Image Source File Security Detection Methods and Systems

Abstract

This invention discloses a method and system for security detection of image source files, comprising: S1: receiving uploaded images and performing basic parameter detection; S2: preprocessing the images that have passed the basic parameter detection, extracting image features, and using a multi-attention mechanism to focus on potential abnormal regions, and outputting an image risk score; S3: using a fully convolutional network to detect text regions in the images that have passed the basic parameter detection to identify potential illegal content, and outputting a text risk score; S4: converting the binary code of the images that have passed the basic parameter detection into grayscale images according to predetermined rules, determining whether malicious code features exist, and outputting code similarity; S5: combining the outputs of S2, S3, and S4, making a final decision through a weighted scoring algorithm, and blocking the upload of images determined to be risky and generating a security alert. This invention can comprehensively, accurately, and efficiently detect malicious code and abnormal text in image source files.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for security detection of image source files. Background Technology

[0002] With the rapid development of internet technology, image upload functionality has become a standard service for various websites and applications. However, malicious attackers frequently exploit this feature for security attacks, embedding malicious code into image files to bypass traditional security detection mechanisms and carry out malicious activities. For example, they may tamper with the binary source file of an image to inject redirect links, malicious code, or inappropriate or illegal content such as pornography, gambling, or drugs. These techniques and their inherent limitations mainly include the following: Single detection dimension: Most systems rely solely on file extension detection or simple magic number detection (such as file header features) to verify file type. Attackers can easily bypass this detection by modifying file header information, so they cannot effectively identify disguised malicious code.

[0003] Low detection rate of unknown threats: Traditional signature-based detection methods cannot effectively deal with zero-day attacks and unknown malware variants.

[0004] Limited processing power: Existing methods are insufficient for deep feature extraction of image content and lack multimodal joint analysis capabilities, making it difficult to detect malicious code hidden in image pixels.

[0005] Insufficient text detection accuracy: Traditional OCR technology has a low recognition accuracy for illegal text embedded in images in natural scenes of varying quality, with complex backgrounds or diverse fonts.

[0006] Some existing technologies attempt to detect malicious code by converting it into an image and using an image classification model. While this method improves the ability to detect unknown threats, it does not consider multimodal fusion analysis of text and code, and its effectiveness in detecting malicious code embedded in the content of the image source file itself is limited. Summary of the Invention

[0007] The technical objective of this invention is to address the above-mentioned shortcomings by providing a method and system for security detection of image source files. This method and system solve the problems of existing solutions, such as limited image security detection dimensions, low detection rate of unknown threats, and lack of multimodal analysis capabilities. It can comprehensively, accurately, and efficiently detect malicious code and abnormal text in image source files.

[0008] In a first aspect, the present invention provides a method for security detection of image source files, comprising: S1: Receive the uploaded image and perform basic parameter detection. If any abnormality is detected, mark the image as a security risk image and stop uploading. If no abnormality is detected, the image passes the basic parameter detection. S2: The images detected by the basic parameters are preprocessed, and then the image features extracted by the pre-trained deep learning model are used. A multi-attention mechanism is used to focus on potential abnormal regions and output an image risk score. S3: Use a fully convolutional network to detect text regions in the image detected by the basic parameters, and extract the text content using OCR technology. The text content is analyzed by a natural language processing model to identify potential illegal content and output a text risk score. S4: Using code-image conversion technology, the binary code of the image detected by basic parameters is converted into a grayscale image according to a predetermined rule. Then, an image classification model is used to analyze the grayscale image to determine whether there are malicious code features and output the code similarity. S5: Based on the output results of S2, S3 and S4, a final decision is made through a weighted scoring algorithm. For images determined to be safe, selective post-processing is performed to destroy any missed malicious code. For images determined to be risky, uploading is blocked and a security alert is generated.

[0009] One possible approach is that, in S1, basic parameter detection includes: filename path detection, file extension verification, file magic number detection, and 00 truncation detection.

[0010] One optional approach is that, in step S2, the image detected by the basic parameters is preprocessed, and then the image features extracted by the pre-trained deep learning model are used, and a multi-attention mechanism is used to focus on potential abnormal regions. This includes: converting the image to RGB space, performing Gaussian filtering and histogram equalization enhancement processing, then using a multi-attention convolutional neural network to extract the image features of the processed image and generate a feature map, detecting regions with abnormal pixel distributions in the feature map and marking them as suspicious regions.

[0011] One possible approach is to convert the image detected by the basic parameters into a grayscale image and calculate its hash value before step S2. The hash value is then matched against a blacklist. If the match is successful, the image is marked as a suspicious image and the upload is stopped. If the match is unsuccessful, step S2 is performed.

[0012] One optional approach is that, in step S3, the text content is analyzed using a natural language processing model to identify potential illegal content, including: using an NLP model to perform keyword matching, semantic understanding, and sentiment analysis on the text content to identify potential illegal content.

[0013] One optional approach is to use code-image conversion technology in step S4 to convert the binary code of the image detected by basic parameters into a grayscale image according to predetermined rules. Then, an image classification model is used to analyze the grayscale image to determine if malicious code features exist. This includes: converting the image into binary source content, verifying and comparing for the presence of risky keywords; if no risky keywords are found, segmenting the binary code of the image into 4-byte segments, mapping each segment to a pixel, generating a 32×32 grayscale image; analyzing the grayscale image using a pre-trained ResNet-50 model, and outputting code similarity scores. Higher code similarity scores indicate more malicious code features. If risky keywords are found, the image is marked as high-risk and the corresponding code risk score is output.

[0014] One optional approach is to use code-image conversion technology in step S4 to convert the binary code of the image detected by basic parameters into a grayscale image according to a predetermined rule. Then, an image classification model is used to analyze the grayscale image to determine whether there are malicious code features. At the same time, the binary stream of the image is compared with the signature in the malicious code library. If the similarity reaches a threshold, an alarm is triggered and the image upload is stopped.

[0015] One optional approach is that, in step S5, the output results of steps S2, S3, and S4 are combined to make a final decision using a weighted scoring algorithm, including: the total risk value is the sum of the product of the image risk score and its weight, the product of the text risk score and its weight, and the product of the code similarity / code risk score and its weight; if the total risk value is higher than the total risk threshold, then the image is determined to be a risky image.

[0016] One possible approach is that, in S5, the post-processing methods include at least compression, cropping, and secondary rendering.

[0017] Secondly, the present invention provides an image source file security detection system, comprising: Image receiving and preliminary verification module: used to receive uploaded images and perform basic parameter detection. If any abnormality is detected, the image is marked as a security risk image and the upload is stopped. If no abnormality is detected, the image passes the basic parameter detection. Image preprocessing and detection module: used to preprocess the images detected by the basic parameters, then use the image features extracted by the pre-trained deep learning model, and use a multi-attention mechanism to focus on potential abnormal regions, and output an image risk score; Text detection and recognition module: used to detect text regions in the image detected by the basic parameters using a fully convolutional network, and extract the text content using OCR technology. The text content is analyzed by a natural language processing model to identify potential illegal content and output a text risk score. Malicious code detection module: It is used to convert the binary code of the image detected by basic parameters into a grayscale image according to a predetermined rule using code-image conversion technology, and then use an image classification model to analyze the grayscale image to determine whether there are malicious code features and output the code similarity. Multimodal decision and post-processing module: It integrates the output results of the image preprocessing and detection module, text detection and recognition module and malicious code detection module, and makes a final decision through a weighted scoring algorithm. For images that are determined to be safe, selective post-processing is performed to destroy any missed malicious code. For images that are determined to be risky, uploading is blocked and a security alert is generated.

[0018] The image source file security detection method and system of the present invention have the following advantages: Comprehensive security enhancement: Through a multi-layered detection mechanism, it effectively defends against various attack methods based on image uploads, including parsing vulnerabilities, 00 truncation, hidden code, and illegal text, significantly reducing the risk of malicious attacks on the backend system; High-precision detection: Combining deep learning and multi-attention mechanisms, the accuracy of malicious code detection is significantly improved, and the false positive rate is greatly reduced; High-efficiency processing capability: Supporting real-time or near-real-time detection, the average processing time for a single image is less than 500 milliseconds, meeting the business needs of high-concurrency scenarios; Strong adaptability: Capable of processing images of various qualities (from high-quality document images to natural scene images), suitable for scenarios with complex backgrounds and diverse fonts; Self-learning capability: By continuously collecting feedback data, the system can automatically update the model and adjust weight parameters, possessing the ability to evolve against new types of attacks. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] The invention will be further described below with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart of an image source file security detection method according to Embodiment 1 of the present invention; Figure 2 This is a logical structure block diagram of the image source file security detection system according to Embodiment 2 of the present invention; Detailed Implementation

[0022] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0023] It should be understood that in the description of the embodiments of the present invention, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance, nor as indicating or implying order. In the embodiments of the present invention, "multiple" refers to two or more.

[0024] In this embodiment of the invention, "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, B existing alone, or both A and B existing simultaneously. Furthermore, in this document, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0025] Definitions: 00 truncation detection: This is a classic defense against file upload vulnerabilities, mainly used to prevent attackers from bypassing file type checks by using null characters (\0, i.e., characters with ASCII code 0).

[0026] OCR (Optical Character Recognition) engine: uses image processing, pattern recognition and other technologies to convert text in images such as pictures and scanned documents into editable and searchable text data. Example

[0027] like Figure 1 As shown, the image source file security detection method provided in this embodiment employs multi-level and multi-modal detection. By combining file structure analysis, deep learning image classification, natural language processing, and multi-attention mechanisms, it achieves comprehensive detection of malicious code and abnormal text in image files.

[0028] In today's rapidly developing internet era, the ability to upload image files such as pictures and avatars has become a standard feature of various websites and information service programs. However, there are risks of image binary text content being tampered with and malicious content being injected, low efficiency in detecting malicious links and illegal content hidden in images, and easy leakage of privacy during image upload and storage. The image source file security detection method in this embodiment can solve the above problems.

[0029] The image source file security detection method in this embodiment includes the following steps: S1: Receive the uploaded image and perform basic parameter checks. If any abnormality is detected, the image is marked as a security risk and the upload is stopped. If no abnormality is detected, the image passes the basic parameter check.

[0030] Basic parameter detection includes: filename path detection, file extension verification, file magic number detection, and 00 truncation detection.

[0031] The first step involves receiving and initially verifying the file. Multiple image formats are supported. After receiving the uploaded image file, the system first performs structural parsing and validity verification, including filename path detection (checking for illegal characters such as \, / , :, ?, *, etc.), file extension verification (ensuring it's a valid image format like jpg, png, gif, etc.), file magic number detection (comparing the file header signature to the claimed format), 00 truncation detection, metadata analysis, and binary structure checks. If any anomaly is detected, it's immediately marked as a security risk, and uploading the image is stopped. If all checks are normal, proceed to the next step.

[0032] S2: The images detected by the basic parameters are preprocessed, and then the image features extracted by the pre-trained deep learning model are used to focus on potential abnormal regions using a multi-attention mechanism, and the image risk score is output.

[0033] This step involves image detection. Images that pass initial verification proceed to the image preprocessing stage, including image filtering, enhancement, and normalization. Subsequently, pre-trained deep learning models (such as ResNet and VGG) are used to extract image features, and a multi-attention mechanism is employed to focus on potential anomalous regions. Furthermore, the images are converted to grayscale and their hash values ​​are calculated for rapid matching to blacklists.

[0034] Specifically, before S2, images detected by basic parameters are converted to grayscale and their hash values ​​are calculated. These hash values ​​are then matched against a blacklist. If a match is found, the image is marked as suspicious and uploading is stopped. If no match is found, S2 is performed. The advantage is that it can quickly and accurately intercept images by comparing hash values ​​to the blacklist before complex calculations such as image feature extraction and risk scoring, significantly reducing the processing load on subsequent deep learning models and improving overall detection efficiency.

[0035] In S2, the image detected by basic parameters is converted to RGB space and enhanced with Gaussian filtering and histogram equalization. Then, a multi-attention convolutional neural network is used to extract image features from the processed image and generate a feature map. Regions with abnormal pixel distributions in the feature map are detected and marked as suspicious areas. Converting the image to RGB space preserves the original image's color information, providing a rich data foundation for subsequent feature extraction. Gaussian filtering effectively removes Gaussian noise from the image, reducing the impact of noise interference on the accuracy of feature extraction. Histogram equalization enhances image contrast, making potential abnormal region features more prominent, facilitating accurate capture by the subsequent model. When extracting image features, the multi-attention convolutional neural network adaptively focuses on key information in different channels and spatial locations within the image. The generated feature map visually reflects the feature distribution of each region in the image. Detecting and marking regions with abnormal pixel distributions in the feature map as suspicious areas enables precise localization of potential risk regions in the image.

[0036] The blacklist consists of a pre-collected set of known malicious image hashes.

[0037] S3: Use a fully convolutional network to detect text regions in the image detected by basic parameters, and extract the text content using OCR technology. The text content is then analyzed using a natural language processing model to identify potential illegal content and output a text risk score.

[0038] This step involves text detection and recognition in the image. A fully convolutional network (FCN) is used to detect text regions in the image, and OCR technology is used to extract the text content. The extracted text is then analyzed by a natural language processing (NLP) model, including keyword matching, semantic understanding, and sentiment analysis, to identify potential violations (such as inappropriate information, sensitive topics, etc.).

[0039] S4: Using code-image conversion technology, the binary code of the image detected by basic parameters is converted into a grayscale image according to a predetermined rule. Then, the grayscale image is analyzed using an image classification model to determine whether there are malicious code features and output the code similarity.

[0040] This step involves malicious code detection. The image is converted into binary source content, and the presence of risky keywords is verified and compared. If no risky keywords are found, the binary code of the image is segmented into 4-byte segments, each segment mapped to a pixel, generating a 32×32 grayscale image. A pre-trained ResNet-50 model is used to analyze the grayscale image, outputting code similarity scores. Higher code similarity scores indicate more malicious code features. If risky keywords are found, the image is marked as high-risk, and the corresponding code risk score is output. Simultaneously, character stream similarity matching is performed, comparing the binary stream of the image with signatures in a malicious code database. If the similarity reaches a threshold, an alarm is triggered, and image uploading is stopped.

[0041] This method employs code-to-image conversion technology to convert the binary code of an image into a grayscale image according to predetermined rules. Subsequently, an image classification model (such as CNN) is used to analyze the converted image to determine the presence of malicious code features. This effectively identifies malicious code features hidden in image files, overcoming the shortcomings of traditional signature-based detection methods in detecting unknown or mutated malicious code. Combined with a dual verification mechanism of preliminary risk keyword screening and character stream similarity matching, it further improves the accuracy and comprehensiveness of malicious code detection, enabling timely discovery and blocking of potential malicious code propagation, and providing multi-dimensional and in-depth protection for the security detection of image source files.

[0042] S5: Combining the outputs of S2, S3, and S4, a final decision is made using a weighted scoring algorithm. For images deemed safe, selective post-processing is performed to destroy any missed malicious code. For images deemed risky, uploading is blocked and a security alert is generated.

[0043] This step is the multimodal decision-making and post-processing stage. Finally, the analysis results of each module are combined to make a final decision using a weighted scoring algorithm. For images determined to be safe, selective post-processing can be performed to destroy any potentially missed malicious code, further enhancing the security redundancy of the image source file. Even if a very small number of images are not identified in the initial detection, security can be ensured through post-processing. For images determined to be risky, uploading is blocked and a security alert is generated, enabling administrators to quickly locate the source of the risk, analyze its causes, and take targeted measures.

[0044] The total risk value used by the weighted scoring algorithm to make the final decision can be the sum of the product of the image risk score and its weight, the product of the text risk score and its weight, and the product of the code similarity / code risk score and its weight. If the total risk value is higher than the total risk threshold, the image is determined to be risky. The sum of all weights is 1.

[0045] Post-processing methods include compression, cropping, and secondary rendering. These post-processing methods can be used individually or in combination according to the security requirements of the actual application scenario to achieve the best malicious code destruction effect.

[0046] In this embodiment, S2, S3, and S4 can be performed simultaneously. The weight allocation is dynamically adjusted based on the historical detection accuracy of each module.

[0047] In one specific application of this embodiment, for example, a user on a social media platform uploads an image file named "abcde.png".

[0048] (1) Document reception and preliminary verification: The system receives the file and verifies that its extension is .png (passes).

[0049] The magic number of the detected file is 89504E47 (PNG standard magic number, passed).

[0050] The filename was checked for 00 truncation characters or other illegal characters (passed).

[0051] The initial verification has passed, and the document will proceed to the next stage.

[0052] (2) Image preprocessing and feature extraction: The image is converted to RGB space and then enhanced with Gaussian filtering and histogram equalization.

[0053] Image features are extracted and feature maps are generated using a multi-attention convolutional neural network (MA-CNN).

[0054] The model detected an abnormal pixel distribution in the lower right corner of the image (possibly related to the embedded code) and marked it as a suspicious area.

[0055] (3) Text detection and recognition: The presence of text regions in the middle of the image was detected using a fully convolutional network (FCN).

[0056] The OCR engine extracted the text content as: "Claim your free discount!"

[0057] The NLP model analysis indicates that the text contains promotional information but no illegal keywords, resulting in a low risk score.

[0058] (4) Detection of malicious code in source file content: The image was converted to binary source content, and the presence of keywords such as html, src, script, href, and document was verified and compared. No risky keywords were found.

[0059] The binary code of the image is divided into 4-byte segments, and each segment is mapped to a pixel (RGB value) to generate a 32×32 grayscale image.

[0060] The grayscale image was analyzed using a pre-trained ResNet-50 model, and the model output confidence score was 87%, indicating that the image has malicious code characteristics.

[0061] Meanwhile, the character stream similarity matching module found that some binary sequences had a similarity of 65% to known PHP shell code (below the threshold of 75%, so no alarm was triggered directly).

[0062] (5) Multimodal decision-making and post-processing: The decision fusion module integrates the results from: image feature analysis (high risk), text detection (low risk), and code similarity (medium risk).

[0063] The total risk value is calculated using a weighted formula: Total risk value = 0.5 × image risk score + 0.3 × code similarity risk + 0.2 × text risk score = 0.5 × 0.87 + 0.3 × 0.65 + 0.2 × 0.15 = 0.435 + 0.195 + 0.03 = 0.66 (higher than the total risk threshold of 0.6).

[0064] The system determined that the image posed a security risk, blocked its upload, and notified the security team for further analysis. Example

[0065] Figure 2 This is a logical structure block diagram of the image source file security detection system according to Embodiment 2 of the present invention; like Figure 2 As shown, the image source file security detection system provided in this embodiment is a system corresponding to the image source file security detection method in Embodiment 1, and includes: Image receiving and preliminary verification module: This module receives uploaded images and performs basic parameter checks. If any anomalies are detected, the image is marked as a security risk and uploading is stopped. If no anomalies are detected, the image passes the basic parameter check. It also receives uploaded image files and performs checks such as magic number verification, file extension verification, and binary structure integrity checks to identify file format spoofing attacks.

[0066] Image preprocessing and detection module: This module preprocesses the images detected by basic parameters, extracts image features using a pre-trained deep learning model, employs a multi-attention mechanism to focus on potential abnormal regions, and outputs an image risk score. It uses a convolutional neural network model based on a multi-attention mechanism to extract visual features from the image files to detect abnormal patterns in the images.

[0067] The text detection and recognition module uses a fully convolutional network to detect text regions in the image detected by basic parameters, extracts the text content using OCR technology, and analyzes the text content using a natural language processing model to identify potential violations and output a text risk score. It employs a fully convolutional network for text region detection and combines optical character recognition (OCR) and natural language processing techniques to analyze the violation of the extracted text content.

[0068] Malicious code detection module: This module uses code-to-image conversion technology to convert the binary code of the image detected by basic parameters into a grayscale image according to predetermined rules. Then, it uses an image classification model to analyze the grayscale image to determine whether malicious code features exist and outputs the code similarity score. It is configured to map the binary code stream of an image file to a grayscale image according to predetermined rules and analyze the grayscale image using an image classification model to identify malicious code features.

[0069] The multimodal decision-making and post-processing module integrates the outputs of the image preprocessing and detection module, the text detection and recognition module, and the malicious code detection module. It then uses a weighted scoring algorithm to make a final decision. For images deemed safe, selective post-processing is performed to remove any missed malicious code. For images deemed risky, uploading is blocked and a security alert is generated. The module receives and weights the risk scores output by the image preprocessing and detection module, the text detection and recognition module, and the malicious code detection module to generate the final security detection result.

[0070] This embodiment describes a system for detecting malicious code and abnormal text in image source files of formats such as jpg, png, gif, and bmp. This embodiment combines image processing, deep learning, text recognition, and multimodal analysis technologies to effectively identify malicious code and illegal text content hidden in image files, thereby improving the system's security.

[0071] The image source file security detection method and system according to the present invention have been described above by way of example with reference to the accompanying drawings. However, those skilled in the art should understand that various modifications can be made to the image source file security detection method and system proposed in the present invention without departing from the scope of the invention. Therefore, the scope of protection of the present invention should be determined by the content of the appended claims.

Claims

1. A method for security detection of image source files, characterized in that, Includes the following steps: S1: Receive the uploaded image and perform basic parameter detection. If any abnormality is detected, mark the image as a security risk image and stop uploading. If no abnormality is detected, the image passes the basic parameter detection. S2: The images detected by the basic parameters are preprocessed, and then the image features extracted by the pre-trained deep learning model are used. A multi-attention mechanism is used to focus on potential abnormal regions and output an image risk score. S3: Use a fully convolutional network to detect text regions in the image detected by the basic parameters, and extract the text content using OCR technology. The text content is analyzed by a natural language processing model to identify potential illegal content and output a text risk score. S4: Using code-image conversion technology, the binary code of the image detected by basic parameters is converted into a grayscale image according to a predetermined rule. Then, an image classification model is used to analyze the grayscale image to determine whether there are malicious code features and output the code similarity. S5: Based on the output results of S2, S3 and S4, a final decision is made through a weighted scoring algorithm. For images determined to be safe, selective post-processing is performed to destroy any missed malicious code. For images determined to be risky, uploading is blocked and a security alert is generated.

2. The image source file security detection method according to claim 1, characterized in that, In S1, basic parameter detection includes: filename path detection, file extension verification, file magic number detection, and 00 truncation detection.

3. The image source file security detection method according to claim 1, characterized in that, In step S2, the image detected by the basic parameters is preprocessed, and then the image features extracted by the pre-trained deep learning model are used. A multi-attention mechanism is employed to focus on potential abnormal regions. This includes converting the image to RGB space and performing Gaussian filtering and histogram equalization enhancement processing. Subsequently, a multi-attention convolutional neural network is used to extract the image features of the processed image and generate a feature map. Regions with abnormal pixel distributions in the feature map are detected and marked as suspicious regions.

4. The image source file security detection method according to claim 1, characterized in that, Before step S2, the image detected by the basic parameters is converted into a grayscale image and its hash value is calculated. The hash value is then matched with a blacklist. If the match is successful, the image is marked as a suspicious image and uploading is stopped. If the match is unsuccessful, step S2 is performed.

5. The image source file security detection method according to claim 1, characterized in that, In step S3, the text content is analyzed using a natural language processing model to identify potential violations, including: using an NLP model to perform keyword matching, semantic understanding, and sentiment analysis on the text content to identify potential violations.

6. The image source file security detection method according to claim 1, characterized in that, In step S4, a code-to-image conversion technique is used to convert the binary code of the image detected by basic parameters into a grayscale image according to predetermined rules. Then, an image classification model is used to analyze the grayscale image to determine if malicious code features exist. This includes: converting the image into binary source content, verifying and comparing for the presence of risky keywords; if no risky keywords are found, the binary code of the image is segmented into 4-byte segments, each segment mapped to a pixel, generating a 32×32 grayscale image; a pre-trained ResNet-50 model is used to analyze the grayscale image, outputting a code similarity score. A higher code similarity score indicates more malicious code features. If risky keywords are found, the image is marked as high-risk and a corresponding code risk score is output.

7. The image source file security detection method according to claim 1, characterized in that, In step S4, code-to-image conversion technology is used to convert the binary code of the image detected by basic parameters into a grayscale image according to a predetermined rule. Then, an image classification model is used to analyze the grayscale image to determine whether there are malicious code features. At the same time, the binary stream of the image is compared with the signature in the malicious code library. If the similarity reaches a threshold, an alarm is triggered and the image upload is stopped.

8. The image source file security detection method according to claim 1, characterized in that, In step S5, the output results of steps S2, S3, and S4 are combined to make a final decision using a weighted scoring algorithm. This decision includes: the total risk value is the sum of the product of the image risk score and its weight, the product of the text risk score and its weight, and the product of the code similarity / code risk score and its weight. If the total risk value is higher than the total risk threshold, the image is determined to be a risky image.

9. The image source file security detection method according to claim 1, characterized in that, In S5, the post-processing methods include at least compression, cropping, and secondary rendering.

10. A security detection system for image source files, characterized in that, include: Image receiving and preliminary verification module: used to receive uploaded images and perform basic parameter detection. If any abnormality is detected, the image is marked as a security risk image and the upload is stopped. If no abnormality is detected, the image passes the basic parameter detection. Image preprocessing and detection module: used to preprocess the images detected by the basic parameters, then use the image features extracted by the pre-trained deep learning model, and use a multi-attention mechanism to focus on potential abnormal regions, and output an image risk score; Text detection and recognition module: used to detect text regions in the image detected by the basic parameters using a fully convolutional network, and extract the text content using OCR technology. The text content is analyzed by a natural language processing model to identify potential illegal content and output a text risk score. Malicious code detection module: It is used to convert the binary code of the image detected by basic parameters into a grayscale image according to a predetermined rule using code-image conversion technology, and then use an image classification model to analyze the grayscale image to determine whether there are malicious code features and output the code similarity. Multimodal decision and post-processing module: It integrates the output results of the image preprocessing and detection module, text detection and recognition module and malicious code detection module, and makes a final decision through a weighted scoring algorithm. For images that are determined to be safe, selective post-processing is performed to destroy any missed malicious code. For images that are determined to be risky, uploading is blocked and a security alert is generated.

Images