Apparatus and method for detecting malicious URL using artificial neural network and search result

Abstract

A method for detecting a malicious uniform resource locator (URL) according to one embodiment comprises the steps in which: a collection unit obtains a search result for a target URL in response to a search for the target URL being performed through a user device; a parsing unit divides natural language data included in the search result into sentence units by parsing the search result for the target URL; a preprocessing unit preprocesses the natural language data divided into the sentence units so as to be processed by an artificial neural network; and the artificial neural network outputs a risk score of the target URL for each of a plurality of preset labels on the basis of the preprocessed data, wherein the artificial neural network can learn a method for outputting the risk score for each of the plurality of labels for input data by using data obtained by preprocessing a search result for a plurality of pre-stored URLs.

Description

Device and method for detecting malicious URLs using artificial neural networks and search results

[0001] Various embodiments disclosed in this document relate to a device and method for detecting malicious URLs using an artificial neural network and search results.

[0002] Recently, there has been a surge in attacks that force users to download malware through websites. These attacks pose a significant threat because they occur without the user's knowledge.

[0003] In particular, victims are increasingly becoming victims of acts such as inducing access to malicious websites to steal personal information or planting malicious codes inside PCs (personal computers) to cause additional damage.

[0004] To protect users' PCs from these threats, active research is being conducted on preemptive detection of malicious websites using web crawlers. Specifically, techniques are primarily used to identify malicious websites by downloading and examining files suspected of being malicious.

[0005] However, these conventional techniques may have a low preventive effect against newly modified sites or phishing methods, as they separately manage blacklists or whitelists containing suspicious sites.

[0006] The purpose of the present invention is to provide a malicious URL detection device and method that provide a notification to a user about a malicious website before the user accesses the malicious website through the malicious URL.

[0007] In addition, the purpose of the present invention is to provide a malicious URL detection device and method that can detect in real time whether a malicious URL and malicious website that are continuously changing are malicious or not using a learned artificial neural network.

[0008] The technical problems to be achieved in the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned can be clearly understood by a person having ordinary skill in the technical field to which the present disclosure belongs from the description below.

[0009] According to one embodiment, a method for detecting a malicious URL (uniform resource locator) includes: a step of a collection unit obtaining a search result for a target URL in response to a search being performed for the target URL through a user device; a step of a parsing unit segmenting natural language data included in the search result into sentence units through parsing the search result for the target URL; a step of a preprocessing unit preprocessing the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and a step of the artificial neural network outputting, based on the preprocessed data, a risk score that the target URL has for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of URLs stored in advance.

[0010] According to one embodiment, the method for detecting malicious URLs may further include a step of outputting, through the user device, a notification including a label having the highest score among the plurality of labels based on a risk score for each of the plurality of labels output by the artificial neural network.

[0011] In one embodiment, the step of preprocessing the natural language data divided into sentence units by the preprocessing unit may include the step of matching at least some words of the natural language data with some of the tokens set in advance in the artificial neural network, and the step of converting a word matched with one of the tokens set in advance into a vector assigned to the matched token.

[0012] According to one embodiment, a method for detecting a malicious URL may further include a step of labeling at least some of the plurality of labels for each of the plurality of previously stored URLs, a step of obtaining a search result for each of the plurality of URLs, a step of labeling at least some of the plurality of labels for each of the sentences included in the search result for each of the plurality of URLs, and a step of inputting data labeled with at least some of the plurality of labels into the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels for the input data.

[0013] According to one embodiment, the artificial neural network may include a BERT (bidirectional encoder representation from transformer) model or a KoBERT (Korean bidirectional encoder representation from transformer) model.

[0014] According to one embodiment, the plurality of labels include at least some of positive, neutral, caution, and risk, and the method for detecting a malicious URL may further include a step of determining that the target URL is a malicious URL when the risk score for the risk among the plurality of labels output by the artificial neural network is the highest.

[0015] A method for detecting a malicious URL according to one embodiment may further include a step of outputting a notification through the user device in response to a connection request to the target URL occurring through the user device when the target URL is determined to be a malicious URL.

[0016] According to one embodiment, a malicious URL detection device includes a collection unit that, in response to a search for a target URL being performed through a user device, obtains a search result for the target URL, a parsing unit that parses the search result for the target URL to divide natural language data included in the search result into sentence units, a preprocessing unit that preprocesses the natural language data divided into sentence units so that it can be processed by an artificial neural network, and an artificial neural network that receives the preprocessed data and outputs a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of previously stored URLs.

[0017] According to one embodiment, the malicious URL detection device further includes a learning data generation unit connected to the artificial neural network, wherein the learning data generation unit labels at least some of the plurality of labels for each of the plurality of previously stored URLs, obtains a search result for each of the plurality of URLs, labels at least some of the plurality of labels for each of the sentences included in the search result for each of the plurality of URLs, and inputs data labeled with at least some of the plurality of labels to the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels with respect to the input data.

[0018] According to one embodiment, the preprocessing unit can match at least some words of the natural language data with some of the tokens set in the artificial neural network, and convert a word matched with one of the tokens set in the artificial neural network into a vector assigned to the matched token.

[0019] In one embodiment, a malicious URL detection system comprises: a control unit of the malicious URL detection system, in response to a search performed by a collection unit through a user device for a target URL, to obtain a search result for the target URL; a parsing unit, through parsing the search result for the target URL, to segment natural language data included in the search result into sentence units; a preprocessing unit, to preprocess the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and the artificial neural network can receive the preprocessed data and output a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels; and the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of previously stored URLs.

[0020] According to one embodiment, a program executed by an electronic device or one or more processors and stored in a computer-readable recording medium, the program comprises: a step in which a collection unit, in response to a search for a target URL being performed through a user device, obtains a search result for the target URL; a step in which a parsing unit segments natural language data included in the search result into sentence units through parsing the search result for the target URL; a step in which a preprocessing unit preprocesses the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and a step in which the artificial neural network receives the preprocessed data and outputs a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of URLs stored in advance.

[0021] A malicious URL detection device according to an embodiment of the present invention can provide a user with a notification about a malicious website before the user accesses the malicious website through a malicious URL.

[0022] In addition, the malicious URL detection device according to an embodiment of the present invention can detect in real time whether a malicious URL and malicious website that are continuously modified are malicious or not using a learned artificial neural network.

[0023] The effects that can be obtained from various embodiments of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art to which the present disclosure pertains from the description below.

[0024] Other aspects, features and advantages of the above-described specific preferred embodiments of the present invention will become more apparent from the following description taken in conjunction with the accompanying drawings.

[0025] FIG. 1 is a block diagram showing a malicious URL detection device according to an embodiment of the present invention.

[0026] Figure 2 is a flowchart illustrating a method for detecting malicious URLs according to one embodiment.

[0027] Figure 3 is a flowchart illustrating a method for preprocessing natural language data divided into sentence units according to one embodiment.

[0028] FIG. 4 is a flowchart illustrating a method for providing a user with a notification of a malicious URL based on the output of a neural network according to one embodiment.

[0029] Fig. 5a is a flowchart illustrating a malicious URL detection device according to another embodiment.

[0030] Figure 5b is a flowchart showing a method by which the malicious URL detection device of Figure 5a trains an artificial neural network.

[0031] In connection with the description of the drawings, the same reference numerals may be used for identical or substantially identical components.

[0032] The advantages and features of the present invention, and the methods for achieving them, will become clearer with reference to the embodiments described in detail below together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. These embodiments are provided only to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

[0033] When describing embodiments of the present invention, detailed descriptions of known functions or configurations will be omitted if they are deemed to unnecessarily obscure the gist of the invention. Furthermore, the terms described below are defined based on their functions in the embodiments of the present invention and may vary depending on the intent or custom of the user or operator. Therefore, their definitions should be based on the overall content of this specification.

[0034] At this time, it will be understood that each block of the processing flowchart drawings and combinations of the flowchart drawings can be performed by computer program instructions. These computer program instructions can be installed in a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing equipment, so that the instructions executed by the processor of the computer or other programmable data processing equipment create a means for performing the functions described in the flowchart block(s). These computer program instructions can also be stored in a computer-available or computer-readable memory that can direct a computer or other programmable data processing equipment to implement the functions in a specific manner, so that the instructions stored in the computer-available or computer-readable memory can also produce a manufactured item that includes an instruction means for performing the functions described in the flowchart block(s). Since the computer program instructions may be installed on a computer or other programmable data processing device, a series of operational steps may be performed on the computer or other programmable data processing device to create a computer-executable process, and the instructions that cause the computer or other programmable data processing device to perform the steps for performing the functions described in the flowchart block(s) may also provide steps for performing the functions described in the flowchart block(s).

[0035] Additionally, each block may represent a module, segment, or portion of code that contains one or more executable instructions for performing a specific logical function(s). It should also be noted that in some alternative implementation examples, the functions described in the blocks may occur out of order. For example, two blocks depicted in succession may actually be executed substantially concurrently, or the blocks may sometimes be executed in reverse order, depending on their respective functions.

[0036] Here, the term '~ part' used in the present embodiment means software or hardware components such as FPGA (field-programmable gate array) or ASIC (application specific integrated circuit), and the '~ part' performs certain roles. However, the '~ part' is not limited to software or hardware. The '~ part' may be configured to be in an addressable storage medium and may be configured to play one or more processors. Therefore, as an example, the '~ part' includes components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functions provided within the components and '~ parts' may be combined into a smaller number of components and '~ parts' or further separated into additional components and '~ parts'. Additionally, components and '~parts' may be implemented to regenerate one or more CPUs within a device or secure multimedia card.

[0037] In specifically describing embodiments of the present invention, examples of specific systems will be primarily used, but the main points claimed in this specification can be applied to other communication systems and services having similar technical backgrounds without significantly departing from the scope disclosed in this specification, and this can be done at the discretion of a person skilled in the relevant technical field.

[0038] FIG. 1 is a block diagram showing a malicious URL detection device according to an embodiment of the present invention.

[0039] Referring to FIG. 1, a malicious URL detection device (100) according to one embodiment may include a collection unit (120), a parsing unit (130), a preprocessing unit (140), and an artificial neural network (110).

[0040] More specifically, the malicious URL detection device (100) can determine whether a target URL is malicious or not by using a collection unit (120), a parsing unit (130), a preprocessing unit (140), and an artificial neural network (110).

[0041] According to one embodiment, the malicious URL detection device (100) may include a collection unit (120) that obtains search results for a target URL.

[0042] More specifically, the malicious URL detection device (100) may include a collection unit (120) that obtains search results for a target URL in response to a search for the target URL being performed through a user device.

[0043] Here, the user device may refer to various types of devices. For example, the user device may include a portable communication device (e.g., a smartphone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance. The user device according to the embodiments of this document is not limited to the aforementioned devices. However, for convenience of explanation, below, it is assumed that the user device is a computing device such as a personal computer (PC).

[0044] For example, the collection unit (120) can obtain search results for the target URL in response to a search for the target URL being performed on a portal site (e.g., Google, Naver) through a user device.

[0045] In addition, here, the search results for the target URL may be limited to search contents excluding the UI (user interface) among the configurations of the portal site (or website) that outputs the search results for the target URL.

[0046] For example, search results for a target URL may be understood as, but are not limited to, information composed of natural language output in response to a search for the target URL.

[0047] In addition, the malicious URL detection device (100) according to one embodiment may include a parsing unit (130) that divides natural language data included in the search results for the target URL into sentence units.

[0048] More specifically, the parsing unit (130) can divide natural language data included in the search results for the target URL into sentence units by parsing the search results for the target URL.

[0049] For example, the parsing unit (130) can divide natural language data consisting of a set of natural language words among the search results for the target URL into sentence units.

[0050] The malicious URL detection device (100) can convert the search results for the target URL to be preprocessed using the parsing unit (130).

[0051] In addition, the malicious URL detection device (100) according to one embodiment may include a preprocessing unit (140) that preprocesses natural language data divided into sentence units so that it can be processed by an artificial neural network (110).

[0052] More specifically, the malicious URL detection device (100) may include a preprocessing unit (140) that preprocesses at least some of the search results for the target URL to convert them into data in a format defined by the artificial neural network (110).

[0053] For example, the preprocessing unit (140) can tokenize each word in natural language data divided into sentence units. Furthermore, the preprocessing unit (140) can perform index representation and padding processes on the tokenized data. Furthermore, the preprocessing unit (140) can perform vectorization on the tokenized data.

[0054] However, the types and sequences of preprocessing operations performed by the preprocessing unit (140) are not limited to the examples described above, and may be referred to as various operations and sequences for preprocessing data acquired through the parsing unit (130) (or, collection unit (120)) so that the artificial neural network (110) can process it.

[0055] A detailed explanation of this will be provided later in the description of Figure 3 below.

[0056] The malicious URL detection device (100) may include an artificial neural network (110) that outputs a risk score for a target URL based on preprocessed data.

[0057] More specifically, the malicious URL detection device (100) may include an artificial neural network (110) that receives preprocessed data and outputs a risk score that the target URL has for each of a plurality of preset labels.

[0058] An artificial neural network (110) according to one embodiment may be understood as a recognition model that mimics the computational capabilities of a biological system by utilizing a plurality of artificial neurons connected by connection lines. The artificial neural network (110) utilizes artificial neurons that simplify the functions of biological neurons, and the artificial neurons may be interconnected through connection lines having connection weights. The connection weight, which is a parameter of the artificial neural network (110), may represent the connection strength as a value of a connection line. The artificial neural network (110) may perform human cognitive functions or learning processes through the artificial neurons. In this case, the artificial neurons of the artificial neural network (110) may be referred to as nodes.

[0059] The artificial neural network (110) may include a plurality of layers. For example, the artificial neural network (110) may include an input layer, one or more hidden layers, and an output layer. The input layer may receive input data for training the artificial neural network (110) and transmit it to the hidden layer, and the output layer may generate output data of the artificial neural network (110) based on signals received from nodes of the hidden layer. One or more hidden layers may be positioned between the input layer and the output layer, and may convert input data transmitted through the input layer into values ​​that are easy to predict. Nodes included in the input layer and one or more hidden layers may be connected to each other through connection lines having connection weights, and nodes included in the hidden layer and the output layer may also be connected to each other through connection lines having connection weights. The hidden layer may be a convolution filter or a fully connected layer in a convolution neural network (CNN), or may represent various types of filters or layers grouped based on special functions or characteristics.

[0060] Among artificial neural networks, an artificial neural network that includes multiple hidden layers is called a deep neural network, and training a deep neural network is called deep learning.

[0061] According to one embodiment, the artificial neural network (110) may be understood as a model trained to output a risk score for each of a plurality of preset labels of natural language data input through such deep learning. For example, the artificial neural network (110) may be understood as a machine learning model such as a deep neural network (DNN), a recurrent neural network (RNN), or a bidirectional recurrent deep neural network (BRDNN). Furthermore, the artificial neural network (110) may be referred to as a machine learning model or a deep learning model.

[0062] An artificial neural network (110) according to one embodiment may be designed to learn a method of outputting a risk score for each of a plurality of labels for input data using preprocessed data of search results for a plurality of previously stored URLs.

[0063] Additionally, the artificial neural network (110) can be trained to determine whether a URL included in the input data is a malicious URL based on a risk score for each of a plurality of labels.

[0064] Here, for example, the multiple labels may include, but are not limited to, at least some of positive, neutral, caution, and danger. The multiple labels may be customized through fine-tuning of the artificial neural network (110).

[0065] Furthermore, the malicious URL detection device (100) can provide a notification to the user device including the risk score or maliciousness identified by the artificial neural network (110).

[0066] Here, the artificial neural network (110) can be understood as a pre-trained NLP (natural language processing) model that classifies multiple labels in response to natural language input obtained from a user.

[0067] For example, the artificial neural network (110) can be understood to include a BERT (bidirectional encoder representation from transformer) model or a KoBERT (Korean bidirectional encoder representation from transformer) model.

[0068] However, the types and configurations of artificial neural networks (110) are not limited to the examples described above.

[0069] Referring to the above-described configurations, the malicious URL detection device (100) can determine the risk score and / or maliciousness of a specific URL using a learned artificial neural network (110).

[0070] Through this, the malicious URL detection device (100) according to an embodiment of the present invention can provide information on whether a URL is malicious before a user clicks on the URL or accesses a website linked to the URL.

[0071] Furthermore, the malicious URL detection device (100) can prevent security attacks on user devices caused by malicious URLs.

[0072]

[0073] Figure 2 is a flowchart illustrating a method for detecting malicious URLs according to one embodiment.

[0074] Referring to FIG. 2, a malicious URL detection device (100) according to one embodiment can determine the risk score and / or maliciousness of a target URL searched through a user device using a learned artificial neural network (110).

[0075] More specifically, the malicious URL detection device (100) can output a risk score for the target URL using preprocessed natural language data among the search results for the target URL.

[0076] Furthermore, the malicious URL detection device (100) can determine whether the target URL is malicious based on the risk score output through the artificial neural network (110).

[0077] First, in operation 201, the malicious URL detection device (100) can obtain search results for the target URL.

[0078] More specifically, the malicious URL detection device (100) can obtain search results for the target URL in response to a search for the target URL being performed through the user device.

[0079] For example, the malicious URL detection device (100) can obtain search results for a specific URL in response to a search being performed for the specific URL on a portal site (or website) through a user device.

[0080] Here, the search results for the target URL may be limited to the search contents excluding the UI (user interface) among the configurations of the portal site (or website) that outputs the search results for the target URL.

[0081] For example, search results for a target URL may be understood as, but are not limited to, information composed of natural language output in response to a search for the target URL.

[0082] In operation 203, the malicious URL detection device (100) can divide natural language data included in the search results into sentence units through parsing the search results.

[0083] More specifically, the malicious URL detection device (100) can divide natural language data consisting of a set of natural language words among search results for a target URL into sentence units.

[0084] Here, for example, the malicious URL detection device (100) can parse tagged data (e.g., data in HTML format) for each natural language word among the search results for the target URL.

[0085] Furthermore, in operation 205, the malicious URL detection device (100) can preprocess natural language data divided into sentence units.

[0086] More specifically, the malicious URL detection device (100) can preprocess natural language data divided into sentence units so that the artificial neural network (110) can process it.

[0087] The malicious URL detection device (100) can preprocess and convert natural language data divided into sentence units into the format of input data defined by the artificial neural network (110).

[0088] For example, the malicious URL detection device (100) can perform tokenization and vectorization on natural language data segmented into sentence units. A detailed description of this will be provided later in the description of FIG. 3 below.

[0089] In operation 207, the malicious URL detection device (100) can cause the artificial neural network (110) to output a risk score that the target URL has for each of a plurality of labels based on the preprocessed data.

[0090] More specifically, the malicious URL detection device (100) can output a risk score for each of a plurality of preset labels of a target URL included in the preprocessed data using a learned artificial neural network (110).

[0091] Here, each of the preset labels can be designated as a sentiment classification. Furthermore, the risk scores for the multiple labels can be designated as a sentiment index for the sentiment classification.

[0092] The malicious URL detection device (100) can input preprocessed data into an artificial neural network (110).

[0093] Furthermore, the malicious URL detection device (100) can obtain the risk score that the target URL included in the preprocessed data has for each of the plurality of labels by using an artificial neural network (110) trained to output the risk score that the URL included in the input data has for each of the plurality of labels.

[0094] Furthermore, the malicious URL detection device (100) can determine whether the target URL is a malicious URL based on the risk scores output through the artificial neural network (110).

[0095] Referring to the above-described configurations, the malicious URL detection device (100) can determine the risk score and / or maliciousness of a specific URL using a learned artificial neural network (110).

[0096] Through this, the malicious URL detection device (100) according to an embodiment of the present invention can provide information on whether a URL is malicious before a user clicks on the URL or accesses a website linked to the URL.

[0097] Furthermore, the malicious URL detection device (100) can prevent security attacks on user devices caused by malicious URLs.

[0098]

[0099] Figure 3 is a flowchart illustrating a method for preprocessing natural language data divided into sentence units according to one embodiment.

[0100] Referring to FIG. 3, a malicious URL detection device (100) according to one embodiment can perform preprocessing on natural language data divided into sentence units.

[0101] More specifically, the malicious URL detection device (100) can perform preprocessing on natural language data included in the search results for the target URL so that the artificial neural network (110) can process it.

[0102] In operation 301, the malicious URL detection device (100) can match at least some words in the natural language data with some of the tokens set in the artificial neural network (110).

[0103] More specifically, the malicious URL detection device (100) can match at least some of the natural language words included in the natural language data with some of the word tokens preset in the artificial neural network (110).

[0104] Furthermore, in operation 303, the malicious URL detection device (100) can convert words matched with some of the tokens into vectors assigned to the matched tokens.

[0105] More specifically, the malicious URL detection device (100) can convert words matched with some of the tokens into vectors assigned to the corresponding word tokens in an artificial neural network (110).

[0106] Through this, the malicious URL detection device (100) can convert the acquired natural language data into the format of input data defined in the artificial neural network (110).

[0107] Furthermore, the malicious URL detection device (100) can input (or provide) data converted into vector format to an artificial neural network (110).

[0108] Referring to the above-described configurations, a malicious URL detection device (100) according to one embodiment can convert a search result for a specific URL performed through a user device into a format that can be processed by an artificial neural network (110).

[0109] Through this, the malicious URL detection device (100) according to an embodiment of the present invention can utilize an artificial neural network (110) to determine the risk score and / or whether the searched URL is malicious.

[0110]

[0111] FIG. 4 is a flowchart illustrating a method for providing a user with a notification of a malicious URL based on the output of a neural network according to one embodiment.

[0112] Referring to FIG. 4, a malicious URL detection device (100) according to one embodiment can provide a user with a notification about a malicious URL based on the output of an artificial neural network (110).

[0113] More specifically, the malicious URL detection device (100) can output a notification about a malicious URL through a user device based on a risk score for each of a plurality of labels output by the artificial neural network (110).

[0114] In operation 405, a malicious URL detection device (100) according to one embodiment can determine whether a target URL is a malicious URL.

[0115] More specifically, the malicious URL detection device (100) can determine whether a target URL is a malicious URL in response to the artificial neural network (110) outputting a risk score for each of a plurality of labels.

[0116] Here, the malicious URL detection device (100) can determine whether the target URL is a malicious URL based on the risk score for each of the multiple labels output by the artificial neural network (110).

[0117] For example, the malicious URL detection device (100) can determine that the target URL is a malicious URL if the risk score for the “dangerous” label is the highest among the risk scores for each of the plurality of labels.

[0118] For another example, the malicious URL detection device (100) may determine that the target URL is a malicious URL if the risk score for the “dangerous” label among the risk scores for each of the plurality of labels exceeds a preset threshold value.

[0119] However, the method by which the malicious URL detection device (100) determines whether a target URL is a malicious URL based on the risk score for each of a plurality of labels is not limited to the examples described above.

[0120] Furthermore, in operation 407, the malicious URL detection device (100) can output a notification based on the output of the artificial neural network through the user device.

[0121] More specifically, if the malicious URL detection device (100) determines that the target URL is a malicious URL, it can output a notification including information that the target URL is a malicious URL through the user device.

[0122] For example, if the malicious URL detection device (100) determines that the target URL is a malicious URL, it may output a notification including a “danger” label through the user device.

[0123] Additionally, for example, if the malicious URL detection device (100) determines that the target URL is a malicious URL, it can output a notification related to the malicious URL in the form of a pop-up window through the user's PC.

[0124] However, the method by which the malicious URL detection device (100) provides notification of a malicious URL through a user device is not limited to the examples described above, and can be understood to include various methods.

[0125] Through this, the malicious URL detection device (100) according to an embodiment of the present invention can provide information on whether a URL is malicious before a user clicks on the URL or accesses a website linked to the URL.

[0126] Furthermore, the malicious URL detection device (100) can prevent security attacks on user devices caused by malicious URLs.

[0127]

[0128]

[0129] Fig. 5a is a flowchart illustrating a malicious URL detection device according to another embodiment. Fig. 5b is a flowchart illustrating a method by which the malicious URL detection device of Fig. 5a trains an artificial neural network.

[0130] Referring to FIGS. 5A and 5B together, a malicious URL detection device (500) according to one embodiment can generate learning data for learning how an artificial neural network (110) outputs a risk score that a URL included in input data has for a plurality of labels.

[0131] More specifically, the malicious URL detection device (500) can use the learning data generation unit (510) to generate learning data for learning how the artificial neural network (110) outputs a risk score that the input URL has for each of a plurality of labels.

[0132] According to one embodiment, the learning data generation unit (510) can generate learning data to be input into the artificial neural network (110) using a plurality of previously stored URLs.

[0133] In operation 501, the learning data generation unit (510) can label multiple labels for each of the multiple URLs previously stored.

[0134] More specifically, the learning data generation unit (510) can identify a plurality of previously stored URLs (or domain lists) and label each identified URL as a normal URL or a malicious URL.

[0135] In operation 503, the learning data generation unit (510) can obtain search results for each of a plurality of URLs.

[0136] More specifically, the learning data generation unit (510) can obtain search results for each of a plurality of URLs in which at least some of the plurality of labels are labeled through crawling of each of the plurality of URLs.

[0137] For example, the learning data generation unit (510) can search a portal site (or website) for each of a plurality of URLs. Furthermore, the learning data generation unit (510) can obtain data on search results for each URL by crawling the website where each of the plurality of URLs was searched.

[0138] In operation 505, the learning data generation unit (510) can perform labeling for each sentence included in the search results.

[0139] More specifically, the learning data generation unit (510) can divide natural language data included in the search results for each of a plurality of URLs into sentence units.

[0140] Furthermore, the learning data generation unit (510) can label multiple labels for each sentence in natural language data divided into sentence units.

[0141] For example, the learning data generation unit (510) can label a natural language sentence included in a search result for a specific URL with a “positive” label among a plurality of labels.

[0142] For another example, the learning data generation unit (510) can label natural language sentences included in search results for a specific URL with a “dangerous” label among a plurality of labels.

[0143] In operation 507, the learning data generation unit (510) can input labeled data into the artificial neural network (110).

[0144] More specifically, the learning data generation unit (510) can input a plurality of labeled URLs into the artificial neural network (110). In addition, the learning data generation unit (510) can input sentences included in the search results of each of the plurality of URLs and a plurality of labels labeled for each of the sentences into the artificial neural network (110).

[0145] For example, the learning data generation unit (510) can input a sentence labeled with a “danger” label and a URL containing the sentence into the artificial neural network (110).

[0146] Furthermore, the artificial neural network (110) can learn a method of outputting a risk score for each of a plurality of labels of a URL included in the input data based on data input from the learning data generation unit (510).

[0147] For example, based on the similarity between sentences included in the search results of the target URL and sentences included in the data input from the learning data generation unit (510), the risk score that the target URL has for each of the multiple labels can be determined.

[0148] Furthermore, the malicious URL detection device (500) can obtain a risk score for each of the multiple labels of the target URL by using an artificial neural network (110) learned through the above-described configurations.

[0149] Through this, the malicious URL detection device (500) can determine whether the target URL is a malicious URL.

[0150] For example, the malicious URL detection device (500) can determine that the target URL is a malicious URL if the target URL has a risk score exceeding a preset threshold value for the “dangerous” label among multiple labels.

[0151] Furthermore, if the malicious URL detection device (500) determines that the target URL is a malicious URL, it can provide a notification related to the malicious URL through the user device.

[0152] Through this, the malicious URL detection device (500) according to an embodiment of the present invention can provide information on whether a URL is malicious before a user clicks on the URL or accesses a website linked to the URL.

[0153] Furthermore, the malicious URL detection device (500) can prevent security attacks on user devices caused by malicious URLs.

[0154] According to one embodiment, a method for detecting a malicious URL (uniform resource locator) includes: a step of a collection unit obtaining a search result for a target URL in response to a search being performed for the target URL through a user device; a step of a parsing unit segmenting natural language data included in the search result into sentence units through parsing the search result for the target URL; a step of a preprocessing unit preprocessing the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and a step of the artificial neural network outputting, based on the preprocessed data, a risk score that the target URL has for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of URLs stored in advance.

[0155] According to one embodiment, the method for detecting malicious URLs may further include a step of outputting, through the user device, a notification including a label having the highest score among the plurality of labels based on a risk score for each of the plurality of labels output by the artificial neural network.

[0156] In one embodiment, the step of preprocessing the natural language data divided into sentence units by the preprocessing unit may include the step of matching at least some words of the natural language data with some of the tokens set in advance in the artificial neural network, and the step of converting a word matched with one of the tokens set in advance into a vector assigned to the matched token.

[0157] According to one embodiment, a method for detecting a malicious URL may further include a step of labeling at least some of the plurality of labels for each of the plurality of previously stored URLs, a step of obtaining a search result for each of the plurality of URLs, a step of labeling at least some of the plurality of labels for each of the sentences included in the search result for each of the plurality of URLs, and a step of inputting data labeled with at least some of the plurality of labels into the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels for the input data.

[0158] According to one embodiment, the artificial neural network may include a BERT (bidirectional encoder representation from transformer) model or a KoBERT (Korean bidirectional encoder representation from transformer) model.

[0159] According to one embodiment, the plurality of labels include at least some of positive, neutral, caution, and risk, and the method for detecting a malicious URL may further include a step of determining that the target URL is a malicious URL when the risk score for the risk among the plurality of labels output by the artificial neural network is the highest.

[0160] A method for detecting a malicious URL according to one embodiment may further include a step of outputting a notification through the user device in response to a connection request to the target URL occurring through the user device when the target URL is determined to be a malicious URL.

[0161] According to one embodiment, a malicious URL detection device includes a collection unit that, in response to a search for a target URL being performed through a user device, obtains a search result for the target URL, a parsing unit that parses the search result for the target URL to divide natural language data included in the search result into sentence units, a preprocessing unit that preprocesses the natural language data divided into sentence units so that it can be processed by an artificial neural network, and an artificial neural network that receives the preprocessed data and outputs a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of previously stored URLs.

[0162] According to one embodiment, the malicious URL detection device further includes a learning data generation unit connected to the artificial neural network, wherein the learning data generation unit labels at least some of the plurality of labels for each of the plurality of previously stored URLs, obtains a search result for each of the plurality of URLs, labels at least some of the plurality of labels for each of the sentences included in the search result for each of the plurality of URLs, and inputs data labeled with at least some of the plurality of labels to the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels with respect to the input data.

[0163] According to one embodiment, the preprocessing unit can match at least some words of the natural language data with some of the tokens set in the artificial neural network, and convert a word matched with one of the tokens set in the artificial neural network into a vector assigned to the matched token.

[0164] In one embodiment, a malicious URL detection system comprises: a control unit of the malicious URL detection system, in response to a search performed by a collection unit through a user device for a target URL, to obtain a search result for the target URL; a parsing unit, through parsing the search result for the target URL, to segment natural language data included in the search result into sentence units; a preprocessing unit, to preprocess the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and the artificial neural network can receive the preprocessed data and output a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels; and the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of previously stored URLs.

[0165] According to one embodiment, a program executed by an electronic device or one or more processors and stored in a computer-readable recording medium, the program comprises: a step in which a collection unit, in response to a search for a target URL being performed through a user device, obtains a search result for the target URL; a step in which a parsing unit segments natural language data included in the search result into sentence units through parsing the search result for the target URL; a step in which a preprocessing unit preprocesses the natural language data segmented into sentence units so that it can be processed by an artificial neural network; and a step in which the artificial neural network receives the preprocessed data and outputs a risk score that corpuses included in the preprocessed data have for each of a plurality of preset labels, wherein the artificial neural network can learn a method of outputting a risk score for each of the plurality of labels for input data using data obtained by preprocessing search results for a plurality of URLs stored in advance.

[0166]

[0167] As such, various embodiments of the present invention can be implemented as computer-readable code on a computer-readable recording medium in certain aspects. A computer-readable recording medium is any data storage device capable of storing data that can be read by a computer system. Examples of computer-readable recording media can include read-only memories (ROMs), random access memories (RAMs), compact disk-read-only memories (CD-ROMs), magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission over the Internet). A computer-readable recording medium can also be distributed across network-connected computer systems, so that the computer-readable code is stored and executed in a distributed manner. Additionally, functional programs, codes, and code segments for achieving various embodiments of the present invention can be easily interpreted by programmers skilled in the field to which the present invention is applied.

[0168] It will also be appreciated that devices and methods according to various embodiments of the present invention can be implemented in the form of hardware, software, or a combination of hardware and software. Such software may be stored in a volatile or non-volatile storage device, such as a storage device such as a ROM, for example, regardless of whether it is erasable or rewritable, or in a memory such as a RAM, a memory chip, a device, or an integrated circuit, or in a storage medium that is optically or magnetically recordable and simultaneously machine-readable (e.g., a computer), such as a compact disk (CD), a DVD, a magnetic disk, or a magnetic tape. It will be appreciated that methods according to various embodiments of the present invention can be implemented by a computer or a portable terminal including a control module and a memory, and such a memory is an example of a machine-readable storage medium suitable for storing a program or programs including commands for implementing embodiments of the present invention.

[0169] Accordingly, the present invention encompasses a program containing code for implementing the devices or methods described in the claims of this specification, and a machine-readable storage medium (e.g., a computer) storing such a program. Furthermore, such a program may be transmitted electronically via any medium, such as a communication signal transmitted via a wired or wireless connection, and the present invention appropriately encompasses equivalents thereof.

[0170] The embodiments of the present invention disclosed in this specification and drawings are intended to provide a simple explanation of the technical content of the present invention and provide specific examples to aid understanding of the present invention, and are not intended to limit the scope of the present invention. Furthermore, the embodiments of the present invention described above are merely exemplary, and those skilled in the art will understand that various modifications and equivalent embodiments are possible. Therefore, the true technical protection scope of the present invention should be defined by the following claims.

Claims

1. In a method for detecting malicious URL (uniform resource locator), A step of the collection unit obtaining a search result for the target URL in response to a search being performed for the target URL through the user device; A step in which the parsing unit divides the natural language data included in the search results into sentence units through parsing the search results for the target URL: A preprocessing unit preprocesses the natural language data divided into sentence units so that it can be processed by an artificial neural network; and The artificial neural network includes a step of outputting a risk score for each of a plurality of preset labels of the target URL based on the preprocessed data, A method for detecting malicious URLs, wherein the artificial neural network learns a method of outputting a risk score for each of the plurality of labels for input data using preprocessed data of search results for a plurality of previously stored URLs.

2. In claim 1, A method for detecting malicious URLs, further comprising the step of outputting a notification including a label having the highest score among the plurality of labels through the user device based on a risk score for each of the plurality of labels output by the artificial neural network.

3. In claim 1, The steps of the above preprocessing unit to preprocess natural language data divided into sentence units are: A step of matching at least some of the words in the above natural language data with some of the tokens set in advance in the artificial neural network, and A method for detecting malicious URLs, comprising the step of converting a word matched with one of the above preset tokens into a vector assigned to the matched token.

4. In claim 3, A method for detecting malicious URLs, wherein the step of preprocessing natural language data divided into sentence units by the above preprocessing unit further includes the step of identifying the natural language data by dividing it into morpheme units included in the natural language data.

5. In claim 3, A method for detecting malicious URLs, wherein the step of preprocessing natural language data divided into sentence units by the above preprocessing unit further includes the step of excluding data determined to be stop words according to preset criteria from among the natural language data divided into sentence units.

6. In claim 1, A step of labeling at least some of the plurality of labels for each of the plurality of previously stored URLs; A step of obtaining search results for each of the plurality of URLs; A step of labeling at least some of the plurality of labels for each of the sentences included in the search results for each of the plurality of URLs; and A method for detecting malicious URLs, further comprising a step of inputting data labeled with at least some of the plurality of labels into the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels for the input data.

7. In claim 1, A method for detecting malicious URLs, wherein the artificial neural network includes a BERT (bidirectional encoder representation from transformer) model or a KoBERT (Korean bidirectional encoder representation from transformer) model.

8. In claim 1, The above multiple labels include at least some of positive, neutral, caution and danger, A method for detecting a malicious URL, further comprising a step of determining that the target URL is a malicious URL if the risk score for each of the plurality of labels output by the artificial neural network is the highest.

9. In claim 8, A method for detecting a malicious URL, further comprising the step of outputting a notification through the user device in response to a connection request to the target URL occurring through the user device when the target URL is determined to be a malicious URL.

10. In the malicious URL detection device, A collection unit that obtains search results for a target URL in response to a search being performed for the target URL through a user device; A parsing unit that divides the natural language data included in the search results into sentence units by parsing the search results for the above target URL: A preprocessing unit that preprocesses natural language data divided into sentence units so that it can be processed by an artificial neural network; and An artificial neural network that receives the preprocessed data and outputs a risk score for each of a plurality of preset labels of corpora included in the preprocessed data, The above artificial neural network is a malicious URL detection device that learns a method of outputting a risk score for each of the plurality of labels for the input data using preprocessed data of search results for a plurality of previously stored URLs.

11. In claim 10, Further comprising a learning data generation unit connected to the above artificial neural network, The above learning data generation unit: Labeling at least some of the plurality of labels for each of the plurality of previously stored URLs, Obtain search results for each of the above multiple URLs, Labeling at least some of the plurality of labels for each of the sentences included in the search results for each of the plurality of URLs, A malicious URL detection device that inputs data, in which at least some of the plurality of labels are labeled, into the artificial neural network so that the artificial neural network learns a method of outputting a risk score for each of the plurality of labels for the input data.

12. In claim 10, The above preprocessing unit: Matching at least some of the words in the above natural language data with some of the tokens set in the artificial neural network, A malicious URL detection device that converts a word matched with one of the above-described tokens into a vector assigned to the matched token.

13. In the malicious URL detection system, The control unit of the above malicious URL detection system: In response to a search for a target URL being performed through a user device, the collection unit obtains search results for the target URL, The parsing unit divides the natural language data included in the search results into sentence units by parsing the search results for the target URL, The preprocessing unit preprocesses the natural language data divided into sentence units so that it can be processed by an artificial neural network. The artificial neural network receives the preprocessed data and outputs a risk score for each of the plurality of preset labels of the corpora included in the preprocessed data, The above artificial neural network is a malicious URL detection system that learns a method of outputting a risk score for each of the plurality of labels for the input data using preprocessed data of search results for a plurality of previously stored URLs.

14. A program stored on a computer-readable recording medium, executed by an electronic device or one or more processors, The above program is, A step of the collection unit obtaining a search result for the target URL in response to a search being performed for the target URL through the user device; A step in which the parsing unit divides the natural language data included in the search results into sentence units through parsing the search results for the target URL: A preprocessing unit preprocesses the natural language data divided into sentence units so that it can be processed by an artificial neural network; and The artificial neural network includes a step of receiving the preprocessed data and outputting a risk score for each of the plurality of preset labels of the corpuses included in the preprocessed data, The above artificial neural network is a program stored in a computer-readable recording medium that learns a method of outputting a risk score for each of the plurality of labels for the input data using preprocessed data of search results for a plurality of previously stored URLs.

Images