Sanitizing a Microsoft Office file means running dozens of protection treatments against it. The conventional approach gives each protection treatment a full read of the document and keeps reading that same document each time protection is applied.
Deep CDR™ Technology reads each document once and runs every treatment during that single pass. This method speeds up processing time of large Office files two folds while maintaining identical sanitization results.
The Hidden Tax of Thoroughness
Sanitization is thorough by design. Deep CDR™ Technology sanitizes a Microsoft Office document by applying dozens of treatments at once: external links, embedded objects, images and their metadata, smart tags, and more. Each treatment targets its own threat category and performs its own analysis and editing.
Modern Office files make that thoroughness time-consuming and resource-intensive. A Word or Excel file is a compressed folder. Inside are text files written in XML, a structured format that describes every cell, paragraph, image, and link in the document. To sanitize the file, Deep CDR™ Technology must read through that XML. A spreadsheet that arrives as a 50 MB file can unpack into a single sheet holding half a gigabyte of XML.
In a conventional engine layout, each treatment runs through the entire XML package: one pass for links, another for embedded objects, another for images, and so on.
Processing cost grows with every protection applied. That ‘hidden tax’ shows up as longer file queues and more compute for the same traffic. It also creates pressure to compromise protections just to keep pace.
One-Pass Strategy: One Walk, Multiple Workers
Picture a home inspection. Normally the electrician, the plumber, and the fire inspector inspect the house one after another, and each one walks every room. How about sending them all through together? The house gets inspected once, by all the needed specialists.
That is exactly what Deep CDR™ Technology’s one-pass strategy does. It inverts the conventional sanitization layout with three ideas:
- One host, one walk. A single processing host reads through, or ‘walks’, each XML part of the document exactly once. Every protection is a handler that rides along on that walk, sees each XML node as it streams past, and does its work on the spot. Ten protections mean one read of a 500 MB sheet, with ten workers watching it.
- Each protection is a plug-in. A specialized checker, or ‘handler’, owns one concern end to end: the usage nodes inside the content XML, the resource definitions that declare them, and the stored artifact itself. Every handler follows the same lifecycle: initialize, process each node, finalize. Adding a protection to the engine means registering one more handler on the same walk. The cost of thoroughness no longer grows with each protection added.
- Disabled protections never run. Before the walk starts, each handler checks whether its configuration applies. A protection your policy has disabled steps out up front and adds no per-node work. The document is read once, and only the protections that matter take part
What the Benchmarks Show
We benchmarked the strategy before and after, on both crafted large documents and full real-world regression suites, on Windows and Linux.
- Large Excel documents (about 500 MB of sheet XML): roughly 2× faster. Total processing time improved 94% on Windows and 67% on Linux, and the densest single-sheet file improved 147%.
- Large Word documents (70-file crafted set): roughly 2× faster on total run time, with per-file average time improving 169%.
- Real-world regression suites (thousands of Word, Excel, and PowerPoint files): roughly 4% to 20% faster, depending on format and platform. Most files are small, so the single-read advantage grows with document size.
- Zero behavior change: both versions completed the full regression suites with identical sanitization outcomes. The speed came from removing repeated reading, and no protection was skipped.
That last result matters most. In security settings, a performance claim matters only when protection stays constant. Throughput at a gateway also supports security: the faster a file is sanitized, the less pressure teams feel to route around the protection.
Why We Tested Office 2007 Formats First
The Office 2007 family (.docx, .xlsx, and .pptx) is where the XML hidden cost concentrates. All three formats share the same package structure, so one host design covers them all, and spreadsheet-heavy traffic is where half-gigabyte XML parts occur in the wild.
The strategy itself applies to any format whose cost lives in large structured content, which makes those formats candidates for the same treatment.
Thoroughness used to carry a price that grew with every protection added. With one-pass processing, Deep CDR™ Technology assesses the whole document once, no matter how many protection treatments are applied.
Nhut Ngo is Director of Software Engineering at OPSWAT, where he leads the engineering teams behind Deep CDR™ Technology and other file-processing technologies in MetaDefender Core™. With more than a decade of experience in software engineering and cybersecurity, he focuses on making file sanitization fast, accurate, and ready for critical infrastructure. Nhut earned his PhD in Information Science in 2015.
