Spear phishing mail detection method and device

Abstract

The invention discloses a spear phishing mail detection method, which comprises the steps of: acquiring mail data traffic in a network, reverting content of an mail according to an encoding type of the acquired mail to acquire current mail information; judging whether a sender of the current mail is one of frequent trust contacts of a receiver through sender information of the acquired current mail information; if the sender is one of the frequent trust contacts of the receiver, comparing and analyzing the current mail with historical communication mails which are sent from the sender to the receiver based on multi-dimensional communication characteristics, thereby determining whether the current mail is a spear phishing mail or not; and if the sender is not one of the frequent trust contacts of the receiver, extracting at least one of an IP address, a domain name and a link in the current mail for comparative analysis when a visual similarity between the current mail and mails of well-known authoritative websites reaches a threshold value, thereby determining whether the current mail is a spear phishing mail or not. The invention further discloses a spear phishing mail detection device.

Description

technical field [0001] The invention relates to the field of information security detection, in particular to a detection method and device for spear phishing emails. Background technique [0002] With the development of computer network, the Internet has played an increasingly important role in people's daily life. And because of various flaws in network operating systems and network applications, Internet security problems are becoming more and more serious. The essence of security is continuous confrontation. In recent years, with the continuous improvement of defense technology, attack techniques and methods have also been constantly changing, from the traditional direct vulnerability attack based on the target network to the indirect social engineering of computer personnel vulnerabilities. Attacks, using people's own consciousness defects to attack the target user's personal computer, mobile phone and other equipment, execute the malicious code customized and develope...

AI Technical Summary

Problems solved by technology

However, the method of detecting link domain names in phishing emails also has certain limitations. For example, attackers use methods of attacking third-party servers (watering hole attacks), and trick users to click on websites with tampered content by hanging horses on websites with legitimate domain names. Legitimate websites, the existing methods for detecting link domain names in phishing emails cannot detect them in time

Images