Electronic device for improving detection of malicious script by using artificial intelligence model and control method thereof

Abstract

Disclosed are an electronic device for improving detection of a malicious script by using an artificial intelligence model, and a control method thereof. The electronic device according to the present disclosure may comprise: a memory for storing a detection rule generation model for generating a rule for detecting a malicious script included in target data; and a processor which is connected to the memory and generates, by executing at least one instruction, a rule for detecting a malicious script included in the target data on the basis of a value output by inputting the malicious script into the malicious script detection rule generation model.

Description

Electronic device for improving detection of malicious scripts using an artificial intelligence model and a method for controlling the same

[0001] The present disclosure relates to a malicious script detection technology, and more specifically, to an electronic device that improves the detection of malicious scripts using a generative artificial intelligence model and a method for controlling the same.

[0002] The technology according to the present disclosure is supported by a national research and development project, and the project information is as follows.

[0003] Project Unique ID: 1415188783, Project Number: P0024367, Ministry: Ministry of Trade, Industry and Energy, Project Management (Specialized) Agency: Korea Institute for Industrial Technology Advancement, Research Project Name: World Class Plus Project Support, Research Task Title: Development of Next-Generation Security Technology and Service Infrastructure for Response to Global Cyber ​​Threats, Contribution Rate: 1 / 1, Performing Agency: AhnLab, Research Period: 2023.04.01 ~ 2026.12.31

[0004] Malicious software, including malicious code and malicious scripts, accesses specific systems and databases to transform legitimate programs and software into malicious code, leak data, or perform preliminary work to enable the installation of other malicious code.

[0005] Malicious software can be implemented in various forms and modes of operation, such as ransomware, spyware, adware, viruses, Trojans, and worms.

[0006] Technologies for detecting malicious software in advance to prevent it from accessing systems, databases, etc., have been developed in various ways and are widely utilized in software security.

[0007] As a representative method, malicious software can be identified by detecting malicious code and scripts contained within it, and access to systems or databases can be blocked.

[0008] An artificial intelligence system is a computer system that implements human-level intelligence, in which machines learn and make judgments on their own, and whose recognition rate improves with use.

[0009] Artificial intelligence technology consists of machine learning (deep learning) technology, which utilizes algorithms to self-classify and learn the characteristics of input data, and component technologies that utilize machine learning algorithms to mimic functions such as cognition and judgment of the human brain.

[0010] Generative AI models are AI models capable of generating text, images, and other media in response to prompts; they are AI models focused on creating new content rather than simply analyzing existing data.

[0011] Generative AI models include text AI models, image AI models, speech AI models, video AI models, and multimodal AI models, and each model can output data corresponding to text, images, voice, and video based on input data.

[0012] Generative AI models can perform not only the operation of encoding input data into vector values, but also the decoding operation to output output data as text, images, voice, video, etc.

[0013] There is a need to explore a method that can automatically generate a malicious script detection rule capable of automatically identifying malicious scripts, and to adjust the detection range of the detection rule to an appropriate range without human intervention.

[0014] The purposes of the present disclosure are not limited to those mentioned above, and other purposes and advantages of the present disclosure not mentioned may be understood from the following description and will be more clearly understood from the embodiments of the present disclosure. Furthermore, it will be readily apparent that the purposes and advantages of the present disclosure can be realized by the means and combinations thereof set forth in the claims.

[0015] An electronic device for detecting malicious scripts using a generative artificial intelligence model according to the present embodiment may include: a memory storing a detection rule generation model that generates a rule for detecting malicious scripts included in target data; and a processor connected to the memory that generates a rule for detecting malicious scripts included in target data based on an output value obtained by inputting a malicious script into the detection rule generation model by executing at least one instruction.

[0016] The processor can obtain a malicious script detection rule corresponding to a malicious script, and obtain an improved detection rule by resetting the malicious script detection range corresponding to the obtained malicious script detection rule.

[0017] The processor can input a malicious script into a malicious function analysis model to identify at least one malicious function corresponding to the malicious script based on the output value, and input the identified at least one malicious function into a detection rule creation model to obtain a malicious script detection rule corresponding to each of the at least one malicious function based on the output value.

[0018] The processor can input the acquired malicious script detection rule into a detection range determination model to obtain feedback information corresponding to the detection range of the malicious script detection rule based on the output value, and input the acquired feedback information into a detection rule improvement model to obtain an improved detection rule corresponding to the malicious script detection rule based on the output value.

[0019] The processor obtains feedback information corresponding to the detection range of the malicious script detection rule based on detection range change data, and the feedback information may be information regarding the expansion or reduction of the detection range of the detection rule.

[0020] The processor can identify matching information between at least one script stored in a script database and the improved detection rule, and perform a verification operation on the detection range of the improved detection rule based on the matching information.

[0021] The processor can input the improved detection rule into a similar detection rule identification model and, based on the output value, identify at least one similar detection rule whose similarity to the improved detection rule is greater than or equal to a preset value, and input the improved detection rule and the identified at least one similar detection rule into a detection rule merging model and, based on the output value, obtain an integrated detection rule that merges the improved detection rule and the at least one similar detection rule.

[0022] The processor can identify an embedding vector value corresponding to the improved detection rule based on the output value obtained by inputting the improved detection rule into a language model, and can identify a similarity detection rule in which the vector similarity with the embedding vector value is greater than or equal to a preset value.

[0023] The processor identifies matching information of at least one script stored in a script database and the integrated detection rule, identifies a first detection range of the integrated detection rule based on the matching information, and if the similarity between the first detection range and the second detection range of a rule set including the improved detection rule and the similar detection rule is less than a preset value, the processor can obtain a re-merged integrated detection rule based on the output value by re-inputting the improved detection rule and the similar detection rule into the detection rule merging model.

[0024] The processor may store the integrated detection rule if the similarity between the first detection range and the second detection range of the rule set including the improved detection rule and the similar detection rule is greater than or equal to a preset value.

[0025] A control method for an electronic device that detects a malicious script using a generative artificial intelligence model according to the present disclosure may include: a step of obtaining a malicious script detection rule corresponding to the malicious script; a step of obtaining an improved detection rule by resetting a malicious script detection range corresponding to the obtained malicious script detection rule; and a step of obtaining an integrated detection rule by merging a similarity detection rule, which has a similarity to the improved detection rule greater than or equal to a preset value, with the improved detection rule.

[0026] A non-transient computer-readable recording medium according to the present disclosure may store at least one instruction that is executed by a processor of an electronic device to perform a method of operation of said electronic device.

[0027] By applying at least one generative artificial intelligence model, detection rules capable of automatically identifying malicious scripts can be automatically generated, and the detection range of the detection rules can be adjusted to an appropriate range without human intervention.

[0028] Generative AI models can adjust the rule detection range themselves to prevent excessive detection or excessive missing detection.

[0029] In addition, the generative AI model checks for duplicate rule sets and integrates similar rule sets, thereby preventing various side effects that occur from excessively passing through rule sets.

[0030] Aspects, features, and advantages of specific embodiments of the present disclosure will become more apparent from the following description with reference to the accompanying drawings.

[0031] FIG. 1 is a block diagram illustrating the configuration of an electronic device according to one embodiment of the present disclosure.

[0032] FIG. 2 is a block diagram illustrating a detailed model that may be included in a malicious script detection rule generation model according to one embodiment of the present disclosure.

[0033] FIG. 3 is a flowchart illustrating the process of analyzing the malicious functions of a malicious script using a generative artificial intelligence model and obtaining a malicious script detection rule according to one embodiment of the present disclosure.

[0034] FIG. 4 is a flowchart illustrating the process of determining the detection range of a malicious script detection rule and obtaining an improved detection rule using a generative artificial intelligence model according to one embodiment of the present disclosure.

[0035] FIG. 5 is a flowchart illustrating a process of identifying detection rules similar to an improved detection rule using a language artificial intelligence model according to one embodiment of the present disclosure, and merging detection rules similar to the improved detection rule to obtain an integrated detection rule.

[0036] FIG. 6 is a flowchart for explaining the operation of an electronic device according to one embodiment of the present disclosure.

[0037] The embodiments described herein are subject to various modifications and may have various forms; specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the scope of specific embodiments and should be understood to include various modifications, equivalents, and / or alternatives of the embodiments of the present disclosure. In relation to the description of the drawings, similar reference numerals may be used for similar components.

[0038] In describing the present disclosure, if it is determined that a detailed description of related known functions or configurations could unnecessarily obscure the essence of the present disclosure, such detailed description is omitted.

[0039] Additionally, the following embodiments may be modified in various other forms, and the scope of the technical concept of the present disclosure is not limited to the following embodiments. Rather, these embodiments are provided to make the present disclosure more faithful and complete and to fully convey the technical concept of the present disclosure to those skilled in the art.

[0040] The terms used in this disclosure are used merely to describe specific embodiments and are not intended to limit the scope of the rights. The singular expression includes the plural expression unless the context clearly indicates otherwise.

[0041] In the present disclosure, expressions such as “have,” “may have,” “include,” or “may include” indicate the presence of such features (e.g., numerical values, functions, actions, or components such as parts) and do not exclude the presence of additional features.

[0042] In the present disclosure, expressions such as “A or B,” “at least one of A or / and B,” or “one or more of A or / and B” may include all possible combinations of items listed together. For example, “A or B,” “at least one of A and B,” or “at least one of A or B” may refer to cases including (1) at least one A, (2) at least one B, or (3) both at least one A and at least one B.

[0043] Expressions such as "first," "second," "first," or "second" used in this disclosure may modify various components regardless of order and / or importance, and are used only to distinguish one component from another and do not limit said components.

[0044] Where it is stated that a component (e.g., Component 1) is "(operatively or communicatively) coupled with / to" or "connected to" another component (e.g., Component 2), it should be understood that the component may be directly connected to the other component or connected through the other component (e.g., Component 3).

[0045] On the other hand, when it is stated that a certain component (e.g., a first component) is "directly connected" or "directly coupled" to another component (e.g., a second component), it may be understood that no other component (e.g., a third component) exists between the certain component and the other component.

[0046] As used in this disclosure, the expression “configured to” may be replaced, depending on the context, with, for example, “suitable for,” “having the capacity to,” “designed to,” “adapted to,” “made to,” or “capable of.” The term “configured to” may not necessarily mean only “specifically designed to” in hardware.

[0047] Instead, in some situations, the expression “device configured to do something” may mean that the device is “capable of doing something” together with other devices or components. For example, the phrase “processor configured (or set) to perform A, B, and C” may mean a dedicated processor for performing those operations (e.g., an embedded processor), or a generic-purpose processor (e.g., a CPU or application processor) capable of performing those operations by executing one or more software programs stored in a memory device.

[0048] In the embodiments, a 'module' or 'part' performs at least one function or operation and may be implemented in hardware or software, or a combination of hardware and software. Additionally, a plurality of 'modules' or a plurality of 'parts' may be integrated into at least one module and implemented by at least one processor, except for the 'module' or 'part' that needs to be implemented in specific hardware.

[0049] Meanwhile, the various elements and areas in the drawings are depicted schematically. Accordingly, the technical concept of the present invention is not limited by the relative sizes or spacing depicted in the attached drawings.

[0050] Hereinafter, embodiments according to the present disclosure are described in detail with reference to the attached drawings so that those skilled in the art can easily implement them.

[0051] The electronic device (100) may be an electronic device (100) capable of performing operations to process data, information, and signals.

[0052] The electronic device (100) may be, for example, a server which is a computer that provides services to clients over a network. The server may be an FTP server, a web server, a database server, or a cloud server, and the server may be built with an operating system such as Linux.

[0053] A server can perform multiple different functions and is not necessarily a single device; rather, it can be distributed across multiple devices to implement each function.

[0054] In addition, the electronic device (100) may be a user terminal device. The user terminal device may include, for example, at least one of a desktop PC, a smartphone, a tablet PC, a laptop PC, a netbook computer, a mobile device, and a wearable device, but is not limited thereto.

[0055] An electronic device (100) according to one embodiment of the present disclosure is not limited to the above-described device, and the electronic device (100) may be implemented as an electronic device (100) having two or more functions of the above-described devices.

[0056] FIG. 1 is a block diagram illustrating the configuration of an electronic device (100) according to one embodiment of the present disclosure.

[0057] Referring to FIG. 1, the electronic device (100) may include a memory (110) and a processor (120). However, the configuration of the electronic device (100) is not limited to that described above, and may include additional configurations or omit some configurations.

[0058] The memory (110) stores various programs or data temporarily or non-temporarily and transmits the stored information to the processor (120) upon the call of the processor (120). Additionally, the memory (110) can store various information required for the operation, processing, or control operation of the processor (120) in an electronic format.

[0059] The memory (110) may include, for example, at least one of a main memory and an auxiliary memory. The main memory may be implemented using a semiconductor storage medium such as ROM and / or RAM. The ROM may include, for example, a conventional ROM, EPROM, EEPROM and / or MASK-ROM. The RAM may include, for example, a DRAM and / or SRAM. The auxiliary memory may be implemented using at least one storage medium capable of storing data permanently or semi-permanently, such as a flash memory device, an SD (Secure Digital) card, a solid state drive (SSD), a hard disk drive (HDD), an optical recording medium such as a magnetic drum, a compact disc (CD), a DVD, or a laser disc, a magnetic tape, a magneto-optical disc and / or a floppy disk.

[0060] The memory (110) can store a malicious script detection rule generation model (10). The malicious script detection rule generation model (10) may be a generative artificial intelligence model that outputs a value (e.g., text, script, code, etc.) corresponding to a rule for detecting a malicious script included in target data when a malicious script composed of text, etc. is input.

[0061] FIG. 2 is a block diagram illustrating a detailed model that may be included in a malicious script detection rule generation model (10) according to one embodiment of the present disclosure.

[0062] Referring to FIG. 2, the malicious script detection rule generation model (10) may be a single generative artificial intelligence model capable of performing all operations of malicious function analysis, detection rule creation, detection range determination, detection rule improvement, similar detection rule identification, and detection rule merging, but it may also be a set of multiple generative artificial intelligence models that perform different functions and operations.

[0063] Generative AI models are AI models capable of generating text, images, and other media in response to prompts; they are AI models focused on creating new content rather than simply analyzing existing data.

[0064] Generative artificial intelligence models include text artificial intelligence models, image artificial intelligence models, speech artificial intelligence models, video artificial intelligence models, multimodal artificial intelligence models, etc., and each model can output data corresponding to text, image, voice, and video based on input data. However, the generative artificial intelligence model according to the present disclosure is trained based on language data (script), and when language data (script) is input, it can output language data generated corresponding to the input language data.

[0065] When the malicious script detection rule generation model (10) is composed of a set of multiple generative artificial intelligence models, the malicious script detection rule generation model (10) may include a malicious function analysis model (10-1), a detection rule creation model (10-2), a detection range determination model (10-3), a detection rule improvement model (10-4), a similar detection rule identification model (10-5), and a detection rule merging model (10-6).

[0066] The processor (120) controls the overall operation of the electronic device (100). Specifically, the processor (120) is connected to the configuration of the electronic device (100) including the memory (110) as described above, and can control the overall operation of the electronic device (100) by executing at least one instruction stored in the memory (110) as described above. In particular, the processor (120) can be implemented as a single processor as well as as a plurality of processors.

[0067] The processor (120) may be implemented in various ways. For example, one or more processors (120) may include one or more of a CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerated Processing Unit), MIC (Many Integrated Core), DSP (Digital Signal Processor), NPU (Neural Processing Unit), hardware accelerator, or machine learning accelerator. One or more processors (120) may control one or any combination of other components of the electronic device (100) and may perform operations or data processing related to communication. One or more processors (120) may execute one or more programs or instructions stored in memory (110). For example, one or more processors (120) may perform a method according to one embodiment of the present disclosure by executing one or more instructions stored in memory (110).

[0068] In the case where the method according to one embodiment of the present disclosure includes a plurality of operations, the plurality of operations may be performed by one processor (120) or by a plurality of processors (120). For example, when a first operation, a second operation, and a third operation are performed by the method according to one embodiment, the first operation, the second operation, and the third operation may all be performed by a first processor, or the first operation and the second operation may be performed by a first processor (e.g., a general-purpose processor) and the third operation may be performed by a second processor (e.g., an artificial intelligence dedicated processor).

[0069] One or more processors (120) may be implemented as a single-core processor including one core, or as one or more multicore processors including multiple cores (e.g., homogeneous multicore or heterogeneous multicore). When one or more processors (120) are implemented as multicore processors, each of the multiple cores included in the multicore processor may include internal processor memory such as on-chip memory (110), and a common cache shared by the multiple cores may be included in the multicore processor (120). Additionally, each of the multiple cores included in the multicore processor (120) (or some of the multiple cores) may independently read and execute program instructions for implementing a method according to one embodiment of the present disclosure, or all (or some) of the multiple cores may be linked together to read and execute program instructions for implementing a method according to one embodiment of the present disclosure.

[0070] When a method according to one embodiment of the present disclosure includes a plurality of operations, the plurality of operations may be performed by one of the plurality of cores included in a multi-core processor, or may be performed by a plurality of cores. For example, when a first operation, a second operation, and a third operation are performed by a method according to one embodiment, the first operation, the second operation, and the third operation may all be performed by a first core included in a multi-core processor, or the first operation and the second operation may be performed by a first core included in a multi-core processor and the third operation may be performed by a second core included in a multi-core processor.

[0071] In embodiments of the present disclosure, the processor (120) may mean a system-on-chip (SoC) in which one or more processors (120) and other electronic components are integrated, a single-core processor, a multi-core processor, or a core included in a single-core processor or a multi-core processor, wherein the core may be implemented as a CPU, GPU, APU, MIC, DSP, NPU, hardware accelerator, or machine learning accelerator, but the embodiments of the present disclosure are not limited thereto.

[0072] The processor (120) may include a malicious function analysis unit (21) that identifies a malicious function corresponding to a malicious script, a detection rule creation unit (22) that creates a malicious script corresponding to a malicious function of a malicious script, a detection range determination unit (23) of a detection rule, a detection rule improvement unit (24) that obtains an improved detection rule based on feedback information corresponding to the detection range of a detection rule, a similar detection rule identification unit (25) that searches for and identifies a detection rule similar to the improved detection rule, and a detection rule merging unit (26) that merges the detection rules similar to the improved detection rule to obtain an integrated detection rule.

[0073] However, each part or module constituting the processor (120) is not necessarily composed of different parts, modules, or units, and the processor (120) may perform the overall operation for the malicious script detection rule described above without separate distinction.

[0074] The processor (120) is connected to memory (110) and, by executing at least one instruction, can input a malicious script into a malicious script detection rule generation model (10) and generate a rule to detect a malicious script included in target data based on the output value.

[0075] The processor (120) can obtain a malicious script detection rule corresponding to the malicious script.

[0076] FIG. 3 is a flowchart illustrating the process of analyzing the malicious functions of a malicious script using a generative artificial intelligence model and obtaining a malicious script detection rule according to one embodiment of the present disclosure.

[0077] Referring to FIG. 3, the processor (120) can input a malicious script into a malicious function analysis model (10-1) (or a malicious script detection rule generation model (10)) and identify at least one malicious function corresponding to the malicious script based on the output value. At this time, the processor (120) can obtain a list of malicious functions including at least one malicious function.

[0078] Here, the processor (120) can control the malicious function analysis unit (21) to identify at least one malicious function corresponding to the malicious script.

[0079] The contents and examples of the list of malicious features and corresponding prompt examples are as follows, but are not limited thereto.

[0080] The prompts of the malicious function analysis unit (21) are as shown in Table 1.

[0081] 악성기능 분석부 프롬프트As a professional security analyst, You will provide step-by-step analysis of the malicious batch script that user provided and explain its malicious intent. By breaking down the code snippet and providing partial segments for each specific analysis, You'll uncover the potential harm it can cause. Then display and number the malicious points based on mitre attack ttp. For example,1. Title[script snippet]- intent: ``short description``- TTP: ``TTP code - code name``- ``Long description``2. Title[script snippet]- intent: ``short description``- TTP: ``TTP code - code name``- ``Long description``스크립트id악성 기능 카테고리Code snippet악성의 근거41024T1112 - Modify RegistrySTART reg delete HKCR / .exeSTART reg delete HKCR / .dllSTART reg delete HKCR / *Disabling the Windows Security Center and the firewall can make the system vulnerable by turning ...42247T1562.004 - Impair Defenses: Disable or Modify System Firewallnet stop "wuauserv"By stopping the Windows Update service, the script prevents the system from receiving important security patches and updates, leaving it vulnerable to known exploits.

[0082] The processor (120) can obtain a malicious script detection rule corresponding to each of at least one malicious function based on the output value obtained by inputting at least one identified malicious function into a detection rule creation model (10-2) (or a malicious script detection rule creation model (10)). Here, the processor (120) can obtain a malicious script detection rule corresponding to each of at least one identified malicious function by controlling a detection rule creation unit (22).

[0083] The format of the detection rule may follow the yara rule format or regular expression commonly used in the security industry, but is not limited thereto. The detection rule creation unit (22) includes a rule compiler, so the processor (120) can identify that an error occurred in the rule compiler when a rule that is not grammatically correct is generated.

[0084] The processor (120) can once again pass the error message from the compilation to the detection rule creation model (10-2) (or malicious script detection rule creation model (10)) to induce the creation of a rule without rule compilation errors.

[0085] The attributes and examples that the generated rule must have, as well as examples of prompts that must be entered, are as follows, but are not limited thereto.

[0086] The prompt for the detection rule creation section (22) is as shown in Table 2.

[0087] Detection rule writing section promptI'd like to make detection rule covering "Rule Name".Induce specific requirements for covering this. Do not include all the details, but include most important aspect of suspiciousnesswrite regular expression for this. and explain piece by piece of regular expression Rule Name Rule Version Association techniqueCode snippet Script id Rule Condition Disable Windows Update Service1.0.0.1T1112 - Modify RegistrySTART reg delete HKCR / .exeSTART reg delete HKCR / .dllSTART reg delete HKCR / *41024START / s+reg / s+delete / s+HKCR( / | / .) / w*Registry Tampering1.0.0.1T1562.004 - Impair Defenses: Disable or Modify System Firewallnet stop "wuauserv"42247(net / s+stop / s+"?wuauserv"?|sc / s+config / s+"?wuauserv"? / s+start= / s*disabled)

[0088] The processor (120) can obtain an improved detection rule by resetting the malicious script detection range corresponding to the acquired malicious script detection rule. Since the rule for detecting malicious functions does not determine the script itself as malicious, setting the detection range is a key requirement.

[0089] For example, since even legitimate scripts can sometimes include functions that can be used maliciously, the detection rule can be matched to legitimate scripts. Conversely, if a detection rule with too broad a detection range is generated, the unique characteristics that the detection rule can capture are compromised, so it is necessary to maintain an appropriate range of detection rule conditions and detection range. This can be represented in Table 3 below.

[0090] Total Data Count Regular Expression Example Matching Result Rule Range Normal: 103,583 Malicious: 310,964(?:assoc|ftype) / s+ / .([a-zA-Z0-9]+)= / s*([a-zA-Z0-9]+ / .)(?!exe|bat|cmd|ps1|vbs|js|wsh)[a-zA-Z0-9]+Normal: 5 Malicious: 3 Narrow(http: / |https: / )[a-zA-Z0-9 / .-]+ / w+Normal: 6,963 Malicious: 7,021 Wide, distinction between malicious and normal is not clear

[0091] Previously, such judgments relied on professional analysts; however, given the generation of a large volume of new malicious scripts, there is a need to automate these assessments to ensure a timely response. Additionally, pre-existing correlation analysis reports can be utilized during the malicious function analysis phase.

[0092] For example, the processor (120) can identify previously analyzed scripts similar to the script currently being analyzed, and additionally identify analysis reports written based on the script. The processor (120) can identify parts of the report content related to the script through embedding and transmit them to the malicious function analysis unit (21). Using similar cases contained therein as hints, higher quality malicious function analysis may be possible.

[0093] FIG. 4 is a flowchart illustrating the process of determining the detection range of a malicious script detection rule and obtaining an improved detection rule using a generative artificial intelligence model according to one embodiment of the present disclosure.

[0094] Referring to FIG. 4, the processor (120) can input the acquired malicious script detection rule into the detection range determination model (10-3) (or malicious script detection rule generation model (10)) and obtain feedback information corresponding to the detection range of the malicious script detection rule based on the output value. For example, the processor (120) can obtain feedback information corresponding to the detection range of the malicious script detection rule based on detection range change data.

[0095] Here, the feedback information may be information regarding the expansion or reduction of the detection range of the detection rule. That is, the feedback information may be feedback information regarding the detection condition corresponding to the detection range of the detection rule.

[0096] Additionally, the processor (120) can control the detection range determination unit (23) to obtain feedback information corresponding to the detection range of the malicious script detection rule.

[0097] As described above, the detection rule range determination unit (23) performs the operation of adjusting the detection range determination of the detection rule. Generally, the generative artificial intelligence model of the detection rule range determination unit (23) can be trained by recalling data related to the current script based on a large amount of scripts and analysis infringement reports used during previous training. However, relying solely on such probabilistic association may result in hallucinations or the addition of other conditions with little relevance. To solve the aforementioned problems, a detection rule range change experience buffer may be used.

[0098] The buffer accumulates condition change cases that have been thoroughly verified by expert analysts, and uses this data to train the AI ​​so that it can be utilized to determine the direction of changes.

[0099] Accordingly, the processor (120) can obtain feedback information for changing, adjusting, and updating the judgment range, conditions, etc. of a malicious script detection rule based on data stored in the range change experience buffer. Here, changing, adjusting, and updating the judgment range, conditions, etc. means expanding or shrinking the degree to which the detection rule detects malicious scripts, detection sensitivity, detection range, and detection conditions.

[0100] The scope change experience cases are expert-based data and can be represented as shown in Table 4.

[0101] Existing Condition Rule Modified Condition Rule Evaluation Basis Evaluation Result (0-5) Change Direction (?:del|erase|rmdir / s+ / s / s+ / q) / s+(?:%windir%|%systemroot%|%system32%|C: / Windows) / .*?del / s+.+|erase / s+.+|rmdir / s+ / s / s+ / q / s+.+(“.sys” program) The existing rule was too detailed regarding deletion programs 4 Extension

[0102] The data also includes data with poor evaluation results, which prevents the rule from being expanded or contracted too much by providing examples related to directions that should not be changed. The processor (120) can control the detection rule range judgment unit (23) to utilize the mechanisms described above to finally create detection rule improvement direction feedback such as Table 5.

[0103] Direction of rule change under consideration Basis context to be used(?:del|erase|rmdir / s+ / s / s+ / q) / s+(?:%windir%|%systemroot%|%system32%|C: / Windows) / .*? extension Change to delete related files rather than files in a specific path del / s+.+|erase / s+.+|rmdir / s+ / s / s+ / q / s+.+(“.sys” programs)

[0104] The processor (120) can obtain an improved detection rule corresponding to a malicious script detection rule based on the output value by inputting the acquired feedback information into the detection rule improvement model (10-4) (or malicious script detection rule generation model (10)). The processor (120) can obtain an improved detection rule corresponding to a malicious script detection rule by controlling the detection rule improvement unit (24).

[0105] The processor (120) performs the task of changing the actual rule conditions based on the previously written feedback on the direction of improvement of the detection rule. The processor (120) may perform a verification operation on a script repository (which may correspond to a script database) to check whether the rule conditions have been changed efficiently.

[0106] The processor (120) can apply both the rule before modification and the rule after modification to the script to identify the amount of change in the number of rule matches.

[0107] The processor (120) can identify whether more scripts should be matched to the rule after the change if the direction of the rule change is expansion, and whether more rules are actually matched.

[0108] The processor (120) selects an appropriate ratio of the change amount trend based on expertise, and confirms that it has changed appropriately if it falls within that ratio.

[0109] Table 6 is a table showing example data for the verification of the detection rule improvement section (24). Since the rule change information is a candidate to be included in the buffer of experience cases for range changes later, it can be evaluated by an expert after collection and added retrospectively.

[0110] Number of Matches Before Rule ID Modification Number of Matches After Modification Change in Matching Count 752444,0004,40010% Increase 7589510,0008,90011% Decrease

[0111] An example of an improved detection rule derived in the manner described above can be shown in Table 7 below.

[0112] Rule ID Association Category Rule Condition Association Script 75244T1112 - Modify Registry START / s+reg / s+delete / s+HKCR( / | / .) / w*4102475895T1562.004 - Impair Defenses: Disable or Modify System Firewall(net / s+stop / s+"?wuauserv"?|sc / s+config / s+"?wuauserv"? / s+start= / s*disabled)42247

[0113] Through the above-described operation, the processor (120) can automatically adjust the detection range of malicious scripts to an appropriate level by preventing the detection of an unnecessarily large or excessively small number of malicious scripts. Additionally, the processor (120) can repeat the operation of determining the detection range or detection conditions of a detection rule and obtaining an improved detection rule multiple times. Through multiple repetitions, an improved detection rule corresponding to a more appropriate detection range can be obtained.

[0114] The processor (120) can identify matching information between at least one script and an improved detection rule stored in a script database, and perform a verification operation on the detection range of the improved detection rule based on the matching information.

[0115] In order for a rule rewritten through the above process to be finally added to the detection rule repository, it must be verified whether a malicious script with a similar pattern has been previously analyzed and whether a related similar rule is already in the repository. There are two methods for identifying similar detection rules, as follows.

[0116] The first method involves converting rules into latent embedding vectors through a separate language model and identifying similar rules based on the vector similarity between these vectors. This is suitable for discovering semantic similar rules that might otherwise go undetected.

[0117] The second method is to find similar rules based on matching information regarding which scripts each rule was found in. For example, if a significant number of scripts in the list to which one rule was matched are also matched by another rule, the similarity between the two rules can be considered high. The composition and examples of the similarity detection rule list can be shown in Table 8 below.

[0118] Reference Rule ID Similarity Rule ID Reference Rule Embedding Similarity Rule Embedding Matching Script List Similarity 1 Similarity 2 75 24 4 75 24 3 Vector(64) Vector(64) [10 25 4, 25 6 74, ...] 95% 97% 75 8 95 75 8 00 Vector(64) Vector(64) [10 25 4, 25 6 75, ...] 56% 63%

[0119] FIG. 5 is a flowchart illustrating a process of identifying detection rules similar to an improved detection rule using a language artificial intelligence model according to an embodiment of the present disclosure, and merging detection rules similar to the improved detection rule to obtain an integrated detection rule. Referring to FIG. 5, a processor (120) can identify at least one similar detection rule whose similarity to the improved detection rule is greater than or equal to a preset value based on the output value of inputting the improved detection rule into a similar detection rule identification model (10-5) (or a malicious script detection rule generation model (10)). Here, the similar detection rule identification model (10-5) may be a separate language artificial intelligence model for similarity determination, rather than the generative artificial intelligence model described above.

[0120] The similarity detection rule identification model (10-5) is learned based on language data (scripts), but can output vector values ​​corresponding to the similarity between different input language data (scripts).

[0121] The processor (120) can obtain a rule set including improved detection rules and similar detection rules.

[0122] Here, the processor (120) can control the similarity detection rule identification unit (25) to identify at least one similarity detection rule in which the similarity to the improved detection rule is greater than or equal to a preset value.

[0123] The processor (120) can identify an embedding vector value corresponding to an improved detection rule based on the output value of an improved detection rule input into a language model, and identify a similar detection rule in which the vector similarity with the embedding vector value is greater than or equal to a preset value.

[0124] Here, the language model is a model that assigns probabilities to sequences of words, and is also called a probabilistic language model.

[0125] A language model can be, for example, a Large Language Model (LLM), which is a deep learning model trained on unlabeled text through self-supervised or semi-self-supervised learning based on a vast amount of data.

[0126] After identifying similar rules through the various methods described above, the similar rules can be merged through a similar detection rule merging model (10-6) (or a malicious script detection rule generation model (10)), which is a generative artificial intelligence model or a separate language artificial intelligence model.

[0127] You can measure whether the merged rule set matches the detection range of the rule set before merging by applying the actual rule set to the script repository.

[0128] If the range similarity is lower than a specific ratio, the processor (120) can again use the similar detection rule merging model (10-6) (or malicious script detection rule generation model (10)) to obtain an integrated detection rule that re-merged the improved detection rule and the similar detection rule.

[0129] Since only merged rule sets that have passed verification are applied to the rule repository, rule management is performed efficiently. The results and examples derived from the similar detection rule merging unit (26) can be shown in Table 9 as follows.

[0130] Detection Rule List Detection Range Before Merging Detection Range After Merging Range Similarity Success Status [75244, 75243] 32% 31% 96.9% Success [75895, 75800] 67% 42% 62.7% Failure

[0131] The processor (120) can obtain an integrated detection rule by merging the improved detection rule and at least one similar detection rule based on the output value by inputting the improved detection rule and at least one identified similar detection rule into the detection rule merging model (10-6) (or malicious script detection rule generation model (10)). Here, the processor (120) can obtain an integrated detection rule by merging the improved detection rule and at least one similar detection rule by controlling the detection rule merging unit (26).

[0132] The processor (120) can merge N rules obtained using a similar detection rule identification model (10-5) (or a malicious script detection rule generation model (10)) that includes a language model of a different kind or a generative artificial intelligence model that includes a language model.

[0133] Depending on the learning method of the similar detection rule model, there may be several similar detection rule identification models (10-5) (or malicious script detection rule generation models (10)) with different generation features, and the processor (120) can obtain similar rules by using N different models separately and effectively merge the rules through a similar detection rule merging model (10-6) (or malicious script detection rule generation models (10)).

[0134] The processor (120) can identify matching information of at least one script and an integrated detection rule stored in a script database.

[0135] The processor (120) can identify the first detection range of the integrated detection rule based on matching information.

[0136] If the similarity of the first detection range and the second detection range of the rule set including the improved detection rule and the similar detection rule is less than a preset value, the processor (120) can obtain a re-merged integrated detection rule based on the output value by re-inputting the improved detection rule and the similar detection rule into the detection rule merging model (10-6).

[0137] The processor (120) can store an integrated detection rule if the similarity between the first detection range and the second detection range of the rule set, which includes an improved detection rule and a similar detection rule, is greater than or equal to a preset value.

[0138] FIG. 6 is a flowchart for explaining the operation of an electronic device (100) according to one embodiment of the present disclosure.

[0139] Referring to FIG. 6, the electronic device (100) can obtain a malicious script detection rule corresponding to a malicious script (S610).

[0140] The electronic device (100) can obtain an improved detection rule by resetting the malicious script detection range corresponding to the obtained malicious script detection rule (S620).

[0141] The electronic device (100) can obtain an integrated detection rule by merging a similarity detection rule, in which the similarity to an improved detection rule is greater than or equal to a preset value, with the improved detection rule (S630).

[0142] Additionally, finally, the electronic device (100) may store the acquired / identified malicious script detection rule, improved detection rule, and integrated detection rule as described above in memory or a database that stores detection rules, or transmit the acquired / identified malicious script detection rule, improved detection rule, and integrated detection rule to an external database, an external server, etc., so that they can be stored.

[0143] According to one embodiment, the method according to the various embodiments disclosed herein may be provided by being included in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)), or distributed online (e.g., download or upload) through an application store (e.g., Play Store™) or directly between two user devices (e.g., smartphones). In the case of online distribution, at least a portion of the computer program product (e.g., downloadable app) may be temporarily stored or temporarily created on a device-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server.

[0144] Although preferred embodiments of the present disclosure have been illustrated and described above, the present disclosure is not limited to the specific embodiments described above. It is understood that various modifications can be made by those skilled in the art without departing from the essence of the present disclosure as claimed in the claims, and such modifications should not be understood individually from the technical spirit or perspective of the present disclosure.

Claims

1. An electronic device that improves the detection of malicious scripts using an artificial intelligence model, Memory storing a detection rule generation model that generates a rule to detect malicious scripts included in target data; and An electronic device comprising: a processor connected to the memory and, by executing at least one instruction, inputting a malicious script into the detection rule generation model and generating a rule to detect a malicious script included in target data based on the output value.

2. In Paragraph 1, The above processor is, Acquire malicious script detection rules corresponding to malicious scripts, and An electronic device that obtains an improved detection rule by resetting the malicious script detection range corresponding to the above-mentioned obtained malicious script detection rule.

3. In Paragraph 2, The above processor is, A malicious script is input into a malicious function analysis model to identify at least one malicious function corresponding to the said malicious script based on the output value, and An electronic device that inputs at least one identified malicious function into a detection rule creation model and obtains a malicious script detection rule corresponding to each of the at least one malicious function based on the output value.

4. In Paragraph 2, The above processor is, The above-mentioned acquired malicious script detection rule is input into a detection range determination model, and feedback information corresponding to the detection range of the above-mentioned malicious script detection rule is obtained based on the output value. An electronic device that inputs the above-mentioned acquired feedback information into the above-mentioned detection rule improvement model and obtains an improved detection rule corresponding to the above-mentioned malicious script detection rule based on the output value.

5. In Paragraph 4, The above processor is, Based on detection range change data, feedback information corresponding to the detection range of the malicious script detection rule is obtained, and The above feedback information is, An electronic device, which is information regarding the expansion or reduction of the detection range of the above detection rule.

6. In Paragraph 4, The above processor is, Identifying matching information of at least one script previously stored in a script database and the improved detection rule, and An electronic device that performs a verification operation on the detection range of the improved detection rule based on the matching information above.

7. In Paragraph 2, The above processor is, Based on the output value obtained by inputting the above-mentioned improved detection rule into a similarity detection rule identification model, at least one similarity detection rule is identified that has a similarity to the above-mentioned improved detection rule greater than or equal to a preset value, and An electronic device that inputs the improved detection rule and the identified at least one similar detection rule into a detection rule merging model and obtains an integrated detection rule by merging the improved detection rule and the at least one similar detection rule based on the output value.

8. In Paragraph 7, The above processor is, The above improved detection rule is input into a language model, and based on the output value, an embedding vector value corresponding to the above improved detection rule is identified, and An electronic device that identifies a similarity detection rule in which the vector similarity between the above embedding vector value and the vector is greater than or equal to a preset value.

9. In Paragraph 7, The above processor is, Identifying matching information of at least one script previously stored in a script database and the integrated detection rule, and Identify the first detection range of the integrated detection rule based on the above matching information, and An electronic device that, if the similarity of the first detection range and the second detection range of a rule set including the improved detection rule and the similar detection rule is less than a preset value, re-inputs the improved detection rule and the similar detection rule into the detection rule merging model and obtains a re-merged integrated detection rule based on the output value.

10. In Paragraph 9, The above processor is, An electronic device that stores the integrated detection rule if the similarity of the first detection range and the second detection range of the rule set including the improved detection rule and the similar detection rule is greater than or equal to a preset value.

11. A method for controlling an electronic device that improves the detection of malicious scripts using an artificial intelligence model, A step of obtaining a malicious script detection rule corresponding to a malicious script; A step of obtaining an improved detection rule by resetting the malicious script detection range corresponding to the above-mentioned obtained malicious script detection rule; and An electronic device comprising the step of obtaining an integrated detection rule by merging a similarity detection rule, wherein the similarity to the improved detection rule is greater than or equal to a preset value, with the improved detection rule.

12. A non-transient computer-readable recording medium storing at least one instruction that is executed by a processor of an electronic device to cause said electronic device to perform the method of operation of claim 11.

Images