# US 2025/0148079 A1 · Mobile security file leakage detection method and system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0148079 A1
- Document ID: US20250148079A1
- Status: Published application
- Kind: A1
- Application number: 18/948,632
- Filed: 2024-11-15
- Published: 2025-05-08
- Earliest claimed: 2023-11-02
- Assignees: UROCK Inc.
- Applicants: UROCK Inc.
- Inventors: Hong Sun LEE; Jang Hoon KIM; Jae Hwan LEE; Sung Woo AN; Bong Seok YOU; Jeong Min HONG; Seon Ho HWANG; Jae Wook JEONG
- Web page: https://patentgrep.com/patent/US20250148079A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method of detecting mobile security file leakage of the present disclosure includes receiving, by a detection server, an operating system type from a mobile device, connecting, by the detection server, to the mobile device depending on an operating system to load a media file system, checking an analysis setting time by the detection server connected to the mobile device, analyzing, by the detection server, the media file system to detect presence or absence of an abnormality, generating, by the detection server, an analysis result based on presence or absence of an abnormality, checking whether there is an error in the analysis result and extracting an original file and a thumbnail file if there is no error by the detection server, deleting, by the detection server, a file from which an abnormality is detected based on the analysis result, and generating and storing a result report on the analysis result by the detection server, wherein the operating system type is at least one of a first operating system and a second operating system.

## Claims

### Claim 1

A method of detecting mobile security file leakage, comprising:
receiving, by a detection server, an operating system type from a mobile device;
connecting, by the detection server, to the mobile device depending on an operating system to load a media file system;
checking an analysis setting time by the detection server connected to the mobile device;
analyzing, by the detection server, the media file system to detect presence or absence of an abnormality;
generating, by the detection server, an analysis result based on presence or absence of an abnormality;
checking whether there is an error in the analysis result and extracting an original file and a thumbnail file if there is no error by the detection server;
deleting, by the detection server, a file from which an abnormality is detected based on the analysis result; and
generating and storing a result report on the analysis result by the detection server,
wherein the operating system type is at least one of a first operating system and a second operating system, and the analyzing, by the detection server, the media file system to detect presence or absence of an abnormality comprises:
when the operating system type received from the mobile device is the first operating system, performing, by the first operating system, general analysis to analyze directory files, application-specific directories, and deleted data in the media file system;
performing, by the first operating system, detailed analysis to analyze a file system and logs in the media file system;
performing, by the first operating system, hidden analysis to analyze DB files, DB logs, and a security folder in the media file system; and
detecting, by the first operating system, presence or absence of an abnormality through analysis content of at least one of the general analysis, detailed analysis, and hidden analysis.

### Claim 2 (depends on 1)

The method of claim 1, wherein the detection server uses, as criteria for determining presence or absence of an abnormality, a case in which use of a camera is detected during the analysis setting time in the media file system, a case in which creation and modification of a directory and a file are detected during the analysis setting time, a case in which a usage pattern of the mobile device is analyzed to detect media file creation and action different from the pattern, and a case in which an abnormality is determined by extracting necessary data from media-related DB data.

### Claim 3 (depends on 1)

The method of claim 1, wherein the analyzing, by the detection server, the media file system to detect presence or absence of is an abnormality comprises:
performing, by the second operating system, general analysis to analyze directory files, application-specific directories, and deleted data in the media file system when the operating system type received from the mobile device is the second operating system;
performing, by the second operating system, detailed analysis to analyze media resource files in the media file system; and
detecting, by the second operating system, presence or absence of an abnormality through analysis content of at least one of the general analysis and the detailed analysis.

### Claim 4

A mobile security file leakage detection system comprising:
a mobile device configured to transmits an operating system type to a detection server and connected to the detection server depending on the operating system type; and
the detection server configured to receive the operating system type from the mobile device, connect to the mobile device depending on an operating system to load a media file system, check an analysis setting time, analyze the media file system to detect presence or absence of an abnormality, generate an analysis result based on presence or absence of an abnormality, check whether there is an error in the analysis result, extract an original image and a thumbnail image if there is no error, delete a file from which an abnormality is detected based on the analysis result, and generate and store a result report on the analysis result,
wherein, when the detection server analyzes the media file system to detect presence or absence of an abnormality, if the operating system type received from the mobile device is a first operating system, the first operating system performs general analysis to analyze directory files, application-specific directories, and deleted data in the media file system, performs detailed analysis to analyze a file system and logs in the media file system, performs hidden analysis to analyze DB files, DB logs, and a security folder in the media file system, and detects presence or absence of an abnormality through analysis content of at least one of the general analysis, detailed analysis, and hidden analysis.

### Claim 5 (depends on 4)

The mobile security file leakage detection system of claim 4, wherein the detection server uses, as criteria for determining presence or absence of an abnormality, a case in which use of a camera is detected during the analysis setting time in the media file system, a case in which creation and modification of a directory and a file are detected during the analysis setting time, a case in which a usage pattern of the mobile device is analyzed to detect media file creation and action different from the pattern, and a case in which an abnormality is determined by extracting necessary data from media-related DB data.