTF file destined for a network device; parsing the RTF file to identify a plurality of objects in the RTF file; checking a first object of the plurality of objects for a first heuristic; based upon an outcome of the checking of the first object for the first heuristic, increasing a cumulative weight by a first weight value; comparing the cumulative weight against at least one threshold to classify the RTF file; and based on the classification of the RTF file, taking a protective action on the RTF file.