Method and apparatus for detecting a macro computer virus using static analysis

A method for detecting a macro virus in a computer system by statically analyzing macro operations within a document, comprising:

• receiving the document containing the macro operations, the macro operations being in source code form;
• locating the macro operations within the document;
• performing a flow analysis on the macro operations within the document to determine associated values for variables within the macro operations, wherein performing the flow analysis on the macro operations includes performing at least one of a data flow analysis and a control flow analysis;
• comparing the macro operations including the associated values for variables against a profile containing information about suspect macro operations and associated values for variables to determine whether the document contains suspect macro operations;
• if the document contains suspect macro operations, informing a user that the document contains suspect macro operations;
• and
• receiving instructions from the user specifying an action to take with regards to the document.

A computer readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for detecting a macro virus in a computer system by statically analyzing macro operations within a document, comprising:

• receiving the document containing the macro operations;
• locating the macro operations within the document;
• performing a flow analysis on the macro operations within the document to determine associated values for variables within the macro operations, wherein performing the flow analysis on the macro operations includes performing at least one of a data flow analysis and a control flow analysis;
• comparing the macro operations including the associated values for variables against a profile containing information about suspect macro operations and associated values for variables to determine whether the document contains suspect macro operations;
• and
• if the document contains suspect macro operations, informing a user that the document contains suspect macro operations.

An apparatus that detects a macro virus in a computer system by statically analyzing macro operations within a document, comprising:

• a receiving mechanism that receives the document containing the macro operations;
• a macro operation locating mechanism that locates the macro operations within the document;
• a flow analysis mechanism that performs a flow analysis on the macro operations within the document to determine associated values for variables within the macro operations, wherein performing the flow analysis on the macro operations includes performing at least one of a data flow analysis and a control flow analysis;
• a comparison mechanism that compares the macro operations including the associated values for variables against a profile containing information about suspect macro operations and associated values for variables to determine whether the document contains suspect macro operations;
• and
• an informing mechanism that informs a user if the document contains suspect macro operations.