[논문]Forgery Detection Mechanism with Abnormal Structure Analysis on Office Open XML based MS-Word File

Lee, HanSeong; Lee, Hyung-Woo

doi:10.7236/ijasc.2019.8.4.47

[국내논문] Forgery Detection Mechanism with Abnormal Structure Analysis on Office Open XML based MS-Word File 원문보기

International journal of advanced smart convergence, v.8 no.4, 2019년, pp.47 - 57

Lee, HanSeong (Div. of Computer Engineering, Hanshin Univ.) , Lee, Hyung-Woo (Div. of Computer Engineering, Hanshin Univ.)

Abstract ▼ AI-Helper

We examine the weaknesses of the existing OOXML-based MS-Word file structure, and analyze how data concealment and forgery are performed in MS-Word digital documents. In case of forgery by including hidden information in MS-Word digital document, there is no difference in opening the file with the MS-Word Processor. However, the computer system may be malfunctioned by malware or shell code hidden in the digital document. If a malicious image file or ZIP file is hidden in the document by using the structural vulnerability of the MS-Word document, it may be infected by ransomware that encrypts the entire file on the disk even if the MS-Word file is normally executed. Therefore, it is necessary to analyze forgery and alteration of digital document through internal structure analysis of MS-Word file. In this paper, we designed and implemented a mechanism to detect this efficiently and automatic detection software, and presented a method to proactively respond to attacks such as ransomware exploiting MS-Word security vulnerabilities.

Keyword

표/그림 (11)

그림 Figure 1. OOXML based MS-Word File Structure
그림 Figure 2. Internal ZIP Structure of MS-Word File
그림 Figure 3. CDH and LFH Specifications
그림 Figure 4. Data Hiding in LFH of MS-Word’s Internal ZIP Structure
그림 Figure 5. Data Hiding in a single CDH of MS-Word’s Internal ZIP Structure
그림 Figure 6. Data Hiding in multiple CDHs of MS-Word’s Internal ZIP Structure
그림 Figure 7. File comment fields in CDH and EOCD Record Specifications and on the Properties in 7-ZIP
그림 Figure 8. Hiding ‘My Hidden Message.’ using by Inserting NULL in the File Comment of ‘docProps/app.xml’ Fils’s CDH in MS-Word File
그림 Figure 9. Hiding ‘My Hidden Message.’ using by Inserting NULL in the File Comment of the EOCD Record in MS-Word File
그림 Figure 10. Design of MS-Word Forgery Analyzer
표 Table 1. A Comparison of Slack Space and File comment field for Forgery in MS-Word Files

참고문헌 (8)

Wikipedia contributors, "Digital forensics," Wikipedia, The Free Encyclopedia, https://en.wikipedia.org/w/index.php?titleDigital_forensics&oldid916341369 (accessed October 3, 2019).
Wikipedia contributors, "SHA-2," Wikipedia, The Free Encyclopedia, https://en.wikipedia.org/w/index.php?titleSHA-2&oldid917408454(accessed October 3, 2019).
Wikipedia contributors, "Office Open XML," Wikipedia, The Free Encyclopedia, https://en.wikipedia.org/w/index.php?titleOffice_Open_XML&oldid917283554 (accessed October 3, 2019).
GandCrab ransomware operation says it's shutting down. By Catalin Cimpanu. Available from: https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/
CVE-2017-3867 Detail, https://nvd.nist.gov/vuln/detail/CVE-2017-3867
Wikipedia contributors, "JPEG," Wikipedia, The Free Encyclopedia, https://en.wikipedia.org/w/index.php?titleJPEG&oldid918055789 (accessed September 27, 2019).
Wikipedia contributors, "Zip (file format)," Wikipedia, The Free Encyclopedia, https://en.wikipedia.org/w/index.php?titleZip_(file_format)&oldid916422219 (accessed September 27, 2019).
File Formats: Microsoft Word Document (DOCX/DOC), https://www.leadtools.com/help/leadtools/v20/dh/to/document-file-formats-microsoft-word-document-docxdoc.html

활용도 분석정보

상세보기

다운로드

내보내기

활용도 Top5 논문

해당 논문의 주제분야에서 활용도가 높은 상위 5개 콘텐츠를 보여줍니다.
더보기 버튼을 클릭하시면 더 많은 관련자료를 살펴볼 수 있습니다.

내보내기 구분	파일저장 인쇄 메일전송
구성항목	기본정보 상세정보 관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관 관리번호, 논문명, 대등논문명, 저자 , 저널/프로시딩명, 발행기관, 발행년, 발행언어, 권, 호, 시작페이지, 끝페이지, ISBN, ISSN, 주제분야, 키워드, 초록(한글), 초록(영문), 저자(소속기관)
저장형식	Text(ASCII format) Excel format RefWorks Direct Export RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley
메일정보	받는사람 (필수) @ 보내는사람 (선택) @ 제목 내용 KISTI 검색결과 이메일 서비스
안내	총 건의 자료가 검색되었습니다. 다운받으실 자료의 인덱스를 입력하세요. (1-10,000) 검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다. 데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요) 다운로드 파일은 UTF-8 형태로 저장됩니다. 파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오. ~ Text(ASCII format) Excel format

연합인증