# A Universal Malicious Documents Static Detection Framework Based on Feature Generalization
## 4 Feature Engineering
### Number of Objects
#### 4.4.2 Number of Office Document Objects  
In the Word document detection process, the type of OLE document, the number of malicious images, and the number of malicious URLs are used as features to enhance the detection rate of malicious Word documents. (1) Number of OLE document types  
It is troublesome to directly analyze an embedded OLE document. Based on the analysis of the types of OLE documents embedded in the samples, it was found that the benign samples contained only documents with bytecodes of all 0 \(\times\) 00 and some binary documents with unknown document types. Numerous types of documents were found in the malicious samples, such as HTML, PE, DOS, JavaScript, and JAR documents. This indicates that Word documents with OLE object embedding are likely to be embedded with programs containing malicious code or media documents containing vulnerabilities, while OLE objects similar to the executable programs are rarely seen in normal samples; thus, this will be beneficial for the detection of malicious documents. Oletools is an open-source security analysis tool developed in the Python language for the analysis of OLE objects, VBA code extraction, and the VBA code analysis of Office documents. The OLE objects contained in each sample can be extracted and saved as documents via the command line, after which Exiftool can be used to identify the type of the extracted document. The use of the OLE document type as a feature not only relies on the result of Exiftool, but also combines the document suffixes corresponding to the extracted OLE objects as features, as malicious documents usually disguise malicious OLE objects to reduce user suspicion. Images usually exist in Word documents, and malicious images usually have potential vulnerabilities. Attackers often use Office tools to parse the potential vulnerabilities of images to launch attacks. Therefore, it is particularly important to analyze the security of images. The proposed static detection framework is used to detect the security of the images in a Word document after completing the image security test. For each document, a numerical value is used to record the number of malicious images in the document. Number of malicious URLs  
A malicious URL request will automatically download the malicious document and open the website. The content that can initiate a URL request in DOCX is mainly determined by the \"Target\" attribute of the \"Relationship\" tag in the \".rels\" document, excluding the \"document.xml.rels\" document in the \"word/_rels\" directory of the ZIP document. If the value of \"Target\" is a URL link and the link ends with the document name (the document download link), the danger of the DOCX document is significantly enhanced. Therefore, in the DOCX document detection process, the URL will be extracted from the \".rels\" described in the previous paragraph, and the number of URLs will be used as a feature. Number of Image Objects  
Via the image document parser, the number of each type of object in the document is obtained after parsing the document, and the sum of the number of each type of object is used as a feature. Number of RTF Objects  
The content analysis of RTF documents is realized by writing an RTF document parser. The sequence and the number of occurrences of each type of object and each type of keyword in the document are obtained from the analysis result. The RTF document contains many kinds of keywords, and the latter portion of the keywords usually contains numbers, which significantly increases the number of types of keywords. To avoid the problem of keyword expansion, the numbers in the latter part of the keywords are ignored when parsing RTF documents. Some keywords are selected from the set of keywords that appear in the RTF documents, and the number of times that they appear in the document is used as a feature. Via the statistics of the samples, some substantial differences were found between the keywords of the malicious and benign samples.