Method for judging e-mail address scanning behaviors

Abstract

The invention relates to a method for judging an address scanning behavior of an email box, which comprises the following steps of: A, if an external email and / or an external email source can be matched with a blacklist record in safety equipment, disconnecting network connection and an email communication protocol, otherwise, continuing to execute; B, a mailbox address scanning analysis system analyzing whether an external mail and / or an external mail source has an electronic mailbox address scanning behavior or not, wherein the electronic mailbox address scanning behavior comprises at leastone of mailbox address invalid frequency analysis, enumeration address analysis, same sender analysis, same theme or content analysis or mailbox suffix analysis in unit time; and C, if a scanning behavior is judged, adding the sender into a blacklist to intercept, otherwise, processing according to a normal mail. According to the invention, the problem that the traditional mail security gateway cannot effectively identify and intercept the address scanning behavior of the email box is solved, the address scanning behavior of the email box can be effectively identified and intercepted, and thesecurity and privacy of a mail system are obviously improved.

Description

technical field [0001] The invention relates to the field of computer information security, in particular to a method for judging scanning behavior of electronic mail addresses. Background technique [0002] As information technology such as paperless office and digital communication gradually enters the work of enterprises, the degree of informatization of enterprises is getting higher and higher, and the email system has played an important role in the daily office of enterprises. However, in recent years, email security incidents have occurred frequently, and accurate email address directories are publicly sold as user information on the Internet. The email system we have used for more than 40 years is facing more Internet security threats. The email system has become the weakest part of the enterprise security protection system, so strengthening the security protection of the enterprise email system must be given sufficient attention. [0003] Under normal circumstances...

AI Technical Summary

Problems solved by technology

Email attackers generally collect valid email addresses, and then list email addresses as advertising / spam marketing targets, or send targeted phishing, virus, and extortion emails for precise attacks. If the recipient accidentally clicks Related malicious emails will cause the computer to be infected with malware or the user's important data information will be stolen

[0004] In the existing solutions, although many enterprises have deployed email security gateways, this product only focuses on preventing security threats such as phishing, spam, and virus emails, and does not effectively identify and block email address scanning behaviors.

Images