Ai-based email security integrated analysis and visualization system and method

Abstract

The present invention relates to an integrated system for AI-based email translation and link graph dynamic analysis, comprising: a processor; a user profile database; a language detection unit; an AI translation engine; a security engine; an integrated interface unit; a link graph generation engine; and a sandbox agent module. The processor may include a behavior analysis module and a risk path visualization module, wherein the processor parses the body of a received email to extract all clickable elements and generates an initial link graph in which each element is a node and transition relationships between elements are edges, wherein the processor sequentially visits each node of the initial link graph in a virtual browser environment and dynamically expands the link graph by creating additional nodes for newly discovered clickable elements on the visited pages, wherein the processor monitors activities occurring during the process of visiting each node to detect threat behavior and assigns a risk indicator to the node where the detected threat behavior occurred to calculate a risk score, wherein the processor visually renders the expanded link graph and highlights nodes where the risk score exceeds a threshold value through visual attributes, and when a user selects a specific node, displays detailed information on the threat behavior detected at that node and the path from the initial email to that node, wherein the processor performs language translation and dynamic link graph analysis on the received email in parallel and determines the final risk level by cross-verifying the analysis results of the translated text and the analysis results of the link graph.

Description

Technology Field

[0001] The present invention relates to an AI-based integrated email security analysis visualization system and method, and more specifically, to a technology for a system that includes a link graph generation engine, a sandbox agent module, a behavior analysis module, a risk path visualization module, and an AI translation engine, which dynamically explores all hyperlinks within a received email, detects threat activities on a multi-stage redirection path in advance, and determines the final risk level by cross-validating the phishing pattern analysis results of the translated text with the risk node analysis results of the link graph. Background Technology

[0002] With the recent surge in phishing attacks and the distribution of malicious links via email, the importance of email security is becoming increasingly prominent. In particular, hyperlinks within emails often lead users to malicious sites through multi-stage redirection, making it difficult to detect actual threats by simply scanning the initial link. Furthermore, as users may click on links in multilingual phishing emails without fully understanding the content, potentially resulting in damages such as personal information leaks and malware infections, there is a growing demand for integrated security systems capable of detecting and blocking these threats in advance.

[0003] Existing email security systems are primarily limited to sandbox analysis of attachments or blacklist matching of single URLs, and thus have limitations in detecting complex threat paths where links within emails undergo multiple redirection stages to reach final malicious sites. In particular, existing URL inspection methods are limited to tracking only a portion of the redirection chain or verifying the final destination, making it impossible to identify threats occurring in the intermediate path, such as personal information collection, cookie theft, and conditional malware distribution, in advance. Furthermore, since translation and security analysis functions for multilingual emails are separated, there is currently a lack of a system that comprehensively evaluates linguistic social engineering patterns and actual link threats.

[0004] As prior art, U.S. registered patent US20240114053A1 describes a system that detects phishing emails by extracting HTML tag / CSS structures within an email into a Directed Acyclic Graph (DAG) and using a Graph Neural Network (GNN). The problem to be solved

[0005] Existing email security systems are designed for general malicious attachment detection or single URL scanning, failing to adequately consider complex threat paths where links within emails ultimately reach malicious sites through multi-stage redirection. In particular, there is a lack of methods to proactively detect and visually warn of threatening behaviors—such as personal information leakage, malware installation, and cookie theft—that occur through multiple steps after a user clicks a link. Furthermore, since translation and security analysis functions are not integrated for phishing emails written in multiple languages, there is a need for a feature that determines the final risk level by comprehensively evaluating risk factors in linguistic social engineering patterns and actual link graphs.

[0006] To solve these problems, the present invention provides an integrated analysis system specialized in email translation and link security, generates an initial link graph with all hyperlinks in a received email as nodes, dynamically expands newly discovered links by actually visiting each node through a sandbox agent, detects threat activities occurring on a multi-stage redirection path to visually highlight the risk path, and cross-verifies the phishing pattern analysis results of the translated text with the link graph analysis results to enable more accurate and effective email security response. means of solving the problem

[0007] An integrated AI-based email translation and link graph dynamic analysis system for solving the aforementioned problem comprises a user profile database, a language detection unit, an AI translation engine, a security engine, an integrated interface unit, a link graph generation engine, a sandbox agent module, a behavior analysis module, and a risk path visualization module. The link graph generation engine parses the HTML or text body of a received email to extract all hyperlinks, form actions, image maps, and JavaScript event listeners, and generates an initial link graph in which each link is a node and transition relationships between links are edges. The sandbox agent module operates in a virtual browser environment to sequentially visit each node of the initial link graph and dynamically expands the link graph by generating additional nodes for newly discovered clickable links on the visited pages. The behavior analysis module monitors network requests, file downloads, API calls, and form submission behaviors occurring during the process in which the sandbox agent module visits each node, detects at least one threat behavior among the transmission of personal information to an unidentified domain, the download of an executable file, and an attempt to install malware, and calculates a risk score by assigning a risk indicator to the node where the detected threat behavior occurred. The risk path visualization module [represents] the expanded link graph It is characterized by visually rendering nodes where the risk score exceeds a threshold and highlighting them through at least one visual attribute among color, size, or pattern, and when a user selects a specific node, displaying detailed information on the threat activity detected at that node and the path from the initial email to that node, and performing language translation through the AI ​​translation engine and dynamic analysis of the link graph in parallel for the received email, and determining the final risk level by cross-validating the phishing pattern analysis results of the translated text and the risk node analysis results of the link graph. Effects of the invention

[0008] The present invention provides a system comprising a link graph generation engine, a sandbox agent module, a behavior analysis module, and an AI translation engine that automatically generates a link graph with all hyperlinks within an email as nodes, and dynamically expands multi-stage redirection paths by actually visiting each node in a sandbox environment to detect threatening behaviors at an early stage. This enables the user to identify the entire threat path to the final destination and quickly determine the level of risk before clicking a link. Through this, multi-stage attack paths that could not be detected by existing single-URL inspection methods can be blocked in advance, thereby effectively preventing email-based security threats.

[0009] Furthermore, by visually rendering the extended link graph through the risk path visualization module and highlighting nodes with risk scores exceeding thresholds using color, size, or patterns, users can intuitively understand what threatening behavior occurs a few steps after clicking a link in an email. This makes complex redirection chains visually understandable, which is expected to raise user security awareness and strengthen vigilance against phishing attacks.

[0010] Furthermore, by performing AI translation engines and dynamic link graph analysis in parallel, and determining the final risk level through a function that cross-validates the results of natural language processing-based phishing pattern analysis of translated text with the risk node analysis results of the link graph, it is possible to comprehensively evaluate linguistic social engineering tactics and actual link threats regarding phishing emails written in multiple languages. Additionally, by reinforcing the detection of phishing tactical patterns specific to a given culture based on the email language identified by the language detection unit and adjusting the domain risk level of the link graph upward, it is possible to achieve more accurate and customized threat assessment.

[0011] Furthermore, by having the sandbox agent module visit each node in a virtual browser environment and monitor network requests, file downloads, API calls, and form submissions in real time, it enables the detection of new phishing sites not on the blacklist or malware that operates conditionally. By simulating various browser profiles and cookie states to detect threats that behave differently depending on the visitor's environment, the agent provides the ability to respond to sophisticated attack techniques that could not be detected by existing static analysis methods. Brief explanation of the drawing

[0012] FIG. 1 is an exemplary diagram showing the overall components and data flow of a system according to one embodiment of the present invention. FIG. 2 is an exemplary diagram illustrating a link graph generation and dynamic expansion process according to an embodiment of the present invention. FIG. 3 is a flowchart showing the operation flow of a sandbox agent according to one embodiment of the present invention. FIG. 4 is an example diagram showing an example of the implementation of a risk path visualization UI according to one embodiment of the present invention. FIG. 5 is a flowchart illustrating the cross-validation process of translation and link graph analysis according to one embodiment of the present invention. FIG. 6 is an illustrative diagram showing a detailed example of threat behavior detection according to one embodiment of the present invention. Specific details for implementing the invention

[0013] Various embodiments are described with reference to the drawings. In the present invention, various descriptions are provided to facilitate an understanding of the invention. However, it is evident that these embodiments can be practiced without such specific descriptions. The term "or" is intended to mean an implicit "or" rather than an exclusive "or." That is, unless otherwise specified or evident from the context, "X uses A or B" is intended to mean one of the natural implicit substitutions. That is, if X uses A; if X uses B; or if X uses both A and B, "X uses A or B" may apply to any of these cases. Furthermore, the term "and / or" as used in the present invention should be understood to refer to and include all possible combinations of one or more of the listed related items. Additionally, the terms "include" and / or "include" should be understood to mean that the relevant feature and / or component is present. However, the terms “comprising” and / or “comprising” should be understood as not excluding the presence or addition of one or more other features, components and / or groups thereof. Furthermore, unless otherwise specified or clearly evident from the context to indicate a singular form, the singular in the present invention and claims should generally be interpreted to mean “one or more.” Also, the term “at least one of A or B” should be interpreted to mean “in the case of including only A,” “in the case of including only B,” or “in the case of being combined with the configuration of A and B.” Where the subject is not specified, the operations of the embodiments of the present invention may be understood to be performed by the integrated interface unit or the central processor of the server.The integrated interface unit described above serves as the central control unit of the system and is responsible for key functions such as email reception, language detection, translation processing, link graph generation, sandbox agent control, threat analysis, and cross-validation, enabling various modules of the system to operate organically. However, the integrated interface unit may also receive analysis results from each specialized module and perform an integrated judgment. In this case, the language detection unit identifies the email language, the AI ​​translation engine performs translation, the link graph generation engine and the sandbox agent module are responsible for link analysis, and the cross-validation module executes a command to determine the final risk level by integrating these results; the integrated interface unit accepts this, controls various components within the system, and executes necessary responses.

[0015] FIG. 1 is an exemplary diagram showing the components of a system according to one embodiment of the present invention.

[0016] Referring to FIG. 1, the system of the present invention may be composed of a user environment and a server system. The user environment may include a user terminal and a received email, and the server system may include a user profile database, a processor, a link graph generation and sandbox analysis engine, a language detection and AI translation engine, a cross-validation module, and a risk path visualization module.

[0017] The above-mentioned user terminal is a device for a user to check emails and may include a computer, smartphone, tablet, etc. The above-mentioned received email refers to an email delivered to the user from an external source and may include not only legitimate emails but also phishing emails, spam emails, etc. When a user receives an email, the email may be delivered to a server system for analysis, either automatically or at the user's request.

[0018] The server system described above can perform all processes of analyzing received emails to determine risk levels. A processor is located at the center of the server system and can control the entire system and manage the data flow between each component. The processor receives received emails, initiates analysis, and can retrieve necessary information from the user profile database or store new information during the analysis process.

[0019] The user profile database described above can store information such as the user's language settings, email address, history of receiving phishing emails, and preferred security settings. The processor can communicate bidirectionally with the user profile database, as indicated by the dotted arrow, and can store data or query profiles. For example, for a user who primarily uses Korean, the email can be translated into Korean by checking the language settings stored in the database; after the analysis is complete, whether the email was dangerous is recorded in the database, enabling faster detection of similar emails in the future.

[0020] Two main analysis paths can originate from the aforementioned processor. The left path leads to a link graph generation and sandbox analysis engine, while the right path leads to language detection and an AI translation engine. These two paths operate simultaneously to analyze emails from different perspectives.

[0021] The aforementioned link graph generation and sandbox analysis engine can identify all links included in an email and verify their risk status by actually visiting each link. First, the link graph generation function analyzes the email body to extract all hyperlinks, buttons, forms, image maps, etc., and represents them as a graph connected by points and lines. Subsequently, the sandbox analysis function allows users to actually click and visit each link within a virtual, safe environment. If new links are discovered during the visit process, they are added to the graph, causing it to gradually expand. Simultaneously, the system can monitor whether the visited website requests personal information, attempts to automatically download files, or transmits information to suspicious locations. Through this analysis, a secondary risk score for link analysis can be calculated. For example, if clicking a link in an email appears to lead to a legitimate bank site, but pressing the login button and entering information transmits that data to an unknown server, a high risk score can be assigned by tracking all three stages of this process. The risk score is calculated by considering (i) a base weight based on the type of detected threat behavior, (ii) the graph depth of the node where the threat occurred, and (iii) whether it is repeated on the same path. For example, a base weight of 10 points may be assigned to personal information leakage, 15 points to malware installation, 12 points to social engineering-based behavior, and 3 points to excessive tracking behavior, and an additional weighting factor of 1.2 may be applied if the depth from the root node is 3 or greater. The final risk score S can be expressed by the following formula.

[0022] [Mathematical Formula 1]

[0023] S = (Σ Wi) × D × R

[0024] Wi: Default weights per detected threat activity

[0025] D: Coefficient based on graph depth (e.g., 1.0 ~ 1.3)

[0026] R: Correction factor for repetitive risky behavior within the same path (e.g., 1.0 ~ 1.2)

[0027] The aforementioned language detection and AI translation engine can automatically identify the language of the email body and translate it into a language the user can understand. The language detection function analyzes the characters, words, and grammatical structures used in the email to determine which language it was written in, among various languages ​​such as English, Korean, Chinese, and Japanese. The AI ​​translation function can naturally translate the identified language into the user's set language. The translated text can undergo a phishing pattern analysis process to check for the inclusion of expressions that create a sense of urgency, phrases demanding money, or instructions to enter personal information. Through this analysis, a text analysis risk score (Risk 1) can be calculated. For example, a phrase such as "Your account will be permanently deleted if you do not verify within 24 hours" may be judged as a typical phishing tactic that creates a sense of urgency and receive a high risk score. Phishing patterns may include the following detailed types. (i) patterns that induce urgency: expressions that apply time pressure, such as 'check immediately' or 'action required within 24 hours'; (ii) patterns of financial request: requests for remittances, requests for payment re-authorization, or requests for financial information using refunds as bait; (iii) patterns of personal information request: expressions that induce the input of passwords, account information, financial information, etc.; and (iv) patterns of institutional impersonation: expressions that induce trust by using vocabulary similar to the name of a legitimate institution or mimicking sentence structures. In this case, the presence of the above patterns can be detected through sentence-level or token-level analysis of the translated text.

[0028] The cross-validation module described above can determine the final risk level by receiving both the second risk score calculated from link analysis and the first risk score calculated from text analysis. Instead of simply summing the two scores, different judgments can be made depending on whether both scores exceed a threshold, only one exceeds it, or both fall within a safe range. If both the first and second risk scores exceed their respective thresholds, the email content and link behavior are considered suspicious, so it can be judged as a very dangerous phishing email and blocked. If only one score exceeds the threshold, it can be judged as an email requiring caution, and detailed analysis results can be displayed to the user along with a warning message. If both scores fall within a safe range, it can be judged as a normal email and delivered to the user. For example, if the first risk score is 65 points due to many expressions emphasizing urgency in the email body, and the second risk score is 90 points because it is discovered that following the link automatically downloads an executable file, the email can be finally judged as a high-risk email because both scores are high. The threshold of the risk score is set between 0 and 100 according to the system's default policy and can be calculated by statistically analyzing the score distribution of normal, caution, and risk emails based on phishing detection logs from the past year. For example, the 80th percentile of the risk score can be set as a reference value and used as the threshold for the 'risk' level, and the user can adjust this threshold upward or downward as needed.

[0029] The aforementioned risk path visualization module receives the final risk assessment results from the cross-validation module and converts them into a format that is easy for users to understand. Link graphs are displayed graphically on the screen, with dangerous links colored red, links requiring caution yellow, and safe links green. Additionally, the entire path from a link in the email body to the final risk site can be highlighted. When a user clicks a specific link, they can view detailed information, such as what dangerous activities were detected at that link and what information is being transmitted to where. Through this visualization, even users unfamiliar with technology can intuitively understand the risks associated with the email.

[0030] Once the analysis is completed on the aforementioned server system, the results can be delivered back to the user environment. If an email is determined to be dangerous, a warning message may be displayed on the user's terminal, and instructions advising against clicking links may be provided. If the email is determined to be at a cautionary level, a risk path graph may be displayed along with a warning, providing information that allows the user to make their own judgment. If the email is determined to be safe, it can be read normally without any separate warning.

[0031] The overall system operation flow can be summarized as follows. When a user receives an email, it is forwarded to the server system's processor. The processor queries the user profile database for necessary information and can simultaneously initiate two analysis tasks. On one side, a link graph generation and sandbox analysis engine extracts all links in the email, visits them to identify risky behavior, and calculates a second risk score. On the other side, a language detection and AI translation engine translates the email body and analyzes phishing patterns to calculate a first risk score. These two scores are passed to a cross-validation module to determine the final risk level. The determination result passes through a risk path visualization module, is converted into a format easy for the user to understand, and is finally displayed on the user's terminal.

[0032] Through this configuration, the system of the present invention can perform a comprehensive security scan by simultaneously analyzing email bodies and links. In particular, for phishing emails written in foreign languages, the translation function helps users accurately understand the content, and allows for the safe identification of hidden threats that appear only after clicking links multiple times, all within a sandbox environment. Furthermore, by cross-validating the two analysis results, it is possible to reduce false positives and increase accuracy.

[0034] FIG. 2 is an exemplary diagram illustrating a link graph generation and dynamic expansion process according to an embodiment of the present invention.

[0035] Referring to Figure 2, the process of creating and gradually expanding a link graph can be seen in three stages. The first stage is the process of extracting links from emails, the second stage is the process of creating an initial graph with the extracted links, and the third stage is the process of actually visiting each link in a sandbox environment to expand the graph and display the risk level.

[0036] In the first step, a suspicious phishing email with the subject line "Account verification required" may be received. The link graph generation engine described above can analyze the email body in detail to identify all clickable elements. As shown in the diagram, three links may be found in the email body. Link 1 may be a standard hyperlink, Link 2 may be a hidden link in the form of a button, and Link 3 may be a link that moves when an image is clicked. For example, in an actual phishing email, a text link saying "Click here to verify your account," a "Verify" button, and a bank logo image may each be connected to different addresses, and all three can be extracted.

[0037] In the second step, an initial graph can be generated based on the extracted links. A root node is placed at the center of the graph, which can represent the email body itself. Three arrows can extend from the root node and connect to Node 1, Node 2, and Node 3. Each node represents a link extracted in the previous step, and the arrows indicate that one can navigate to that link from the email body. At this stage, since the links have not yet been actually visited, it is impossible to know whether each node is safe or dangerous, and all nodes may be displayed in the same form. Because the initial graph contains only information directly visible in the email, it can have a relatively simple structure.

[0038] In the third stage, the sandbox agent can perform dynamic exploration by actually visiting each node in the virtual environment. During this process, the graph expands significantly, and the risk level of each node can be determined. Looking at the diagram, three nodes are positioned below the root node, and this time, the status of each node can be displayed. Node 1 is marked as "Safe" with a check mark, indicating that no particular risk factors were found when the sandbox agent visited. Node 3 can also be marked as "Safe." On the other hand, Node 2 is highlighted in gray and marked as "Caution" with a warning icon, indicating that something suspicious has been detected.

[0039] As a result of visiting Node 2, additional new links may be discovered. Two arrows may extend from Node 2 to connect to Nodes 4 and 5. This could mean that when accessing the webpage pointed to by Node 2, there were other clickable elements within that page. Node 5 may be marked as "Safe," indicating that there are no risk factors. However, Node 4 may be highlighted in gray and labeled "Form Submission" along with a circular icon. This could mean that when the sandbox agent visited Node 4, there was a form prompting the user to enter information, and that the agent actually entered dummy information and submitted it. For example, the webpage corresponding to Node 2 appeared to be a normal banking site, but clicking the "Login" button (Node 4) within it might bring up a form for entering an email and password.

[0040] After submitting the form at Node 4, another node may be detected. An arrow connects from Node 4 to Node 6, which is highlighted in a darker gray and labeled "Personal Information Leak" along with a circular icon. This may indicate that information entered at Node 4 has been detected being transmitted to an untrusted server. The behavioral analysis module analyzes network requests generated during the form submission process and can detect that the entered email address and password are being transmitted to an unknown external domain instead of a legitimate bank server. Since this is a clear attempt at personal information leakage, Node 6 may receive a very high risk score.

[0041] Synthesizing the entire process, an email that initially displayed only three links can expand into a complex graph containing six nodes through sandbox exploration. More importantly, a risk path that was unknown when the email was first received becomes clearly revealed. If a user clicks Link 2 in the email and then clicks the login button on the resulting page to enter information, it could ultimately result in their personal information being transmitted to a hacker. This risk path can be represented as "Root → Node 2 → Node 4 → Node 6," and the user can verify this entire process in advance before clicking the link.

[0042] It can be observed that the complexity of the graph increases at each stage. In the first stage, there were simply three links; in the second stage, a simple graph consisting of a root and three nodes was created; and in the third stage, an expanded graph containing a total of six nodes can be completed by adding three more nodes. This dynamic expansion is possible because the sandbox agent continuously discovers hidden links as it actually visits them.

[0043] The safety indicator method is also noteworthy. Safe nodes can be clearly marked with a check mark and the text "Safe." Nodes requiring caution can be marked with a warning icon and the text "Caution." Nodes where specific dangerous activity has been detected can be displayed with a gray background, along with specific indications of the type of risk, such as "Form Submission" or "Personal Information Leak." Through this visual distinction, users can identify which paths are dangerous at a glance.

[0044] To illustrate a real-world example, assume a user receives an email stating, "Your account has been suspended. If not verified within 24 hours, it will be permanently deleted." The email may contain a "Verify Now" button. In the first step, the system can extract the link connected to this button. In the second step, an initial graph can be created with the email body as the root and the button link as the node. In the third step, if the sandbox agent clicks the button, a login page resembling a real bank appears, and an additional "Login" button may be discovered on this page. If the agent enters a test email and password and clicks the Login button, it may be detected that the entered information is being transmitted to a suspicious domain called "phishing-collector.net." This entire process is represented as a graph, and finally, the node where personal information is leaked can be highlighted in red to provide a warning to the user.

[0045] The advantage of this dynamic scaling method is that it can detect hidden threats that cannot be found through static analysis. If the system only inspects links directly visible in an email, it may incorrectly determine that the site is safe if the first link appears to be a legitimate bank website. However, by having the sandbox agent actually visit the site and attempt to log in, it can identify that the site, while appearing normal on the surface, is actually a phishing site designed to steal information. Furthermore, it can clearly demonstrate how many clicks a user must make to reach the point of danger. In the example shown in the diagram, a total of three clicks are required (clicking Node 2 → clicking Node 4 → entering information and submitting); users can be protected by identifying this multi-stage attack path in advance.

[0047] FIG. 3 is a flowchart showing the operation flow of a sandbox agent according to one embodiment of the present invention.

[0048] Referring to Fig. 3, the entire process of the processor dynamically exploring and expanding the link graph can be observed sequentially. This process involves several stages of judgment and operations from start to end, and can be controlled so as not to repeat infinitely while checking all links without omission.

[0049] The process can start at the start phase. The start phase may refer to the point when an email is received and the initial link graph is prepared. The first task after start is to load the initial graph and add the root node to the queue. Here, the queue can refer to a waiting list of nodes to be visited. The root node represents the email body itself, and the search can begin by adding this to the queue.

[0050] When a root node is added to the queue, the processor can enter the first decision phase. In the phase determining whether the queue is empty or timed out, two conditions can be checked. First, it can be verified whether there are no more nodes remaining in the queue to visit. Second, it can be verified whether the set time limit has been exceeded. If either of these applies, the process can proceed to the termination phase. The reason for setting a time limit may be to prevent malicious websites from generating an infinite number of links and overloading the system.

[0051] If the conditions are not met, the process can proceed to the step of selecting a node from the queue. The queue can operate on a First-In, First-Out (FIFO) basis, and the node that enters first can be selected first. Initially, the root node is selected, and subsequently, the links connected to the root node can be selected in order. Once a node is selected, it is not visited immediately; instead, it can first be checked whether the node has already been visited.

[0052] In the step determining whether a node has been visited, it is checked whether the selected node has already been visited in the past. If the node has already been visited, the process can return to the queue check step. This is intended to save time and resources by preventing duplicate visits to the same node. Conversely, if it is a new node that has not yet been visited, the process can proceed to the actual visit step.

[0053] Here, the processor can determine a browser profile to simulate the actual user's connection environment before visiting a selected node. The browser profile may include one or more of the following factors: User-Agent string, operating system information, cookie or session storage state, region-based IP settings, whether browser extensions are installed, screen resolution, and language settings, and may be selected randomly or based on predefined rules. These profile settings can be utilized to detect conditional threats that behave differently depending on the visitor's environment, even for the same link.

[0054] During the virtual browser visit phase, you can actually open the website pointed to by the selected node. Since this operation is performed in a secure virtual environment, the actual computer may not be affected even if malicious code is present. The virtual browser can display web pages and execute JavaScript just like a browser used by a regular user.

[0055] When a webpage is opened, the behavior monitoring phase can begin. In this phase, all activities performed by the webpage can be monitored. As shown in the diagram, key activities such as network requests, file downloads, and API calls can be tracked. Network request monitoring allows verification of the webpage communicating with other servers. File monitoring can detect attempts to save files to the user's computer. API call monitoring can track attempts by the webpage to use specific browser functions.

[0056] Once behavior monitoring is complete, the process can proceed to the stage of determining whether threats have been detected. The information collected in the previous stage is analyzed to determine if any dangerous activities have occurred. If personal information is transmitted to a suspicious location, a malicious file is downloaded, or other threatening behavior is detected, the process moves to the threat indicator assignment stage to identify the type of threat found on the corresponding node and calculate a risk score. If no threats are detected, the process can proceed directly to the new link extraction stage.

[0057] In the new link extraction step, you can look for other clickable elements on the visited webpage. All types of links can be extracted, including hyperlinks, buttons, forms, and image links. The extracted links have not yet been added to the graph and may await further evaluation.

[0058] In the step for determining the existence of new links, it is possible to verify whether new links were actually discovered in the previous step. If at least one new link is found, the process can proceed to the node and edge addition step. In this step, each discovered link is created as a new node, and edges connecting the currently visited node to the new node can be added to the graph. Additionally, newly created nodes can be added to a queue to reserve them for later visit. If no new links are found, the process can proceed directly to the next decision.

[0059] In the step determining whether the maximum depth has been reached, it can be checked whether the current node is too far from the email body. Depth refers to the number of steps taken to reach it from the root node. The processor can set a predetermined maximum depth, which is generally limited to an appropriate number of steps. Regardless of whether the maximum depth has been reached, the process can return to the initial queue check step after this determination. By creating this cyclical structure, the task of visiting and analyzing nodes can be repeated as long as nodes remain in the queue.

[0060] The overall flow can be explained using a real-world example as follows. First, a suspected phishing email may be received. The processor can add the email body to a queue and start the process. Since the queue is not empty, the root node can be selected. As this is the first time the root node is visited, the email body can be analyzed to extract the link to the confirmation button. This link can be added to the graph and placed in the queue. Checking the queue again reveals that the corresponding node exists, so it can be selected. Since it has not been visited yet, the address can be accessed using a virtual browser. Upon visiting, a login page may appear. Since no specific threat was detected during behavioral monitoring, a threat indicator may not be assigned. However, a login button and other links may be found on the page. These can be added to the graph and placed in the queue.

[0061] There may now be new nodes in the queue. You can select and visit the login node. The virtual browser allows you to click the login button and enter test information into the form that appears. Behavioral monitoring may reveal that the entered information is being transmitted to a suspicious server. Since this is a clear attempt to leak personal information, a threat indicator can be assigned to the node and a risk score recorded. As no new links were found on this page, you can return to checking the queue. Other nodes can be visited and analyzed in a similar manner. Once all nodes have been visited and the queue is empty, the processor moves to the termination phase and can return the final graph.

[0062] The core of this flowchart lies in the combination of iteration and judgment. It repeats continuously as long as there are nodes in the queue, while making appropriate judgments at each stage to skip unnecessary tasks or record critical information. Through design features such as avoiding revisiting visited nodes, imposing time and depth limits, and immediately recording threats upon detection, efficient and comprehensive analysis becomes possible. Furthermore, this process is automated and can be executed without human intervention. When a user receives an email, the system can automatically execute this entire process and provide results. Users can determine the safety of an email based on the system's verification results, without having to manually click on dangerous links.

[0064] FIG. 4 is an example diagram showing an example of the implementation of a risk path visualization UI according to one embodiment of the present invention.

[0065] Referring to FIG. 4, the user interface provided by the risk path visualization module includes a graph display area, a detailed information display area, and a control function area. The graph display area is positioned on the left side of the screen to visually render a link graph, and the detailed information display area is positioned on the right side of the screen to display detailed information of a selected node. The control function area is located at the top of the screen and can be configured to allow the user to filter nodes to be displayed or adjust analysis options.

[0066] The control function area described above includes a risk filter slider and a threat category selection menu. The risk filter slider adjusts the graph to display only nodes with a risk score above a threshold set by the user. When the slider value is set to 70, nodes with a risk score below 70 are dimmed or hidden, clearly highlighting only high-risk nodes. The threat category selection menu can provide a function to filter and display only threats of a specific category of interest to the user among personal information leakage, malware installation, tracking, and social engineering scams.

[0067] The graph display area described above visually represents all links within an email and their relationships. A root node representing the initial email is located at the center of the graph, and multiple nodes are arranged radially or hierarchically from the root node. Each node is displayed as a circle and has different colors and sizes depending on its risk score. Safe nodes with low risk scores are displayed small in light gray or green hues, nodes requiring a moderate level of caution are displayed medium-sized in yellow hues, and high-risk nodes with high risk scores may be displayed large in red hues.

[0068] Connections between nodes are represented by lines and are visually distinguished according to the type of connection. General hyperlinks are displayed as solid lines, and automatically moving redirects are displayed as dotted lines. The thickness of the lines can be adjusted in proportion to the importance or frequency of occurrence of the corresponding transition path.

[0069] A legend is displayed on one side of the graph display area to help the user understand the meaning of the colors and lines. The legend provides information that light colors indicating a safe level represent a risk score of 0 to 30, medium colors indicating a caution level represent a risk score of 31 to 70, and dark colors indicating a dangerous level represent a risk score of 71 to 100. Additionally, it may include an explanation that solid lines represent regular links and dotted lines represent automatic redirects.

[0070] When a user selects a specific node, the entire path from the initial email node to the selected node is highlighted in bolder than other lines. The entire click path, starting from the email and passing through several intermediate nodes to the final selected node, is visually distinguished, allowing the user to intuitively understand the order in which to follow the links to reach the risk.

[0071] The detailed information display area described above is configured as a scrollable panel and provides multi-layered information regarding the selected node. A path display section is located at the top of the panel, specifying the path from the initial email to the currently selected node in text form. The path is represented as a series of node identifiers connected by arrows, clearly showing how many clicks the user needs to take to reach the corresponding node.

[0072] A node information section is placed at the bottom of the path display section. This node information section lists basic attributes of the selected node, such as the full URL address, node type, access method, depth from the email, and risk score. The URL address is displayed in the form of a normalized absolute path, and the node type specifies the appropriate type among hyperlink, form submission, download link, image map, and redirect. The access method indicates the HTTP method used to access the node, such as GET, POST, or JavaScript, and the depth is a number indicating how many steps away it is from the initial email. The risk score is expressed on a scale from 0 to 100 to quantify the risk level of the node.

[0073] Located below the Node Information section is the Detected Threat Behaviors section. This section displays a list of specific threat behaviors detected by the sandbox agent during its visit to the node. Each threat item is described along with a category code, and specific actions such as attempts to automatically download executable files, transmission of personal information to unidentified domains, attempts to access the file system, clipboard access, and permission requests are recorded. If multiple threats are detected, all threats are listed, allowing the user to understand the full scope of risks occurring at the node.

[0074] A network request log section is located at the bottom of the threat behavior section. This section records all network communications that occurred when the sandbox agent visited a node in chronological order. Each network request includes the HTTP method, destination URL, request headers, request body content, response status code, response headers, and the size and type of the response body. The logs are displayed in bright text on a dark background to enhance the readability of technical information and provide the information necessary for security experts or technically savvy users to perform detailed analysis.

[0075] The Page Screenshot section is located below the Network Log section. This section displays screen capture images of the webpage rendered by the sandbox agent upon visiting the node. These images are displayed within a bordered area, allowing users to visually verify how the page actually looks. If a phishing site impersonates a legitimate service, users can use the screenshots to compare the appearance of the fake page with that of the genuine page. If the agent fails to visit the page or is unable to capture a screenshot, an alternative message may be displayed.

[0076] A recommended action section is placed at the very bottom of the detailed information display area. This recommended action section clearly presents the actions the user should take based on the risk level of the selected node. If a high-risk node is selected, a strong warning message, such as "Do not click this link" or "Delete the email immediately," is displayed with a highlighted background color and bold text. At the bottom of the warning message, the specific details of the risk may be explained in language that is easy for the user to understand. If a malicious executable file is automatically downloaded, an explanation such as "This link attempts to install a malicious program on your computer" may be provided; if personal information is leaked, an explanation such as "This page transmits the information you entered to hackers" may be provided.

[0077] If a moderate level of risk is detected, the recommended actions section displays a cautionary warning and provides information such as "This link contains multiple ad trackers" or "This page may request excessive permissions." For nodes deemed safe, a safety indicator on a green background may appear along with the message "No threats were detected on this link."

[0078] The graph display area and the detailed information display area can operate in synchronization. When a user clicks a node in the graph, the contents of the detailed information display area are immediately updated to display information about that node, and at the same time, the path to the selected node on the graph is highlighted. When a user clicks a link to move to another node in the detailed information panel, the selection state of the graph is also changed so that the two areas always maintain consistent information.

[0079] In a real-world usage scenario, when a user receives a suspicious email, the system automatically performs a link graph analysis and displays a risk path visualization UI. Users can grasp the overall risk distribution at a glance through the graph on the left side of the screen and immediately recognize the presence of high-risk nodes marked in red. Clicking on a node of interest displays detailed information on the right panel, allowing users to clearly identify the specific threats and how many times they must click on specific links within the email to reach that risk.

[0080] General users with limited technical knowledge can assess the risk of an email and take appropriate action based solely on color coding and recommended action messages. In contrast, security experts or technically proficient users perform in-depth analysis by utilizing detailed information such as network request logs, URL data, and page screenshots. As such, the aforementioned risk path visualization UI can provide a hierarchical information structure that satisfies the needs of users at various levels.

[0082] FIG. 5 is a flowchart illustrating the cross-validation process of translation and link graph analysis according to one embodiment of the present invention.

[0083] Referring to Figure 5, one can see the overall flow of email analysis and how the two analysis methods cooperate to reach a final decision. The flowchart illustrates the entire process step-by-step, from receiving an email to displaying results to the user, and clearly shows the structure in which text analysis and link analysis proceed simultaneously and are later integrated.

[0084] The above process begins at the email reception stage. When a new email arrives at the user's email account, the system can automatically detect it and initiate the analysis process.

[0085] Upon receipt of an email, a first filtering step is performed by the security engine. In this first filtering step, emails that are clearly determined to be malicious can be filtered out in advance. The security engine checks whether the sender's address is included in a list of known malicious senders, whether the subject or body contains obvious malicious keywords, and whether the file extension of the attachment corresponds to a dangerous type. If the sender's domain uses typosquatting techniques or the body contains suspicious patterns, the email may pass the first filtering and be classified as requiring further detailed analysis.

[0086] Parallel processing begins for emails that have passed the above first filtering. The process can be branched into two independent paths and proceed simultaneously. Path A analyzes the text content of the email body, and Path B analyzes the links included in the email. By having the two paths operate in parallel, a comprehensive inspection can be performed while reducing the overall analysis time.

[0087] Path A begins with a language detection step. The language detection unit can automatically identify the language used in the email body. By analyzing character types, word patterns, grammatical structures, character encoding, etc., it can determine the language used in the email among multiple languages.

[0088] Once the language is identified, the process proceeds to the stage where the AI ​​translation engine translates into the user-set language. If the primary language set by the user differs from the language used to compose the email, the AI ​​translation engine can translate the email body into the user's language. The AI ​​translation engine performs natural translation that considers context, rather than simple word matching.

[0089] Once translation is complete, the process moves to the NLP text analysis stage. In this stage, the translated text is analyzed using natural language processing technology to detect major phishing patterns. Patterns that create a sense of urgency are identified through expressions that exert time pressure, patterns requesting money are identified through expressions related to financial transactions or payments, and patterns requesting personal information are identified through expressions demanding the provision of sensitive information. The text analysis module can comprehensively evaluate the presence and combination patterns of these patterns.

[0090] Once the above text analysis is completed, the process proceeds to the first risk score calculation step. A predefined weight is assigned to each discovered pattern, and the first risk score can be calculated by summing these weights. The weights are set differentially according to the risk level of each pattern, and scores can be accumulated if multiple patterns are discovered simultaneously.

[0091] Path B begins with a link graph generation step. The link graph generation engine can generate a graph composed of nodes and edges by extracting all clickable elements from the email body. Hyperlinks, buttons, form actions, image maps, etc., are all represented as nodes, and the transition relationships between them can be represented as edges.

[0092] Once the initial graph is generated, the process proceeds to a stage where the sandbox agent performs dynamic exploration. The sandbox agent actually visits each link in a virtual browser environment and can expand the graph by creating additional nodes for newly discovered links on the visited pages. During this process, hidden threat paths reachable only through multi-step clicks may also be discovered.

[0093] Simultaneously with the sandbox exploration described above, a step is performed in which a behavior analysis module detects dangerous behavior. The behavior analysis module can monitor in real time activities such as network requests, file downloads, API calls, and form submissions that occur during the process of visiting each node. Behaviors such as the transmission of personal information to unverified domains, the automatic downloading of executable files, the loading of an excessive number of trackers, and the display of pages impersonating public institutions may be detected.

[0094] Once the above behavioral analysis is completed, the process proceeds to the step of calculating a second risk score. The score of the node with the highest risk score among all nodes in the link graph can be set as the second risk score. This represents the maximum risk level that can be reached when following the link in the email.

[0095] The first risk score calculated from Path A and the second risk score calculated from Path B are both transmitted to the cross-validation module. The cross-validation module can perform the role of making a final judgment by comprehensively evaluating the two scores. Rather than simply summing the two scores, the cross-validation module independently evaluates whether each score exceeds a preset threshold.

[0096] After cross-validation, the process enters a step to determine whether both scores exceed their respective thresholds. This determination step can be branched into three cases.

[0097] If both the first risk score and the second risk score exceed their respective thresholds, the process moves to the email blocking step along the high-risk determination path. The system determines the email to be a high-risk phishing attempt and can automatically block it to prevent user access or move it to a quarantine folder.

[0098] If only one of the two scores exceeds the threshold, the process proceeds to a step of displaying a warning message and a risk path graph along the warning determination path. Although the system does not completely block the email, it may display a warning message indicating that caution is required to the user and provide a risk path visualization graph. Based on this information, the user can decide whether to open the email.

[0099] If both scores are below their respective thresholds, the process proceeds to the step of normally delivering the email along the normal determination path. The system determines that the email is safe and can display it normally in the user's inbox without any special warning.

[0100] The three paths mentioned above all converge in the user UI display stage. In the UI display stage, a screen corresponding to each judgment result can be provided to the user. For emails judged as high-risk, a blocking notification is displayed; for emails judged as warning, a risk path graph is displayed along with a caution message; and for emails judged as normal, they can be displayed without restrictions.

[0101] After the user UI is displayed, the process reaches the termination phase. Once the analysis of one email is complete, the system can wait for the next email or prepare to process other requests.

[0102] The aforementioned cross-validation process can improve detection accuracy by combining two independent methods: text-based analysis and link-based analysis. If only text analysis is performed, emails with normal body text but malicious links may fail to detect; conversely, if only link analysis is performed, emails with safe links but body text containing psychological manipulation may be missed. By parallelizing these two analyses and cross-validating the results, a comprehensive email security system capable of responding to various forms of phishing attacks can be implemented.

[0104] FIG. 6 is an illustrative diagram showing a detailed example of threat behavior detection according to one embodiment of the present invention.

[0105] Referring to Fig. 6, four major threat categories that the behavior analysis module can detect and specific threat behaviors belonging to each category can be identified. Each category is assigned differential weights according to its risk level, and a method for the sandbox agent to detect them is presented.

[0106] Category A includes threats of personal information leakage and may be assigned a weight of 10 points. This category encompasses all attempts to transmit a user's sensitive information to an unintended recipient. The first type of threat is when personal information is transmitted to an unidentified domain upon form submission. The sandbox agent can track the destination of the data transmission by analyzing network requests after entering and submitting test data into the form. If personal information is included in the body of a POST request and the target server is not on the list of trusted domains, this may be classified as an attempt to leak personal information.

[0107] The second type of threat is an attempt to access the clipboard. The aforementioned sandbox agent can detect clipboard API calls by monitoring the JavaScript code of the webpage. If it is discovered that a clipboard read command is executed and the read content is transmitted to an external server, this can be recorded as suspicious activity.

[0108] Category B includes threats of malware installation and may be assigned a weight of 15 points. This category encompasses all attempts to install harmful programs on a user's system. The first type of threat is the automatic download of executable files. The sandbox agent can track whether new files are created in the download folder through file system monitoring. If the file extension is in an executable format and the user has not explicitly requested the download, this may be determined as an attempt to install malware.

[0109] The second type of threat is a request to install browser extensions. The aforementioned sandbox agent can detect when an extension installation dialog is displayed in the browser. The third type of threat is an attempt to access the file system. If an attempt by JavaScript code to access the user's system's file system is detected, this can be classified as malicious activity.

[0110] Category C includes advertising and tracking threats and may be assigned a weight of 3 points. The aforementioned category encompasses acts of excessively tracking users' personal information. The first type of threat is excessive third-party tracker calls. The sandbox agent records all network requests occurring during page loading and can count the number of different external domains. If a connection to an external tracking service exceeds a preset threshold, this may be determined as excessive tracking.

[0111] The second type of threat is the ad redirect chain. If a link click involves multiple intermediate steps before reaching the final destination, the sandbox agent can calculate the number of redirects. If the number of redirect steps exceeds a preset threshold, it can be classified as a suspicious ad chain.

[0112] Category D includes social engineering deception threats and may be assigned a weight of 12 points. This category encompasses all techniques that psychologically manipulate users to induce dangerous behavior. The first type of threat is a combination of inciting urgency and demanding money. The system can analyze translated text to detect patterns in which expressions applying time pressure and expressions demanding financial transactions appear simultaneously.

[0113] The second type of threat is impersonation of public or financial institutions. The system can calculate the similarity between the node's domain and the legitimate institution's domain using a string similarity measurement algorithm. If the Levenstein distance between the two domains is very close, falling below a preset threshold, it can be determined as an intentional typosquatting attempt. Additionally, based on the email language identified by the language detection unit, a list of domains belonging to major public and financial institutions in the corresponding region can be loaded to perform comparative verification.

[0114] The weights for each category are set differentially based on the severity of the threat. Category B receives the highest weight because the installation of malware can cause direct and fatal damage to the system; Category A receives a high weight due to the high possibility of secondary damage resulting from the leakage of personal information; Category D receives a medium weight because it can lead to other risks through psychological manipulation; and Category C receives a low weight because the direct damage is relatively small.

[0115] Through the aforementioned threat behavior classification system, the system can identify specific threat types and attack methods beyond simple binary judgments. When a user selects a specific node in the risk path visualization interface, they can view the threat categories and detailed behavioral history detected at that node, thereby enabling a clear understanding of the nature of the risk. Furthermore, this detailed classification information can be utilized by system administrators to analyze the frequency of occurrence by attack type and formulate appropriate response strategies.

[0117] The embodiments of the present invention are presented merely for illustrative purposes, and the entire scope of the present invention is not limited to specific embodiments. Various modifications and variations are possible based on the embodiments described above, and such variations also fall within the technical spirit and scope of the present invention. Accordingly, the present invention can be implemented in various ways within the scope described in the claims and is not limited to the embodiments presented in this specification, but allows for various applications.

Claims

Claim 1 In an AI-based integrated email security analysis and visualization system, the system comprises: a user terminal; a processor; a user profile database; a link graph generation and sandbox analysis engine; a language detection and AI translation engine; a cross-validation module; and a risk path visualization module; wherein the processor controls the entire system, manages data flow, receives and analyzes received emails, receives information necessary for the analysis process from the user profile database, and analyzes the received emails through a parallel analysis path of link analysis and text analysis; wherein the language detection and AI translation engine automatically identifies and translates the language of the email body during text analysis, determines the language used by analyzing characters, words, and grammatical structures used in the email, translates the identified language into the user's set language, and calculates a first risk score by analyzing phishing patterns; and wherein the link graph generation and sandbox analysis engine receives a signal from the processor during link analysis, parses the body of the received email to extract all clickable elements, generates an initial link graph in which each element is a node and transition relationships between elements are displayed, sequentially visits each node of the initial link graph, generates additional nodes for newly discovered clickable elements on the visited pages, expands and analyzes the link graph, and calculates a second risk score. An AI-based email security integrated analysis visualization system comprising: a cross-validation module that receives the calculated first and second risk scores and makes a final risk determination by making different judgments based on whether all, only one, or all of the predetermined thresholds are exceeded; and a risk path visualization module that receives the final risk determination result from the cross-validation module, displays it in different colors according to the risk level, highlights the entire path to the risk site, and visually converts the content of the risky behavior and the information transmission path upon link clicking to provide them to a user terminal. Claim 2 A method for visualizing an AI-based integrated analysis of email security is performed by a system comprising a user terminal, a processor, a user profile database, a link graph generation and sandbox analysis engine, a language detection and AI translation engine, a cross-validation module, and a risk path visualization module, wherein: (a) the processor receives a received email, receives necessary information from the user profile database, and controls the analysis of the received email through a parallel analysis path of link analysis and text analysis; (b) the language detection and AI translation engine automatically identifies and translates the language of the email body during text analysis, determines the language used by analyzing the characters, words, and grammatical structures used in the email, translates the identified language into the user's set language, and calculates a first risk score by analyzing phishing patterns; (c) the link graph generation and sandbox analysis engine receives a signal from the processor during link analysis, parses the body of the received email to extract all clickable elements, and generates an initial link graph in which each element is a node and transition relationships between elements are displayed; (d) the link graph generation and sandbox analysis engine sequentially visits each node of the initial link graph and adds newly discovered clickable elements on the visited page as additional nodes A step of generating, expanding, and analyzing a link graph to calculate a second risk score; (e) a step in which the cross-validation module receives the calculated first and second risk scores and makes a different judgment based on whether all, only one, or none of the predetermined thresholds are exceeded to determine the final risk level; and (f) a step in which the risk path visualization module receives the final risk level determination result from the cross-validation module, displays it in a different color according to the risk level, highlights the entire path to the risk site, and visually converts the content of the risky behavior and the information transmission path upon link clicking to provide it to the user terminal.AI-based email security integrated analysis visualization method including

Images