Phishing mail identification method, device, equipment and medium

Abstract

The invention discloses a phishing mail identification method and device, equipment and a medium. The method comprises the following steps: when a newly sent target mail is received, performing multi-source feature extraction on the target mail, obtaining feature vectors of various features of the target mail, and fusing the feature vectors of the various features to obtain a feature fusion result; inputting the feature fusion result into a pre-established mail recognition model, and obtaining a recognition result output by the mail recognition model; when determining that the target mail belongs to the phishing mail according to the identification result, determining whether the target mail is allowed to be displayed according to a preset screening rule; and when it is determined that the target mail is allowed to be displayed, extracting an alarm element in the target mail, and sending an alarm to a user according to an identification result and the alarm element. By adopting the technical scheme, phishing mail detection can be carried out according to the multi-source features of the mail, and the accuracy and reliability of phishing mail identification are improved.

Description

Technical Field

[0001] The present invention relates to the field of email detection technology, and in particular to a phishing email identification method, device, equipment and medium. Background Art

[0002] Phishing emails are usually sent to users disguised as regular organizations, such as e-commerce platforms. The content of these emails may induce users to click on links or enter personal information in the emails, using reasons such as winning notifications or system updates. In order to ensure the security of corporate information and personal privacy, phishing emails need to be identified in a timely manner and users need to be reminded to maintain a good network order.

[0003] Existing phishing email identification methods generally identify a single feature or a small number of features of an email, but criminals send phishing emails in various forms, and highly disguised phishing emails may not be accurately identified. In addition, the interpretability of existing phishing email identification methods is poor. Even if a phishing email is identified, it is difficult for users to understand the basis for identifying the phishing email, which is not conducive to manual intervention and optimization. Summary of the invention

[0004] The present invention provides a phishing email identification method, device, equipment and medium, which can detect phishing emails according to multi-source characteristics of emails, thereby improving the accuracy and reliability of phishing email identification.

[0005] According to one aspect of the present invention, a method for identifying phishing emails is provided, comprising:

[0006] Whenever a newly sent target email is received, multi-source feature extraction is performed on the target email to obtain feature vectors of various features of the target email, and the feature vectors of various features are fused to obtain feature fusion results;

[0007] Inputting the feature fusion result into a pre-established email recognition model, and obtaining the recognition result output by the email recognition model;

[0008] When it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule;

[0009] When it is determined that the target email is allowed to be displayed, an alarm element in the target email is extracted, and an alarm is sent to the user according to the recognition result and the alarm element.

[0010] Optionally, perform multi-source feature extraction on the target email to obtain feature vectors of various features of the target email, including:

[0011] Extract the address features, mail header features, mail body features, and attachment features of the target mail respectively, and obtain multiple feature elements corresponding to each feature;

[0012] A feature vector for each type of feature is determined based on a plurality of feature elements corresponding to each type of feature.

[0013] Optionally, the characteristic elements of the address characteristic include a full email address, a sender account name, and a sender email domain name;

[0014] The characteristic elements of the email header feature include X-header, X-return path, Message-id, DKIM, DMARC and SPF;

[0015] The characteristic elements of the email body feature include URL, redirect URL, email text, Hypertext Markup Language HTML code and pictures;

[0016] The characteristic elements of attachment features include hash, obfuscated code, and dynamic behavior.

[0017] Optionally, when it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule includes:

[0018] When it is determined that at least one of the complete email address, sender account name, and sender mailbox domain name of the target email belongs to the user whitelist, the target email is determined to be an email that is not allowed to be displayed, and a phishing email label is generated and stored correspondingly to the target email.

[0019] Optionally, when it is determined that the target email is allowed to be displayed, the warning elements in the target email are extracted, including:

[0020] When it is determined that the target email is allowed to be displayed, the email body and attachments of the target email are analyzed to obtain the inducement behavior statements in the target email, and the inducement behavior statements are determined as warning elements.

[0021] Optionally, after sending an alarm to a user according to the recognition result and the alarm element, the method further includes:

[0022] After it is determined that the user processes the target email, the user's analysis result on the target email is obtained; wherein the analysis result includes the real attribute of the target email and the misjudgment situation.

[0023] Optionally, the phishing email identification method further includes:

[0024] Whenever an update node of the email recognition model is reached, a target time period is determined according to the update node, and historical emails within the target time period are obtained;

[0025] Among them, historical emails within the target time period include normal emails received within the target time period, phishing emails determined to be not allowed to be displayed within the target time period, and phishing emails for which research and judgment results were generated within the target time period;

[0026] The email recognition model is trained again based on historical emails within the target time period to obtain an updated email recognition model.

[0027] According to another aspect of the present invention, a phishing email identification device is provided, comprising:

[0028] The feature extraction module is used to extract multi-source features of the target email whenever a new target email is received, obtain feature vectors of various features of the target email, and fuse the feature vectors of various features to obtain feature fusion results;

[0029] A model recognition module, used to input the feature fusion result into a pre-established email recognition model and obtain the recognition result output by the email recognition model;

[0030] An email screening module, for determining whether the target email is allowed to be displayed according to a preset screening rule when the target email is determined to be a phishing email according to the identification result;

[0031] The alarm display module is used to extract the alarm element in the target email when it is determined that the target email is allowed to be displayed, and send an alarm to the user according to the recognition result and the alarm element.

[0032] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0033] at least one processor; and

[0034] a memory communicatively connected to the at least one processor; wherein,

[0035] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the phishing email identification method described in any embodiment of the present invention.

[0036] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the phishing email identification method described in any embodiment of the present invention when executed.

[0037] The technical solution of the embodiment of the present invention is to extract multi-source features of the target email every time a newly sent target email is received, obtain feature vectors of various features of the target email, and then perform feature fusion to obtain feature fusion results, input the feature fusion results into a pre-established email recognition model, obtain the recognition results output by the email recognition model, and determine whether the target email identified as a phishing email is allowed to be displayed according to preset screening rules. When it is determined that the target email is allowed to be displayed, the warning elements in the target email are extracted, and an alarm is sent to the user based on the recognition results and the warning elements. This method can perform real-time phishing email recognition based on the multi-source features of the email, effectively capture the subtle features of the phishing email, effectively improve the accuracy of phishing email detection, and timely prevent phishing email attacks. Moreover, after the phishing email is identified, the result can clearly display the identification basis of the phishing email, so that the phishing email recognition is explainable and convenient for user understanding and manual intervention.

[0038] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 is a flow chart of a phishing email identification method provided according to Embodiment 1 of the present invention;

[0041] Figure 2 is a flow chart of another phishing email identification method provided according to Embodiment 2 of the present invention;

[0042] Figure 3 is a schematic diagram of the structure of a phishing email identification device provided according to Embodiment 3 of the present invention;

[0043] Figure 4 It is a schematic diagram of the structure of an electronic device for implementing the phishing email identification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0046] Embodiment 1

[0047] Figure 1 This is a flowchart of a phishing email identification method provided in the first embodiment of the present invention. This embodiment is applicable to the case of high-precision detection of phishing emails. The method can be executed by a phishing email identification device, which can be implemented in the form of hardware and / or software and can generally be configured in a computer or processor with data processing functions. Figure 1 As shown, the method includes:

[0048] S110. Whenever a newly sent target email is received, multi-source feature extraction is performed on the target email to obtain feature vectors of various features of the target email, and the feature vectors of various features are fused to obtain a feature fusion result.

[0049] Optionally, the target email may refer to a new email currently received in the mailbox.

[0050] Optionally, the multi-source feature types of the email may include email address, email header, email body, and email attachment.

[0051] Optionally, the email address may include features such as the full email address, account name, and email domain name; the email header may also include features such as X-header, X-return path, Message-id, DKIM, DMARC, and SPF; the email body may also include features such as URL, redirect URL, email content, HTML code, and images; and the email attachment may also include features such as Hash, obfuscated code, and dynamic behavior.

[0052] Optional, X-header is an extension header, which is a custom field in the email header. It is not a required field defined by the standard email protocol, but additional information that can be added by the email sender. X-return path is a non-standard return path, which is a custom or extended return path setting, which can usually be added by the email server software or the email sender. Message-id is the message ID in the email header. As a unique identifier generated when the email is created, it can uniquely identify the corresponding email. DKIM (DomainKeys Identified Mail) is an email authentication technology, whose main purpose is to verify whether the email is really sent from the domain name it claims. DMARC (Domain-based Message Authentication, Reporting & Conformance) is a domain-based email authentication, reporting and compliance protocol that allows email recipients to verify according to the policy published by the domain name owner when receiving the email. SPF (Sender Policy Framework) is an email authentication mechanism, mainly used to prevent email forgery. The domain name owner publishes SPF records in DNS to specify which IP addresses or host names are authorized to send emails for this domain name.

[0053] Optional, URL (Uniform Resource Locator) is a network address that can be used to locate resources on the Internet, which can be used to locate web pages, files, pictures and other resources on the Internet; redirect URL is a link. Clicking on the redirect URL will cause the user to jump from the email content page to other web pages. In phishing emails, the redirect URL may point to a fake website that is very similar to the real website in order to deceive the user's sensitive information; HTML (Hypertext Markup Language) code is a markup language code that users use to construct the email content format, which can make the email content appear like a web page.

[0054] Optional. Hash is a value generated by a data encryption algorithm. It is calculated on the contents of an attachment through a specific hash function, such as MD5, SHA-1, SHA-256, etc. It can be used to verify the integrity of the attachment. By comparing the hash value provided by the sender with the hash value in the email attachment, it can be determined whether the attachment has been tampered with during transmission.

[0055] Optionally, feature extraction is performed on each type of feature respectively to obtain the feature value of each feature element in each type of feature, and a feature vector of each type of feature is formed according to the feature value of each element.

[0056] Optionally, the feature vectors of various features may be fused to obtain a feature fusion result of the target email.

[0057] The advantage of this setting is that by integrating multi-source information such as email addresses, email headers, email bodies and email attachments, comprehensive feature detection can be performed on target emails, subtle features of phishing emails can be captured, the comprehensiveness and diversity of information can be ensured, and the detection efficiency of phishing emails can be effectively improved.

[0058] S120: Input the feature fusion result into a pre-established email recognition model, and obtain the recognition result output by the email recognition model.

[0059] Optionally, the email recognition model is a pre-trained classification model. The email recognition model can classify emails through a machine learning algorithm. The recognition result output by the email recognition model may include a classification result of whether the target email is a phishing email.

[0060] S130: When it is determined that the target email is a phishing email according to the identification result, whether the target email is allowed to be displayed is determined according to a preset screening rule.

[0061] It is understandable that in the actual phishing email identification process, users may have the following needs: for phishing emails that the user is aware of, the user does not need to be reminded of these phishing emails. For example, emails sent by the target sender or target domain name provided by the user, the user knows that these are phishing emails. In this case, the user will not subjectively query these emails and there is no need to remind; for emails that the user is sure can be intercepted, there is no need to identify and remind. For example, the user knows that his email gateway can successfully intercept certain phishing emails, so there is no need to display these emails.

[0062] Optionally, in order to meet the user's alarm needs, after determining that the target email is a phishing email, it can be determined based on preset screening rules whether it is necessary to issue an alarm reminder to the user based on the target email.

[0063] Optionally, the preset screening rules may include a whitelist provided by the user, which may include the complete email address, account name, and email domain name. When the target email hits the whitelist, it is determined that the target email is not allowed to be displayed. If it does not hit, it is determined that the target email is allowed to be displayed.

[0064] S140: When it is determined that the target email is allowed to be displayed, extract the warning element in the target email, and send an alarm to the user according to the recognition result and the warning element.

[0065] Optionally, when it is determined that the target email is allowed to be displayed, it may be determined that an alarm reminder needs to be sent to the user for the target email.

[0066] Optionally, the warning element may refer to factors that cause the target email to be identified as a phishing email. For example, if the email address of the target email is identified as a malicious address, the email address will be used as a warning element. Alternatively, if there are statements in the attachment that induce users to behave, the attachment or the statement may be used as a warning element. The warning element may be one or more, depending on the specific risky content in the email.

[0067] Optionally, after determining the alarm element, a user alarm can be generated based on the identification result and the alarm element. The user alarm page can include the identification result proof that the target email is a phishing email, as well as screenshots or statement displays related to the alarm element.

[0068] The advantage of this setting is that it can clearly display the basis for identifying phishing emails, making phishing email identification explainable and convenient for users to understand and intervene manually.

[0069] The technical solution of the embodiment of the present invention is to extract multi-source features of the target email every time a newly sent target email is received, obtain feature vectors of various features of the target email, and then perform feature fusion to obtain feature fusion results, input the feature fusion results into a pre-established email recognition model, obtain the recognition results output by the email recognition model, and determine whether the target email identified as a phishing email is allowed to be displayed according to preset screening rules. When it is determined that the target email is allowed to be displayed, the warning elements in the target email are extracted, and an alarm is sent to the user based on the recognition results and the warning elements. This method can perform real-time phishing email recognition based on the multi-source features of the email, effectively capture the subtle features of the phishing email, effectively improve the accuracy of phishing email detection, and timely prevent phishing email attacks. Moreover, after the phishing email is identified, the result can clearly display the identification basis of the phishing email, so that the phishing email recognition is explainable and convenient for user understanding and manual intervention.

[0070] Embodiment 2

[0071] Figure 2 This is a flow chart of a phishing email identification method provided in the second embodiment of the present invention. This embodiment specifically describes the phishing email identification method based on the above embodiment. Figure 2 As shown, the method includes:

[0072] S210. Whenever a newly sent target email is received, the address features, email header features, email body features, and attachment features of the target email are extracted to obtain a plurality of feature elements corresponding to each type of feature.

[0073] Optionally, the characteristic elements of the address feature include the full email address, sender account name and sender email domain name; the characteristic elements of the email header feature include X-header, X-return path, Message-id, DKIM, DMARC and SPF; the characteristic elements of the email body feature include URL, redirect URL, email text, Hypertext Markup Language HTML code and pictures; the characteristic elements of the attachment feature include hash, obfuscated code and dynamic behavior.

[0074] S220. Determine a feature vector for each type of feature based on a plurality of feature elements corresponding to each type of feature.

[0075] S230, merging feature vectors of various features to obtain feature fusion results.

[0076] S240: Input the feature fusion result into a pre-established email recognition model, and obtain the recognition result output by the email recognition model.

[0077] S250: When it is determined that the target email is a phishing email according to the identification result, determine whether the target email is allowed to be displayed according to a preset screening rule.

[0078] Optionally, when it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule includes:

[0079] When it is determined that at least one of the complete email address, sender account name, and sender mailbox domain name of the target email belongs to the user whitelist, the target email is determined to be an email that is not allowed to be displayed, and a phishing email label is generated and stored correspondingly to the target email.

[0080] S260: When it is determined that the target email is allowed to be displayed, the email body and attachments of the target email are analyzed to obtain the inducement behavior statements in the target email, and the inducement behavior statements are determined as warning elements.

[0081] S270: Send an alarm to the user based on the recognition result and the alarm element.

[0082] S280: After it is determined that the user processes the target email, obtain the user's analysis result on the target email.

[0083] The analysis and judgment results include the true attributes of the target email and any misjudgments.

[0084] It is understandable that after the alarm is sent to the user, the analysis and judgment results of the user's feedback can also be received. The user can manually check the alarm email again to determine whether it is a phishing email. If it is not a phishing email, the phishing email alarm is determined to be a false positive. The analysis and judgment results of the target email can be stored together with the target email for updating and training of the email recognition model.

[0085] Optionally, the phishing email identification method may further include:

[0086] Whenever an update node of the email recognition model is reached, a target time period is determined according to the update node, and historical emails within the target time period are obtained;

[0087] Among them, historical emails within the target time period include normal emails received within the target time period, phishing emails determined to be not allowed to be displayed within the target time period, and phishing emails for which research and judgment results were generated within the target time period;

[0088] The email recognition model is trained again based on historical emails within the target time period to obtain an updated email recognition model.

[0089] Optionally, in order to adapt to the ever-changing phishing email attack methods and improve the scalability of phishing email recognition, the email recognition model can be re-trained at specified time intervals to update the email recognition model, and the training samples for each training can be normal emails and phishing emails received within the target time period before the update node. This not only ensures adaptation to the latest phishing email attack methods, but also ensures the quality of the training samples and improves the accuracy of the email recognition model.

[0090] Whenever a newly sent target email is received, multi-source feature extraction is performed on the target email, feature vectors of various features of the target email are obtained, and then feature fusion is performed to obtain feature fusion results, and the feature fusion results are input into a pre-established email recognition model to obtain recognition results output by the email recognition model, and whether the target email identified as a phishing email is allowed to be displayed is determined according to preset screening rules. When it is determined that the target email is allowed to be displayed, the warning element in the target email is extracted, and an alarm is sent to the user according to the recognition result and the warning element. This method can perform real-time phishing email recognition based on the multi-source features of the email, effectively capture the subtle features of the phishing email, effectively improve the accuracy of phishing email detection, and timely prevent phishing email attacks. Moreover, after the phishing email is identified, the result can clearly display the identification basis of the phishing email, so that the phishing email recognition is explainable and convenient for user understanding and manual intervention.

[0091] Embodiment 3

[0092] Figure 3 This is a schematic diagram of the structure of a phishing email identification device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a feature extraction module 310, a model recognition module 320, an email screening module 330 and an alarm display module 340.

[0093] The feature extraction module 310 is used to extract multi-source features of the target email whenever a newly sent target email is received, obtain feature vectors of various features of the target email, and fuse the feature vectors of various features to obtain feature fusion results.

[0094] The model recognition module 320 is used to input the feature fusion result into a pre-established email recognition model and obtain the recognition result output by the email recognition model.

[0095] The email screening module 330 is used to determine whether the target email is allowed to be displayed according to a preset screening rule when it is determined that the target email is a phishing email according to the identification result.

[0096] The alarm display module 340 is used to extract the alarm element in the target email when it is determined that the target email is allowed to be displayed, and send an alarm to the user according to the recognition result and the alarm element.

[0097] The technical solution of the embodiment of the present invention is to extract multi-source features of the target email every time a newly sent target email is received, obtain feature vectors of various features of the target email, and then perform feature fusion to obtain feature fusion results, input the feature fusion results into a pre-established email recognition model, obtain the recognition results output by the email recognition model, and determine whether the target email identified as a phishing email is allowed to be displayed according to preset screening rules. When it is determined that the target email is allowed to be displayed, the warning elements in the target email are extracted, and an alarm is sent to the user based on the recognition results and the warning elements. This method can perform real-time phishing email recognition based on the multi-source features of the email, effectively capture the subtle features of the phishing email, effectively improve the accuracy of phishing email detection, and timely prevent phishing email attacks. Moreover, after the phishing email is identified, the result can clearly display the identification basis of the phishing email, so that the phishing email recognition is explainable and convenient for user understanding and manual intervention.

[0098] Based on the above embodiments, the feature extraction module 310 can be specifically used for:

[0099] Extract the address features, mail header features, mail body features, and attachment features of the target mail respectively, and obtain multiple feature elements corresponding to each feature;

[0100] A feature vector for each type of feature is determined based on a plurality of feature elements corresponding to each type of feature.

[0101] Based on the above embodiments, the characteristic elements of the address feature include the complete email address, the sender account name, and the sender email domain name;

[0102] The characteristic elements of the email header feature include X-header, X-return path, Message-id, DKIM, DMARC and SPF;

[0103] The characteristic elements of the email body feature include URL, redirect URL, email text, Hypertext Markup Language HTML code and pictures;

[0104] The characteristic elements of attachment features include hash, obfuscated code, and dynamic behavior.

[0105] Based on the above embodiments, the email screening module 330 can be specifically used for:

[0106] When it is determined that at least one of the complete email address, sender account name, and sender mailbox domain name of the target email belongs to the user whitelist, the target email is determined to be an email that is not allowed to be displayed, and a phishing email label is generated and stored correspondingly to the target email.

[0107] Based on the above embodiments, the alarm display module 340 can be specifically used for:

[0108] When it is determined that the target email is allowed to be displayed, the email body and attachments of the target email are analyzed to obtain the inducement behavior statements in the target email, and the inducement behavior statements are determined as warning elements.

[0109] On the basis of the above embodiments, a judgment result collection module may be further included, which is used to:

[0110] After it is determined that the user processes the target email, the user's analysis result on the target email is obtained; wherein the analysis result includes the real attribute of the target email and the misjudgment situation.

[0111] On the basis of the above embodiments, a mail recognition model training module may also be included, which is used to:

[0112] Whenever an update node of the email recognition model is reached, a target time period is determined according to the update node, and historical emails within the target time period are obtained;

[0113] Among them, historical emails within the target time period include normal emails received within the target time period, phishing emails determined to be not allowed to be displayed within the target time period, and phishing emails for which research and judgment results were generated within the target time period;

[0114] The email recognition model is trained again based on historical emails within the target time period to obtain an updated email recognition model.

[0115] The phishing email identification device provided in the embodiment of the present invention can execute the phishing email identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0116] Embodiment 4

[0117] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0118] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0119] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0120] The processor 11 may be any general and / or dedicated processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the phishing email identification method described in the embodiment of the present invention. That is:

[0121] Whenever a newly sent target email is received, multi-source feature extraction is performed on the target email to obtain feature vectors of various features of the target email, and the feature vectors of various features are fused to obtain feature fusion results;

[0122] Inputting the feature fusion result into a pre-established email recognition model, and obtaining the recognition result output by the email recognition model;

[0123] When it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule;

[0124] When it is determined that the target email is allowed to be displayed, an alarm element in the target email is extracted, and an alarm is sent to the user according to the recognition result and the alarm element.

[0125] In some embodiments, the phishing email identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the phishing email identification method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the phishing email identification method in any other appropriate manner (e.g., by means of firmware).

[0126] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0127] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0128] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0129] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0130] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0131] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0132] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0133] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying phishing emails, characterized in that: include: Whenever a newly sent target email is received, multi-source feature extraction is performed on the target email to obtain feature vectors of various features of the target email, and the feature vectors of various features are fused to obtain feature fusion results; Inputting the feature fusion result into a pre-established email recognition model, and obtaining the recognition result output by the email recognition model; When it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule; When it is determined that the target email is allowed to be displayed, an alarm element in the target email is extracted, and an alarm is sent to the user according to the recognition result and the alarm element.

2. The method according to claim 1, characterized in that Perform multi-source feature extraction on the target email to obtain feature vectors of various features of the target email, including: Extract the address features, mail header features, mail body features, and attachment features of the target mail respectively, and obtain multiple feature elements corresponding to each feature; A feature vector for each type of feature is determined based on a plurality of feature elements corresponding to each type of feature.

3. The method according to claim 2, characterized in that The characteristic elements of the address feature include the full email address, the sender account name, and the sender email domain name; The characteristic elements of the email header feature include X-header, X-return path, Message-id, DKIM, DMARC and SPF; The characteristic elements of the email body feature include uniform resource locator URL, redirection URL, email text, hypertext markup language HTML code and pictures; The characteristic elements of attachment features include hash, obfuscated code, and dynamic behavior.

4. The method according to claim 3, characterized in that When it is determined according to the identification result that the target email is a phishing email, determining whether the target email is allowed to be displayed according to a preset screening rule includes: When it is determined that at least one of the complete email address, sender account name, and sender mailbox domain name of the target email belongs to the user whitelist, the target email is determined to be an email that is not allowed to be displayed, and a phishing email label is generated and stored correspondingly to the target email.

5. The method according to claim 3, characterized in that: When it is determined that the target email is allowed to be displayed, the warning elements in the target email are extracted, including: When it is determined that the target email is allowed to be displayed, the email body and attachments of the target email are analyzed to obtain the inducement behavior statements in the target email, and the inducement behavior statements are determined as warning elements.

6. The method according to claim 1, characterized in that After sending an alarm to a user according to the recognition result and the alarm element, the method further includes: After it is determined that the user processes the target email, the user's analysis result on the target email is obtained; wherein the analysis result includes the real attribute of the target email and the misjudgment situation.

7. The method according to claim 6, characterized in that Also includes: Whenever an update node of the email recognition model is reached, a target time period is determined according to the update node, and historical emails within the target time period are obtained; Among them, historical emails within the target time period include normal emails received within the target time period, phishing emails determined to be not allowed to be displayed within the target time period, and phishing emails for which research and judgment results were generated within the target time period; The email recognition model is trained again based on historical emails within the target time period to obtain an updated email recognition model.

8. A phishing email identification device, characterized in that: include: The feature extraction module is used to extract multi-source features of the target email whenever a new target email is received, obtain feature vectors of various features of the target email, and fuse the feature vectors of various features to obtain feature fusion results; A model recognition module, used to input the feature fusion result into a pre-established email recognition model and obtain the recognition result output by the email recognition model; An email screening module, for determining whether the target email is allowed to be displayed according to a preset screening rule when the target email is determined to be a phishing email according to the identification result; The alarm display module is used to extract the alarm element in the target email when it is determined that the target email is allowed to be displayed, and send an alarm to the user according to the recognition result and the alarm element.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the phishing email identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the phishing email identification method according to any one of claims 1 to 7 when executed.

Images