Method and system for file security using language model

Abstract

A file security method is provided, comprising the steps of: extracting active content from a multimedia file; evaluating the security threat level of the active content based on a pre-stored list of signatures of harmful files; generating a natural language description of the active content using a language model, wherein the natural language description of the active content includes at least one of the type, context, or attack scenario using the active content of the active content; and providing the security threat level of the active content and the natural language description of the active content to a security manager.

Description

Technology Field

[0001] The present disclosure relates to a file security method and system using a language model. Background Technology

[0002] Files can embed active content that performs various functions for the convenience of users. Active content is diverse, including macros, links to websites within or outside the document, attachments, Dynamic Data Exchange (DDE), media files (e.g., sound, movies, or 3D models), formulas, and metadata (e.g., EXIF ​​or document information). Users of files can have a more diverse and detailed experience through active content, which can thereby improve work efficiency.

[0003] However, active content can also threaten the security of file users. The various functions of active content designed for diverse user experiences are a double-edged sword, as they are easily exploited to compromise the security of the user's system. The aforementioned various active content is used to infect the recipient's computer with malicious code, to automatically install harmful programs, or to automatically connect to harmful sites for such purposes.

[0004] In response to such threats from active content, Content Disarm & Reconstruction (CDR) technology has emerged. If a file contains active content, a CDR system removes that content before delivering it to the recipient. Therefore, a CDR system can fundamentally block attempts to cause harm to the recipient's system by embedding harmful active content into a file.

[0005] However, CDR systems focus solely on removing active content and do not provide specific, qualitative descriptions or interpretations regarding threats, making it difficult for security managers to properly recognize the nature and type of threats. The problem to be solved

[0006] The present disclosure is intended to provide a file security method and system that uses a language model to generate natural language descriptions of harmful active content and provide them to a security manager in order to enhance the security manager's understanding and response capabilities. means of solving the problem

[0007] According to one aspect of the present disclosure, a file security method may include the steps of: extracting active content from a multimedia file; evaluating the security threat level of the active content based on a pre-stored list of signatures of harmful files; generating a natural language description of the active content using a language model, wherein the natural language description of the active content includes at least one of the type, context, or attack scenario using the active content; and providing the security threat level of the active content and the natural language description of the active content to a security manager.

[0008] In one embodiment, the method may be performed in an on-premise environment, and the language model may be a small large language model (sLLM).

[0009] In one embodiment, the language model may be a pre-trained model that has been fine-tuned to be specialized in describing security threats.

[0010] In one embodiment, the security threat level of the active content may include at least one of a risk score or a risk grade, and the step of evaluating the security threat level of the active content may include the step of determining the risk score within a range of 0 to 10 points, and the step of determining the risk grade as one of 'low', 'medium', 'high', or 'critical' according to the determined risk score.

[0011] In one embodiment, the type of active content may include at least one of a macro, a link to an in-document or external website, an attachment, Dynamic Data Exchange (DDE), an image file, an audio file, a video file, a mathematical expression, or meta information.

[0012] In one embodiment, the context of the active content may include at least one of the background, location, intent, sender, or receiver in which the active content is inserted into the multimedia file.

[0013] In one embodiment, the method may further include the steps of receiving a natural language question from the security manager through the language model regarding at least one of the active content, the security threat level of the active content, or a natural language description regarding the active content, and providing a natural language answer to the security manager using the language model.

[0014] According to one aspect of the present disclosure, a non-transient computer-readable recording medium may store one or more instructions, and when the one or more instructions are executed by at least one processor, the at least one processor may perform the file security method.

[0015] According to one aspect of the present disclosure, a file security system may include at least one processor; and a memory for storing one or more instructions, and when the one or more instructions are executed by the at least one processor, the file security system may extract active content from a multimedia file, evaluate the security threat level of the active content based on a pre-stored list of signatures of harmful files, generate a natural language description of the active content using a language model, and the natural language description of the active content may include at least one of the type, context, or attack scenario using the active content, and provide the security threat level of the active content and the natural language description of the active content to a security manager.

[0016] In one embodiment, the file security system may be implemented in an on-premise environment, and the language model may be a small large language model (sLLM).

[0017] In one embodiment, the language model may be a pre-trained model that has been fine-tuned to be specialized in describing security threats.

[0018] In one embodiment, the security threat level of the active content may include at least one of a risk score or a risk grade, and when the one or more instructions are executed by the at least one processor, the file security system may determine the risk score within a range of 0 to 10 points and determine the risk grade as one of 'low', 'medium', 'high', or 'critical' according to the determined risk score.

[0019] In one embodiment, the type of active content may include at least one of a macro, a link to an in-document or external website, an attachment, Dynamic Data Exchange (DDE), an image file, an audio file, a video file, a mathematical expression, or meta information.

[0020] In one embodiment, the context of the active content may include at least one of the background, location, intent, sender, or receiver in which the active content is inserted into the multimedia file.

[0021] In one embodiment, when one or more instructions are executed by the at least one processor, the file security system receives a natural language question from the security manager through the language model regarding at least one of the active content, the security threat level of the active content, or a natural language description regarding the active content, and can provide a natural language answer to the natural language question to the security manager using the language model. Effects of the invention

[0022] A file security method and system according to one embodiment can generate a natural language description of harmful active content using a language model to enhance the security manager's understanding and response capabilities, and provide it to the security manager.

[0023] A file security method and system according to one embodiment can operate in an on-premises environment where computing resources are limited by using a lightweight language model. Brief explanation of the drawing

[0024] FIG. 1 is a block diagram illustrating an environment in which a file security system according to one embodiment can be applied. FIG. 2 is a block diagram illustrating the components of a file security system according to one embodiment. FIG. 3 is a flowchart for setting the operation of a file security system according to one embodiment. Specific details for implementing the invention

[0025] The terms used in this disclosure have been selected to be as widely used and general as possible, taking into account their functions within this disclosure; however, these terms may vary depending on the intent of those skilled in the art, case law, the emergence of new technologies, etc. In specific cases, terms have been selected at the applicant's discretion, and in such cases, their meanings will be described in detail in the relevant explanatory sections. Therefore, terms used in this disclosure should be defined not merely by their names, but based on their meanings and the overall content of this disclosure.

[0026] Singular expressions may include plural expressions unless the context clearly indicates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as generally understood by those skilled in the art as described in this specification.

[0027] In this disclosure, the term “and / or” includes a combination of a plurality of related described components or any of a plurality of related described components.

[0028] Terms including ordinal numbers, such as "first" or "second," used in this disclosure may be used to describe various components, but said components should not be limited by said terms. Such terms are used solely for the purpose of distinguishing one component from another.

[0029] In the present disclosure, the expression “at least one of a, b, or c” may refer to “a,” “b,” “c,” “a and b,” “a and c,” “b and c,” “all of a, b, and c,” or variations thereof.

[0030] When a part of a specification is described as "comprising" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, terms such as "part" or "module" as used in the specification refer to a unit that processes at least one function or operation, and this may be implemented in hardware or software, or as a combination of hardware and software.

[0031] Hereinafter, embodiments of the present disclosure are described in detail with reference to the attached drawings so that those skilled in the art can easily implement the present invention. However, the present disclosure may be embodied in various different forms and is not limited to the embodiments described herein. Furthermore, in order to clearly explain the present disclosure in the drawings, parts unrelated to the explanation have been omitted, and similar parts throughout the specification have been given similar reference numerals. In addition, the reference numerals used in each drawing are for the purpose of explaining each drawing, and different reference numerals used in different drawings are not intended to represent different elements.

[0032] FIG. 1 is a block diagram illustrating an environment in which a file security system according to one embodiment can be applied.

[0033] Referring to FIG. 1, a file security system (100) receives a multimedia file from an electronic device (200), performs the operations described below with respect to the multimedia file, and can transmit a neutralized file from which active content has been removed from the multimedia file and / or a natural language description of the active content to the electronic device (200). However, the present disclosure is not limited thereto, and, for example, the file security system (100) may be implemented to display the neutralization result of the multimedia file, including a natural language description of the active content, on a display without a transmission process.

[0034] A multimedia file may be any type of file containing specific information. For example, a multimedia file may be any one of document files (e.g., hwp, docs, pptx, xlsx, pdf, txt, etc.), image files (e.g., jpg, png, gif, bmp, tif, webp, etc.), audio files (e.g., mp3, wav, aac, flac, ogg, etc.), or video files (e.g., mp4, avi, mkv, mov, wmv, etc.), but is not limited thereto.

[0035] A multimedia file may contain one or more active content. Active content is content embedded in the multimedia file to perform additional functions for the convenience of the user. For example, active content may include, but is not limited to, at least one of macros, links to websites within or outside the document (e.g., URLs), attachments, Dynamic Data Exchange (DDE), image files, audio files, video files, mathematical expressions, or meta information (e.g., EXIF).

[0036] A neutralized file refers to a multimedia file from which active content has been removed by a file security system (100).

[0037] The electronic device (200) may be a system that requests the file security system (100) to verify the harmfulness of a multimedia file. For example, the electronic device (200) may be an email server that receives email from the outside and delivers it to an internal recipient, a network linkage server that connects the company's external network and internal network, or a device of a security officer, but is not limited thereto.

[0038] For example, when an email server receives an email with a multimedia file attached, it may send the multimedia file to a file security system (100) to verify the harmfulness of the file before delivering the email to the recipient.

[0039] For example, a network linkage server may transmit a multimedia file to a file security system (100) to verify the harmfulness of the file before delivering the multimedia file received through an external network (e.g., the Internet) to a recipient through an internal network (e.g., an intranet).

[0040] The file security system (100) and the electronic device (200) can operate in an on-premise environment. An on-premise environment refers to a method of installing and operating systems, software, or data on a user's (e.g., a company) own server. That is, the file security system (100) and the electronic device (200) can operate in a closed network environment. By being implemented to operate in an on-premise environment, the file security system (100) can prevent external leakage of data and facilitate additional functional expansion.

[0041] FIG. 2 is a block diagram illustrating the components of a file security system according to one embodiment.

[0042] Referring to FIG. 2, the file security system (100) may include a communication interface (110), memory (120), and a processor (130). However, not all of the illustrated components are essential components. The file security system (100) may be implemented with more components than those illustrated in FIG. 2, or with fewer components.

[0043] The communication interface (110) is, for example, CAN (Controller Area Network), LIN (Local Interconnect Network), Ethernet, UART (Universal Asynchronous Receiver-Transmitter), SPI (Serial Peripheral Interface), I 2 Data communication between a file security system (100) and other devices (e.g., electronic device (200)) can be performed using at least one of a data communication method including C (Inter-Integrated Circuit), cellular communication (e.g., 3G, 4G, 5G, etc.), wireless LAN, Wi-Fi, Bluetooth, BLE (Bluetooth Low Energy), NFC (Near Field Communication), infrared communication (IrDA, Infrared Data Association), or RF communication.

[0044] The communication interface (110) can transmit and receive data for file sanitization with the electronic device (200). For example, the communication interface (110) can receive a multimedia file from the electronic device (200) and transmit a natural language description of the sanitized file and / or active content to the electronic device (200).

[0045] The memory (120) may store one or more instructions or programs that can be executed by the processor (130). The operations of the file security system (100) described in this disclosure may be implemented by the processor (130) executing the instructions or programs stored in the memory (120).

[0046] The memory (120) may include at least one of flash memory, hard disk, RAM (Random Access Memory), SRAM (Static Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), or PROM (Programmable Read-Only Memory), but is not limited thereto.

[0047] The memory (120) may store one or more data, algorithms, or programs that enable the file security system (100) to operate to neutralize multimedia files. For example, the memory (120) may store a list of signatures (122) of harmful files and a language model (124).

[0048] A signature refers to a specific part of data that a file security system (100) uses to identify a harmful file. For example, a signature may be the hash value of a multimedia file. The signature list (122) may be updated periodically or non-periodically so that newly modified harmful files can be identified.

[0049] The language model (124) refers to an artificial intelligence model that understands and predicts the structure and patterns of natural language. As described below, the file security system (100) can use the language model (124) to generate a natural language description of active content extracted from a multimedia file.

[0050] The language model (124) may be a pretrained model that is fine-tuned to be specialized for describing security threats. For example, the language model (124) may be fine-tuned using training data consisting of input data such as the title of a document, the type of active content, the author, and links, and output data of corresponding natural language descriptions. If the file security system (100) is implemented in an on-premises environment, it may be partially fine-tuned using techniques such as LoRA (Low-Rank Adaptation) and QLoRA (Quantized LoRA).

[0051] The language model (124) may be a large language model (LLM) such as GPT, Claude, Gemini, Grok, or a small large language model (sLLM) such as Phi-2, TinyLLaMA, DistilBERT, Gemma 4B. If the file security system (100) is implemented in an on-premises environment, for example, NVIDIA® GeForce RTX It is preferable that the language model (124) be a lightweight language model so that it can be run on a GPU (Graphics Processing Unit) or NPU (Neural Processing Unit) with a computing power of 4090 or more.

[0052] The processor (130) can control the overall operations of the file security system (100). For example, the processor (130) can control the operations performed by the file security system (100) to neutralize a file by executing one or more instructions or programs stored in memory (120). There may be one or more processors (130).

[0053] The processor (130) may be composed of at least one of, for example, a CPU (Central Processing Unit), a microprocessor, an AP (Application Processor), a GPU (Graphics Processing Unit), a NPU (Neural Processing Unit), an ASIC (Application Specific Integrated Circuit), or a DSP (Digital Signal Processor), but is not limited thereto.

[0054] FIG. 3 is a flowchart for setting the operation of a file security system according to one embodiment.

[0055] Referring to FIG. 3, in operation 310, the file security system (100) can extract active content from a multimedia file. After extracting the active content, the file security system (100) can recombine the multimedia file to create a neutralized file.

[0056] In operation 320, the file security system (100) may evaluate the security threat level of active content based on a pre-stored list of signatures (122) of harmful files. The security threat level may include, but is not limited to, at least one of a risk score or a risk grade. For example, the risk score may be determined within a range of 0 to 10 points, and the risk grade may be any one of 'low', 'medium', 'high', or 'critical' depending on the determined risk score. For example, if the risk score is 0 points or more and less than 3 points, the risk grade may be 'low'; if the risk score is 3 points or more and less than 6 points, the risk grade may be 'medium'; if the risk score is 6 points or more and less than 9 points, the risk grade may be 'high'; and if the risk score is 9 points or more, the risk grade may be 'critical'.

[0057] The file security system (100) can evaluate the level of security threat by considering various aspects of the active content.

[0058] For example, the file security system (100) may assign a higher risk score when active content is executable than when it is not.

[0059] For example, the file security system (100) may assign a higher risk score when active content is automatically executed than when it is not.

[0060] For example, the file security system (100) may assign a higher risk score when active content calls an external system or data than when it does not.

[0061] For example, the file security system (100) may assign a higher risk score if the active content includes an executable file (e.g., exe) than if it does not.

[0062] For example, the file security system (100) may assign a higher risk score when the sender of the active content is unknown (e.g., a sender who has never previously exchanged multimedia files) than when it is not.

[0063] In addition to the examples described above, the file security system (100) can evaluate the level of security threat of active content based on various criteria related to security threats.

[0064] In operation 330, the file security system (100) can generate a natural language description of active content using a language model (124). The language model (124) may be an artificial intelligence model that receives the active content and the security threat level of the active content as input and generates a natural language description of the active content. The natural language description of the active content may include at least one of the type of active content, the context of the active content, or an attack scenario using the active content.

[0065] Types of active content may include, but are not limited to, at least one of macros, links to websites within or outside the document (e.g., URLs), attachments, Dynamic Data Exchange (DDE), image files, audio files, video files, mathematical expressions, or meta information (e.g., EXIF).

[0066] The context of the active content may include, but is not limited to, at least one of the background, location, intent, sender, or receiver in which the active content is embedded in the multimedia file.

[0067] An attack scenario using active content refers to the flow of how active content can actually be exploited, and may include, for example, a description of the attacker's purpose and the technology used.

[0068] For example, if the multimedia file is a PDF file with the filename "tax invoice" and contains JavaScript that displays a fake login page, the language model (124) can generate a natural language description including an attack scenario such as "when a user views the PDF file, the automatically executed JavaScript displays a fake login page and can steal the user account."

[0069] For example, if the multimedia file is an executable file (e.g., exe) with the filename “security patch tool”, the language model (124) can generate a natural language description including an attack scenario such as “when a user clicks the exe icon in the document, the executable file runs and the user’s PC may be infected with ransomware”.

[0070] In operation 340, the file security system (100) may provide the security manager with the security threat level of the active content and a natural language description of the active content. For example, the file security system (100) may display the security threat level of the active content and a natural language description of the active content on a display or transmit it to the security manager's device (e.g., a personal computer).

[0071] The file security system (100) receives a natural language question from a security manager regarding at least one of active content, the level of security threat of active content, or a natural language description of active content through a language model (124), and can provide a natural language answer to the security manager for the natural language question using the language model (124).

[0072] A security manager can ask the language model (124) questions about the security threat level of the active content provided in operation 340 and about the natural language description of the active content that the manager is curious about or does not know, and the language model (124) can provide a natural language answer to the question to the security manager.

[0073] For example, if a natural language description such as “when a user opens a PDF file, an automatically executed JavaScript can display a fake login page and steal the user account” is provided, the security manager can ask the language model (124) “What is JavaScript?” and the language model (124) can provide the security manager with a natural language answer regarding JavaScript.

[0074] The embodiments of the present disclosure described above may be implemented in the form of a recording medium comprising computer-executable instructions, such as program modules executed by a computer. A computer-readable medium may include any volatile and non-volatile media, and removable and inseparable media, that can be accessed by a computer. Additionally, a computer-readable medium may include computer storage media and communication media. A computer storage medium may include volatile and non-volatile, removable and inseparable media implemented by any method or technique for storing information, such as computer-readable instructions, data structures, program modules, or other data. A communication medium may include other data of modulated data signals, such as computer-readable instructions, data structures, or program modules.

[0075] The foregoing description of the present disclosure is for illustrative purposes only, and those skilled in the art will understand that other specific forms can be easily modified without altering the technical spirit or essential features of the present disclosure. Therefore, all of the above descriptions should be understood as illustrative and not limiting. For example, a component described in a single form may be implemented in a distributed manner, and components described in a distributed manner may likewise be implemented in a combined manner.

[0076] The scope of the present disclosure is defined by the claims set forth below rather than by the detailed description above, and all modifications or variations derived from the meaning and scope of the claims and equivalents thereof should be interpreted as being included within the scope of the present disclosure. Explanation of the symbols

[0077] 100: File security system 110: Communication interface 120: Memory 122: Signature List 124: Language Model 130: Processor 200: Electronic device

Claims

Claim 1 A step of extracting active content from a multimedia file; a step of evaluating the security threat level of the active content based on a pre-stored list of signatures of harmful files; a step of generating a natural language description of the active content using a language model, wherein the natural language description of the active content includes at least one of the type, context, or attack scenario using the active content of the active content; A file security method comprising the step of providing a security threat level of the active content and a natural language description regarding the active content to a security manager, wherein the language model is an artificial intelligence model that receives the active content and the security threat level of the active content as input and generates a natural language description regarding the active content, wherein the security threat level of the active content includes a risk score, and the step of evaluating the security threat level of the active content includes the step of determining the risk score, wherein the step of determining the risk score determines the risk score based on at least one of whether the active content is executable, whether the active content is automatically executed, whether the active content calls an external system or data, whether the active content includes an executable file, or whether the sender of the active content is known. Claim 2 A file security method according to claim 1, wherein the method is performed in an on-premise environment and the language model is a Small Large Language Model (sLLM). Claim 3 delete Claim 4 A file security method according to claim 1, wherein the security threat level of the active content further includes a risk grade, and the step of evaluating the security threat level of the active content further includes the step of determining the risk grade as one of 'low', 'medium', 'high', or 'critical' according to the determined risk score. Claim 5 A file security method according to claim 1, wherein the type of active content comprises at least one of a macro, a link to an internal or external website, an attachment, a Dynamic Data Exchange (DDE), an image file, an audio file, a video file, a mathematical expression, or meta information. Claim 6 A file security method according to claim 1, wherein the context of the active content includes at least one of the background, location, intention, sender, or receiver in which the active content is inserted into the multimedia file. Claim 7 A file security method according to claim 1, further comprising: receiving a natural language question from a security manager through the language model regarding at least one of the active content, the security threat level of the active content, or a natural language description regarding the active content; and providing a natural language answer to the security manager using the language model. Claim 8 A non-transient computer-readable recording medium storing one or more instructions, wherein when the one or more instructions are executed by at least one processor, the at least one processor performs the method of any one of claims 1, 2, and 4 through 7. Claim 9 As a file security system, at least one processor; The file security system includes memory for storing one or more instructions, and when the one or more instructions are executed by the at least one processor, the file security system extracts active content from a multimedia file, evaluates the security threat level of the active content based on a pre-stored list of signatures of harmful files, generates a natural language description of the active content using a language model, and the natural language description of the active content includes at least one of the type, context, or attack scenario using the active content, and provides the security threat level of the active content and the natural language description of the active content to a security manager, wherein the language model is an artificial intelligence model that receives the active content and the security threat level of the active content as input and generates a natural language description of the active content, and the security threat level of the active content includes a risk score, and the file security system determines whether the active content is executable, whether the active content is automatically executed, whether the active content calls an external system or data, and the active A file security system that determines the risk score based on at least one of whether the content includes an executable file or whether the sender of the active content is known. Claim 10 In claim 9, the file security system is implemented in an on-premise environment, and the language model is a Small Large Language Model (sLLM). Claim 11 delete Claim 12 In claim 9, the security threat level of the active content further includes a risk class, and when the one or more instructions are executed by the at least one processor, the file security system determines the risk class as one of 'low', 'medium', 'high', or 'critical' according to the determined risk score. Claim 13 In claim 9, the type of active content comprises at least one of a macro, a link to an in-document or external website, an attachment, Dynamic Data Exchange (DDE), an image file, an audio file, a video file, a mathematical expression, or meta information, in a file security system. Claim 14 In claim 9, the context of the active content comprises at least one of the background, location, intent, sender, or receiver in which the active content is inserted into the multimedia file, in a file security system. Claim 15 In claim 9, when one or more instructions are executed by the at least one processor, the file security system receives a natural language question from the security manager through the language model regarding at least one of the active content, the security threat level of the active content, or a natural language description regarding the active content, and provides a natural language answer to the security manager using the language model.

Images