面向公式对象的恶意文档智能检测技术  

Formula Object Oriented Intelligent Detection Method For Malicious Documents

作　　者：陈祥 宋恩舟 韩伟涛 CHEN Xiang;SONG Enzhou;HAN Weitao(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2024年第4期453-458,共6页Journal of Information Engineering University

基　　金：国家自然科学基金(62176214)。

摘　　要：公式编辑器作为Office办公软件的重要组件,已成为漏洞利用的重灾区。针对此问题,提出一种面向公式对象的恶意文档智能检测方法,通过提取办公文档中的公式对象并转换成图像,将恶意公式对象检测问题转变成图像分类问题,利用深度学习技术实现检测特征的自提取。检测模型在4078个良性样本和1173个恶意样本构成的训练集上进行训练,在1323个良性样本和312个恶意样本上进行测试,恶意样本检测率为99.36%,良性样本零误报,样本平均检测时间约0.5 ms。为检验模型的抗规避能力,在恶意测试样本的基础上采用“加正常”和“去异常”的方式构建相应的对抗样本测试集,实验表明,提出的检测方法具有较强的鲁棒性。Formula editor,an important component of Office software,has become a disaster area for vulnerability exploit.In response to the above issues,a formula object oriented intelligent detection method for malicious documents is proposed.By extracting formula objects from office documents and converting them into images,the problem of detecting malicious formula objects is transformed into an image classification problem.Deep learning technology is used to achieve self extraction of detection features.The detection model is trained on a training set consisting of 4078 benign samples and 1173 malicious samples,and tested on 1323 benign samples and 312 malicious samples,achieving a malicious sample detection rate of 99.36%,with zero false positives for benign samples and an average sample detection time of about 0.5 ms.To test the anti-evasion ability of the model,a corresponding adversarial sample test set is constructed using the methods of"adding normal"and"removing abnormal"on the basis of malicious test samples mentioned above.The experiments show that the proposed detection method has strong robustness.

关 键 词：办公软件 恶意文档 公式编辑器 公式对象 深度学习 漏洞利用 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]