Identification of electronic documents that are likely to contain embedded malware

A method of determining a likelihood that an electronic document contains embedded malware, the method comprising:

• processing one or more signals that represent a contents of the electronic document so as to identify one or more pre-defined metadata structures that, at least in part, make up the electronic document;
• attributing a weighting value to each of the identified, one or more pre-defined metadata structures;
• wherein the weighting value attributed to each identified, pre-defined metadata structure reflects a degree to which the corresponding, pre-defined metadata structure relates to the likelihood the document contains embedded malware;
• generating a numerical score for the electronic document by combining the weighting values that were attributed to each of the identified, one or more pre-defined metadata structures;
• comparing the numerical score attributed to the electronic document to a pre-established model threshold value;
• and
• determining whether the electronic document is likely to contain embedded malware based on a result of the comparison.

A storage disk or storage device comprising instructions that, when executed, cause a machine to determine a likelihood that an electronic document contains embedded malware by:

• processing one or more signals that represent a contents of the electronic document to identify one or more pre-defined metadata structures that, at least in part, make up the electronic document;
• applying a set of pre-established rules to the one or more pre-defined metadata structures such that a numerical score is attributed to the electronic document;
• comparing the numerical score attributed to the electronic document with a pre-established model threshold value;
• and
• determining whether the electronic document is likely to contain embedded malware based on a result of the comparing.