Detection of malicious code that is obfuscated within a document file

Abstract

The technology disclosed relates to cybersecurity attacks and cloud-based security, and specifically to the detection of malicious code that is obfuscated within document files. Such malicious code can be delivered in the form of malicious macros and/or malicious OLE objects stored within document files. The technology disclosed detects obfuscated and malicious code using a trained machine learning model to predict which documents include malicious code, despite such malicious not having a known signature. The technology disclosed can thus predict which documents include malicious code lacking a known signature. Safe documents are allowed into the network. Suspicious documents are subjected to additional processing, including quarantining or sandboxing methods. Malicious documents are rejected from the network. In a further aspect, the disclosed technology combines machine learning with other network security methods, to further increase the capability of a network security system to detect malicious macros and malicious OLE files.