Mailbox account anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention provides a mailbox account anomaly detection method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining multiple pieces of mail data of a first mailbox account within a preset time period; performing feature extraction on each piece of mail data to obtain a mail feature corresponding to each piece of mail data; and inputting the account communication feature, the communication relation feature and the mail content feature into a pre-constructed detection model, and obtaining a detection result which is output by the detection model and indicates whether the first mailbox account is abnormal or not. According to the embodiment of the invention, the account communication feature, the communication relation feature and the mail content feature are used as the feature vectors at the same time, wherein the multiple mail data are analyzed by using the machine learning algorithm, so that whether the first mailbox account has an abnormal condition or not is determined from multiple dimensions, and the detection accuracy is improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular, to a method, device, electronic equipment and storage medium for detecting abnormality of an email account. Background technique [0002] Mailboxes in corporate intranets are frequently used communication tools in daily office work, and attackers usually use mailbox servers or mailbox accounts as the entry point for attacks, such as phishing emails. Through research, researchers have found that many organizations' work mailboxes send a large number of spam emails and illegal emails internally or externally, and these mailboxes are usually completely controlled by attackers, and the above-mentioned emails occur without the attacker's knowledge. Behavior. [0003] At present, there are mainly two common methods for analyzing abnormal email behaviors: the first method: whether there is mass mailing behavior or not. Among them, mass mailing is usually judged accord...

AI Technical Summary

Problems solved by technology

The second method is to detect whether the email account has logged in at multiple different places within a short period of time. This method needs to filter the settings of the regular mail collection service, and only considers the login behavior. The detection conditions are relatively harsh, and the result is difficult to trigger

[0004] It can be seen that the accuracy of the above two methods for email account detection is low

Images