Method and device for detecting spear phishing emails

Abstract

The invention discloses a spear-phishing mail detection method, which comprises the steps of: obtaining mail data flow in the network, and restoring the content of the mail according to the code type of the obtained mail, so as to obtain current mail information; according to the obtained The sender information in the current mail information is used to determine whether the sender of the current mail is a frequently trusted contact of the recipient; Comparative analysis of the historical communication emails sent by the sender to the recipient, so as to determine whether the current email is a spear phishing email; When the degree reaches the threshold, at least one of the IP address, domain name and link in the current mail is extracted for comparative analysis, so as to determine whether the current mail is a spear phishing mail. The invention discloses a detection device for spear fishing emails.

Description

technical field [0001] The invention relates to the field of information security detection, in particular to a detection method and device for spear phishing emails. Background technique [0002] With the development of computer networks, the Internet has played an increasingly important role in people's daily life. And because of various flaws in the network operating system and network application program, the security problem of the Internet is becoming more and more serious. The essence of security is continuous confrontation. In recent years, with the continuous improvement of defense technology, attack techniques and methods have also been constantly changing, from the traditional direct vulnerability attack based on the target network to the indirect social engineering of computer personnel vulnerabilities. Attacks, using people's own consciousness defects to attack the target user's personal computer, mobile phone and other equipment, execute the malicious code cus...

AI Technical Summary

Problems solved by technology

However, there are certain limitations in the method of detecting linked domain names in phishing emails. For example, attackers use the method of attacking a third-party server (watering hole attack), and hang a horse on a legitimate domain name website to induce users to click on the website whose content has been tampered with. Legitimate websites, the existing methods for detecting link domain names in phishing emails cannot detect them in time

Images