METHOD AND APPARATUS FOR DETECTING A MACRO COMPUTER VIRUS USING STATIC ANALYSIS

One embodiment of the present invention provides a system that detects a macro virus in a computer system by statically analyzing macro operations within a document. The system operates by receiving the document containing the macro operations. The system locates the macro operations within the document, and performs a flow analysis on the macro operations within the document to determine associated values for variables within the macro operations. Next, the system compares the macro operations including the associated values for variables against a profile containing information about suspect macro operations and associated values for variables to determine whether the document contains suspect macro operations. If so, the system informs a user that the document contains suspect macro operations. In one embodiment of the present invention, after informing the user, the system receives instructions from the user specifying an action to take with regards to the document. In a variation on this embodiment, the action can include, deleting the document or cleaning the document to remove suspect macro operations. Note that it is possible to perform static analysis on macro viruses, because unlike other viruses that are propagated in executable code form, macro viruses are propagated in source code form, which is more amenable to static analysis than executable code.