Methods, media, and systems for detecting attack on a digital processing device
Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack. In some embodiments, the methods include: selecting a data segment in at least one portion of an electronic document; determining whether the arbitrarily selected data segment can be altered without causing the electronic document to result in an error when processed by a corresponding program; in response to determining that the arbitrarily selected data segment can be altered, arbitrarily altering the data segment in the at least one portion of the electronic document to produce an altered electronic document; and determining whether the corresponding program produces an error state when the altered electronic document is processed by the corresponding program.
1. A method for detecting an attack on an application, comprising:
receiving, using a digital processing device, a document;
determining, using the digital processing device, whether attacking code is included in the document by (i) performing a static analysis that comparing compares at least part of the document to a static first detection model and (ii) performing a dynamic analysis that compares behavior observed by execution of the document to a second detection model, wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment;
executing the at least one known malicious document in a second environment;
comparing behavior observed by execution in the first environment to behavior observed by execution in the second environment to determine any differences in behavior; and
adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment;
determining whether attacking code is included in the document based on the comparison of the document to the static detection model;
executing at least part of the document;
determining whether attacking code is included in the document based on the execution of the at least part of the document; and
if attacking code is determined to be included in the document based on at least one of the performed static analysis and the performed dynamic analysis comparison of the document to the static detection model and the execution of the at least part of the document, reporting, using the hardware processor, the presence of an attack.
2. The method of claim 1 , further comprising:
updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.
3. The method of claim 1 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises:
comparing behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.
4. The method of claim 1 , further comprising:
parsing the document into sections and wherein the comparing the at least part of the document to the first detection model by:
selecting at least one the sections; and
comparing the at least one selected section to the first detection model.
5. The method of claim 1 , wherein the document is a word processing document, wherein the execution comprises opening the document in word processing software, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.
6. A system for detecting attack, comprising:
an interface in communication with a network;
a memory; and
a processor in communication with the memory and the interface, wherein the processor is configured to:
receive a document;
determine whether attacking code is included in the document by (i) performing a static analysis that compares at least part of the document to a first detection model and (ii) performing a dynamic analysis that compares behavior observed by execution of the document to a second detection model, wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment;
executing the at least one known malicious document in a second environment;
comparing behavior observed by execution in the first environment to behavior observed by execution in the second environment to determine any differences in behavior; and
adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment; and
if attacking code is determined to be included in the document based on at least one of the performed static analysis and the performed dynamic analysis, reporting the presence of an attack.
7. The system of claim 6 , wherein the processor is further configured to:
update the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.
8. The system of claim 6 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises:
comparing behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.
9. The system of claim 6 , wherein the processor is further configured to:
parse the document into sections and wherein the comparing the at least part of the document to the first detection model by:
selecting at least one the sections; and
comparing the at least one selected section to the first detection model.
10. The system of claim 6 , wherein the document is a word processing document, wherein the execution comprises opening the document in word processing software, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.
11. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an attack on an application, the method comprising:
receiving a document;
determining whether attacking code is included in the document by (i) performing a static analysis that compares at least part of the document to a first detection model and (ii) performing a dynamic analysis that compares behavior observed by execution of the document to a second detection model, wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment;
executing the at least one known malicious document in a second environment;
comparing behavior observed by execution in the first environment to behavior observed by execution in the second environment to determine any differences in behavior; and
adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment; and
if attacking code is determined to be included in the document based on at least one of the performed static analysis and the performed dynamic analysis, reporting the presence of an attack.
12. The non-transitory computer-readable medium of claim 11 , wherein the method further comprises:
updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.
13. The non-transitory computer-readable medium of claim 11 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises:
comparing behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.
14. The non-transitory computer-readable medium of claim 11 , wherein the method further comprises:
parsing the document into sections and wherein the comparing the at least part of the document to the first detection model by:
selecting at least one the sections; and
comparing the at least one selected section to the first detection model.
15. The non-transitory computer-readable medium of claim 11 , wherein the document is a word processing document, wherein the execution comprises opening the document in word processing software, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.