KR102662965B1 - Apparatus and method for detecting ai based malignant code in structured document - Google Patents

Abstract

The present invention relates to an artificial intelligence-based augmented reality avatar pose proposal device and method that reflects the surrounding environment structure and user preferences, and the device includes an image generator that generates a real image through a camera, and a user avatar generator that generates a user avatar. A user avatar composition recommendation unit that analyzes the real image and recommends a composition of the user avatar on the real image, and adjusts the composition of the recommended user avatar according to user control to determine the size, position, or pose. It includes a user avatar composition control unit.

Description

Artificial intelligence-based malware detection device and method for structured documents {APPARATUS AND METHOD FOR DETECTING AI BASED MALIGNANT CODE IN STRUCTURED DOCUMENT}

The present invention relates to an artificial intelligence-based malicious code detection technology. More specifically, the present invention relates to an artificial intelligence-based artificial intelligence-based document for structured documents that can determine the possibility of a structured document containing malicious code by inputting a plurality of document components into a malicious code detection model. It relates to a malware detection device and method.

Malicious code is a program that infringes on a user's computer and prevents it from performing normal functions. Typical examples include Trojan horses, worm viruses, keyloggers, spyware, adware, and ransomware. There are many types of such malware and they are evolving into new types of malware. There are various distribution formats of malware, and there are ways to cause hacking incidents that steal important data by attaching malicious document files to media content such as emails. Various methods are being proposed as countermeasures against such malware.

In general, malicious code detection methods detect malicious code using pattern information of specific code sections of files suspected to be malicious code. However, the PDF malware detection rate of domestic companies is very low, and the current detection method of detecting a specific pattern (string) has the problem of having to add a new specific pattern every time a new malicious code is released.

The method of creating a blacklist or whitelist based on the signature of the code and using it to detect malicious code is suitable for detecting existing known malicious code, but has limitations in detecting newly emerged malicious code.

In addition, past signature-based malware detection methods are weak in detecting new types of malware because they use the unique hashing value of the expressed malware or detect using patterned attack rules.

The most accurate way to analyze malicious code is for experts to directly find out whether the code is malicious using various analysis methods suggested by reverse engineering. However, new malicious codes are steadily increasing using only malicious code detection rules defined by security experts. It is difficult to detect effectively, and not only does it require experts with specialized knowledge in the field of reverse engineering, but it also requires a lot of time to analyze the code, making it difficult to analyze large amounts of malicious code in real time.

Recently, due to the development of artificial intelligence, including machine learning, studies are being attempted to apply various methods of machine learning to detect malicious code.

Korean Patent No. 10-2018-0024136 relates to a malware detection system based on Ai deep learning, which includes a file to be analyzed (hereinafter referred to as target file) from a user terminal and a file collection module that collects file information of the target file; a distribution module that stores the binary file of the target file in a file storage and transmits the collected file information of the target file to a management module; a management module that registers an analysis task for the target file in a task queue using the file information of the target file; Receives file information registered in the work queue, reads the target file of the corresponding file information from the file storage, renders the target file, collects dynamic information that is a record of what the target file has performed, and attributes based on the file structure of the target file. An information collection module that collects static information from values; a feature extraction module that selectively extracts predefined features from the collected dynamic information and static information and stores the extracted features; A classification module that uses a machine learning classifier to determine whether a target file is malicious code based on the characteristics of the target file and transmits the result of whether the target file is malicious code to a management module; and an agent module that deletes or isolates malicious files, wherein the management module generates IOC (Indicator Of Compromise) information for the corresponding malicious code according to the results of the classification module, and the agent module generates IOC information based on the IOC information. AI deep learning utilizes both static and dynamic information of the target file by deleting or isolating malicious files according to the configuration, performs machine learning on the correlation and continuity of features with strong malicious characteristics, and determines whether it is malicious code. A malware-based malware detection system is being launched.

Korean Patent No. 10-2018-0024136 (2018.02.28)

An embodiment of the present invention seeks to provide an artificial intelligence-based malware detection device and method for structured documents that can determine the possibility of a structured document containing malware by inputting a plurality of document components into a malware detection model.

One embodiment of the present invention seeks to provide an artificial intelligence-based malware detection device and method for structured documents that can detect malware through meta, stream, entropy, and content analysis of PDF (Portable Document Format) documents. do.

An embodiment of the present invention seeks to provide an artificial intelligence-based malware detection device and method for structured documents that can detect malware by implementing a malware detection model with a random forest-based artificial intelligence model.

Among embodiments, an artificial intelligence-based malware detection device for structured documents includes a document structure detection unit that identifies a document format for a structured document and detects a plurality of document components, and feature analysis for the plurality of document components. It includes a document feature generation unit that generates document features and a malicious code determination unit that determines the possibility of the structured document containing malicious code by inputting the document features into a malicious code detection model.

The document structure detection unit may analyze a PDF (Portable Document Format) document and detect a plurality of objects as the plurality of document components.

The document feature generator may generate a plurality of feature elements constituting the document feature through meta, stream, entropy, and content analysis of the plurality of document elements.

In the first embodiment, the document feature generator may calculate the sum of stream lengths and the ratio between the file size and the sum of stream lengths through meta-analysis of the plurality of document components. In a second embodiment, the document feature generator may calculate the maximum and minimum values, average value, and standard deviation of the stream length through stream analysis of the plurality of document components. In a third embodiment, the document feature generator may calculate the maximum and minimum values, average value, and standard deviation of stream entropy through entropy analysis of the plurality of document components. In the fourth embodiment, the document feature generator may calculate a stream tag set through content analysis of the plurality of document components.

The malicious code determination unit may determine the possibility of containing the malicious code based on the partial possibility of malicious code for each of meta, stream, entropy, and content analysis constituting the document features through the malicious code detection model. The malicious code determination unit may determine the possibility of containing the malicious code by calculating a weighted average value of the possibility of the partial malicious code. The malicious code decision unit may implement the malicious code detection model as a random forest artificial intelligence model.

Among embodiments, an artificial intelligence-based malware detection method for structured documents includes a document structure detection step of detecting a plurality of document components by identifying a document format for a structured document, and features for the plurality of document components. It includes a document feature generation step of generating document features through analysis, and a malicious code determination step of determining the possibility of the structured document containing malicious code by inputting the document features into a malicious code detection model.

The document structure detection step may include analyzing a Portable Document Format (PDF) document and detecting a plurality of objects as the plurality of document components.

The document feature generation step may include generating a plurality of feature elements constituting the document feature through meta, stream, entropy, and content analysis of the plurality of document elements.

The malicious code determination step may determine the possibility of containing the malicious code based on the partial possibility of malicious code for each of the meta, stream, entropy, and content analysis constituting the document features through the malicious code detection model.

The disclosed technology can have the following effects. However, since it does not mean that a specific embodiment must include all of the following effects or only the following effects, the scope of rights of the disclosed technology should not be understood as being limited thereby.

The artificial intelligence-based malware detection device and method for structured documents according to an embodiment of the present invention can determine the possibility of a structured document containing malware by inputting a plurality of document components into a malware detection model.

The artificial intelligence-based malware detection device and method for structured documents according to an embodiment of the present invention can detect malware through meta, stream, entropy, and content analysis of PDF (Portable Document Format) documents.

The artificial intelligence-based malicious code detection device and method for structured documents according to an embodiment of the present invention can detect malicious code by implementing a malicious code detection model using a random forest artificial intelligence model.

1 is a diagram illustrating an artificial intelligence-based malware detection system for structured documents according to an embodiment of the present invention.
FIG. 2 is a hardware block diagram illustrating an artificial intelligence-based malware detection device for the structured document in FIG. 1.
FIG. 3 is a functional block diagram illustrating an artificial intelligence-based malware detection device for the structured document in FIG. 1.
Figure 4 is a flowchart explaining the artificial intelligence-based malware detection process for structured documents.
Figure 5 is an example diagram explaining a structured document such as a PDF document.
Figure 6 is an example diagram explaining meta, stream, entropy, and content analysis of document structure.

Since the description of the present invention is only an example for structural or functional explanation, the scope of the present invention should not be construed as limited by the examples described in the text. In other words, since the embodiment can be modified in various ways and can have various forms, the scope of rights of the present invention should be understood to include equivalents that can realize the technical idea. In addition, the purpose or effect presented in the present invention does not mean that a specific embodiment must include all or only such effects, so the scope of the present invention should not be understood as limited thereby.

Meanwhile, the meaning of the terms described in this application should be understood as follows.

Terms such as “first” and “second” are used to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, a first component may be named a second component, and similarly, the second component may also be named a first component.

When a component is referred to as being “connected” to another component, it should be understood that it may be directly connected to the other component, but that other components may exist in between. On the other hand, when a component is said to be “directly connected” to another component, it should be understood that there are no other components in between. Meanwhile, other expressions that describe the relationship between components, such as "between" and "immediately between" or "neighboring" and "directly neighboring" should be interpreted similarly.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as “comprise” or “have” refer to implemented features, numbers, steps, operations, components, parts, or them. It is intended to specify the existence of a combination, and should be understood as not excluding in advance the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

For each step, identification codes (e.g., a, b, c, etc.) are used for convenience of explanation. The identification codes do not explain the order of each step, and each step clearly follows a specific order in context. Unless specified, events may occur differently from the specified order. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the opposite order.

All terms used herein, unless otherwise defined, have the same meaning as commonly understood by a person of ordinary skill in the field to which the present invention pertains. Terms defined in commonly used dictionaries should be interpreted as consistent with the meaning they have in the context of the related technology, and cannot be interpreted as having an ideal or excessively formal meaning unless clearly defined in the present application.

1 is a diagram illustrating an artificial intelligence-based malware detection system for structured documents according to an embodiment of the present invention.

Referring to FIG. 1, the artificial intelligence-based malware detection system 100 for structured documents includes a user terminal 110, an artificial intelligence-based malware detection device 130, and a user database 150, which are Can be connected through a network.

The user terminal 110 may correspond to a computing device that edits, views, or creates structured documents. In one embodiment, the user terminal 110 may be implemented as a smartphone, tablet, laptop, PC, etc. Additionally, the user terminal 110 may be connected to the artificial intelligence-based malware detection device 130 by wire or wirelessly. Here, the structured document may include at least one of text, pictures, audio, video, and script having a specific format for configuring the document, and may include, for example, a PDF (Portable Document Format) document.

In one embodiment, the user terminal 110, unlike Figure 1, is included and implemented as a component of the artificial intelligence-based malware detection device 130 and can perform the role of editing, viewing, or creating structured documents. .

The artificial intelligence-based malware detection device 130 may correspond to a separate computing device (i.e., server) that can be linked to the user terminal 110 through a network, or may provide an artificial intelligence-based malware detection function. It may correspond to a user terminal 110 that installs the implemented application.

The artificial intelligence-based malicious code detection device 130 may receive a structured document from the user terminal 110 and input the structured document into a malicious code detection model to determine the possibility of the structured document containing malicious code.

More specifically, the artificial intelligence-based malware detection device 130 identifies a document format for a structured document, detects a plurality of document components, and applies document features for the plurality of document components to a malware detection model. Enter the information to determine whether it contains malicious code.

The user database 150 manages user information and, in particular, may include user billing information for a malware detection service. In addition, the user database 150 can build a record of structured documents that clearly contain malicious code through user feedback, and the artificial intelligence-based malicious code detection device 130 can perform artificial intelligence-based malicious code analysis prior to analysis. Through the record, the possibility of malicious code can be determined using the signature method.

Meanwhile, the user database 150 is not necessarily limited to this, and may store collected or processed information about structured documents in the process of performing malicious code detection. In addition, the user database 150 is assumed to be implemented as a separate physical device from the artificial intelligence-based malware detection device 130 in FIG. 1, but it is not necessarily limited to this and the artificial intelligence-based malware detection device 130 ) can be implemented integratedly.

FIG. 2 is a hardware block diagram illustrating an artificial intelligence-based malware detection device for the structured document in FIG. 1.

Referring to FIG. 2, the artificial intelligence-based malware detection device 130 may include a processor 210, a memory 230, a user input/output unit 250, and a network input/output unit 270.

The processor 210 can execute an artificial intelligence-based malicious code detection procedure according to an embodiment of the present invention, and manage the memory 230 that is read or written in this process. The synchronization time between volatile memory and non-volatile memory can be scheduled. The processor 210 can control the overall operation of the artificial intelligence-based malicious code detection device 130, and is electrically connected to the memory 230, the user input/output unit 250, and the network input/output unit 270 to communicate between them. Data flow can be controlled. The processor 210 may be implemented as a CPU (Central Processing Unit) of the artificial intelligence-based malware detection device 130.

The memory 230 is implemented as a non-volatile memory such as a solid state disk (SSD) or a hard disk drive (HDD) and includes an auxiliary memory device used to store all data required for the user-customized psychological counseling expert matching device 130. It can include a main memory implemented as volatile memory such as RAM (Random Access Memory). Additionally, the memory 230 can store a set of instructions for executing the learning database construction method according to the present invention by being executed by the electrically connected processor 210.

The user input/output unit 250 includes an environment for receiving user input and an environment for outputting specific information to the user, and includes an input adapter such as, for example, a touch pad, a touch screen, an on-screen keyboard, or a pointing device. It may include an output device including a device and an adapter such as a monitor or touch screen. In one embodiment, the user input/output unit 250 may correspond to a computing device connected through remote access, and in such case, the artificial intelligence-based malware detection device 130 may be performed as an independent server.

The network input/output unit 270 provides a communication environment for connection to the user terminal 110 through a network, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and It may include an adapter for communication such as VAN (Value Added Network). Additionally, the network input/output unit 270 may be implemented to provide short-range communication functions such as WiFi and Bluetooth or wireless communication functions of 4G or higher for wireless transmission of learning data.

FIG. 3 is a functional block diagram illustrating an artificial intelligence-based malware detection device for the structured document in FIG. 1.

Referring to FIG. 3, the artificial intelligence-based malicious code detection device 130 may include a document structure detection unit 310, a document feature creation unit 320, a malicious code determination unit 330, and a control unit 340. .

The document structure detection unit 310 identifies a document format related to a structured document and detects a plurality of document elements. For example, a structured document may correspond to a Portable Document Format (PDF) document.

Figure 5 is an example diagram explaining a structured document such as a PDF document.

In Figure 5, a PDF document (file) 500 consists of a header, body, table, and trailer. The header can contain a PDF version, and the body can contain a set of objects. Here, the object set may be composed of a plurality of objects (Objecti-1, Ojbecti, Objecti+1, ...). The table corresponds to the indirect object global reference table, and the trailer may contain the location of the global reference object.

In one embodiment, the document structure detection unit 310 analyzes a PDF document and detects a plurality of objects (Objecti-1, Ojbecti, Objecti+1, ...) in the object set of the body as the plurality of document components. It can be detected.

Objects may include the actual content of a PDF, and more specifically, include an object head, content, and content stream.

The object head may include the number and version of the object, the content contains internal data of the object corresponding to the actual content, and the content stream contains relatively large content (content) that cannot be expressed by other objects. may contain page configuration objects (e.g. images) or page configuration objects (file contents).

Again in FIG. 3, the document feature generator 320 generates document features through feature analysis of a plurality of document components. Here, feature analysis can be used to detect new malicious code without using a specific pattern, such as detecting an existing specific pattern (string). In other words, feature analysis can be used to generate summarized characteristics for multiple document components. The document feature generator 320 can configure the document features as feature vectors or feature maps, and when the document features are configured as feature maps, the size of the feature map can be reduced through pooling.

The document feature generator 320 may generate a plurality of feature elements constituting the document feature through meta, stream, entropy, and content analysis of the plurality of document elements. Meta, stream, entropy, and content analysis are explained with reference to FIG. 6.

Figure 6 is an example diagram explaining meta, stream, entropy, and content analysis of document structure.

In Figure 6, document structure analysis techniques 600 include meta, stream, entropy, and content analysis.

Here, the definitions of terms used below are as follows.

len(file) corresponds to the file size (unit: bytes), Si: Content Streami of the object (Objecti), and can be expressed as a byte stream. len(Si) represents the size of Si (unit: byte), ent(Si) represents the entropy of Si, and tags(Si) represents a set of tags included in Si.

The document feature generator 320 calculates the sum of stream lengths through meta-analysis (Meta) of a plurality of document components. and sum of file size and stream length The ratio between the two can be calculated.

The document feature generator 320 determines the maximum stream length through stream analysis of a plurality of document components. and minimum value , average value and standard deviation can be calculated.

The document feature generator 320 determines the maximum value of stream entropy through entropy analysis of a plurality of document components. and minimum value , average value and standard deviation can be calculated.

The document feature generator 320 sets stream tags through content analysis of a plurality of document components. can be calculated.

Again in FIG. 3, the malicious code determination unit 330 inputs document features into a malicious code detection model to determine the possibility of the structured document containing malicious code. Here, the malware detection model can be built through artificial intelligence-based learning and, for example, can be implemented as a random forest-type artificial intelligence model.

The malicious code determination unit 330 determines the possibility of containing malicious code based on the partial possibility of malicious code for each of the meta, stream, entropy, and content analysis constituting the document features through a malicious code detection model.

Here, from the perspective of meta-analysis through a malware detection model, PDFs attempting malicious actions must have malicious actions inserted into the object stream and object content, so the stream length compared to normal files and its ratio to the actual file size are Because they will differ, meta-analysis can determine partial malware likelihood based on these differences.

From the perspective of stream analysis through a malware detection model, if a PDF attempting to perform a malicious act contains a malicious act in an object, in the case of a PDF created purely for malicious acts, the standard deviation of the stream length will be large and the average will be small. And the type of tags inside the object will also be small. In other words, if an object attempting a malicious action is inserted into a normal file, the object will show a different aspect from other objects, which may make the statistical values of the PDF file different from normal. Stream analysis can determine the likelihood of partial malware based on these differences.

From the perspective of entropy analysis through a malware detection model, if an object attempting a malicious action is obfuscated, the maximum value of entropy will be very high, and this is likely to be different from the average entropy of the objects, so the standard deviation will also increase. There is a possibility. In particular, in the case of PDFs created solely for malicious activity, the difference between the average and maximum values will be very large. Entropy analysis can determine the likelihood of partial malware based on these differences.

From the perspective of content analysis through a malware detection model, if it is created purely for malicious activity, the content of the PDF does not contain meaning, so it is highly likely that the number of tags inside the object will not be diverse. Content analysis can determine the likelihood of partial malware based on these differences.

The malicious code decision unit 330 can determine the final possibility of containing malicious code by combining the possibilities of partial malicious code. Figure 7 is a table showing the results of detecting the possibility of containing malicious code using a malicious code detection model through a random forest.

In the table 700 of FIG. 7, the malware detection model shows much better performance when combined than when using only meta, stream, entropy, and content.

In one embodiment, the malicious code determination unit 330 may determine the possibility of containing malicious code by calculating a weighted average value of the possibility of partial malicious code. That is, the malicious code decision unit 330 can assign weights to each of meta, stream, entropy, and content analysis and calculate a weighted average value. For example, weights may be given proportionally to differences greater than the average in meta, stream, entropy, and content analysis processes.

The control unit 290 controls the overall operation of the artificial intelligence-based malware detection device 130, and controls the control flow or data between the document structure detection unit 310, the document feature creation unit 320, and the malware determination unit 330. You can manage the flow.

Figure 4 is a flowchart explaining the artificial intelligence-based malware detection process for structured documents.

In FIG. 4, the document structure detection unit 310 identifies a document format related to a structured document and detects a plurality of document elements (step S410). The document feature generator 320 generates document features through feature analysis of a plurality of document components (step S420). The malicious code determination unit 330 inputs document features into a malicious code detection model to determine the possibility of the structured document containing malicious code.

Although the present invention has been described above with reference to preferred embodiments, those skilled in the art may make various modifications and changes to the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. You will understand that you can do it.

100: Artificial intelligence-based malware detection system for structured documents
110: user terminal 150: user database
130: Artificial intelligence-based malware detection device
310: Document structure detection unit 320: Document feature creation unit
330: Malicious code decision unit 340: Control unit

Claims (14)

a document structure detection unit that identifies a document format for a structured document and detects a plurality of document elements;
a document feature generator that generates document features through feature analysis of the plurality of document components; and
The document features are input into a malicious code detection model to determine the possibility of the structured document containing malicious code, and the partial malicious code for each of the meta, stream, entropy, and content constituting the document features is determined through the malicious code detection model. Artificial intelligence-based malicious code for a structured document including a malicious code determination unit that determines the possibility of containing the malicious code based on code possibility and determines the possibility of including the malicious code by calculating a weighted average value of the partial malicious code possibility. Detection device.
The method of claim 1, wherein the document structure detection unit
An artificial intelligence-based malware detection device characterized by analyzing a PDF (Portable Document Format) document and detecting a plurality of objects as the plurality of document components.
The method of claim 1, wherein the document feature generator
An artificial intelligence-based malware detection device characterized in that it generates a plurality of feature elements constituting the document feature through meta, stream, entropy, and content analysis of the plurality of document components.
The method of claim 2, wherein the document feature generator
An artificial intelligence-based malware detection device, characterized in that the sum of stream lengths and the ratio between the file size and the sum of stream lengths are calculated through meta-analysis of the plurality of document components.
The method of claim 2, wherein the document feature generator
An artificial intelligence-based malware detection device that calculates the maximum, minimum, average, and standard deviation of the stream length through stream analysis of the plurality of document components.
The method of claim 2, wherein the document feature generator
An artificial intelligence-based malware detection device characterized by calculating the maximum, minimum, average, and standard deviation of stream entropy through entropy analysis of the plurality of document components.
The method of claim 2, wherein the document feature generator
An artificial intelligence-based malware detection device characterized by calculating a set of stream tags through content analysis of the plurality of document components.
delete delete The method of claim 1, wherein the malicious code determination unit
An artificial intelligence-based malware detection device characterized by implementing the malware detection model as a random forest-type artificial intelligence model.
In the malware detection method performed by the malware detection device,
A document structure detection step of detecting a plurality of document elements by identifying a document format related to a structured document through a document structure detection unit;
A document feature generation step of generating document features through feature analysis of the plurality of document components through a document feature creation unit; and
Through the malicious code determination unit, the document features are input into a malicious code detection model to determine the possibility of the structured document containing malicious code, and meta, stream, entropy and content analysis that constitute the document features are performed through the malicious code detection model. A structured document including a malicious code determination step of determining the possibility of containing the malicious code based on the possibility of partial malicious code for each, and calculating the weighted average value of the possibility of the partial malicious code to determine the possibility of including the malicious code. Malware detection method based on artificial intelligence.
The method of claim 11, wherein the document structure detection step is
An artificial intelligence-based malware detection method comprising analyzing a PDF (Portable Document Format) document and detecting a plurality of objects as the plurality of document components.
The method of claim 11, wherein the document feature creation step is
An artificial intelligence-based malware detection method comprising generating a plurality of feature elements constituting the document feature through meta, stream, entropy, and content analysis of the plurality of document elements.
delete