Content-based malicious mail detecting method and system

Abstract

The invention discloses a content-based malicious mail detecting method and system. The method comprises the following steps: collecting known social worker mails of a preset post, performing a word segmentation operation to obtain high-frequency vocabularies related to the post, and forming a high-frequency vocabulary list; calculating a suspicious value of each social worker mail, wherein the suspicious value is related to the occurrence frequency of each high-frequency vocabulary occurring in the social worker mail in all mails and the occurrence times in the current mail; calculating an average suspicious value of all social worker mails of the preset post; performing the word segmentation operation on a to-be-detected mail to obtain high-frequency vocabularies occurring in the high-frequency vocabulary list; and calculating the suspicious value of the to-be-detected mail, comparing the suspicious value of the to-be-detected mail with the average suspicious value of the post, and judging whether the to-be-detected mail is a malicious mail. By adoption of the technical scheme of the invention, the detecting scheme can be adjusted according to different posts, so that the malicious mail can be detected more accurately, and the fine granularity of the screening can also be adjusted according to user requirements.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a content-based malicious mail detection method and system. Background technique [0002] E-mail has always been favored by hackers because of its obvious target, low attack cost and high return. However, if the group suffers from spam, it may cause major security problems. [0003] At present, there are dynamic and static detection technologies for mail generation on the market. However, content-based detection is a relatively fixed method, and it is difficult to flexibly adjust the filtering threshold, and it is impossible to select the appropriate filtering mode according to the needs of different positions. Contents of the invention [0004] In view of the above technical problems, the technical solution of the present invention collects the known social worker emails received by different positions of the internal staff of the enterprise or the structure, perfor...

AI Technical Summary

Problems solved by technology

However, content-based detection is a relatively fixed method, and it is difficult to flexibly adjust the filtering threshold, and it is impossible to select the appropriate filtering mode according to the needs of different positions.

Images