KR20200107612A - Apparatus for neutralizing malicious code and hidden information included in image file and driving method thereof - Google Patents

Abstract

The present invention relates to a device for neutralizing a malicious code and hidden information included in an image file and a driving method thereof. The technical problem to be solved is to analyze a structure of an original image file format and neutralize the malicious code or hidden information hidden in the image file through conversion by image data area even if no prior information on the signature or characteristics of the malicious code exists. To this end, the device for neutralizing a malicious code and hidden information include in the image file of the present invention comprises: an image file format analysis unit which checks whether the format structure of the original image file introduced through a file inflow path is a normal structure consisting of image header information, image additional information, and an image data area; and an image file conversion unit electrically connected with the image file format analysis unit, receiving the original image file of a normal structure from the image file format analysis unit, and generating a conversion image file by sequentially converting each of the image header information, the image additional information, and the image data area to generate a conversion image file.

Description

Device for neutralizing malicious code and hidden information contained in image files and its operation method {APPARATUS FOR NEUTRALIZING MALICIOUS CODE AND HIDDEN INFORMATION INCLUDED IN IMAGE FILE AND DRIVING METHOD THEREOF}

Various embodiments of the present invention relate to an apparatus for disabling malicious code and hidden information included in an image file and a driving method thereof.

Malicious codes, which are becoming more intelligent, are inserted into not only executable files (PE, ELF, etc.) but also various document-type files (MS Office, HWP, PDF, Images, etc.) and are used for attacks. To detect such malicious codes, signature-based anti-virus technology and content disarm & reconstruction (CDR) technology that removes active content (Macro, JavaScript, etc.) in files are mainly used. In addition, machine learning technology is applied to classify known malicious code files as reputation-based or unknown malicious code files.

Meanwhile, among document-type files, malicious code is inserted into an image file and used for attack, and a number of malicious code concealed image files are also collected in a global commercial service that analyzes malicious code based on reputation.

As such, in the case of malicious code concealment type image files, known malicious code concealment type image files are detected and secured through conventional signature-based anti-virus or content detoxification and recombination technology, but unknown malicious codes are concealed. There is no reputation information or signature for the image file, which makes it difficult to detect.

In addition, steganography is an information hiding method in which information to be hidden is subtly inserted into media such as images or audio so that the existence of the information itself is not revealed. It is difficult to detect when malicious code is concealed in an image file using steganography and transmitted by an outsider (Stegosploit, Shellcode hiding, etc.) or if an insider intentionally leaks information using an image file that conceals confidential information. There are also limitations in clearly determining whether or not information is hidden.

Registered Patent 10-1865785 (2018.06.01)

The problem to be solved according to an embodiment of the present invention is to analyze the structure of the original image file format even if there is no prior information on the signature or characteristic of the malicious code, and convert the image data area to the malicious code or hidden information hidden in the image file. It is to provide an apparatus and a driving method for disabling malicious code and hidden information included in an image file capable of incapacitating an image file.

An apparatus for neutralizing malicious code and hidden information included in an image file according to the present invention and a driving method thereof include the format structure of the original image file introduced through the file inflow path, consisting of image header information, image additional information, and image data area. An image file format analysis unit that checks whether it has a normal structure, and an image file format analysis unit that is electrically connected to the image file format analysis unit, and receives the original image file of a normal structure from the image file format analysis unit. It may include an image file conversion unit that sequentially converts each of the image data areas to generate a converted image file.

When the file introduced through the file inflow path is a document file, an image file extracting unit for extracting an image file included in the document file and providing it to the image file format analysis unit may be further included.

A converted image file management unit including a storage that is electrically connected to the image file conversion unit and stores the converted image file converted by the image file conversion unit and a hash value of the original image file that is the original image of the converted image file. It may further include.

The image file conversion unit calculates the hash value of the original image file received from the image file format analysis unit, and the converted image file management unit calculates the hash value of the image file identical to the hash value information of the original image file and the corresponding conversion You can check and receive an image file.

The converted image file management unit may store the hash value of the stored original image file and the converted image file corresponding thereto for a predetermined period of time based on the creation time, and then delete and periodically update the hash value.

The image file conversion unit converts the image header information by converting the identification signature corresponding to the original image file into an identification signature of the image format to be converted, and filters the image additional information to a specific string frequently used in a malicious code script ( html, head, script, etc.), and the image data area can be converted to a converted image file by using a nonlinear transfer function.

이며,

는 비선형 전달 함수의 특성을 갖게 하는 특정

범위값(0.950<

<0.995 or 1.005<

<1.050)이고, W 는 알파 채널의 적용 유무(ON or OFF)일 수 있다. The nonlinear transfer function for transforming the image region is

Is,

Is a specific

Range value (0.950<

<0.995 or 1.005<

<1.050), and W may indicate whether an alpha channel is applied (ON or OFF).

의 값을 특정한 범위 값으로 한정함으로써 변환 값이 각 픽셀의 하위 비트(Leat Significant Bit)가 1~4 비트 이하에서만 변화시킬 수 있다. The image file conversion unit in a nonlinear transfer function for converting the image area

By limiting the value of to a specific range value, the converted value can be changed only when the lower bit (Leat Significant Bit) of each pixel is 1 to 4 bits or less.

The image file format analysis unit may further check whether the original image file is an animation image format.

When the image file conversion unit receives the animation image format from the file format analysis unit, the animation image file may be divided into separate image files of the same format by the number of animations, and then each of the plurality of separated image files may be converted.

In addition, the apparatus for neutralizing malicious code and hidden information included in an image file according to the present invention and its driving method include the format structure of the original image file introduced through the file inflow path as image header information, image additional information, and image data area. The image file format structure analysis step checked by the image file format analysis unit to check whether or not the structure is a normal structure, and the image file conversion unit receives the original image file of a normal structure from the image file format analysis unit, and image header information, An image file conversion step of generating a converted image file by sequentially converting each of the image additional information and the image data area may be included.

Before the step of dividing the image file format structure, if the file introduced through the file inflow path is a document file, an image file extracting unit extracts an image file included in the document file and provides the original image to the image file format analysis unit A file extraction step may be further included.

Prior to the image file conversion step, calculating a hash value of the original image file received from the image file format analysis unit in the image file conversion unit, and a hash value of the original image file in the storage of the converted image file management unit The step of checking whether a hash value of the image file identical to the information and a converted image file corresponding thereto are stored.

After the image file conversion step, the converted image file converted by the image file conversion unit and the original image file stored in the converted image file management unit for storing a hash value of the original image file that is the original image of the converted image file The hash value of and the converted image file corresponding thereto may be stored only for a certain period of time as a time point, and then deleted and periodically updated. The image file storage and periodic update steps may be further included.

In the image file format structure analysis step, if the image file format analysis unit determines that the format structure of the original image file is not a normal structure, the image file format analysis unit provides and converts a designated arbitrary file through a file outflow path. You can signal that this is a failed image.

In the image file conversion step, the image file conversion unit converts the image header information by converting the identification signature corresponding to the original image file into an identification signature of an image format to be converted, and the image additional information Additional information conversion step of filtering a specific string frequently used in malicious code scripts (html, head, script, etc.) and converting the image data area using a nonlinear transfer function, and converting data into a converted image file It may include steps.

In the image file conversion step, before the header information conversion step, when the image file format analysis unit checks whether the original image file is an animation image format, and the image file conversion unit receives the animation image format from the file format analysis unit And separating the animation image files into separate image files of the same format as many as the number of animations.

In the image file conversion step, after the data conversion step, in the image file conversion unit, when the original image file is in the animation image format, checking whether conversion of all separated image files has been completed, and the image file conversion unit When the conversion of the split image file is completed, the step of reassembling converted image files of the split image files corresponding to the animation image format into one image format identical to the original image format may be further included.

이며,

는 비선형 전달 함수의 특성을 갖게 하는 특정 범위값(0.950<

<0.995 or 1.005<

<1.050)이고, W 는 알파 채널의 적용 유무(ON or OFF)일 수 있다. The nonlinear transfer function for transforming the image region is

Is,

Is a specific range of values (0.950<) that characterizes the nonlinear transfer function.

<0.995 or 1.005<

<1.050), and W may indicate whether an alpha channel is applied (ON or OFF).

의 값을 특정한 범위 값으로 한정함으로써 변환 값이 각 픽셀의 하위 비트(Leat Significant Bit)가 1~4 비트 이하에서만 변화시킬 수 있다. In the nonlinear transfer function to transform the image area

By limiting the value of to a specific range value, the converted value can be changed only when the lower bit (Leat Significant Bit) of each pixel is 1 to 4 bits or less.

The device for disabling malicious code and hidden information included in an image file according to the present invention and a driving method thereof include a device for disabling malicious code and concealed information included in the image file, and the method thereof is a malicious code or hidden information hidden in the original image file. Without applying any analysis or detection technique, the structure of the image file format is analyzed and data for each area is converted to neutralize malicious code operation or hidden information, thereby preventing the spread of malicious code or information leakage. .

In addition, the device for incapacitating the malicious code and hidden information included in the image file according to the present invention and the driving method thereof are different from the signature-based anti-virus or reputation analysis, content detoxification and reassembly technology of known malicious codes. It is possible to disable malicious code operation in advance without any prior information about the signature or characteristic of unknown malicious code.

In addition, the device for incapacitating the malicious code and hidden information included in the image file according to the present invention and the driving method thereof are such that the converted image file in which the malicious code or hidden information included in the original image file is disabled cannot be distinguished by the naked eye. It can provide a level similar to the original image quality.

1 is a structural diagram illustrating an apparatus for disabling malicious code and hidden information of an image file according to an embodiment of the present invention.
2 is an example of a normal image file structure and a bad image file structure.
3 is a flowchart illustrating a method of driving the apparatus for disabling malicious code and hidden information of the image file of FIG. 1.
FIG. 4 is a detailed flowchart illustrating a step of converting an image file in the driving method of the apparatus for disabling malicious code and hidden information of the image file of FIG. 3.
5 is a structural diagram illustrating a method of converting the image file of FIG. 4 for each area.
6 is an example of an image data conversion result in the image file of FIG. 5.
7 and 8 are simulation results in which malicious code or hidden information is disabled through the device for disabling malicious code and hidden information of an image file of the present invention and a driving method thereof.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The embodiments of the present invention are provided to more completely describe the present invention to those of ordinary skill in the art, and the following examples may be modified in various other forms, and the scope of the present invention is as follows. It is not limited to the examples. Rather, these embodiments are provided to make the present disclosure more faithful and complete, and to completely convey the spirit of the present invention to those skilled in the art.

In addition, in the following drawings, the thickness or size of each layer is exaggerated for convenience and clarity of description, and the same reference numerals refer to the same elements in the drawings. As used herein, the term "and/or" includes any and all combinations of one or more of the corresponding listed items. In addition, the meaning of "connected" in the present specification means not only the case where the member A and the member B are directly connected, but also the case where the member A and the member B are indirectly connected by interposing a member C between the member A and the member B do.

The terms used in this specification are used to describe specific embodiments, and are not intended to limit the present invention. As used herein, the singular form may include the plural form unless the context clearly indicates another case. Further, as used herein, "comprise" and/or "comprising" specifies the presence of the mentioned shapes, numbers, steps, actions, members, elements and/or groups thereof. And does not exclude the presence or addition of one or more other shapes, numbers, actions, members, elements, and/or groups.

A preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement the present invention.

Referring to FIG. 1, a structural diagram showing an apparatus for disabling malicious code and hidden information of an image file according to an embodiment of the present invention is shown.

As shown in FIG. 1, the apparatus 100 for neutralizing malicious code and hidden information included in an image file includes an image file extracting unit 110, an image file format analysis unit 120, and an image file conversion unit 130. And a converted image file management unit 140. First, the device 100 for incapacitating malicious code and hidden information included in the image file is interposed between the file inflow path 10 and the file outflow path 20, and the image file introduced through the file inflow path 10 Alternatively, the image file included in the document may be converted to neutralize malicious code or hidden information and provided as a file leakage path 20. The device 100 for incapacitating malicious codes and hidden information included in such image files can not only disable malicious codes by converting image files or image files included in documents, but also in-house. An image file that hides confidential information leaking to the outside or an image file included in a document can be converted to prevent leakage of confidential information. Here, when the file inflow path 10 is an internal network, the file outflow path 20 may be an external network, and when the file inflow path 10 is an external network, the file outflow path 20 may be an internal network. That is, the device 100 for incapacitating malicious code and hidden information included in an image file is an image file interposed between the file inflow path 10 and the file outflow path 20, or an image file included in the document. It can be leaked after disabling malicious code and hidden information by converting it.

First, the image file extraction unit 110 includes various document files (doc, ppt, xls, hwp) introduced from the file inflow path 10 such as the Internet (web-site), desktop PC, notebook, and mobile terminal. , odt, odp, etc.) or an image object (OLE) included in the image file (JPEG, GIF, PNG, BMP, etc.). In addition, the image file extraction unit 110 may check the image file from the file extension and file header information of the image file introduced from the various file introduction paths 10. That is, the image file extraction unit 110 may check image files introduced from the various file entry paths 10 or extract image files included in the document file. Here, the image file extraction unit 110 may check and extract the identification signature of the image file format from the extension or file header information of each document file in order to select only the image file from the imported document file.

Hereinafter, the image file extracted or confirmed by the image file extraction unit 110 will be referred to as an original image file. The image file extraction unit 110 may transmit the original image file to the image file format analysis unit 120.

In addition, the image file format analysis unit 120 analyzes the format structure of the original image file transmitted from the image file extraction unit 110. In general, the format structure of a normal image file may include image header information, image additional information, and an image data area. First, the image file format analyzer 120 may determine the type of image (JPEG, GIF, PNG, BMP, etc.) from header information of the original image file. In addition, the image file format analysis unit 120 may determine whether the structure of the original image file is a normal structure based on basic image file format structure information according to each image type. Here, the image file format analysis unit 120 may store image file format structure information according to various image types, or may receive an image file format structure from a memory in which image file format structure information according to various image types is stored. The image file format analysis unit 120 may determine whether the original image file has a normal structure through header information and a format structure, and transmit the information to the image file conversion unit 130. For example, a method of determining whether the format structure is a normal structure can be determined by checking whether the image header information, image additional information, and image data area of the original image file are the same as the data structure of the reference format.

The image file format conversion unit 130 may receive the original image file determined as a file having a normal structure from the image file format analysis unit 120. The image file conversion unit 130 may convert image header information, image additional information, and image data areas of the original image file to correspond to the converted image file. First, the image file format analyzer 120 may change the file identifier information of the original image header from the image header information into the file identifier information of the converted image header. In addition, the image file conversion unit 130 may copy information other than a specific string from the original image additional information from the image additional information to the additional information area of the converted image file. In addition, the image file conversion unit 130 may convert the attribute value of the original image by applying a nonlinear transfer function of a specific range value in order to neutralize the characteristics of the malicious code or hidden information in the image data area. The image file conversion unit 130 may provide the converted image file through the file outflow path 20 instead of the original image file.

The converted image file management unit 140 is electrically connected to the image file conversion unit 130, and in order to prevent a reduction in processing speed due to repetitive conversion of the same image file, hash value information of the original image file for the converted image file Can be saved. The converted image file management unit 140 may include a storage for storing hash value information of the original image file for the converted image file. In addition, the converted image file management unit 140 may periodically update by deleting the hash value of the image file that has elapsed for a predetermined time or longer, among hash value information of the image file stored in the storage.

Referring to FIG. 2, an example of a normal format structure (a) of an original image file and a bad image file format structure (b, c, d, e) including malicious code and hidden information are shown.

As shown in FIG. 2, the bad image file format structure (b, c, d, e) is intended to describe examples in which malicious codes or hidden information may be inserted or altered in a certain area of an image file. In addition, the structure of the bad image file format (b, c, d, e) shows four structures in FIG. 2, but these are exemplary, and in the present invention, the structure of the bad image file format (b, c, d, e) is 4 types. It is not limited to. Hereinafter, a method of checking the bad image file format structure (b, c, d, e) in the apparatus 100 for neutralizing malicious code and hidden information included in the image file of the present invention will be described.

Here, the normal format structure (a) may have image header information, image additional information, and an image data area.

For example, as in the first defective image file format structure (b), only the file identification signature for the image type is displayed in the image header information area, and malicious code scripts (JavaScript, HTML, PHP, etc.) are inserted in other areas. There is a structure. The first defective image file format structure (b) may not be detected when the MIME type is determined only by header information, but the image file format analysis unit 120 of the present invention includes image header information having a normal format structure, Since the image additional information and the image data area are not included, it may be determined as a defective image.

In addition, the image format is composed of the second bad image file format structure (c), but at the end of the data, malicious code binaries (PE, DLL, ELF, etc.), malicious code scripts, confidential information (company information, personal information, etc.) There is also a format structure that exploits the addition of a light so that image viewing applications only process up to the end of the image (EOI) and areas after that are ignored.

In addition, as in the third bad image file format structure (d), if the malicious code is of DBD (Drive by Download) type, it is introduced as an image file at the time of download, and then the malicious code script is placed in the additional information area of the image file format. There is also a format structure for restoring the malicious code hidden by the malicious code script by inserting and hiding the malicious code in the image data area (image pixel information).

In the second bad image file format structure (c) and the third bad image file format structure (d), if various encryption and obfuscation algorithms are used or steganography algorithms are used to conceal malicious codes, the signature It can bypass anti-virus (AV) or reputation-based detection techniques, and analysis can be difficult even with machine learning-based techniques. However, in the present invention, the original image file may be converted for each area of the image header information, the additional image information, and the image data area, and a converted image file without malicious code or hidden information may be provided through the file outflow path 20.

In addition, in the case of intentional information leakage by concealing confidential information in the image data area by exploiting various steganography algorithms or tools, such as the fourth defective image file format structure (e), analyze or detect the presence of hidden information. Can be very difficult. However, in the present invention, since a nonlinear transfer function of a specific range value is applied to neutralize the characteristics of malicious codes or hidden information when converting a data area, it is possible to provide a converted image file without malicious code or hidden information.

Referring to FIG. 3, a flow chart showing a method of driving an apparatus for disabling malicious code and hidden information of an image file shown in FIG. 1 is shown. A method of driving the device for disabling malicious code and hidden information of the image file will be described with reference to the device for disabling malicious code and hidden information of the image file shown in FIG. 1.

As shown in FIG. 3, the driving method of the device for disabling malicious code and hidden information of an image file includes an original image file extraction step (S10), an image file format structure analysis step (S20), an image file conversion step (S30), and an image. A file storage and periodic update step (S40) may be included.

First, in the original image file extraction step (S10), the image file extraction unit 110 extracts only image files from various document files introduced from the various file introduction paths 10. In addition, in the original image file extraction step (S10), the image file may be checked from the file extension and file header information of the files introduced from the various file inflow paths 10.

In addition, in the image file format structure analysis step (S20), the original image file extracted by the image file extraction unit 110, and the original image file in the image file format analysis unit 120 are composed of a data structure of a reference format for each image. Analyze. Here, when it is determined that the image file format is a normal configuration, the image file conversion unit may calculate a hash value of the original image file and check whether file information of the same hash value is stored in the converted image file management unit 140. In the image file conversion step S30, the original image file is converted for each information area, and the converted image file is stored in the storage of the converted image file management unit 140 as shown in FIG. 3. In the image file storage and periodic update step (S240), the creation time of the stored image file is stored for a certain period of time as a starting point, image files that have passed the period are deleted, and this process is periodically repeated and updated. Here, a certain period can be arbitrarily set and changed.

More specifically, in the original image file extraction step (S10), the image file extraction unit 110 identifies the image file format from the file extension and file header information among files collected through various file inflow paths 10 ( S11) is checked, and the original image file is extracted. For example, in order to select an image file in a JPEG format, the image file extracting unit 110 may have an extension of'JPEG' or'JPG' or an identification signature of a file header of'FF D8 FF DB'. Or, it can be extracted if it matches'FF D8 FF E0' or'FF D8 FF E1'. In addition, the image file extracting unit 110 may receive the extensions of various image files and the identification signatures of the image file headers from a memory (not shown) stored therein, or may know them through information stored in the image file extracting unit 110. .

In addition, the image file extraction unit 110 refers to the format structure of each document file even in the case of MS Office document files (doc, docx, ppt, pptx, xls, xlsx) or HWP document files (hwp, hwpx) Only image objects included in can be extracted. For example, in the case of a document file, only image objects included in the document file can be extracted into a specific folder using the open document format structure provided by the product manufacturer.

In the image file format structure analysis step (S20), the image file format analysis unit 120 checks whether the format structure of the original image file extracted in the original image file extraction step (S10) is a normal structure. At this time, the image file format analysis unit 120 stores image file format structure information according to various image types, or receives image file format structure information from a memory in which image file format structure information according to various image types is stored (S21). I can. The image file format analysis unit 120 checks only that the file identifier, image additional information, and image data area of the original image file format are configured identically to the format structure information of the basic image file, and the actual data are valid range values. Recognition is checked by the image file conversion unit 130. For example, when the format of the original image file is a JPEG format image file, the image file format analysis unit 120 starts with a file identifier of 0xFFD8 (Start of Image) and the image additional information area is 0xFFE0 to 0xFFEF ( Application Marker), when the image data area starts with 0xFFC0 (Start of Frame) and the end of the image format is 0xFFD9 (End of Image), it can be determined that the image file has a normal structure.

In addition, when the format structure of the original image file is not an image file having a normal structure, the image file format analysis unit 120 may determine that the original image file is a format that cannot be converted (S25). In this way, if the original image file is not in a convertible format, it can be provided by replacing the image file with a designated arbitrary image file (S26) to inform that the image has failed to be converted to the file leakage path (20). An arbitrary image file designated as the outflow path 20 may be provided (S50).

In addition, when the format structure of the original image file is an image file having a normal structure, the image file format analysis unit 120 may determine that it is a format capable of conversion (S25). In addition, when the image file format analysis unit 120 determines that the format structure of the original image file is a normal structure, the image file conversion unit 130 may receive the original image file and convert it into a converted image file.

First, when the image file conversion unit 130 receives the original image file, it may calculate a hash value for the original image file. The image file conversion unit 130 may calculate a hash value of an original image file using a hash algorithm such as SHA256 or MD5, but the hash algorithm is not limited in the present invention. Also, the image file conversion unit 130 may check whether a file having the same hash value is stored in the storage of the converted image file management unit 140 (S28). In this case, if a file having the same hash value is stored in the storage, the converted image file management unit 140 may extract the file and transmit the converted image file corresponding to the hash value to the image file conversion unit 130. Also, the converted image file management unit 140 may periodically update the converted image file corresponding to the stored hash value (S40).

Also, when there is no file having the same hash value in the storage of the converted image file management unit 140, the image file conversion unit 130 may perform image conversion on the original image file (S30).

In addition, in the image file conversion step S30, the image file conversion unit 130 may convert image header information, image additional information, and image data regions of the original image file for each region so as to correspond to the converted image file. In addition, in the image file conversion step S30, the converted image file may be stored in the storage of the converted image file management unit 140 together with the hash value of the original image (S40). In addition, the hash value of the original image file stored in the converted image file management unit 140 may be used to check the converted image file having the same hash value (S28).

In the image file conversion step (S30), even if malicious code or confidential information is hidden and inserted into the original image file, the malicious code or confidential information can be removed from the image file because the conversion is performed for each area. This image file conversion step (S30) will be described in detail with reference to FIG. 4.

In addition, the image file conversion unit 130 converts the converted image file in the image file conversion step (S30) or the converted image file result (S50) having the same hash value extracted from the converted image file management unit 140 instead of the original image file. Thus, it can be provided through the file outflow path 20. That is, in the file leakage path 20, instead of the original image file inserted by hiding malicious code or confidential information through the device 100 for incapacitating malicious code and hidden information included in the image file, malicious code or confidential information A converted image file, which is an image file from which information has been removed, can be provided.

In addition, in the image file conversion step (S30), as shown in FIG. 2, malicious code is intentionally inserted into the image, or malicious code is intentionally inserted into the image as shown in FIG. Even when code or confidential information is concealed, its characteristics can be eliminated through a conversion process for each image information area.

Referring to FIG. 4, a flowchart illustrating a method of converting an original image file into a converted image file in an image file conversion step in the method of driving the apparatus for disabling malicious code and hidden information of the image file shown in FIG. 3 is shown.

The method (S30) of converting the original image file shown in FIG. 4 into a converted image file includes an animation format confirmation step (S31), an animation image separation step (S32), an image header and additional information area change step (S33), and image data. A region conversion step (S34), a conversion confirmation step (S35), and a converted image post-processing step (S36) may be included. Hereinafter, a method S30 of converting an original image file into a converted image file will be described in detail with reference to FIGS. 1 to 4.

First, in the animation format confirmation step (S31), in the image file format structure analysis step (S20) of FIG. 2, the image file format analysis unit 120 determines that the format of the original image file is an image format (GIF, APNG, WebP, etc.) that supports animation. ).

In addition, when the image file conversion unit 130 receives the original image in the animation image format from the image file format analysis unit 120, the animation image may be separated into image files of the same format as the number of animations (S32).

For example, when the original image file is a GIF format (GIF89a) supporting animation, the image file conversion unit 130 starts with GIF89a (0x4749 0x4638 0x3961) and the Graphic Control Extension item By checking the block size after (0x21F9), the animation format can be separated by the number of each image file. Hereinafter, a plurality of image files obtained by separating an original image of an animation format will be referred to as a separate image file.

The image file conversion unit 130 converts a plurality of separated image files into converted image files for an image header area and an additional information area (S33). In addition, when the original image file transmitted from the image file format analysis unit 120 is not in the animation format, the image file conversion unit 130 converts the original image file into a converted image file for the image header area and the additional information area. (S33) You can.

In the image header and additional information conversion step (S33), as shown in FIG. 5, the original image file and the separate image file are converted into converted image files for the image header area and the image additional information area, respectively. Here, the image file conversion unit 130 converts the identification signature of the original and separated image file format provided from the memory (not shown) in which the extension of various image files and the identification signature of the image file header are stored, into the identification signature of the image format to be converted. You can convert the image header information by changing it. In addition, the image file conversion unit 130 may filter (html, head, script, etc.) a specific string frequently used in a malicious code script to convert the image additional information area. In addition, a specific string filtering conversion (TF2) method can be applied to convert the image additional information area. For example, keywords (html, head, script, type, etc.) related to JavaScript, PHP, HTML, etc. are set to 0x00. It is possible to change the copy and not affect the original size, but the present invention is not limited thereto.

The image file conversion unit 130 may convert the image header information area and the image additional information area of the original and separate image files, and then convert the image data area into a converted image file (S34).

In the image data region conversion step S34, the image file converter 130 may convert pixel data values of the image data region through a nonlinear transfer function as shown in FIG. 5. Here, the pixel data to be converted is RGB (or YCbCr) color, and the RGB values of each pixel in the original and separated image data areas are converted through a nonlinear transfer function and copied to the converted image data area.

Additionally, FIG. 6 shows an example showing a process in which the RGB value ([RGB]in) of one pixel of the original or separated image file is converted to the converted pixel RGB value ([RGB]out) at the same location through a nonlinear transfer function. have. As shown in FIG. 5, a nonlinear transfer function for converting an image data area of an original or separate image file is defined and used as shown in Equation 1 below.

는 비선형 전달 함수의 특성을 갖게 하는 특정 범위값(0.950<

<0.995 or 1.005<

<1.050)의 값을 의미하고, W 는 알파 채널의 적용 유무(ON or OFF)를 의미하며 알파 채널이 적용되어 있는 이미지 포맷인 경우에만 적용될 수 있다. here,

Is a specific range of values (0.950<) that characterizes the nonlinear transfer function.

<0.995 or 1.005<

<1.050), and W means whether an alpha channel is applied (ON or OFF), and can be applied only in the case of an image format to which an alpha channel is applied.

의 값을 특정한 범위 값으로 한정함으로써 계산된 변환 값이 각 픽셀의 하위 비트(Leat Significant Bit)가 1~4 비트 이하에서만 변화되도록 제한할 수 있다. 여기서, 제한된 범위의 값으로 변환될 경우, 육안으로 구분하기 어려울 정도로 원본 및 분리 이미지 파일과 거의 유사한 품질을 유지시킬 수 있고, 악성코드가 삽입되어 있거나 유출 정보를 은닉시킨 경우에도 그 속성값이 변하게 되어 무력화되는 결과를 가질 수 있다.In addition, in the nonlinear transfer function defined by Equation 1

By limiting the value of s to a specific range value, it is possible to limit the calculated conversion value so that the lower bit (Leat Significant Bit) of each pixel is changed only from 1 to 4 bits or less. Here, when converted to a value in a limited range, it is possible to maintain the quality almost similar to the original and separated image files so that it is difficult to distinguish with the naked eye, and the attribute value changes even when a malicious code is inserted or leaked information is hidden. May have the result of being neutralized.

For example, as shown in FIG. 6, when the value of one pixel [RGB]in in the original and separated image files is (205, 107, 66), the pixel converted through the nonlinear transfer function of Equation 1 [RGB The value of ]out is calculated as (212, 110, 68). Here, when the color corresponding to the pixel value of the original and separated image files and the color corresponding to the pixel value of the converted image are compared with the naked eye, it can be seen that the converted image is almost indistinguishable.

The image file conversion unit 130 may convert the original image file into an image header information area and an image additional information area, and then terminate the conversion if the image data area is converted.

Meanwhile, in the case of the animation image format, the image file conversion unit 130 checks whether the conversion of all separated image files has been completed (S35), and if there is still a separate image file to be converted, the image header and The additional information conversion step S33 and the image data area conversion step S34 may be sequentially repeated for each image.

In addition, when the conversion of all the separated image files of the animation image format is finished, the image file conversion unit 130 reassembles the converted image files of the separated image files corresponding to the animation image format into one image format identical to the original image format. It can be completed (S36).

7 and 8, a device for disabling malicious code and concealed information included in an image file of the present invention and a simulation experiment in which malicious code or concealed information inserted in an image file performed through the driving method thereof is disabled. It is the result. Hereinafter, a simulated process of incapacitating a malicious code image file or a hidden information image file according to the present invention and a result thereof will be described in detail with reference to FIGS. 7 and 8.

7 shows a JPEG format through an image conversion process using a device for disabling malicious code and hidden information included in an image file of the present invention and a driving method thereof in case a malicious code is inserted in a GIF format image file. This is the result of a simulation of whether the malicious code is neutralized by converting it to an image file. Here, FIG. 7 shows that the malicious code is inserted as a result of checking the original image file including the malicious code in the GIF format in the VT service, and neutralizing the malicious code and hidden information included in the image file of the present invention. Through a result of reconfirming the converted image file converted by the device for and the driving method thereof, it can be determined that the characteristic of the malicious code has disappeared and has been neutralized.

In addition, FIG. 8 is a JPG format that is a normal image structure by using a steganography tool as shown in the second defective image file format structure (c) and the third defective image file format structure (d) shown in FIG. This is the result of a simulation of whether the malicious code is neutralized by converting the image file of the BMP format hidden in the image file into a JPG format image file through the image conversion process according to the present invention. Here, the original image file is a message file to be hidden using the Steganography OpenStego tool, and a malicious code file in PE format is selected, and a normal image file in JPG format is selected as the cover file, and as a result, the malicious code is hidden BMP. A format malware image file was created. In addition, it was analyzed that malicious code was not detected from the result of checking the malicious code image file in the BMP format by the VT service. However, by using the OpenStego tool, the malicious code in the PE format can be restored normally. On the other hand, the device for neutralizing the malicious code and hidden information included in the image file of the present invention and the converted image file converted by the driving method thereof are re-checked. Even if the OpenStego tool is used, the malicious code is not restored. It can be determined that it has been disabled because a failure message is displayed.

What has been described above is only one embodiment for implementing a device for neutralizing malicious code and hidden information included in an image file according to the present invention and a driving method thereof, and the present invention is not limited to the above embodiment, As claimed in the claims below, anyone of ordinary skill in the field to which the present invention pertains will have the technical spirit of the present invention to the extent that various changes can be implemented without departing from the gist of the present invention.

100: Device for neutralizing malicious code and hidden information contained in image files
110: image file extraction unit 120: image file format analysis unit
130: image file conversion unit 140: converted image file management unit

Claims (20)

An image file format analysis unit that checks whether the format structure of the original image file introduced through the file inflow path is a normal structure consisting of image header information, image additional information, and image data area; And
Electrically connected to the image file format analysis unit, the image file format analysis unit receives the original image file of a normal structure and sequentially converts image header information, image additional information, and image data areas to generate a converted image file. An apparatus for disabling malicious code and hidden information included in an image file, comprising: an image file converter to perform an image file conversion. The method of claim 1,
When the file introduced through the file inflow path is a document file, the image file extracting unit further comprises an image file extracting unit for extracting the image file included in the document file and providing it to the image file format analysis unit. A device to neutralize malicious code and hidden information. The method of claim 1,
A converted image file management unit including a storage that is electrically connected to the image file conversion unit and stores the converted image file converted by the image file conversion unit and a hash value of the original image file that is the original image of the converted image file. Device for incapacitating malicious code and hidden information included in the image file, characterized in that it further comprises. The method of claim 3,
The image file conversion unit calculates the hash value of the original image file received from the image file format analysis unit, and the converted image file management unit calculates the hash value of the image file identical to the hash value information of the original image file and the corresponding conversion A device for disabling malicious code and hidden information included in an image file, characterized in that checking and receiving whether an image file is stored. The method of claim 3,
The converted image file management unit stores the hash value of the stored original image file and the converted image file corresponding to the hash value of the stored original image file for a certain period of time as a time point of creation, and then deletes and periodically updates the malicious code included in the image file. And a device for disabling hidden information. The method of claim 1,
The image file conversion unit
Converting the image header information by changing the identification signature corresponding to the original image file into an identification signature of the image format to be converted,
The image additional information is converted by filtering (html, head, script, etc.) specific strings frequently used in malicious code scripts,
A device for neutralizing malicious code and hidden information included in an image file, comprising converting the image data region into a converted image file by converting the image data region using a nonlinear transfer function.

The method of claim 6,
The nonlinear transfer function for transforming the image region is

Is,

Is a specific range of values (0.950<) that characterizes the nonlinear transfer function.

<0.995 or 1.005<

<1.050), and W indicates whether or not an alpha channel is applied (ON or OFF). A device for neutralizing malicious code and hidden information included in an image file, characterized in that. The method of claim 7,
The image file conversion unit in a nonlinear transfer function for converting the image area

A device for neutralizing malicious code and hidden information included in an image file, characterized in that the conversion value changes only when the lower bit of each pixel is 1 to 4 bits or less by limiting the value of . The method of claim 1,
The image file format analysis unit further checks whether the original image file is an animation image format or not. The apparatus for neutralizing malicious code and hidden information included in an image file. The method of claim 8,
The image file conversion unit, when receiving the animation image format from the file format analysis unit, divides the animation image file into separate image files of the same format as many as the number of animations, and then converts each of the plurality of separated image files. A device to neutralize malicious code and hidden information contained in files. An image file format structure analysis step of checking whether the format structure of the original image file introduced through the file inflow path is a normal structure consisting of image header information, image additional information, and image data area; And
An image file conversion step of generating a converted image file by sequentially converting each of the image header information, image additional information, and image data areas by receiving the original image file of a normal structure from the image file format analysis unit from the image file conversion unit. A method of driving an apparatus for disabling malicious code and hidden information included in an image file, comprising: a. The method of claim 11,
Before the image file format structure segmentation step,
When the file introduced through the file inflow path is a document file, the image file extraction unit extracting an image file included in the document file and providing the image file format analysis unit to the image file format analysis unit further comprising: A method of operating a device to neutralize malicious code and hidden information contained in an image file to be used. The method of claim 11,
Before the image file conversion step,
Calculating a hash value of the original image file received from the image file format analysis unit by the image file conversion unit,
And checking whether the hash value of the image file identical to the hash value information of the original image file and the converted image file corresponding thereto are stored in the storage of the converted image file management unit. A method of driving a device to neutralize malicious code and hidden information. The method of claim 11,
After the image file conversion step,
The converted image file converted by the image file conversion unit and the hash value of the original image file stored in the converted image file management unit that stores the hash value of the original image file, which is the original image of the converted image file, and the corresponding conversion To neutralize malicious code and hidden information included in the image file, characterized in that it further comprises storing and periodically updating the image file by storing the image file for a certain period of time as the time point of creation, then deleting and updating periodically. How to drive the device. The method of claim 11,
In the image file format structure analysis step
When the image file format analysis unit determines that the format structure of the original image file is not a normal structure, the image file format analysis unit provides a designated arbitrary file through the file outflow path to inform the image that the conversion has failed. A device driving method for neutralizing malicious code and hidden information included in an image file to be used. The method of claim 11,
The image file conversion step
A header information conversion step of converting the image header information by converting the image header information into an identification signature of an image format to be converted from an identification signature corresponding to the original image file;
An additional information conversion step of converting the image additional information by filtering (html, head, script, etc.) a specific string frequently used in a malicious code script; And
And converting the image data region into a converted image file by converting the image data region using a nonlinear transfer function. 14. A method of driving an apparatus for neutralizing malicious code and hidden information included in an image file. The method of claim 16,
In the image file conversion step,
Before the header information conversion step
Checking whether the original image file is an animation image format in the image file format analysis unit; And
When the image file conversion unit receives the animation image format from the file format analysis unit, the method further comprises dividing the animation image file into separate image files of the same format as the number of animations. A method of driving a device to disable code and hidden information. The method of claim 17,
In the image file conversion step,
After the data conversion step
Checking whether conversion of all separated image files has been completed when the original image file is an animation image format by the image file conversion unit; And
When the conversion of all the separated image files is completed by the image file conversion unit, the step of reassembling converted image files of the separated image files corresponding to the animation image format into one image format identical to the original image format. A method of operating a device to neutralize malicious code and hidden information contained in image files. The method of claim 16,
The nonlinear transfer function for transforming the image region is

Is,

Is a specific range of values (0.950<) that characterizes the nonlinear transfer function.

<0.995 or 1.005<

<1.050), and W is whether or not an alpha channel is applied (ON or OFF). A device driving method for disabling malicious code and hidden information included in an image file, characterized in that. The method of claim 19,
In the nonlinear transfer function to transform the image area

A device for neutralizing malicious code and hidden information included in an image file, characterized in that the conversion value changes only when the lower bit of each pixel is 1 to 4 bits or less by limiting the value of Method of driving.

Images