Method and device for analyzing an item of digital content

Abstract

The invention relates to a method for analyzing at least one item of digital content, the method being implemented by an analysis device and characterized in that the method comprises: a step of obtaining at least one item of data included in the at least one content item; a step of determining at least one analysis result associated with the at least one item of data; and, when the value of the at least one analysis result indicates a non-zero risk level for the at least one content item, a step of modifying and outputting the content item.

Description

Method and device for analyzing digital content

[0001] 1. Scope of the invention

[0002] The invention relates to the field of cybersecurity and more particularly concerns a method capable of helping a user understand when a cyber threat is detected in a particular situation.

[0003] 2. Prior Art

[0004] A user can receive various types of messages (SMS, emails, advertisements, barcodes, etc.) including potentially malicious content (scams, phishing attempts, etc.). They may also encounter dubious content in public or digital spaces (for example, a QR code displayed on an electric vehicle charging station). The complexity of these messages necessitates a thorough analysis of their content, based on their nature and the information they contain, in order to determine their suspicious nature.

[0005] Prior art exists for analysis systems that provide a summary assessment of the danger posed by such messages, for example, by assigning a risk level from among three possibilities (threat / potential threat / no threat), and may include generic cybersecurity advice. However, these results do not allow the user to make their own judgment by independently evaluating the risk level associated with the threat.

[0006] It is also known in prior art that systems exist which allow the analysis of data contained within a suspicious message and provide the user with a comprehensible evaluation associated with each piece of data analyzed. This data includes, for example, the identity of the message sender, an email address, a telephone number, etc.

[0007] However, it remains difficult for a user to clearly understand which message data is analyzed and considered suspicious. Indeed, the user must themselves match the content of the message they submitted with the detailed information provided by the analysis process.

[0008] 3. Description of the invention

[0009] The invention improves upon the state of the art and proposes for this purpose a method of analyzing at least one digital content, said method being implemented by an analysis device and characterized in that it comprises: a step of obtaining at least one data included in said at least one content; a step of determining at least one analysis result associated with said at least one data;

[0010] and when the value of said at least one analysis result indicates that a level of risk associated with said at least one piece of content has reached a threshold, a step of modification and restitution of said content.

[0011] Advantageously, according to the invention, the analysis method allows for the restitution of analyzed content, modified according to the results of the analysis performed. More specifically, the proposed solution consists of returning to a user the content they submitted for analysis, augmented with indicators that highlight one or more pieces of data from the analyzed content whose suspicious nature the analysis revealed. Thus, the invention makes it possible to demonstrate that the analyzed content contains one or more suspicious pieces of data and that, consequently, it is suspect.

[0012] The content can also be modified in its entirety via, for example, the modification of one or more of its style characteristics (bold, underlined, highlighted, strikethrough, color, font size, font, etc.).

[0013] According to a particular embodiment of the invention, a process as described above is characterized in that said modification step includes at least the modification of at least one restitution parameter associated with said at least one data point.

[0014] This embodiment allows, for example, when the data is a string of characters, to modify one or more style characteristics (bold, underlined, highlighted, strikethrough, color, font size, font, etc.) associated with all or part of the characters that constitute the string of characters.

[0015] When the data corresponds to an audio sequence, the process can, for example, modify the sound volume, filter and / or amplify different frequency bands of the voice sequence, mix a tone and / or a sound signal indicative of the suspicious nature into the original signal, alter the velocity of the sound signal, etc.

[0016] When the data corresponds to data contained within an HTML document, the rendering parameter associated with the data can be included in a CSS file (a CSS file is a stylesheet used to format and organize the content of an HTML page). It is then the CSS file that is modified to highlight the data on the HTML page. Note that the modification may consist of changing the display characteristics of an area containing the data, for example, a paragraph identified by the HTML tag. or a division identified via the HTML tag The resulting effect could be a visible border, a typographical change, a colored area, etc.

[0017] When the data corresponds to an image or a portion of an image, the process can, for example, modify the size, contrast, brightness, etc. of the image.

[0018] According to a particular embodiment of the invention, a process as described above is characterized in that said modification step comprises: a step of obtaining at least one position of said at least one data within said content; a step of adding at least one graphic and / or audio element in the vicinity of said position.

[0019] This embodiment allows, for example, when data is embedded in an image, the area of ​​the image containing the data to be surrounded (element / mark as defined in the invention) so as to focus the user's attention on that area. The data and its position are detected within the image, for example, using a computer vision or optical character recognition technique, whether or not implemented by the analysis process.

[0020] In practical terms, when the data corresponds to a character or a string of characters (a word, a phrase, etc.) and optical character recognition is applied to the image, the process obtains, in addition to transcribing the text contained in the image as a sequence of characters, the position of each character within the image. The position corresponds, for example, to (X, Y) coordinates in pixels whose origin is located at the center of a rectangle representing the outer edge of the image.

[0021] Note that the element / mark can correspond to any graphic object such as a geometric figure (a circle, a rectangle, a triangle, etc.), an arrow, a dot, etc.

[0022] Alternatively, position can also correspond to a relative position expressed as a number of characters in relation to a particular character, word, or symbol present in a text.

[0023] Alternatively, the position can also correspond to a level in a tree structure of a DOM (Document Object Model) document with structured content (HTML, XML, etc.).

[0024] Alternatively, the position can also correspond to a specific time t on a given timeline (for example, the 5th minute of a 10-minute audio clip). The marker can then correspond to a sound inserted into the audio clip slightly before and / or slightly after time t.

[0025] According to a particular embodiment of the invention, a process such as described above is characterized in that said restitution step further includes the restitution of at least one piece of information associated with said at least one data point.

[0026] This implementation method allows, for each analyzed element / data deemed suspicious, the retrieval of information (audio and / or graphic and / or textual) associated with the data in question. This information can, for example, characterize / explain the determined level of risk.

[0027] According to a particular embodiment of the invention, a method as described above is characterized in that the format of said digital content comprises a text and / or an image and / or an audio sequence and in that said rendering is carried out graphically and / or vocally.

[0028] This embodiment allows for a transposition / conversion of format between the format of the content to be analyzed and the format of the output of the modified content. For example, the initial content is submitted as text (a copy of a received SMS) and the output is performed orally. This embodiment makes it possible, for example, to take into account the accessibility needs of a user.

[0029] The various modes or embodiments mentioned above can be added independently or in combination with each other to the analysis process defined above.

[0030] The invention also relates to a device for analyzing at least one digital content, said device being configured to implement the following steps: a step of obtaining at least one data included in said at least one content; a step of determining at least one analysis result associated with said at least one data;

[0031] and when the value of said at least one analysis result indicates that a level of risk associated with said at least one piece of content has reached a threshold, a step of modification and restitution of said content.

[0032] According to a particular embodiment of the invention, an analysis device as described above is included in a terminal and / or a server.

[0033] The invention also relates to a computer program comprising instructions for implementing the above method according to any of the particular embodiments described above, when said program is executed by a processor. The method can be implemented in various ways, including in hardwired or software form. This program can use any programming language and be in the form of source code, object code, or code intermediate between source and object code, such as in a partially compiled form, or in any other desirable form.

[0034] The invention also relates to a computer-readable recording or information medium containing instructions for a computer program as described above. The aforementioned recording media can be any entity or device capable of storing the program. For example, the medium may include a storage means, such as a ROM (e.g., a CD-ROM or a microelectronic circuit ROM), or a magnetic recording means, such as a hard drive. Furthermore, the recording media may be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The programs according to the invention can, in particular, be downloaded from a network such as the Internet.

[0035] Alternatively, the recording media may correspond to an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0036] This analysis device and computer program have characteristics and advantages similar to those described previously in relation to the analysis process.

[0037] 4. List of figures

[0038] Other features and advantages of the invention will become clearer upon reading the following description of particular embodiments, given by way of simple illustrative and non-limiting examples, and the accompanying drawings, among which:

[0039] This illustrates an example of an implementation environment according to a particular embodiment of the invention,

[0040] Laillustrates the hardware architecture of a device configured to implement the analysis process according to a particular embodiment of the invention,

[0041] Laillustre des étapes du processus d'analyse selon un particular embodiment de l'invention.

[0042]

[0043] Figures 4a and 4b illustrate an example of content modified according to a particular embodiment of the invention.

[0044] 5. Description of an embodiment of the invention

[0045] Laillustre an example of an implementation environment for the invention according to a particular embodiment of the invention.

[0046] The environment represented includes at least one terminal 101 of a user 100 which integrates a device for analyzing digital content capable of implementing the analysis process according to the present invention.

[0047] The process can operate permanently and autonomously from the moment it is activated or following an action by the user.

[0048] According to a particular embodiment of the invention, the analysis device can be distributed over one or more computing machines such as computers, terminals or servers.

[0049] Terminal 101 is, for example, a smartphone (smartphone in English), tablet, connected television, connected object, car on-board computer, personal computer or any other terminal capable of visually and / or vocally rendering an analysis of digital content.

[0050] One or more graphics / display (103) or sound output devices can be connected to or understood by terminal 101 (connected via wired (via VGA, HDMI, USB cable, etc.) or wireless (WiFi®, Bluetooth®, etc.). These output devices can, for example, be a screen, a video projector, a speaker, etc.).

[0051] According to a particular embodiment of the invention, the graphic or sound output device(s) can be connected to terminal 101 via network 102. Communication network 102 can be a mobile communications network with an access network of type GSM, EDGE, 3G, 3G+, 4G, 5G, 6G, etc., or a fixed communications network with an access network of type ADSL, Fibre, VDSL, etc. Communication network 105 can be a public or private communication network.

[0052] Of course, this is a simplified representation of an implementation environment. The environment may include elements other than those described above. Furthermore, such an architecture is described as an illustrative example. This architecture is not limiting, and other architectures are suitable for implementing the invention. For example, the method may be distributed across several terminals (not shown) connected and / or linked together.

[0053] Figure 1 illustrates a device (S) configured to implement the analysis method according to a particular embodiment of the invention. The device (S) has the conventional architecture of a computer and includes, in particular, a memory memory (MEM), a processing unit (TU), equipped, for example, with a processor (PROC), and controlled by the computer program (PG) stored in memory memory (MEM). The computer program (PG) includes instructions to implement the steps of the analysis method as described later in support of Figure 1, when the program is executed by the processor (PROC).

[0054] At initialization, the code instructions of the computer program PG are, for example, loaded into memory before being executed by the processor PROC. The processor PROC of the processing unit UT implements the steps of the analysis process according to any one of the specific embodiments described in relation to Figures 1, 3, 4a and 4b, according to the instructions of the computer program PG.

[0055] The device (S) includes an OBT retrieval module capable of retrieving at least one piece of data from digital content. The digital content may correspond to a photo, an email, an instant message, a barcode, a document from an office suite, source code, a sound recording, etc.

[0056] A barcode is a graphical representation of numerical and / or alphanumeric data in the form of symbols (for example, colored bars and spaces of varying thickness, black squares arranged in a white square, etc.).

[0057] The barcode can be of any type (one-dimensional, two-dimensional) and generated via any type of technology (QRCode, Datamatrix, 2D-Doc, PDF417, etc.).

[0058] The device (S) further includes a DETER module capable of performing an analysis of each data obtained via the OBT module and of determining / providing an associated result.

[0059] It should be noted that each analysis result indicates a risk level associated with the analyzed data; that is, all or part of the overall risk level associated with the digital content. The overall risk level associated with the digital content is, for example, calculated based on the analysis result(s) determined by the DETER module, and optionally on the intermediate results used to determine the analysis results.

[0060] It should also be noted that the device can include several DETER modules (not shown). In this case, each module can be specialized and handle only one or more types of analysis.

[0061] The device (S) also includes a MOD module capable of modifying the digital content according to the analysis result(s) (overall result or not) determined via the DETER module.

[0062] The device (S) also includes a REST module capable of returning to a user the digital content modified via the MOD module. The return of all or part of the modified digital content can, for example, be done vocally and / or graphically.

[0063] The term "module" can refer to a software component, a hardware component, or a set of hardware and software components. A software component itself corresponds to one or more computer programs or subprograms, or more generally, to any element of a program capable of implementing a function or set of functions as described for the modules in question. Similarly, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or set of functions for the module in question (integrated circuit, smart card, memory card, etc.).

[0064] The diagram illustrates the steps of the analysis process according to a particular embodiment of the invention. In this example, the process is executed by terminal 101 and analyzes digital content that potentially presents a threat to the user, the content being obtained, for example, from a server connected to the network 102 (not shown) or from internal memory. The content may, for example, be a photo, a multimedia stream, an instant message, an audio sequence, a video, etc.

[0065] In the example described below, the digital content corresponds to a photo / image (a screenshot) of a fraudulent SMS received on a mobile phone of user 100.

[0066] In the first step (300), the process obtains one or more data points embedded in the digital content. Optionally, and prior to this retrieval step, the process can perform preprocessing of the content. In this case, the process converts all or part of the image into text using optical character recognition (OCR). Following this preprocessing, the process obtains (step 300) several data points / pieces of information, such as the SMS sender's phone number, the text obtained after OCR, and a link (e.g., a clickable URL) contained within the text.

[0067] Of course, the type of data obtained from digital content is not limited to this example. Data can, for example, correspond to an attachment (in the case of an email), a barcode (for example, a QR code on an image), or any other data capable of providing information about the veracity of the digital content.

[0068] In step 301, the process analyzes the data obtained and determines an analysis result / associated risk for each piece of data. In our example, each piece of data is processed by a specialized module (software or hardware) capable of handling a particular type of data. For example, for the SMS sender's phone number, a first module is used that is capable of searching the appropriate databases / knowledge bases to see if this number is known to send malicious / fraudulent content.

[0069] Alternatively or cumulatively, the first module can identify the type of phone number of the SMS sender (landline or mobile). Identification can be done, for example, via one or more digits that make up the number. In France, sending advertising messages from a mobile phone number is illegal.

[0070] Note that a module can correspond to a software interface (in English an API for Application Programming Interface or "application programming interface") capable of querying a local or remote database such as "Trustpilot ®" or "Verified Reviews ®".

[0071] In our example, the result of analyzing the SMS sender's phone number may correspond to a message associated with a note such as:

[0072] "4 / 20: Number frequently reported as suspicious."

[0073] Note that the score is calculated, for example, based on the number of reports received for a particular phone number.

[0074] Regarding the link (clickable URL), a second module is used to search / check in the appropriate databases / knowledge bases if this URL is known to be malicious / fraudulent.

[0075] Alternatively or cumulatively, the process can, via a third module, execute a browser-type process to visit the website / HTML page referenced by the URL and analyze its content for a threat.

[0076] Alternatively or cumulatively, the process can, via a fourth module, extract the domain name targeted by the URL and submit it for analysis. This analysis could, for example, involve searching a suitable database for the domain name to verify that it is known, certified, or reliable.

[0077] In our example, the URL analysis result could correspond to a message associated with a note, such as:

[0078] "Analysis of the website "https: / / reglement-et-dossler.com"

[0079] 4 / 20: URL frequently reported as suspicious.

[0080] 0 / 20: The URL leads to an unverified and unsecured website.

[0081] 0 / 20: Unknown host.

[0082] Note that the first score can be calculated based on the number of reports received. As for the second score, it can be calculated based on the value of the website's root certificate (root authority, encryption algorithm, signature, etc.), the value of a third-party site certification, and so on.

[0083] For the last grade, this could, for example, correspond to 0 / 20 or 20 / 20 depending on the name of the host (known or unknown).

[0084] Regarding the text itself, a fifth module is used to search for elements indicating that the content is unreliable, such as syntax problems, spelling mistakes, the topic(s) addressed, etc. This type of search can be implemented, for example, using a generative AI process that is asked to list syntax problems, spelling mistakes, etc.

[0085] In our example, the result of the text analysis could correspond to a message associated with a note such as:

[0086] "0 / 20: This message strongly resembles a phishing attempt. Governments do not send web links for fine payments via SMS or email. It is important not to click on the link and to check directly on the official government website for any outstanding fines."

[0087] Note that the score can be calculated based on the number of anomalies detected within the text, optionally with a weighting assigned to each type of anomaly observed.

[0088] According to a particular embodiment of the invention, the modules can be cascaded together to obtain a complete analysis result. Specifically, the analysis results of a first module are used as data to be processed by a second module. The result of the second module then includes the result(s) determined based on the result(s) of the first module. Optionally, the result of the second module may include the result(s) determined by the first module. For example, the method analyzes a domain name extracted from a URL, itself extracted from a QR code.

[0089] According to a particular embodiment of the invention, a suitable analysis module can be used to search, in the image / screenshot, for the presence of a QR Code carrying a URL which will then be analyzed.

[0090] In step 302, the process retrieves all analysis results (e.g., scores), processes them, and modifies all or part of the digital content depending on the processing results. In other words, the digital content is modified partially or completely when at least one analysis result for a piece of data indicates a non-zero risk level (e.g., a score other than 20 / 20). Indeed, a single analysis result indicating risk is sufficient for the digital content to be considered risky.

[0091] Alternatively, the digital content is modified partially or completely when the average grade reaches a specific threshold or score (e.g., 15 / 20). Therefore, a certain number of non-zero results may be required for the average grade to reach the expected threshold or score. Naturally, the threshold can be defined so that it is reached as soon as a data analysis indicates a non-zero risk level.

[0092] In the case where the threshold corresponds to a score of 15 on a scale of 0 to 20 (0 being the worst score and 20 the best), the process can, for example, modify the analyzed digital content as soon as the average of the scores is less than or equal to this threshold.

[0093] It should be noted that other scales for assessing the level of risk associated with data can be implemented by the invention (ascending, descending, numerical, alphanumeric scales, etc.). The method then modifies the analyzed numerical content when the rating / score reaches and / or exceeds the predefined threshold, either upwards or downwards.

[0094] According to a particular embodiment of the invention, when the data corresponds to an image, the process can, for example, modify the size, contrast, brightness, etc. of the image.

[0095] According to a particular embodiment of the invention, when the data is a string of characters, the method can, for example, modify the style (bold, underlined, highlighted, strikethrough, color, font size, font, etc.) associated with all or part of the characters that constitute the string of characters.

[0096] According to a particular embodiment of the invention, when the digital content includes an HTML document and the analyzed data corresponds to data contained within an HTML document, the rendering parameter associated with the data can be included in a CSS file (a CSS file is a stylesheet used to format and organize the content of an HTML page). It is then the CSS file that is modified to highlight the data at the HTML page level. Note that the modification can consist of changing the display characteristics of a text (i.e., its style) or of an area containing the data, for example, a paragraph identified via the HTML tag. or a division identified via the HTML tag Thus, the effect produced / the modification could be a frame, a typographical change, a colored area, etc.

[0097] According to a particular embodiment of the invention, when the digital content includes audio data, the method can, for example, modify the sound volume or filter and / or amplify different frequency bands of the audio data.

[0098] According to a particular embodiment of the invention, when the digital content corresponds to an image and the data is included within the image, the method can obtain a relative or absolute position of the data within the image and then add to the digital content (i.e., the image) a geometric figure (rectangle, square, circle, etc.) centered on the obtained position. This embodiment makes it possible to surround the area of ​​the image containing the data so as to focus the user's attention on this area. The data and its position are, for example, detected within the image using a computer vision or optical character recognition technique, whether or not implemented by the analysis method.

[0099] During step 303, the process provides (graphically and / or audibly) the modified digital content to user 100. This feedback improves user 100's understanding of the analysis by highlighting the elements / data in the content that the device deemed suspicious. Figures 4a and 4b illustrate an example of modified content according to a particular embodiment of the invention. In this example, the digital content is a screenshot of an SMS received on a user's mobile device. Figure 4a corresponds to the screenshot / image before analysis, and Figure 4b corresponds to the screenshot / image modified after analysis. In Figure 4a, the data deemed suspicious is surrounded by a white rectangle.This refers to the phone number from which the message was sent, which is a mobile number not authorized to send this type of message (i.e., a message from the administration responsible for collecting unpaid fines). It also refers to the supposed sender of the message at the beginning (ANTAI). In fact, this administration never sends SMS messages but communicates by mail or via a dedicated online portal. Finally, the URL is not a known valid, or secure, URL.

[0100] According to a particular embodiment of the invention, a method as described above is characterized in that the restitution step further comprises at least the restitution of information associated with said at least one data point. This embodiment allows, for each analyzed element / data point considered suspicious, the restitution of information (audio and / or textual) associated with the data point in question. This information may, for example, characterize / explain the associated level of risk.

[0101] It goes without saying that the embodiment described above is purely illustrative and in no way limiting, and that numerous modifications can easily be made by a person skilled in the art without departing from the scope of the invention. According to other specific embodiments of the invention, the invention also applies to the analysis of an email, for example, using a module adapted to analyze an attachment. Analyzing the attachment might, for instance, involve searching for a threat such as malicious executable code (a macro command in a document, a virus embedded in an executable, etc.). In this case, the method will modify the graphical representation of the email attachment, for example, by highlighting it.

Claims

Method for analyzing at least one digital content, said method being implemented by an analysis device and characterized in that it comprises: - a step of obtaining at least one data included in said at least one content; - a step of determining at least one analysis result associated with said at least one data; and when said at least one analysis result indicates that a risk level associated with said at least one content has reached a threshold - a step of modifying and returning said content, said return including at least the analysis result associated with said at least one data. A method according to claim 1 characterized in that said modification step comprises at least the modification of at least one output parameter associated with said at least one data point. Method according to claim 1 characterized in that said modification step comprises: - a step of obtaining at least one position of said at least one data within said content; - a step of adding at least one graphic and / or audio element in the vicinity of said position. Method according to claim 1 characterized in that the format of said digital content comprises a text and / or an image and / or an audio sequence and in that said rendering is carried out graphically and / or vocally. A device for analyzing at least one piece of digital content, said device being configured to implement the following steps: - a step of obtaining at least one piece of data included in said at least one piece of content; - a step of determining at least one analysis result associated with said at least one piece of data; and when the value of said at least one analysis result indicates that a risk level associated with said at least one piece of content has reached a threshold - a step of modifying and returning said content, said return including at least the analysis result associated with said at least one piece of data. Server and / or terminal comprising an analysis device according to claim 5. Computer program comprising instructions for implementing the method according to any one of claims 1 to 4, when the program is executed by a processor. Computer-readable information carrier containing instructions for a computer program according to claim 7.

Images