Mail monitoring method, system and device

Abstract

The invention discloses a mail monitoring method, system and device. The method comprises the following steps: acquiring an attachment carried by a new mail; computing the attachment by adopting a hash algorithm to acquire the hash features of the attachment; inputting the hash features of the attachment to a preset filter model to acquire a prediction value for predicting that the attachment is malicious software; when the prediction value is greater than the set threshold, sending the attachment to a preset sandbox tool; identifying the attachment through the preset sandbox tool; adding themalicious software mark on the attachment and rejecting the new mail when the attachment is identified as the malicious software; adding a suspicious software mark on the attachment and generating a warning mail carrying the new mail when the attachment is identified as the suspicious attachment. Through the above mail monitoring method disclosed by the invention, whether the attachment carried bythe mail is the malicious software can be quickly and accurately identified, and the mail carrying the malicious software can be timely filtered so as to guarantee the security of a mail receiving end.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a mail monitoring method, system and device. Background technique [0002] With the widespread use of e-mail, its security risks have gradually emerged. Driven by interests, hackers usually use e-mail to spread malicious codes and send spam in order to expand their botnets. Email recipients are usually hard to detect, passively becoming the target of spam and potential victims of malicious code. Hackers usually send spam by controlling botnets. The content of sent mails will change with the current hot events, and malicious links will be constructed according to the recent vulnerabilities. As a result, the mail server has never been able to filter spam and malicious mails. good measure. [0003] Patent No. CN201110442195.1 discloses a system and method for detecting unknown malware, the method includes generating genes for known malicious and clean objects; using d...

AI Technical Summary

Problems solved by technology

But, there is following defect in said method: because a lot of anti-virus systems have a time difference to the reaction of newly-occurring malicious software, when causing anti-virus systems to detect mail attachments with malicious software, a lot of mails have all been delivered and entered the user mailboxes, the anti-virus software reacts too slowly to the latest unknown samples that appear in the mail system

Secondly, because the current anti-virus software is not designed for mail system virus detection, it lacks some information for judging whether an email attachment is malware, and the detection effect of malware is poor.

Images