Gmail

Gmail gets better at detecting malicious documents, over 50% come from Office docs

Ben Schoon | Feb 26 2020 - 8:36 am PT

Lots of emails are sent with malicious intent, putting a heavy burden on Google’s Gmail to protect users. As it turns out, a lot of malicious attachments come from documents, but Gmail is getting better at detecting them.

In a post on its Security Blog, Google explains how Gmail blocks 99.9% of threats from ever reaching your inbox, and how it’s getting even better at that task. Gmail’s malware scanner processes over 300 billion attachments weekly, and 63% of that content changes on a daily basis.

To stay ahead of that, Google has been employing a new scanner that uses machine learning to improve detection. Since the scanner launched, Google has boosted detection of Office documents by 10%. Impressively, Google’s new scanner is getting better at detecting “adversarial, bursty attacks” with the detection rate jumping by 150%.

Interestingly, Google says that 58% of all malware targeting Gmail users comes from malicious documents, the vast majority of that coming from Office documents alone.

Strengthening our document detection capabilities is one of our key focus areas, as malicious documents represent 58% of the malware targeting Gmail users. We are still actively developing this technology, and right now, we only use it to scan Office documents.

Our new scanner runs in parallel with existing detection capabilities, all of which contribute to the final verdict of our decision engine to block a malicious document. Combining different scanners is one of the cornerstones of our defense-in-depth approach to help protect users and ensure our detection system is resilient to adversarial attacks.

We will continue to actively expand the use of artificial intelligence to protect our users’ inboxes, and to stay ahead of attacks.