SPARSE: A Hybrid System to Detect Malcode-Bearing Documents

摘要: Embedding malcode within documents provides a convenient means of penetrating systems which may be unreachable by network-level service attacks. Such attacks can very targeted and difficult to detect compared the typical network worm threat due multitude document-exchange vectors. Detecting embedded in document is owing complexity modern formats that provide ample opportunity embed code myriad ways. We focus on Microsoft Word as carriers case study this paper. introduce hybrid system integrates static dynamic techniques presence location malware documents. The designed automatically update its detection models improve accuracy over time. overall with learning feedback loop demonstrated achieve 99.27% rate 3.16% false positive corpus 6228