A mail monitoring method, system and device

Abstract

The invention discloses a mail monitoring method, system and device. The method includes obtaining an attachment carried by a new mail; calculating the attachment by using a hash algorithm to obtain the hash feature of the attachment; input the hash feature into the preset filtering model to obtain the prediction value that the attachment is malware; when the prediction value is greater than the set threshold, send the attachment to the preset sandbox tool; through the The preset sandbox tool identifies the attachment; when the attachment is identified as malicious software, a malware mark is added to the attachment and the new email is rejected; when the attachment is identified as suspicious software, the The attachment adds a suspicious software flag and generates a warning email carrying said new email. Through the above mail monitoring method, it is possible to quickly and accurately identify whether the attachments carried by the mail are malicious software, and filter the mail carrying the malicious software in time to ensure the security of the mail receiving end.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a mail monitoring method, system and device. Background technique [0002] With the widespread use of e-mail, its security risks have gradually emerged. Driven by interests, hackers usually use e-mail to spread malicious codes and send spam in order to expand their botnets. Email recipients are usually hard to detect, passively becoming the target of spam and potential victims of malicious code. Hackers usually send spam by controlling botnets. The content of sent mails will change with the current hot events, and malicious links will be constructed according to the recent vulnerabilities. As a result, the mail server has never been able to filter spam and malicious mails. good measure. [0003] Patent No. CN201110442195.1 discloses a system and method for detecting unknown malware, the method includes generating genes for known malicious and clean objects; using d...

AI Technical Summary

Problems solved by technology

But, there is following defect in said method: because a lot of anti-virus systems have a time difference to the reaction of newly-occurring malicious software, when causing anti-virus systems to detect mail attachments with malicious software, a lot of mails have all been delivered and entered the user mailboxes, the anti-virus software reacts too slowly to the latest unknown samples that appear in the mail system

Secondly, because the current anti-virus software is not designed for mail system virus detection, it lacks some information for judging whether an email attachment is malware, and the detection effect of malware is poor.

Images