Identification of electronic documents that are likely to contain embedded malware
View Patent ↗The present invention provides a method for determining the likelihood that an electronic document contains embedded malware. After parsing or sequencing an electronic document, the metadata structures that make up the document are analyzed. A number of pre-established rules are then applied with respect to certain metadata structures that are indicative of embedded malware. The application of these rules results in the generation of a score for the electronic document being tested for embedded malware. The score is then compared to a threshold value, where the threshold value was previously generated based on a statistical model relating to electronic documents having the same format as the document being tested. The result of the comparison can then be used to determine whether the document being tested is or is not likely to contain embedded malware.
1. A method of determining a likelihood that an electronic document contains embedded malware, the method comprising:
processing one or more signals that represent a contents of the electronic document to identify one or more pre-defined metadata structures that, at least in part, make up the electronic document;
applying a set of pre-established rules to the one or more pre-defined metadata structures such that a numerical score is attributed to the electronic document;
comparing the numerical score attributed to the electronic document with a pre-established model threshold value; and
determining whether the electronic document is likely to contain embedded malware based on a result of the comparing.
2. The method of claim 1 , wherein processing the one or more signals that represent the contents of the electronic document so as to identify the one or more pre-defined metadata structures includes:
parsing the one or more signals that represent the contents of the electronic document so as to identify the metadata structures that make up the electronic document; and
identifying the one or more pre-defined metadata structures from amongst the metadata structures that make up the electronic document.
3. The method of claim 1 , further including:
determining the number of occurrences of a given one of the identified, pre-defined metadata structures; and
incrementing a weighting value attributed to the given one of the identified, pre-defined metadata structures by an amount based on the number of occurrences.
4. The method of claim 3 , wherein incrementing the weighting value by an amount based on the number of occurrences includes:
multiplying the weighting value attributed to the given one of the identified, pre-defined metadata structures by the number of occurrences.
5. The method of claim 3 , wherein incrementing the weighting value by an amount based on the number of occurrences includes: incrementing the weighting value attributed to the given one of the identified, pre-defined metadata structures by an amount that varies with each additional occurrence.
6. The method of claim 5 , wherein the amount increases in value with each additional occurrence.
7. The method of claim 5 , wherein the amount decreases in value with each additional occurrence.
8. The method of claim 1 , wherein the pre-established model threshold value is a function of a prior parsing and analysis of a plurality of pre-existing electronic documents having the same format as the electronic document.
9. The method of claim 1 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison includes:
determining whether the numerical score attributed to the electronic document is less than the pre-established model threshold value or greater than or equal to the pre-established model threshold value.
10. The method of claim 9 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison further includes:
determining that the electronic document is likely to contain embedded malware if it is determined that the numerical score attributed to the electronic document is greater than or equal to the pre-established model threshold value.
11. The method of claim 9 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison further includes:
determining that the electronic document is not likely to contain embedded malware if it is determined that the numerical score attributed to the electronic document is less than the pre-established model threshold value.
12. A method of determining a likelihood that an electronic document contains embedded malware, the method comprising:
processing one or more signals that represent a contents of the electronic document so as to identify one or more pre-defined metadata structures that, at least in part, make up the electronic document;
attributing a weighting value to each of the identified, one or more pre-defined metadata structures; wherein the weighting value attributed to each identified, pre-defined metadata structure reflects a degree to which the corresponding, pre-defined metadata structure relates to the likelihood the document contains embedded malware;
generating a numerical score for the electronic document by combining the weighting values that were attributed to each of the identified, one or more pre-defined metadata structures;
comparing the numerical score attributed to the electronic document to a pre-established model threshold value; and
determining whether the electronic document is likely to contain embedded malware based on a result of the comparison.
13. The method of claim 12 , wherein processing the one or more signals that represent the contents of the electronic document so as to identify the one or more pre-defined metadata structures includes:
parsing the one or more signals that represent the contents of the electronic document so as to identify the metadata structures that make up the electronic document; and
identifying the one or more pre-defined metadata structures from amongst the metadata structures that make up the electronic document.
14. The method of claim 12 , further including:
determining the number of occurrences of a given one of the identified, one or more pre-defined metadata structures; and
incrementing a weighting value attributed to the given one of the identified, pre-defined metadata structures by an amount based on the number of occurrences.
15. The method of claim 14 , wherein incrementing the weighting value by an amount based on the number of occurrences includes:
multiplying the weighting value attributed to the given one of the identified, pre-defined metadata structures by the number of occurrences.
16. The method of claim 14 , wherein incrementing the weighting value by an amount based on the number of occurrences includes:
incrementing the weighting value attributed to the given one of the identified, pre-defined metadata structures by an amount that varies with each additional occurrence.
17. The method of claim 16 , wherein the amount increases in value with each additional occurrence.
18. The method of claim 16 , wherein the amount decreases in value with each additional occurrence.
19. The method of claim 12 , wherein the pre-established model threshold value is a function of a prior parsing and analysis of a plurality of pre-existing electronic documents having the same format as the electronic document.
20. The method of claim 12 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison includes:
determining whether the numerical score attributed to the electronic document is less than the pre-established model threshold value or greater than or equal to the pre-established model threshold value.
21. The method of claim 20 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison further includes:
determining that the electronic document is likely to contain embedded malware if it is determined that the numerical score attributed to the electronic document is greater than or equal to the pre-established model threshold value.
22. The method of claim 20 , wherein determining whether the electronic document is likely to contain embedded malware based on a result of the comparison further includes:
determining that the electronic document is not likely to contain embedded malware if it is determined that the numerical score attributed to the electronic document is less than the pre-established model threshold value.
23. A storage disk or storage device comprising instructions that, when executed, cause a machine to determine a likelihood that an electronic document contains embedded malware by:
processing one or more signals that represent a contents of the electronic document to identify one or more pre-defined metadata structures that, at least in part, make up the electronic document;
applying a set of pre-established rules to the one or more pre-defined metadata structures such that a numerical score is attributed to the electronic document;
comparing the numerical score attributed to the electronic document with a pre-established model threshold value; and
determining whether the electronic document is likely to contain embedded malware based on a result of the comparing.