Signatureless detection of malicious ms office documents containing embedded ole objects

Abstract

The technology disclosed relates to cybersecurity attacks and cloud-based security. A method and apparatus is provided for detecting documents with embedded threats in the form of malicious Object Linking & Embedding (OLE) objects. The technology disclosed detects obfuscated malicious code using a trained machine learning model to predict documents having malicious code without a known signature. The technology disclosed can thus predict which documents include signatureless malicious code. Feature engineering is used to define a set of features for detecting malicious macros and malicious OLE objects, based on features selected from a list of known characteristics and attributes possessed by files that have historically indicated malicious content. The selected features are used to train a supervised machine learning model, which is used to classify documents as safe, suspicious, or malicious.