E-mail security control method, client and system

Abstract

The invention discloses an E-mail security control method, a client and a system, and relates to the technical field of network security. The method comprises the following steps: acquiring a target mail, and extracting header information, text information and / or attachment information of the target mail; judging whether the mail is a suspected phishing mail according to the header information, the text information and / or the attachment information; when judging that the mail belongs to the suspected phishing mail, sending the header information, the text information and / or the attachment information to an anti-phishing friend group for evaluation; and obtaining an evaluation result and displaying the evaluation result corresponding to the target mail. According to the invention, the detection reliability of the phishing mail is improved, and the detection and confirmation of the suspected phishing mail can be more effectively completed.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an email security control method, client and system. Background technique [0002] While the Internet has greatly facilitated people's lives, it has also brought some unsafe factors to people. For example, with the rapid development of e-commerce, phishing has become the most important and fastest-growing means of network fraud. Among them, the most common means of phishing is phishing emails. Phishing emails refer to phishing attackers sending emails with deceptive content to recipients by forging sender addresses, for example, sending deceptive spam emails claiming to be from banks or other well-known institutions to recipients, luring The recipient visits a forged web page (Web) site, or obtains sensitive information of the recipient by replying to an email. The most common phishing emails are roughly divided into three categories: Phishing emails, link phishing em...

AI Technical Summary

Problems solved by technology

[0004] For the black and white list detection mechanism, since the black and white lists are recorded based on the discovered phishing sites, setting up the dynamic update mechanism in real time also has a certain lag, and it is difficult to achieve the expected protection effect

For other detection mechanisms, whether it is for the domain name detection of email body links or the deployment of virus email gateways or attachment sandboxes, the defense effect against some special phishing email attacks is often difficult to meet expectations

As an example, due to the collection of a large amount of information on the target in advance and the targeted selection of the target, most of the spear-phishing emails use the method of stealing the trust relationship account of the attack target, or using well-designed fake notifications from well-known websites, and the content of news emails Sending emails can effectively bypass the black and white lists of mailboxes; as another example, when an attacker uses the method of attacking a third-party server (watering hole attack) to lure users to click on a legitimate website whose content has been tampered with by hanging a horse on a legitimate domain name website , the existing methods for detecting link domain names in phishing emails cannot detect them in time

At the same time, the development of Internet financial technology has also brought new changes to phishing websites, which are often more confusing and bring great challenges to traditional detection methods

Images