Granted Patent B1

US 9,686,304 · App. 14/025,779 · Granted Jun 20, 2017

Abstract

Claims (66)

1. A computer-implemented method for healing infected document files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving an electronic message directed to a target recipient, the electronic message including a document file formatted in a portable document format, the document file further comprising a cross-reference table;

in response to receiving the electronic message, discovering, by a security program in an initial pass that traverses the document file, that the document file is infected with potentially malicious content by:

parsing the document file into separate objects; and

detecting that one of the separate objects is infected with potentially malicious content by searching within the portable document format document file for a string of text comprising a JAVASCRIPT key;

healing, by the security program, the infected separate object by removing both the JAVASCRIPT key and a value associated with the JAVASCRIPT key;

reconstructing the document file, by the security program in a subsequent pass that traverses the document file after the initial pass, by reuniting the healed separate object with a remainder of the separate objects in a newly generated document file in a manner that preserves readability of the document file as a document; and

providing access to the readable reconstructed document file at a client computing system of the target recipient.

2. The computer-implemented method of claim 1 , wherein:

the electronic message comprises an email; and

the document file comprises an attachment to the email.

3. The computer-implemented method of claim 1 , wherein receiving the electronic message comprises intercepting the electronic message.

4. The computer-implemented method of claim 3 , wherein intercepting the electronic message comprises replacing an infected version of the document file from prior to performance of the healing with a healed version of the document file.

5. The computer-implemented method of claim 3 , wherein providing access to the readable reconstructed document file at the client computing system of the target recipient occurs at one of the following times:

at a time of delivering the electronic message to the client computing system of the target recipient; and

earlier than the time of delivering the electronic message to the client computing system of the target recipient.

6. The computer-implemented method of claim 1 , wherein the security program is configured to perform the following, in a batch process, for each electronic message that is received over a period of time and that includes a document file detected to contain an infected separate object:

parse the document file into separate objects;

heal the infected separate object by removing potentially malicious content from the separate object;

reconstruct the document file by reuniting the healed separate object with a remainder of the separate objects in a manner that preserves readability of the document; and

provide access to the readable reconstructed document file.

7. The computer-implemented method of claim 1 , wherein providing access to the readable reconstructed document file at the client computing system of the target recipient comprises diminishing access to an infected version of the document file.

8. The computer-implemented method of claim 1 , wherein providing access to the readable reconstructed document file at the client computing system of the target recipient comprises notifying the client computing system of the target recipient that the document file was infected.

9. The computer-implemented method of claim 1 , wherein reconstructing, by the security program, the document file comprises:

creating a new document file; and

writing the healed separate object to the new document file.

10. The computer-implemented method of claim 1 , wherein the document file is embedded within a larger file formatted in a container format.

11. The computer-implemented method of claim 1 , wherein:

the document file has a proprietary format; and

the security program is provided by a vendor independent from the vendor that manages the proprietary format.

12. The computer-implemented method of claim 1 , wherein healing the separate object further comprises at least one of:

removing a sub-object from the infected separate object; and

converting the infected separate object from one file format to a different file format.

13. The computer-implemented method of claim 1 , wherein:

the document file contains an embedded document file; and

the security program recursively parses and heals the document file and the embedded document file.

14. A system for healing infected document files, the system comprising:

a reception module that receives an electronic message directed to a target recipient, the electronic message including a document file formatted in a portable document format, the document file further comprising a cross-reference table;

a discovery module that, in response to receiving the electronic message, discovers, as part of a security program in an initial pass that traverses the document file, that the document file is infected with potentially malicious content by:

parsing the document file into separate objects; and

detecting that one of the separate objects is infected with potentially malicious content by searching within the portable document format document file for a string of text comprising a JAVASCRIPT key;

a healing module that heals, as part of the security program, the infected separate object by removing both the JAVASCRIPT key and a value associated with the JAVASCRIPT key;

a reconstruction module that reconstructs the document file, as part of the security program in a subsequent pass that traverses the document file after the initial pass, by reuniting the healed separate object with a remainder of the separate objects in a newly generated document file in a manner that preserves readability of the document file as a document;

a provisioning module that provides access to the readable reconstructed document file at a client computing system of the target recipient; and

at least one physical processor configured to execute the reception module, the discovery module, the healing module, the reconstruction module, and the provisioning module.

15. The system of claim 14 , wherein:

the electronic message comprises an email; and

the document file comprises an attachment to the email.

16. The system of claim 14 , wherein the reception module receives the electronic message by intercepting the electronic message.

17. The system of claim 16 , wherein the provisioning module replaces an infected version of the document file from prior to the healing module performing the healing with a healed version of the document file.

18. The system of claim 16 , wherein the provisioning module provides access to the readable reconstructed document file at the client computing system of the target recipient at one of the following times:

at a time of delivering the electronic message to the client computing system of the target recipient; and

earlier than the time of delivering the electronic message to the client computing system of the target recipient.

19. The system of claim 14 , wherein the security program is configured to perform the following, in a batch process, for each electronic message that is received over a period of time and that includes a document file detected to contain an infected separate object:

parse the document file into separate objects;

heal the infected separate object by removing potentially malicious content from the separate object;

reconstruct the document file by reuniting the healed separate object with a remainder of the separate objects in a manner that preserves readability of the document; and

provide access to the readable reconstructed document file.

20. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive an electronic message directed to a target recipient, the electronic message including a document file formatted in a portable document format, the document file further comprising a cross-reference table;

in response to receiving the electronic message, discover, by a security program in an initial pass that traverses the document file, that the document file is infected with potentially malicious content by:

parsing the document file into separate objects; and

detecting that one of the separate objects is infected with potentially malicious content by searching within the portable document format document file for a string of text comprising a JAVASCRIPT key;

heal, by the security program, the infected separate object by removing both the JAVASCRIPT key and a value associated with the JAVASCRIPT key;

reconstruct the document file, by the security program in a subsequent pass that traverses the document file after the initial pass, by reuniting the healed separate object with a remainder of the separate objects in a newly generated document file in a manner that preserves readability of the document file as a document; and

provide access to the readable reconstructed document file at a client computing system of the target recipient.

Assignments (6)