E-mail secure delivery method and related equipment

Abstract

The embodiment of the invention provides an E-mail secure delivery method and related equipment, and belongs to the technical field of information security. The method comprises the following steps: carrying out explicit content extraction on a received email to obtain email explicit information; performing first classification processing on the emails according to the email explicit information to obtain a first classification result; when the first classification result represents the junk mail, intercepting the E-mail; under the condition that the first classification result shows the credible email, delivering the email to a recipient mailbox; and under the condition that the first classification result shows the suspicious mail, delivering the e-mail to a recipient mailbox, and carrying out second classification processing on the link pointing content of the link domain name in the e-mail to obtain a second classification result. According to the invention, the E-mail delivery security and timeliness can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an email secure delivery method and related equipment. BACKGROUND

[0002] Email is one of the main communication tools for people's daily office work. While people enjoy the convenience brought by email, they also have problems such as being harassed by spam, even being harmed by scam email and virus email, and causing property loss.

[0003] With the continuous development of technology, anti-spam technology related to email has become more mature, and the spam interception capability is getting stronger. In related technology, spam is usually identified and intercepted based on the characteristics of the sender, the email title and the email body. However, more and more phishing emails use the method of carrying phishing links to guide users to click links in the email, and through the links, the user information is illegally stolen or virus files are downloaded, so that the user's personal information is infringed, and there is a great security risk. The current anti-spam technology mainly relies on static black and white list matching and simple rule scanning. In the face of dynamically generated links, semantic disguised links and cross-platform jump links, there are problems of insufficient risk judgment accuracy and incomplete malicious content identification. If the link content is accessed and identified, it will affect the efficiency of email delivery. Therefore, the current email security delivery scheme has the problem of being difficult to balance the timeliness of email delivery and the security of protection. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide an email secure delivery method and related equipment, aiming to improve the security and timeliness of email delivery.

[0005] To achieve the above purpose, one aspect of the embodiments of the present application provides an email secure delivery method, comprising the following steps: Explicit content extraction is performed on the received email to obtain email explicit information; First classification processing is performed on the email according to the email explicit information to obtain a first classification result; In the case that the first classification result represents spam, the email is intercepted; In the case that the first classification result represents trusted email, the email is delivered to the recipient's mailbox; In the case that the first classification result represents suspicious email, the email is delivered to the recipient's mailbox, and second classification processing is performed on the link pointing content of the link domain name in the email to obtain a second classification result; In the case that the second classification result represents a risk email, the email is recovered from the recipient mailbox.

[0006] In some embodiments, the first classification processing of the email according to the mail explicit information includes the following steps: list matching according to the link domain name in the mail explicit information, to obtain a list matching result; the list matching result represents one of a hit in a blacklist, a hit in a whitelist, and a miss; In the case that the list matching result represents a miss, third classification processing of the mail explicit information is performed by using an intelligent pre-determination model to obtain a third classification result, and a trusted relationship is queried according to a recipient and a sender in the mail explicit information; According to the list matching result, the third classification result, and the trusted relationship, a first classification result is determined.

[0007] In some embodiments, the third classification processing of the mail explicit information by using the intelligent pre-determination model includes the following steps: feature extraction of the mail explicit information, to obtain mail explicit features; the mail explicit features include domain name attribute features, mail attribute features, mail content features, and associated risk features; input of the mail explicit features into an intelligent pre-determination model for third classification processing, to obtain a third classification result of the email; the third classification result is one of a first risk level, a second risk level, and a third risk level.

[0008] In some embodiments, the second classification processing of the link pointing content of the link domain name in the email includes the following steps: According to the level priority represented by the third classification result of the email, network crawler processing of the link domain name of the email is performed through an asynchronous thread, to obtain link pointing content; second classification processing of the link pointing content, to obtain a second classification result.

[0009] In some embodiments, the second classification processing of the link pointing content includes the following steps: link declaration type extraction from a hypertext header of the link pointing content; determination of whether the link declaration type is consistent with an actual loading type; In the case that the link declaration type is inconsistent with the actual loading type, the second classification result is determined to be a risk email; In a case where the link declaration type is consistent with the actual loading type, a risk of a hypertext message body of link pointing content is identified by an intelligent deep content analysis model to obtain a second classification result.

[0010] In some embodiments, the risk of the hypertext message body of link pointing content is identified by the intelligent deep content analysis model to obtain the second classification result, including the following steps: For text data in the hypertext message body, a conversational large model is used to identify a risk of the text data to obtain a semantic risk determination result; For picture data in the hypertext message body, a picture recognition model is used to identify picture information in the picture data, and a picture risk determination result is determined according to the picture information; For program script data in the hypertext message body, a code analysis model is used to identify an execution action of the program script data, and an action risk determination result is determined according to the execution action; According to the semantic risk determination result, the picture risk determination result, and the action risk determination result, a second classification result is determined.

[0011] In some embodiments, the email security delivery method further includes the following steps: In a case where the second classification result indicates a risk email, a link domain name in the email is added to a link blacklist library; A smart rule extraction model is used to extract rules from the link blacklist library to obtain a risk link rule, and the risk link rule is added to a rule library.

[0012] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes an email security delivery system, comprising: A receiving module is configured to extract explicit content from a received email to obtain email explicit information; A first classification identification module is configured to perform first classification processing on the email according to the email explicit information to obtain a first classification result; A first classification processing module is configured to, in a case where the first classification result indicates a spam email, intercept the email; in a case where the first classification result indicates a trusted email, deliver the email to a mailbox of a recipient; and in a case where the first classification result indicates a suspicious email, deliver the email to the mailbox of the recipient; A second classification identification module is configured to, in a case where the first classification result indicates a suspicious email, perform second classification processing on link pointing content of a link domain name in the email to obtain a second classification result; The second classification processing module is configured to, in a case where the second classification result indicates a risk email, recover the email from the recipient mailbox.

[0013] To achieve the above object, another aspect of the embodiment of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program.

[0014] To achieve the above object, another aspect of the embodiment of the present application provides a computer program product, which comprises a computer program, and the computer program implements the above method when executed by a processor.

[0015] The embodiment of the present application at least has the following beneficial effects: the present application provides an email secure delivery method, system, electronic device and program product, which first extracts the explicit content of the received email to obtain the explicit information of the email, then performs a preliminary first classification processing on the email according to the explicit information of the email to obtain a first classification result. If the first classification result is a spam email, the email is directly intercepted, if the first classification result is a trusted email, the email is delivered to the recipient mailbox, if the first classification result indicates a suspicious email, the email is first delivered to the recipient mailbox to improve the timeliness of email delivery, then the link pointing content of the link domain name in the email is subjected to a second classification processing to obtain a second classification result, and in a case where the second classification result indicates a risk email, the email is recovered from the recipient mailbox, thereby improving the security of email delivery through further risk identification based on the link instruction content. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of the email secure delivery method provided by the embodiment of the present application; Figure 2 is a flowchart of step S102 in Figure 1 ; Figure 3 is a flowchart of step S202 in Figure 2 ; Figure 4 is a flowchart of step S105 in Figure 1 ; Figure 5 is a flowchart of step S402 in Figure 4 ; Figure 6 is a flowchart of step S504 in Figure 5 ; Figure 7 is a flowchart of the email secure delivery method provided by another embodiment of the present application; Figure 8 is a schematic diagram of an email secure delivery system provided by an embodiment of the present application; Figure 9 is a schematic diagram of a hardware structure of an electronic device provided by an embodiment of the present application; Figure 10 is a schematic diagram of an email secure delivery process provided by an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with embodiments of the present application, but are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0019] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0020] Trust, refers to a trust relationship between mailbox system accounts and accounts, which can be added by the user himself, or can be automatically added by the system according to the record of the correspondence between the accounts.

[0021] Phishing, refers to a fraudulent behavior by impersonating official emails, carrying fake links in emails, and guiding users to input relevant personal information in the links, or downloading virus emails.

[0022] Web crawler, refers to a method or program that automatically extracts the content of web pages pointed by links through the network.

[0023] HTML (Hyper Text Markup Language, Hyper Text Markup Language) is a standard markup language used to create web pages and web applications. It defines the structure and content of a web page through a series of specific tags, such as headings, paragraphs, lists, images, links, etc. HTML files are essentially plain text files, and browsers will read these tags and render the content into the web page that users see according to their meaning.

[0024] DNS (Domain Name System) is the "phone book" or "address book" of the Internet. Its core function is to convert easily remembered domain names (such as www.xxx.com) entered in a browser into machine-readable IP addresses that computers can recognize and communicate with on the network. This process is called domain name resolution.

[0025] Artificial Intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. AI technology is a comprehensive discipline involving a wide range of fields, encompassing both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0026] Convolutional Neural Networks (CNNs) are a type of feedforward neural network that includes convolutional computations and has a deep structure. They can perform supervised learning using labeled training data to accomplish tasks such as visual image recognition and object detection.

[0027] A growing number of phishing emails now incorporate phishing links, tricking users into clicking them to illegally steal personal information or download viruses, thus compromising users' personal data and posing significant security risks. Current anti-spam technologies primarily rely on static blacklist / whitelist matching and simple rule scanning. However, they suffer from insufficient accuracy in risk assessment and incomplete identification of malicious content when facing new phishing methods such as dynamically generated links, semantically spoofed links, and cross-platform redirect links. Furthermore, accessing and identifying linked content would impact email delivery efficiency. Therefore, current email security delivery solutions struggle to balance timely delivery with robust security measures.

[0028] In view of this, this application provides a method and related equipment for secure email delivery. The solution proposes a pre-delivery mechanism, which first classifies emails based on explicit email characteristics, delivers trusted emails, directly intercepts spam emails, and performs secondary classification and identification based on the content pointed to by links for suspicious emails. If the secondary identification determines that it is a high-risk email, the delivered suspicious email is withdrawn, thereby improving the security and timeliness of email delivery.

[0029] The secure email delivery method provided in this application relates to the field of information security technology. This secure email delivery method can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the secure email delivery method, but is not limited to the above forms.

[0030] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0031] In some embodiments, the method of this embodiment can be applied to the following architectural scenarios: The backend server that provides email relay services receives emails from the sender's device frontend; The backend server extracts explicit content from emails to obtain explicit information. Based on this information, it performs a first classification process, and then further processes the email: if it's spam, it's blocked; if it's legitimate, it's sent to the recipient's device; if it's suspicious, it's sent to the recipient's device. Simultaneously, the content linked to in the email is processed for a second classification. If the second classification indicates the email is risky, the email is withdrawn from the recipient's device. Recipients can view delivered emails through the device front end, but cannot view the content of recalled emails. This improves the timeliness of delivery and enhances the protection of the device front end to some extent.

[0032] Figure 1 This is an optional flowchart of the secure email delivery method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0033] S101, Explicitly extract the content of the received email to obtain explicit email information; S102, Perform first classification processing on emails based on explicit email information to obtain the first classification result; S103, if the first classification result indicates spam, the email is blocked; S104, if the first classification result indicates that the email is a trustworthy email, the email will be delivered to the recipient's mailbox; S105, if the first classification result indicates that the email is suspicious, the email is delivered to the recipient's mailbox, and the content pointed to by the linked domain in the email is processed for a second classification to obtain a second classification result; S106, if the second classification result indicates a risky email, retrieve the email from the recipient's mailbox.

[0034] Steps S101 to S106 as shown in the embodiments of this application first perform preliminary classification of emails based on explicit email features. Trustworthy emails are delivered, spam emails are directly blocked, and suspicious emails are further classified and identified based on the content pointed to by the links. If the suspicious emails are determined to be high-risk emails through secondary identification, the delivered suspicious emails are withdrawn, thereby improving the security and timeliness of email delivery.

[0035] In step S101 of some embodiments, the received email is explicitly extracted by parsing standard email format fields to obtain explicit email information. Explicit email information refers to information directly contained in the email, including but not limited to the email title, email body, recipient's email address, sender's email address, and attachments. The email body may include link domains, images, and text.

[0036] In step S102 of some embodiments, the email is first classified according to the explicit information of the email to obtain a first classification result. The first classification result can characterize the email as a trustworthy email, a suspicious email, or spam. The first classification process can be implemented based on rule matching or based on a machine learning classification model.

[0037] In one example, the first classification process could be determined by at least one of the following matching methods, or a combination of the above methods: matching the sender's email address in the explicit email information against email blacklists / whitelists, matching the link domain against link blacklists / whitelists, or matching the mutual trust relationship between the recipient and the sender. For example, if the link domain matches a link blacklist, it is considered spam; if the link domain matches a link whitelist, it is considered trusted; and if the link domain does not match any blacklist or whitelist, it is considered suspicious.

[0038] In another embodiment, the first classification process may be to directly input the above-mentioned explicit email information into a classification model based on deep learning (referred to as the intelligent pre-judgment model or AI pre-judgment model in this embodiment) to obtain the first classification result.

[0039] In another example, the first classification process can also be implemented by combining mutual trust matching and a deep learning classification model. The first classification result is determined by combining the existence of mutual trust between the recipient and sender with the risk level of the explicit information identified in the email by the AI ​​pre-judgment model. Specifically, if there is no mutual trust and the model output is high / medium risk, the first classification result is spam; if there is mutual trust and the model output is low risk, the first classification result is trustworthy email; if there is mutual trust but the model output is high / medium risk, the first classification result is suspicious mailbox.

[0040] In step S103 of some embodiments, if the first classification result indicates spam, the email is blocked. The blocking method may be to prevent the email from being delivered to the recipient's mailbox, so that the recipient cannot view the email on the device front end; the blocking method may also be to deliver the email to the recipient's spam mailbox, and inform the recipient that the email is spam, so that the recipient can only view the title and sender of the email in the spam mailbox.

[0041] In step S104 of some embodiments, if the first classification result indicates a trustworthy email, the email is delivered normally to the recipient's mailbox so that the recipient can confidently view the email.

[0042] In step S105 of some embodiments, if the first classification result indicates a suspicious email, the email is delivered to the recipient's mailbox. The delivery method for suspicious emails can be either to deliver the suspicious email directly to the recipient's mailbox for initial viewing, or to deliver the suspicious email to a suspicious mailbox where the recipient can view emails normally. The suspicious mailbox setting serves as a reminder to the recipient to exercise caution.

[0043] While delivering suspicious emails, the content linked to by the domains in the emails is asynchronously classified into two categories: risky and non-risky. The linked content consists of a header and a body. The classification can be achieved by analyzing the body using an intelligent deep content parsing model (also called an AI deep content parsing model in this embodiment); or by combining matching the link declaration type in the header with the actual loaded type, and analyzing the body using the intelligent deep content parsing model.

[0044] In step S106 of some embodiments, if the second classification result indicates a risky email, the email is retrieved from the recipient's mailbox. The email retrieval method may involve directly deleting the suspicious email from the recipient's device, preventing the recipient from viewing its content; or it may involve transferring the suspicious email directly from the recipient's mailbox / suspicious mailbox to the spam folder, preventing the recipient from viewing the email's body, thus improving the recipient's security.

[0045] According to some embodiments of this application, please refer to Figure 2 Step S102 may include, but is not limited to, the following steps: S201, perform a list matching based on the link domain name in the explicit information of the email to obtain the list matching result; the list matching result indicates one of the following: hit the blacklist, hit the whitelist, or no match; S202, In the case that the list matching result is not matched, the intelligent pre-judgment model is used to perform third classification processing on the explicit information of the email to obtain the third classification result, and the mutual trust relationship is queried based on the recipient and sender in the explicit information of the email. S203, determine the first category result based on the list matching results, the third category results, and the mutual trust relationship.

[0046] In step S201 of some embodiments, link verification is performed based on the link domain name. First, the link domain name is matched and filtered with the link blacklist and whitelist database. For links that match the link blacklist, the email containing the link is directly identified as spam and the email is subsequently blocked. For links that match the link whitelist, the email containing the link is identified as trustworthy and the email is subsequently delivered. For links that do not match either the link blacklist or the link whitelist, they are considered unfamiliar links, and step S202 is further executed.

[0047] In step S202 of some embodiments, for emails containing unfamiliar links, a smart pre-judgment model is used to perform third-classification processing on the explicit information of the email to obtain a third-classification result. The third-classification result is used to characterize the risk level of the email address. The risk level can be two or three. This application embodiment does not specifically limit the granularity of the risk level division of the third-classification result. Similarly, for emails containing unfamiliar links, the mutual trust relationship is queried based on the recipient and sender in their explicit information.

[0048] In step S203 of some embodiments, as described above, if the list matching result indicates a hit on the blacklist, the first classification result is spam; if the list matching result indicates a hit on the whitelist, the first classification result is trusted email; if the list matching result indicates a miss, the determination is made based on mutual trust relationship and third classification result. For example, if a mutual trust relationship exists and the third classification result indicates low risk, the first classification result can be determined as trusted email; otherwise, the first classification result can be determined as suspicious email. The joint determination logic of mutual trust relationship and intelligent pre-determination model output in this embodiment is only exemplary; other determination logic can be set according to actual security protection needs, and this application embodiment does not impose specific limitations.

[0049] This embodiment first performs an initial judgment by matching a list of linked domains. If no match is found, an intelligent pre-judgment model is then activated for more accurate identification, improving the classification efficiency and accuracy in the first classification process. Furthermore, this embodiment employs a differentiated pre-delivery mechanism using an AI pre-judgment model. This involves using an AI model trained with multi-dimensional features to classify emails with unfamiliar links based on risk level, and combining this with the mutual trust relationship between the sending and receiving accounts to achieve a two-dimensional pre-delivery based on "risk level + mutual trust relationship," overcoming the limitations of traditional single-trust-relationship judgment.

[0050] According to some embodiments of this application, please refer to Figure 3 In step S202, an intelligent pre-judgment model is used to perform third-class classification processing on the explicit information in the email to obtain the third-class classification result, which may include, but is not limited to, the following steps: S301, extract features from explicit information in emails to obtain explicit email features; explicit email features include domain attribute features, email attribute features, email content features, and associated risk features. S302, input the explicit features of the email into the intelligent pre-judgment model for third classification processing to obtain the third classification result of the email; the third classification result is one of the first risk level, the second risk level and the third risk level.

[0051] In step S301 of some embodiments, for unfamiliar links that were not matched during the link list matching process, feature extraction is performed on the explicit information of their emails. Specifically, basic attributes of the links in the explicit email information are extracted to obtain domain attribute features, including but not limited to domain registration time and DNS resolution records; the sender account and its historical behavior in the explicit email information are extracted to obtain email attribute features; the semantic correlation between the email body and the links in the explicit email information is extracted to obtain email content features; and historical risk records of the same IP segment as the link's IP address are extracted to obtain associated risk features.

[0052] In step S302 of some embodiments, a feature vector is generated from domain attribute features, email attribute features, email content features, and associated risk features. This feature vector is then input into an AI pre-judgment model, which outputs a first risk level (high risk), a second risk level (medium risk), and a third risk level (low risk) to provide a basis for pre-delivery. Simultaneously, the email is labeled with a risk level tag for subsequent asynchronous scanning priority ranking. The AI ​​pre-judgment model in this embodiment is based on a lightweight deep learning architecture (such as a fine-tuned BERT model or LightGBM classifier). It determines the high, medium, or low risk level of emails containing unfamiliar links by inputting a feature vector containing basic link attributes, associated email features, and features from a comprehensive network risk database.

[0053] This application embodiment uses an AI pre-judgment model to perform the first classification processing of emails, which can improve the accuracy of the first classification processing.

[0054] According to some embodiments of this application, please refer to Figure 4 In step S105, the content pointed to by the linked domains in the email is subjected to a second classification process to obtain a second classification result, which may include, but is not limited to, the following steps: S401, according to the priority level represented by the third classification result of the email, the link domain of the email is processed by a web crawler through an asynchronous thread to obtain the content pointed to by the link; S402, perform a second classification process on the content pointed to by the link to obtain the second classification result.

[0055] In step S401 of some embodiments, for emails identified as suspicious after the first classification process, a risk level is assigned after identification by an AI pre-judgment model. In the backend processor, an asynchronous crawler is initiated to process the suspicious emails according to the risk level priority, and the HTML content pointed to by the links is crawled to the local machine to obtain the linked content. The linked content includes two parts: a hypertext header (i.e., HTML header) and a hypertext message body (i.e., HTML body).

[0056] In step S402 of some embodiments, the second classification result can be achieved by analyzing the hypertext message body through an intelligent deep content parsing model (also referred to as an AI deep content parsing model in this embodiment); or it can be achieved by combining the two methods of matching the link declaration type in the hypertext header with the actual loading type and analyzing the hypertext message body through an intelligent deep content parsing model.

[0057] In this embodiment, for all suspicious emails to be delivered, during the second classification process, an AI pre-judgment model is used to classify the risk level of the suspicious emails, and then the suspicious emails are classified according to the priority order of the risk level. This allows the suspicious emails with higher risk to be processed faster, thereby timely retraction of the suspicious emails to be delivered.

[0058] According to some embodiments of this application, please refer to Figure 5 Step S402 may include, but is not limited to, the following steps: S501, Extract the link declaration type from the hypertext header of the content the link points to; S502, determine whether the link declaration type is consistent with the actual loaded type; S503, In cases where the declared link type does not match the actual loaded type, the second category result is determined to be risky email; S504, when the link declaration type is consistent with the actual loading type, uses an intelligent deep content parsing model to identify risks in the hypertext message body of the content pointed to by the link, and obtains a second classification result.

[0059] In this embodiment, a custom link declaration type is extracted from the content-type field of the hypertext header of the linked content. The actual loading type (such as a redirect, image, etc.) is determined through link parsing and access. It is then judged whether the link declaration type matches the actual loading type. If they do not match, the second classification result is directly determined as risky email. If they match, the intelligent deep content parsing model is used to identify risks in the hypertext message body of the linked content, obtaining the second classification result. The AI ​​deep content parsing model in this embodiment is a modular identification model, including a conversational large model (for semantic recognition), an image recognition model (such as a CNN steganalysis model for image steganalysis), and a code analysis model (such as a CodeBERT code analysis model for dynamic script parsing), enabling deep malicious content identification of HTML text, images, and scripts.

[0060] This embodiment first determines the content to which the link points by matching the link declaration type with the actual loading type. If a match is found, an AI deep content analysis model is then used for more accurate identification, which improves the classification efficiency and accuracy in the second classification process.

[0061] According to some embodiments of this application, please refer to Figure 6 In step S504, the risk of the hypertext message body of the linked content is identified using an intelligent deep content parsing model to obtain a second classification result, which may include, but is not limited to, the following steps: S601, For text data in hypertext message body, use a conversational big model to perform risk semantic recognition on text data and obtain semantic risk judgment results; S602, For image data in hypertext message body, use image recognition model to identify image information in image data, and determine image risk assessment result based on image information; S603, For program script data in hypertext message body, a code analysis model is used to identify the execution actions of the program script data, and the action risk judgment result is determined based on the execution actions; S604. Based on the semantic risk assessment results, image risk assessment results, and action risk assessment results, determine the second classification result.

[0062] In step S601 of some embodiments, the text data in the hypertext message body is input into the conversational big data model to identify phishing semantics, such as disguised phrases like "account anomaly verification" and "emergency freeze processing," and the phishing semantic confidence score is output. If the confidence score is ≥0.8, the semantic risk judgment result is determined to be abnormal. The conversational big data model in this embodiment is a conversational big language model based on natural language processing technology. It constructs a question text based on text data, inputs the question text into the conversational big data model, and can obtain the phishing semantic confidence score output by the model or the semantic risk judgment result directly output by the model.

[0063] In step S602 of some embodiments, image data from the hypertext message body is input into a trained image recognition model to extract image information, and the image risk assessment result is determined based on the image information. The image recognition model can be a CNN steganalysis model used to detect whether hidden links / text or other image information is embedded in the image. Then, a multimodal model (such as CLIP) is used to verify the semantic consistency between the image information and the email body. If they are inconsistent, the image risk assessment result is determined to be abnormal; or if sensitive steganalysis information is detected, the image risk assessment result is determined to be abnormal.

[0064] In step S603 of some embodiments, the program script data in the hypertext message body is input into a code analysis model (such as the CodeBERT code analysis model) to identify the execution action of the program script data, and the action risk judgment result is determined based on the execution action. For example, if there are abnormal behaviors such as dynamically redirecting malicious domains or stealing cookies in the execution action, the action risk judgment result is determined to be abnormal.

[0065] In step S604 of some embodiments, if any of the semantic risk determination results, image risk determination results, and action risk determination results are abnormal, then the second classification result is determined to represent a risky email.

[0066] This embodiment adopts a modular AI deep content parsing architecture, that is, for different link types such as HTML text, images, and scripts, a dedicated AI sub-model (semantic recognition, steganography detection, code analysis) is designed to achieve full-scenario malicious content coverage and solve the problem that static rules cannot understand semantics and logic.

[0067] According to some embodiments of this application, please refer to Figure 7 The secure email delivery method in this application embodiment may also include, but is not limited to, the following steps: S701, if the second classification result indicates a risky email, add the domain name of the link in the email to the link blacklist database; S702 uses an intelligent rule extraction model to extract rules from the link blacklist database, obtain risky link rules, and add the risky link rules to the rule database.

[0068] In this embodiment, for emails whose links fail the content scan (i.e., emails identified as risky through the second classification process), asynchronous retrieval is initiated if the email has already been delivered, and the email delivery status is updated. The user's read status is further checked; if the user indicates that the email has been read, a reminder email is sent to the user, informing them to change their password, perform computer antivirus scans, and other protective measures. Simultaneously, the risky links identified after the second classification process are added to the link blacklist and link whitelist, respectively, triggering an AI rule self-iteration mechanism. This AI rule self-iteration mechanism consists of a similar link clustering model, a rule extraction model, and a feedback learning mechanism, enabling dynamic expansion of the blacklist and whitelist, automatic generation of scanning rules, and self-correction of misjudgments, as detailed below: Similar link clustering: Using an AI similar link clustering model, high-similarity (similarity ≥ 0.9) links for risky links are added to a temporary blacklist, and similar links for normal links are added to a temporary whitelist. After manual review of the temporary blacklist, they are officially added to the formal link blacklist, and after manual review of the temporary whitelist, they are officially added to the formal link whitelist.

[0069] Automatic rule generation: The AI ​​rule extraction model automatically extracts risky link rules (such as "containing 'account freeze verification' content and domain registration <7 days → high risk") from the link blacklist, generates rule descriptions and pushes them to the administrator. After confirmation, the rules are added to the scanning rule library. This rule library can be used to subsequently adjust and optimize the AI ​​pre-judgment model and the AI ​​deep content analysis model to further improve the accuracy of classification and recognition.

[0070] Feedback learning: Collect user-marked emails that were mistakenly blocked / missed, and update the parameters of the AI ​​pre-judgment model and the AI ​​deep content analysis model in reverse, correct the blacklist and whitelist, and reduce the long-term false judgment rate.

[0071] This embodiment uses a closed-loop AI rule self-iteration system to link asynchronous scan results, user feedback and AI model, to achieve similar link clustering expansion, automatic generation of scan rules and dynamic optimization of model parameters, forming a safe closed loop of "scan-judgment-iteration-optimization", and overcoming the lag of traditional manual rule updates.

[0072] Please refer to the following. Figure 10 The following is a process for secure delivery in Medusa, where this implementation method is applied to a company's email system: Email Reception and Pre-delivery: The Medusa gateway receives internal / external emails, parses them, and extracts links. These links are then passed to a link blacklist / whitelist scanning module. Emails matching the blacklist are directly blocked; for unfamiliar links not matched, the email parsing module extracts link features and other relevant characteristics, pushing them to an AI pre-judgment module. Based on the lack of mutual trust between the sender and recipient of an external email, high-risk emails with no mutual trust are identified and delivered to the spam folder, while other suspicious emails are pre-delivered. Simultaneously, the AI ​​pre-judgment model outputs risk levels, and the gateway assigns asynchronous scanning priority to email addresses pre-delivered to the suspicious mailbox based on the risk level.

[0073] Asynchronous scanning execution: The link crawler module prioritizes crawling the links in the high-risk email, penetrating one layer of short links to obtain the final HTML page. AI deep content analysis model is activated: The body text input conversational model, with a phishing semantic confidence score of 0.92, is judged as abnormal; the header section detects that the content-type of the redirect link is "image / jpeg", which does not match the link type, and is therefore judged as a malicious link.

[0074] Results Processing: The email retrieval module detects that the email has not yet been read by the user and immediately recalls it asynchronously, updating the sending status to "Retrieved - Malicious Link". Simultaneously, the AI ​​rule self-iteration module initiates similar link clustering, identifying three similar links from the same IP segment with a registration time of <7 days, and adding them to a temporary blacklist. The rule extraction module generates a new rule, "Containing 'account freeze verification' and domain registration <7 days → High Risk", which is pushed to the administrator for confirmation and added to the scanning rule base within 10 minutes.

[0075] Feedback optimization: One week later, the system collected one user feedback that "a normal working link was misjudged as medium risk". The feedback learning submodule used this link as a negative sample, updated the AI ​​pre-judgment model parameters, and removed similar normal links associated with this link from the temporary blacklist to correct the misjudgment.

[0076] By implementing the above measures, we can improve the blocking rate of new phishing links in email systems, reduce the number of users accidentally clicking on malicious links, reduce the frequency of manual updates to anti-spam rules, and significantly improve system security and operational efficiency.

[0077] This invention provides a security scanning method that integrates AI big data models to ensure the secure transmission of email links, offering a more intelligent and efficient scanning approach for email systems, enhancing anti-spam capabilities, and improving email system security. It combines email-related data to analyze and extract external links carried in the email, classifying them based on HTML feature identifiers. In the synchronous scanning phase, an AI pre-judgment model is introduced to achieve risk classification of unfamiliar links, and precise pre-delivery is achieved based on the mutual trust relationship between sender and receiver accounts. In the asynchronous scanning phase, an AI deep content analysis model performs deep scanning of the content pointed to by the links, including semantics, image steganography, and script logic. Simultaneously, an AI rule self-iteration model is used to dynamically update blacklists and whitelists and automatically generate scanning rules. The synchronous method provides timely email delivery, while the combination of asynchronous scanning and AI models compensates for the limitations of static rules, further improving anti-spam interception capabilities and enhancing the security and intelligence level of the email system.

[0078] Please refer to Figure 8 This application also provides a secure email delivery system, including: The receiving module is used to extract explicit content from received emails and obtain explicit email information. The first classification and identification module is used to perform first classification processing on emails based on explicit email information to obtain the first classification result; The first classification processing module is used to intercept emails when the first classification result indicates that they are spam; to deliver emails to the recipient's mailbox when the first classification result indicates that they are trustworthy; and to deliver emails to the recipient's mailbox when the first classification result indicates that they are suspicious. The second classification identification module is used to perform a second classification process on the content pointed to by the linked domain in the email when the first classification result indicates that the email is suspicious, and to obtain the second classification result. The second classification processing module is used to retrieve emails from the recipient's mailbox if the second classification result indicates that the email is a risky email.

[0079] It is understood that the methods described in the above method embodiments are applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0080] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0081] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0082] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0083] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0084] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0085] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0086] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0087] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0088] The email secure delivery method and related equipment provided in this application have at least one of the following beneficial effects: 1. Enhanced security: The false positive rate of high-risk links is reduced by 40%, and the interception rate of new phishing links is increased by 40%+, covering new attack scenarios such as dynamic links, semantic spoofing, and image steganography, significantly reducing the risk of user information leakage and property loss.

[0089] 2. Efficiency optimization: Email delivery timeliness is unaffected (AI-predicted single link time ≤ 100ms), blacklist and whitelist update timeliness is improved by 60%, manual rule maintenance cost is reduced by 50%, and workload of operation and maintenance personnel is reduced.

[0090] 3. Improved user experience: Low-risk links reduce unnecessary spam deliveries and minimize user disruption; timely notifications of read malicious emails help users quickly take protective measures and increase user trust in the email system.

[0091] 4. Enhanced technological barriers: By integrating multiple AI models with traditional security scanning technologies, a core competitiveness of "intelligent judgment + deep recognition + automatic iteration" is formed. Compared with traditional solutions, it is more adaptable to complex and ever-changing phishing attack environments, and its technological innovation and practicality are significantly improved.

[0092] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0093] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0094] The system embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0095] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0096] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or modules is not necessarily limited to those steps or modules explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0097] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0098] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0099] The modules described above as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0100] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0101] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for securely delivering emails, characterized in that, Includes the following steps: Explicitly extract the content of the received email to obtain the explicit information of the email; The email is classified into a first category based on the explicit information in the email, and a first category result is obtained. If the first classification result indicates that the email is spam, the email will be blocked. If the first classification result indicates that the email is trustworthy, the email will be delivered to the recipient's mailbox. If the first classification result indicates a suspicious email, the email is delivered to the recipient's mailbox, and the content pointed to by the linked domain in the email is subjected to a second classification process to obtain a second classification result; If the second classification result indicates a risky email, the email is retrieved from the recipient's mailbox.

2. The method according to claim 1, characterized in that, The first classification process for the email based on the explicit information in the email, to obtain the first classification result, includes the following steps: The list matching is performed based on the link domain name in the explicit information of the email to obtain the list matching result; the list matching result represents one of the following: hit the blacklist, hit the whitelist, or no match; If the matching result of the list does not match, the intelligent pre-judgment model is used to perform third classification processing on the explicit information of the email to obtain the third classification result, and the mutual trust relationship is queried based on the recipient and sender in the explicit information of the email. Based on the list matching results, the third classification results, and the mutual trust relationship, the first classification result is determined.

3. The method according to claim 2, characterized in that, The process of using an intelligent pre-judgment model to perform third-class classification on the explicit information in the email to obtain the third-class classification result includes the following steps: Feature extraction is performed on the explicit information of the email to obtain explicit email features; the explicit email features include domain name attribute features, email attribute features, email content features, and associated risk features; The explicit features of the email are input into the intelligent pre-judgment model for third classification processing to obtain the third classification result of the email; the third classification result is one of the first risk level, the second risk level and the third risk level.

4. The method according to claim 3, characterized in that, The second classification process for the content linked by the domain name in the email, to obtain the second classification result, includes the following steps: Based on the priority level represented by the third classification result of the email, the link domain name of the email is crawled through an asynchronous thread to obtain the content pointed to by the link; The content pointed to by the links is then subjected to a second classification process to obtain a second classification result.

5. The method according to claim 4, characterized in that, The second classification process for the content pointed to by the link, to obtain the second classification result, includes the following steps: Extract the link declaration type from the hypertext header of the content the link points to; Determine whether the declared link type matches the actual loaded type; If the link declaration type is inconsistent with the actual loading type, the second classification result is determined to be a risky email; When the link declaration type is consistent with the actual loading type, the hypertext message body of the content pointed to by the link is risk-identified by the intelligent deep content parsing model to obtain the second classification result.

6. The method according to claim 5, characterized in that, The process of identifying risks in the hypertext message body of the linked content using an intelligent deep content parsing model to obtain a second classification result includes the following steps: For the text data in the hypertext message body, a conversational big model is used to perform risk semantic recognition on the text data to obtain semantic risk judgment results. For the image data in the hypertext message body, an image recognition model is used to identify the image information in the image data, and the image risk assessment result is determined based on the image information; For the program script data in the hypertext message body, a code analysis model is used to identify the execution actions of the program script data, and the action risk assessment result is determined based on the execution actions; Based on the semantic risk assessment results, the image risk assessment results, and the action risk assessment results, a second classification result is determined.

7. The method according to any one of claims 1 to 5, characterized in that, The secure email delivery method also includes the following steps: If the second classification result indicates a risky email, the linked domain name in the email will be added to the link blacklist database; An intelligent rule extraction model is used to extract rules from the link blacklist database to obtain risky link rules, and these risky link rules are then added to the rule database.

8. A secure email delivery system, characterized in that, include: The receiving module is used to extract explicit content from received emails and obtain explicit email information. The first classification and identification module is used to perform a first classification process on the email based on the explicit information of the email, and obtain a first classification result; The first classification processing module is used to intercept the email if the first classification result indicates that it is spam. If the first classification result indicates that the email is trustworthy, the email will be delivered to the recipient's mailbox. If the first classification result indicates a suspicious email, the email will be delivered to the recipient's mailbox; The second classification identification module is used to perform a second classification process on the content pointed to by the linked domain name in the email when the first classification result indicates that the email is suspicious, and obtain a second classification result. The second classification processing module is used to retrieve the email from the recipient's mailbox if the second classification result indicates that the email is a risky email.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images