| 摘要: |
| Office办公文档如Word、Excel、PowerPoint文档等已成为政府组织及企业日常办公中不可或缺的一部分,它们为社会带来便利的同时也带来了严重的网络安全问题,恶意Office文档已经被广泛应用于网络钓鱼攻击甚至APT攻击中。近年来,随着深度学习技术在恶意软件检测、入侵检测等领域的应用,研究人员开始将深度学习技术应用到恶意Office文档检测中,但均存在样本数据集小、检测效果不佳的问题,且缺乏与传统机器学习检测方法的有效比较。针对上述问题,本文以探索深度学习技术在恶意Office文档检测中的应用方式及优缺点为目标,基于文档中存在“敏感数据区”的思路,分别提出了基于“敏感数据区”的恶意DOC文档深度学习检测方法和恶意XLS文档深度学习检测方法,并在大量恶意文档和良性文档构成的数据集上进行了实验。为了避免人工经验在手动识别“敏感数据区”上的局限性,本文还设计了一种自动识别并提取“敏感数据区”的方法,并比较了两种不同提取方式的效果。实验表明,本文提出的基于“敏感数据区”的恶意文档深度学习检测方法能够显著地提高模型的检测效果,优于当前基于机器学习的检测方法,能够检测各种类型的恶意DOC、XLS文档,如恶意宏文档、漏洞利用文档及其他类型恶意文档。本文还深入分析了深度学习检测方法的优势与不足,为深度学习技术在恶意文档检测上的拓展深化指明了方向。 |
| 关键词: 恶意文档 Office文档 检测 深度学习 敏感数据区 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.07 |
| 投稿时间：2024-09-18修订日期：2025-03-06 |
| 基金项目:本课题得到国家重点研发计划青年科学家项目(No.2022YFB3102800)资助。 |
|
| Deep Learning Detection Method for Malicious DOC/XLS Documents Based on “Sensitive Data Areas” |
|
CHEN Xiang, ZHANG Zheng, WANG Wenbo
|
| (Institute of Information Technology, Information Engineering University, Zhengzhou 450002, China) |
| Abstract: |
| Office documents, including those created in Microsoft Word, Excel, and PowerPoint, have become essential tools in the daily operations of government agencies and businesses. While these documents facilitate various tasks, they also introduce significant cybersecurity risks. Malicious Office documents are frequently employed in phishing campaigns and even advanced persistent threat (APT) attacks. In recent years, the integration of deep learning technologies into malware detection and intrusion detection has prompted researchers to investigate their application in the detection of malicious Office documents. However, challenges such as limited sample sizes and sub-optimal detection performance persist, alongside a lack of comprehensive comparisons with traditional machine learning-based detection methods. This article seeks to address these challenges by examining the methodologies, advantages, and limitations of deep learning approaches in the context of malicious Office document detection. Building on the concept of "sensitive data areas" within documents, we propose a deep learning detection framework specifically for malicious DOC and XLS files, utilizing these "sensitive data areas" as a basis for our approach. We conduct experiments using a substantial data set comprising both malicious and benign documents. To mitigate the reliance on manual expertise for identifying "sensitive data areas," we introduce a method for their automatic identification and extraction, and we assess the effectiveness of two distinct extraction techniques. Our experimental results indicate that the proposed deep learning-based detection method, which leverages the notion of "sensitive data areas," significantly enhances model’s detection performance, outperforming current machine learning-based detection methods. This approach is capable of identifying various forms of malicious DOC and XLS documents, such as malicious macro documents, exploit documents and other types of malicious documents. Furthermore, this article provides a thorough analysis of the strengths and weaknesses of deep learning-based detection methods, while also suggesting avenues for the further development and application of deep learning technologies in the realm of malicious document detection. |
| Key words: malicious documents office documents detection deep learning sensitive data areas |
