Securing a network device from malicious executable code embedded in a computer document

Patent metadata

Field	Value
Publication number	US-10817607-B1
Application number	US-201815881048-A
Country	US
Kind code	B1
Filing date	Jan 26, 2018
Priority date	Jan 26, 2018
Publication date	Oct 27, 2020
Grant date	Oct 27, 2020

Abstract

Protecting a network device from malicious executable code embedded in a computer document. In one embodiment, a method may include detecting executable code embedded in a computer document stored on a network device. The method may also include detecting a potential hoax object in the computer document. The method may further include determining that the potential hoax object is a hoax object by determining that the potential hoax object includes a message enticing a user to enable execution of the executable code. The method may also include, in response to determining that the potential hoax object is a hoax object, concluding that the executable code is malicious and performing a security action on the network device that secures the network device from the malicious executable code.

First claim

The invention claimed is:

1. A computer-implemented method for protecting a network device from malicious executable code embedded in a computer document, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
detecting executable code embedded in the computer document stored on the network device wherein the computer document is an Office document or a Portable Document Format (PDF) computer document;
detecting a potential hoax object in the computer document;
determining that the potential hoax object is a hoax object by determining that the potential hoax object includes a message enticing a user to enable execution of the executable code; and
in response to determining that the potential hoax object is a hoax object, concluding that the executable code is malicious and performing a security action on the network device that secures the network device from the malicious executable code.

2. The method of claim 1 , wherein:
the executable code embedded in the Office computer document is Visual Basic for Applications (VBA) executable code.

3. The method of claim 1 , wherein:
the executable code embedded in the PDF computer document is JavaScript executable code.

4. The method of claim 1 , wherein the potential hoax object is a text object.

5. The method of claim 1 ,
wherein the potential hoax object is an image object;
and
determining that the potential hoax object includes the message enticing the user to enable execution of the executable code comprises processing the image object to extract text present in the image object and searching through the extracted text to identify a word or phrase that indicates that the extracted text includes the message enticing the user to enable execution of the executable code.

6. The method of claim 1 , wherein the performing of the security action on the network device comprises quarantining the executable code and/or quarantining the computer document.

7. The method of claim 1 , wherein the performing of the security action on the network device comprises ceasing the execution of the executable code.

8. A computer-implemented method for protecting a network device from malicious executable code embedded in a computer document, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
detecting executable code embedded in the computer document stored on the network device wherein the computer document is an Office document or a Portable Document Format (PDF) computer document;
detecting a potential hoax object in the computer document, the potential hoax object comprising a text object;
determining that the potential hoax object is a hoax object by searching through text in the text object to identify a word or phrase that indicates that the text object includes a message enticing a user to enable execution of the executable code; and
in response to determining that the potential hoax object is a hoax object, concluding that the executable code is malicious and performing a security action on the network device that secures the network device from the malicious executable code.

9. The method of claim 8 , wherein:
the executable code embedded in the Office computer document is Visual Basic for Applications (VBA) executable code; and
the identified phrase is or includes the phrase “enable content”.

10. The method of claim 8 , wherein:
the executable code embedded in the PDF computer document is JavaScript executable code; and
the identified phrase is or includes the phrase “enable all features”.

11. The method of claim 8 , wherein the performing of the security action on the network device comprises quarantining the executable code and/or quarantining the computer document.

12. The method of claim 8 , wherein the performing of the security action on the network device comprises ceasing the execution of the executable code.

13. A computer-implemented method for protecting a network device from malicious executable code embedded in a computer document, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
detecting executable code embedded in the computer document stored on the network device wherein the computer document is an Office document or a Portable Document Format (PDF) computer document;
detecting a potential hoax object in the computer document, the potential hoax object comprising an image object;
determining that the potential hoax object is a hoax object by one or more of: generating a hash of the image object and determining that the hash of the image object matches a hash of a known hoax object; and processing the image object to extract text present in the image object and searching through the extracted text to identify a vlord or phrase that indicates that the extracted text includes a message enticing a user to enable execution of the executable code; and
in response to determining that the potential hoax object is a hoax object, concluding that the executable code is malicious and performing a security action on the network device that secures the network device from the malicious executable code.

14. The method of claim 13 , wherein:
the executable code embedded in the Office computer document is Visual Basic for the identified phrase is or includes the phrase “enable content”.

15. The method of claim 13 wherein:
the executable code embedded in the PDF computer document is JavaScript executable code; and
the identified phrase is or includes the phrase “enable all features”.

16. The method of claim 13 , wherein the performing of the security action on the network device comprises quarantining the executable code and/or quarantining the computer document.

17. The method of claim 13 , wherein the performing of the security action on the network device comprises ceasing the execution of the executable code.

18. The method of claim 13 , wherein the determining that the hash of the image object matches the hash of the known hoax object comprises determining that the hash of the image object matches the hash of the known hoax object using fuzzy matching.

19. The method of claim 13 ,
wherein: the hash of the image object is a fuzzy hash;
the hash of the known hoax object is also a fuzzy hash; and
the determining that the fuzzy hash of the image object matches the fuzzy hash of the known hoax object comprises determining that the fuzzy hash of the image object matches the fuzzy hash of the known hoax object at or above a threshold matching percentage.

20. The method of claim 13 , wherein the determining that the hash of the image object matches the hash of the known hoax object comprises determining that the hash of the image object matches the hash of the known hoax object using a cyclic redundancy check (CRC) to generate the hash of the image object and the hash of the known hoax object.

Assignees

• Ca Inc

Inventors

• M Yuvaraj
• Ghosh Swapan Kumar
• Govindarajan Srinivasan

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title