A method, device, equipment and readable storage medium for email detection

Abstract

The present application discloses a method for detecting an email, including: receiving an email; when detecting that an attachment is contained in the email, passing the attachment to a sandbox, the sandbox providing an isolation environment for the running program; running the attachment in the sandbox, and monitoring whether the attachment has a target attention behavior; when monitoring that the attachment has a target attention behavior, determining that the attachment contains a ransomware virus, intercepting the email, and outputting an alarm prompt message. The method for detecting an email provided in an embodiment of the present application performs ransomware virus detection in advance before the email is transmitted to the email recipient, and intercepts emails containing ransomware viruses, thereby reducing the risk of computer equipment being infringed by ransomware viruses and improving the security of computer equipment.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, computer equipment and computer-readable storage medium for email detection. Background Art

[0002] With the rapid development of the Internet, network attacks are becoming more and more common. Network attacks usually involve hackers spreading malicious programs written with attack intentions to the Internet. For example, they are implanted into some videos or files. Once a user clicks on the corresponding video or file with the malicious program implanted, the user's terminal will be implanted with the malicious program, causing the user's terminal to be poisoned or information to be stolen.

[0003] Ransomware is one of the cybersecurity threats that has grown rapidly and caused great harm in recent years. It is a kind of malware that criminals hijack user files and other assets or resources by encrypting files, locking screens, etc., and then extort money from users. Ransomware is also called ransomware virus. Criminals implant ransomware into victim computers or servers through phishing methods such as sending emails to encrypt documents on the hard disk or even the entire hard disk, and then demand ransoms of varying amounts from the victim companies or individuals before decrypting them.

[0004] Emails are the hardest hit by ransomware. Criminals induce users to run email attachments to trigger ransomware to encrypt files on the user's local machine, and then use the decryption password to extort ransom to gain profits. In recent years, ransomware has developed very rapidly, and the feature detection method of antivirus software for ransomware has lagged behind, which often leads to the encryption of files in computer devices before the antivirus software has the ability to detect and kill them. In this way, the files in computer devices are at high risk of being damaged by ransomware. Summary of the invention

[0005] The embodiment of the present application provides a method for detecting an email, which detects ransomware in advance before the email is transmitted to the email recipient, and intercepts the email containing the ransomware, thereby reducing the risk of the computer device being damaged by the ransomware. The embodiment of the present application also provides a corresponding device, a computer device, and a computer-readable storage medium.

[0006] The first aspect of the present application provides a method for email detection, comprising:

[0007] Receive emails;

[0008] When detecting that the email contains an attachment, passing the attachment to a sandbox, the sandbox providing an isolation environment for the running program;

[0009] Running the attachment in the sandbox and monitoring whether the attachment performs a target attention behavior;

[0010] When it is monitored that the attachment has the target attention behavior, it is determined that the attachment contains a ransomware virus, the email is intercepted, and an alarm prompt message is output.

[0011] A second aspect of the present application provides an email detection device, comprising:

[0012] A receiving program module for receiving e-mails;

[0013] A detection program module, used to detect whether the email received by the receiving program module contains an attachment;

[0014] a delivery program module, configured to deliver the attachment to a sandbox when the detection program module detects that the email contains an attachment, the sandbox providing an isolation environment for a running program;

[0015] A program running module, used for running the attachment delivered by the delivery program module in the sandbox;

[0016] A monitoring program module, used for monitoring whether the attachment has a target attention behavior when the program running module runs the attachment;

[0017] The processing program module is used to intercept the email and output an alarm prompt message when the monitoring program module detects that the attachment has the target attention behavior and determines that the attachment contains a ransomware virus.

[0018] A third aspect of the present application provides a computer device, comprising: an input / output (I / O) interface, a processor, and a memory, wherein the memory stores instructions for processing the ransomware software according to the first aspect;

[0019] The processor is used to execute the email detection instructions stored in the memory, and perform the steps of the email detection method as described in the first aspect.

[0020] Another aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the computer-readable storage medium is run on a computer, the computer executes the method described in the first aspect.

[0021] Another aspect of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect.

[0022] The embodiment of the present application adopts receiving an email; when it is detected that the email contains an attachment, the attachment is passed to a sandbox, and the sandbox provides an isolated environment for the running program; the attachment is run in the sandbox, and the attachment is monitored to see if the target attention behavior occurs; when the attachment is monitored to occur the target attention behavior, it is determined that the attachment contains a ransomware virus, then the email is intercepted, and an alarm prompt message is output. Compared with the prior art in which the user's computer device is often infected with viruses in the attachments of the running emails, the email detection method provided in the embodiment of the present application performs ransomware virus detection in advance before the email is transmitted to the email recipient, and intercepts the email containing the ransomware virus, thereby reducing the risk of the computer device being damaged by the ransomware virus and improving the security of the computer device. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a schematic diagram of the interface that spreads the ransomware virus through email attachments;

[0024] Figure 2 This is a schematic diagram of an interface that is locked by a ransomware virus;

[0025] Figure 3 This is a schematic diagram of an interface encrypted by the ransomware virus;

[0026] Figure 4 It is a schematic diagram of an embodiment of the detection process of an email in an embodiment of the present application;

[0027] Figure 5 This is a schematic diagram of an embodiment of a method for email detection in an embodiment of the present application;

[0028] Figure 6 is a schematic diagram of another embodiment of the method for email detection in an embodiment of the present application;

[0029] Figure 7 It is a schematic diagram of an embodiment of an apparatus for email detection in an embodiment of the present application;

[0030] Figure 8 is a schematic diagram of an embodiment of a computer device in an embodiment of the present application;

[0031] Fig. 9 It is a schematic diagram of an embodiment of the virtualization form of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following describes the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. It is known to those skilled in the art that with the development of ransomware detection technology, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0033] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described here can be implemented in an order other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The division of modules that appear in this application is only a logical division. There may be other division methods when implemented in actual applications, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0034] The embodiment of the present application provides a method for detecting an email, which detects ransomware in advance before the email is transmitted to the email recipient, and intercepts the email containing the ransomware, thereby reducing the risk of computer equipment being damaged by the ransomware. The embodiment of the present application also provides corresponding devices and equipment. The following are detailed descriptions.

[0035] In the field of computer security, a sandbox is a security mechanism that provides an isolated environment for running programs. It is usually used to experiment with programs whose sources are untrustworthy, destructive, or whose intentions cannot be determined. All changes in the sandbox will not cause any damage to the operating system. Therefore, the sandbox can be used to test programs that may contain viruses or other malicious code.

[0036] The email detection method provided in the embodiment of the present application can be applied to any computer device in the network that may be damaged by ransomware. The computer device is usually a server in the network, but it can also be a terminal. If it is a terminal, it can be a personal computer (PC, personal computer), a mobile phone, a phone watch, a laptop, a tablet computer and other networked terminal devices. If the terminal implements the email detection method in the embodiment of the present application, it can directly discard the email after detecting the virus, and not present the email in the user's email mailbox.

[0037] Ransomware can also be called ransomware. Computers and devices infected by ransomware may be locked or their files may be encrypted, requiring payment to decrypt. Email is a common way for ransomware to spread, such as Figure 1 This is a diagram of the interface for spreading ransomware through email attachments. Figure 1 Once the indicated add-on is run, the Figure 2 or Figure 3 The interface shown.

[0038] like Figure 2 This is a schematic diagram of the interface of the ransomware lock screen. Figure 3 This is a diagram of the interface encrypted by the ransomware virus.

[0039] like Figure 2 As shown, if the screen is locked by ransomware, you will receive a message such as Figure 2 The interface notification shown notifies the user of the phone to contact the hacker who released the ransomware. Usually, after paying the hacker, the hacker will unlock the phone.

[0040] like Figure 3 As shown in the figure, if the files on the computer are encrypted by the ransomware, you will also receive the following message on the computer interface: Figure 3 The interface notification shown informs the user that all files on the computer are encrypted. If the user does not pay the hacker who released the virus within the specified time, the files will be damaged and the remaining time will be prompted.

[0041] The spread of ransomware through emails can sometimes catch users off guard, and hackers sometimes forge contacts in the email address book to spread the virus, so the best way to avoid viruses is to intercept emails with viruses in advance. The current email system has a certain interception function, but the interception function in the current email system is usually a regular interception, which can only intercept viruses that have been analyzed and have their characteristics. It is still impossible to intercept some new viruses in time.

[0042] The present application embodiment provides a detection process of an email, such as Figure 4As shown, the modules involved in the detection process include the email sender, the conventional detection and interception system, the attachment existence judgment system, the sandbox and the security processing system.

[0043] Among them, the conventional detection and interception system has functions such as conventional signature code detection and malicious source detection and interception.

[0044] Attachment existence judgment system: used to judge whether there is an attachment in the email.

[0045] Sandbox: used to determine whether there is file operation behavior and / or network behavior

[0046] Security processing system: handles security alerts that trigger actions

[0047] The testing process includes:

[0048] S1. The email sender sends an email through a terminal.

[0049] After the email reaches the regular detection system, the regular detection system will perform regular detection on the email. The regular detection system will filter and intercept regular viruses and ransomware viruses with existing signature codes. Some large-scale new ransomware viruses can be intercepted through the threshold, but the part that does not reach the threshold cannot be intercepted.

[0050] S2. Email indicating that the routine testing system has passed the test.

[0051] After the email reaches the attachment existence determination system, the attachment existence determination system will determine whether the email contains an attachment.

[0052] If the attachment is not included, step S3 will be executed; if the attachment is included, step S4 will be executed.

[0053] S3. If the email does not contain an attachment, the attachment existence judgment system releases the email, and the email is delivered to the terminal of the email recipient.

[0054] S4. If an attachment is included, the attachment existence determination system passes the attachment to the sandbox.

[0055] The sandbox will monitor the attachment.

[0056] The sandbox in the embodiment of the present application can be configured in the following manner:

[0057] The first method is to use a conventional virtual machine (virtual machine, VM), virtual box VirtualBox, etc. to build a Windows sandbox.

[0058] The second method is to build a single-function Windows-like operating system as a sandbox, which can support the launch of office programs and support the operation and recording of file and network behaviors. This sandbox configuration method can maximize the sandbox's detection of ransomware behaviors.

[0059] like Figure 4 In the sandbox, there are file operation behavior monitoring module and network behavior monitoring module.

[0060] The file operation behavior monitoring module can monitor file behavior in the following ways:

[0061] 1. Use Windows logs, such as Sysmon's file record log, to monitor the operation behavior of the program on the file when the attachment is running.

[0062] The operation behavior may include a series of operation behaviors such as opening, modifying and encrypting.

[0063] 2. The file filter driver records the behavior of the program touching the file.

[0064] A file filter driver may also be called a file system filter driver (FSFD).

[0065] File system filter driver: From the application point of view, the file system filter driver can filter one or more file systems, or the I / O operations of the file system volume. According to different types, the file system filter driver can be divided into logging, system monitoring, data modification and event prevention. Usually, the application programs with the file system filter driver as the core include file encryption and decryption, virus protection, process control, file access, post-audit and information security applications.

[0066] The file filtering driver will record the operation behavior of the attached program on the file when it is running. The operation behavior may include a series of operations such as opening, modifying and encrypting.

[0067] 3. Inject the attachment program into a target program for monitoring, wherein the target program includes an interface associated with an operating file; monitor the attachment program's usage information of the interface to monitor the attachment program's operating behavior on the file when it is running.

[0068] Network behavior includes data transfer behavior after the program operates the file when the attachment is running, for example: key transmission behavior. Usually, the ransomware will generate a corresponding key after encrypting the file. In order to use the key for decryption when obtaining the ransom, the key needs to be sent back to the control end of the ransomware.

[0069] The network behavior monitoring module can monitor network behavior in the following ways:

[0070] 1. Use Windows logs, such as Sysmon's network logs and the system's own firewall logs, to monitor whether network behavior occurs.

[0071] 2. Capture data packets at the network layer and analyze whether network behavior occurs.

[0072] 3. Inject the attachment program into a target program for monitoring, wherein the target program includes an interface associated with network operations; monitor the network behavior of the attachment program when it is running by monitoring the usage information of the interface by the attachment program.

[0073] In the embodiment of the present application, the monitoring of file operation behavior and network behavior can be selectively monitored or can be monitored simultaneously. It can be determined that the attachment contains a ransomware virus only when one of the file operation behavior and the network behavior is monitored, or it can be determined that the attachment contains a ransomware virus only when both the file operation behavior and the network behavior are monitored.

[0074] The target focus behavior in the embodiment of the present application includes at least one of a file operation behavior and a network behavior.

[0075] The file operation behavior refers to the operation behavior of the file when the attachment program is running, and the operation behavior includes encryption behavior.

[0076] Conditions can also be set for file operation behaviors. For example, when the frequency of operations on the file by the attachment program exceeds a frequency threshold, it is determined that the attachment has performed target attention behavior, so as to avoid assuming that the file contains a ransomware virus based on only one operation of the attachment program during operation, which may lead to false alarms.

[0077] The network behavior includes data transfer behavior after the program operates the file when the attachment is running; when data transfer behavior occurs after the program operates the file of the attachment, it is determined that the attachment has a target attention behavior.

[0078] S4. If the sandbox determines that the program of the attachment does not have the above-mentioned target attention behavior when running, the email is released and transmitted to the terminal of the email recipient.

[0079] S5. If the sandbox determines that the above-mentioned target attention behavior occurs when the program of the attachment is running, an alarm prompt message is sent to the security processing system.

[0080] The security personnel of the security processing system will handle the alarm according to the alarm prompt information. They can detect the source of the email containing the ransomware and then handle it from the source.

[0081] In an embodiment of the present application, a sandbox is set up on the email transmission link, a full range of office programs are installed in the sandbox and macros are started, and file operation behaviors and network behaviors are monitored. File operation behaviors, for example, use macro scripts to encrypt files or use macro scripts to download encryption programs and start encryption programs to encrypt files. When the monitored operation frequency is greater than the frequency threshold, it is determined that the attachment contains a ransomware virus. The operation frequency can be determined by the number of operations per unit time. When the number of files touched by the office program per unit time>N, it is determined that the target attention behavior has occurred. When network behavior occurs, it can also be determined that the target attention behavior has occurred. It can be determined that the attachment contains a ransomware virus and the email is intercepted.

[0082] The sandbox of this solution only monitors file operation behaviors and network behaviors. The monitoring amount is small and the speed is fast. It can avoid delays in users receiving emails and can intercept ransomware viruses before users receive them, so that users suffer no losses.

[0083] The following describes the email detection method in the embodiment of the present application in conjunction with the accompanying drawings.

[0084] like Figure 5 As shown, an embodiment of the method for email detection provided by the embodiment of the present application includes:

[0085] 101. Receive email.

[0086] The computer device that performs email detection in the embodiment of the present application may include Figure 4 In the attachment existence judgment system and sandbox, the email is first transmitted to the attachment existence judgment system, and the attachment existence judgment system detects whether the email contains an attachment.

[0087] There are many methods for detecting attachments, such as directly detecting the location of the attachment, or detecting the body content of the email and the byte size of the email to determine whether the attachment is included. In the embodiment of the present application, the method for detecting attachments is not limited, as long as it can quickly detect whether the email contains nearby.

[0088] 102. When it is detected that the email contains an attachment, the attachment is transferred to a sandbox, where the sandbox provides an isolation environment for the running program.

[0089] For the description of the sandbox, please refer to the relevant description of the sandbox above, which will not be repeated here.

[0090] 103. Run the attachment in the sandbox, and monitor whether the attachment performs target attention behavior.

[0091] The target focus behavior in the embodiment of the present application includes at least one of a file operation behavior and a network behavior.

[0092] The file operation behavior refers to the operation behavior of the file when the attachment program is running, and the operation behavior includes encryption behavior.

[0093] Conditions can also be set for file operation behaviors. For example, when the frequency of operations on the file by the attachment program exceeds a frequency threshold, it is determined that the attachment has performed target attention behavior, so as to avoid assuming that the file contains a ransomware virus based on only one operation of the attachment program during operation, which may lead to false alarms.

[0094] The network behavior includes data transfer behavior after the program operates the file when the attachment is running; when data transfer behavior occurs after the program operates the file of the attachment, it is determined that the attachment has a target attention behavior.

[0095] 104. When it is detected that the attachment has the target attention behavior and it is determined that the attachment contains a ransomware virus, the email is intercepted and an alarm prompt message is output.

[0096] The embodiment of the present application adopts receiving an email; when it is detected that the email contains an attachment, the attachment is passed to a sandbox, and the sandbox provides an isolated environment for the running program; the attachment is run in the sandbox, and the attachment is monitored to see if the target attention behavior occurs; when the attachment is monitored to occur the target attention behavior, it is determined that the attachment contains a ransomware virus, then the email is intercepted, and an alarm prompt message is output. Compared with the prior art in which the user's computer device is often infected with viruses in the attachments of the running emails, the email detection method provided in the embodiment of the present application performs ransomware virus detection in advance before the email is transmitted to the email recipient, and intercepts the email containing the ransomware virus, thereby reducing the risk of the computer device being damaged by the ransomware virus and improving the security of the computer device.

[0097] Optionally, see Figure 6 Another embodiment of the method for email detection provided by the embodiment of the present application includes:

[0098] 201. Receive email.

[0099] The computer device that performs email detection in the embodiment of the present application may include Figure 4 In the attachment existence judgment system and sandbox, the email is first transmitted to the attachment existence judgment system, and the attachment existence judgment system detects whether the email contains an attachment.

[0100] There are many methods for detecting attachments, such as directly detecting the location of the attachment, or detecting the body content of the email and the byte size of the email to determine whether the attachment is included. In the embodiment of the present application, the method for detecting attachments is not limited, as long as it can quickly detect whether the email contains nearby.

[0101] 202. When it is detected that the email contains an attachment, the attachment is transferred to a sandbox, where the sandbox provides an isolation environment for the running program.

[0102] 203. Run the attachment in the sandbox.

[0103] 204-1. Monitor the operation behavior of the file when the program of the attachment is running, and the operation behavior includes encryption behavior.

[0104] In the embodiment of the present application, the operation behavior of the program for monitoring the attachment on the file when it is running includes:

[0105] Monitor the operation behavior of the file when the attachment program is running by operating the file log, and the operating file log is a system file log or a log recorded by the file filtering driver. Or,

[0106] The program of the attachment is injected into a target program for monitoring, wherein the target program includes an interface associated with an operation file; by monitoring the usage information of the attachment program on the interface, the operation behavior of the attachment program on the file during its operation is monitored.

[0107] like Figure 4 In the sandbox, there are file operation behavior monitoring module and network behavior monitoring module.

[0108] The file operation behavior monitoring module can monitor file behavior in the following ways:

[0109] 1. Use Windows logs, such as Sysmon's file record log, to monitor the operation behavior of the program on the file when the attachment is running.

[0110] The operation behavior may include a series of operation behaviors such as opening, modifying and encrypting.

[0111] 2. The file filter driver records the behavior of the program touching the file.

[0112] A file filter driver may also be called a file system filter driver (FSFD).

[0113] File system filter driver: From the application point of view, the file system filter driver can filter one or more file systems, or the I / O operations of the file system volume. According to different types, the file system filter driver can be divided into logging, system monitoring, data modification and event prevention. Usually, the application programs with the file system filter driver as the core include file encryption and decryption, virus protection, process control, file access, post-audit and information security applications.

[0114] The file filtering driver will record the operation behavior of the attached program on the file when it is running. The operation behavior may include a series of operations such as opening, modifying and encrypting.

[0115] 3. Inject the attachment program into a target program for monitoring, wherein the target program includes an interface associated with an operating file; monitor the attachment program's usage information of the interface to monitor the attachment program's operating behavior on the file when it is running.

[0116] 205-1. When the operation frequency of the program of the attachment on the file exceeds a frequency threshold, it is determined that the attachment has a target attention behavior.

[0117] 204-2. Monitor the network behavior of the attachment program when it is running, wherein the network behavior includes the data transmission behavior after the attachment program operates the file when it is running.

[0118] The monitoring of the network behavior of the attached program when it is running includes:

[0119] Monitor the network behavior of the attached program when it is running by using the system network log or the attached program's capture of data packets at the network layer. Or,

[0120] The program of the attachment is injected into a target program for monitoring, wherein the target program includes an interface associated with network operations; and the network behavior of the program of the attachment during operation is monitored by monitoring the usage information of the interface by the program of the attachment.

[0121] Network behavior includes data transfer behavior after the program operates the file when the attachment is running, for example: key transmission behavior. Usually, the ransomware will generate a corresponding key after encrypting the file. In order to use the key for decryption when obtaining the ransom, the key needs to be sent back to the control end of the ransomware.

[0122] The network behavior monitoring module can monitor network behavior in the following ways:

[0123] 1. Use Windows logs, such as Sysmon's network logs and the system's own firewall logs, to monitor whether network behavior occurs.

[0124] 2. Capture data packets at the network layer and analyze whether network behavior occurs.

[0125] 3. Inject the attachment program into a target program for monitoring, wherein the target program includes an interface associated with network operations; monitor the network behavior of the attachment program when it is running by monitoring the usage information of the interface by the attachment program.

[0126] 205-2. When data transfer occurs after the program of the attachment operates the file, it is determined that the attachment has a target attention behavior.

[0127] 206. When it is detected that the attachment has the target attention behavior and it is determined that the attachment contains a ransomware virus, the email is intercepted and an alarm prompt message is output.

[0128] In the embodiment of the present application, the monitoring of file operation behavior and network behavior can be selectively monitored or can be monitored simultaneously. It can be determined that the attachment contains a ransomware virus only when one of the file operation behavior and the network behavior is monitored, or it can be determined that the attachment contains a ransomware virus only when both the file operation behavior and the network behavior are monitored.

[0129] The target focus behavior in the embodiment of the present application includes at least one of a file operation behavior and a network behavior.

[0130] Optionally, in an embodiment of the present application, when it is monitored that the attachment does not undergo the target attention behavior, the email is released.

[0131] The above is a description of the method for detecting emails. The following describes an apparatus for detecting emails in an embodiment of the present application in conjunction with the accompanying drawings.

[0132] like Figure 7 As shown, an embodiment of the email detection device 30 provided in the embodiment of the present application includes:

[0133] A receiving program module 301 is used to receive emails;

[0134] The detection program module 302 is used to detect whether the email received by the receiving program module 301 contains an attachment;

[0135] A delivery program module 303, configured to deliver the attachment to a sandbox when the detection program module 302 detects that the email contains an attachment, wherein the sandbox provides an isolation environment for a running program;

[0136] A program running module 304, used for running the attachment transferred by the transfer program module 303 in the sandbox;

[0137] A monitoring program module 305, used for monitoring whether the attachment has a target attention behavior when the program running module 304 runs the attachment;

[0138] The processing program module 306 is used to intercept the email and output an alarm prompt message when the monitoring program module 305 detects that the attachment has the target attention behavior and determines that the attachment contains a ransomware virus.

[0139] The processing program module 306 may include a processor for intercepting emails, and may also include a transceiver or an I / O interface for outputting alarm prompt information.

[0140] In the embodiment of the present application, the receiving program module 301 receives an email; the detecting program module 302 detects whether the email received by the receiving program module 301 contains an attachment; the transmitting program module 303 transmits the attachment to the sandbox when the detecting program module 302 detects that the email contains an attachment, and the sandbox provides an isolation environment for the running program; the program running module 304 runs the attachment transmitted by the transmitting program module 303 in the sandbox; the monitoring program module 305 monitors whether the attachment has a target attention behavior when the program running module 304 runs the attachment; the processing program module 306 determines that the attachment contains a ransomware virus when the monitoring program module 305 detects that the attachment has the target attention behavior, then intercepts the email, and outputs an alarm prompt message. Compared with the prior art in which the user's computer equipment often runs a virus in the attachment in the email, the email detection device provided in the embodiment of the present application performs ransomware virus detection in advance before the email is transmitted to the email recipient, and intercepts the email containing the ransomware virus, thereby reducing the risk of the computer equipment being infringed by the ransomware virus and improving the security of the computer equipment.

[0141] Optionally, in another embodiment of the apparatus 30 for detecting email provided in the embodiment of the present application,

[0142] The monitoring program module 305 is used to:

[0143] Monitoring the operation behavior of the file when the program of the attachment is running, wherein the operation behavior includes encryption behavior;

[0144] When the operation frequency of the program of the attachment on the file exceeds a frequency threshold, it is determined that the attachment has a target attention behavior.

[0145] Among them, monitoring the operation behavior of the attachment program on the file when it is running may include:

[0146] The operation behavior of the attachment program on the file during operation is monitored by operating the file log, wherein the operating file log is a system file log or a log recorded by a file filtering driver.

[0147] or,

[0148] Injecting the program of the attachment into a target program for monitoring, the target program including an interface associated with an operation file;

[0149] By monitoring the usage information of the interface by the program of the attachment, the operation behavior of the program of the attachment on the file when it is running is monitored.

[0150] Optionally, in another embodiment of the apparatus 30 for detecting email provided in the embodiment of the present application,

[0151] The monitoring program module 305 is used to:

[0152] Monitoring the network behavior of the attachment program when it is running, wherein the network behavior includes the data transmission behavior after the attachment program operates the file when it is running;

[0153] When data transfer occurs after the program of the attachment operates the file, it is determined that the attachment has a target attention behavior.

[0154] Among them, monitoring the network behavior of the program when the attachment is running may include:

[0155] The network behavior of the attached program during operation is monitored through the system network log or the attached program's capture of data packets at the network layer.

[0156] or,

[0157] injecting the program of the attachment into a target program for monitoring, the target program including an interface associated with network operations;

[0158] By monitoring the usage information of the interface by the program of the attachment, the network behavior of the program of the attachment when it is running is monitored.

[0159] Optionally, the processing program module 306 is further configured to release the email when it is detected that the attachment does not have the target attention behavior.

[0160] The above description of the device 30 for email detection can be found in the previous Figures 1 to 6 You can understand the method part of this article, and I will not go into details here.

[0161] The computer device that executes the method for email detection in the embodiment of the present application can be a server structure, and of course it can also be a terminal structure. It is usually implemented on a server. Therefore, in the embodiment of the present application, the server structure is taken as an example to introduce the computer device that executes the method for email detection in the embodiment of the present application.

[0162] Figure 8 4 is a schematic diagram of the structure of a computer device 40 provided in an embodiment of the present invention. The computer device 40 includes a processor 410, a memory 450 and a transceiver 430. The memory 450 may include a read-only memory and a random access memory, and provides operation instructions and data to the processor 410. A portion of the memory 450 may also include a non-volatile random access memory (NVRAM).

[0163] In some embodiments, the memory 450 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:

[0164] In the embodiment of the present invention, by calling the operation instruction stored in the memory 450 (the operation instruction may be stored in the operating system),

[0165] receiving electronic mail via transceiver 430;

[0166] When detecting that the email contains an attachment, passing the attachment to a sandbox, the sandbox providing an isolation environment for the running program;

[0167] Running the attachment in the sandbox and monitoring whether the attachment performs a target attention behavior;

[0168] When it is monitored that the attachment has the target attention behavior, it is determined that the attachment contains a ransomware virus, the email is intercepted, and an alarm prompt message is output.

[0169] Compared with the prior art in which users' computer devices are often infected with viruses in attachments in running emails, the computer device provided in the embodiments of the present application performs ransomware virus detection in advance before the email is transmitted to the email recipient, and intercepts emails containing ransomware viruses, thereby reducing the risk of computer devices being infected by ransomware viruses and improving the security of computer devices.

[0170] The processor 410 controls the operation of the computer device 40, and the processor 410 can also be called a CPU (Central Processing Unit). The memory 450 can include a read-only memory and a random access memory, and provides instructions and data to the processor 410. A portion of the memory 450 can also include a non-volatile random access memory (NVRAM). In a specific application, the various components of the computer device 40 are coupled together through a bus system 420, wherein the bus system 420 includes a data bus, a power bus, a control bus, and a status signal bus, etc. However, for the sake of clarity, various buses are labeled as bus systems 420 in the figure.

[0171] The method disclosed in the above embodiment of the present invention can be applied to the processor 410, or implemented by the processor 410. The processor 410 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 410 or the instruction in the form of software. The above processor 410 can be a general processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be combined to be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 450, and the processor 410 reads the information in the memory 450 and completes the steps of the above method in combination with its hardware.

[0172] Optionally, the processor 410 is configured to:

[0173] Monitoring the operation behavior of the file when the program of the attachment is running, wherein the operation behavior includes encryption behavior;

[0174] When the operation frequency of the program of the attachment on the file exceeds a frequency threshold, it is determined that the attachment has a target attention behavior.

[0175] Optionally, the processor 410 is configured to:

[0176] Monitoring the network behavior of the attachment program when it is running, wherein the network behavior includes the data transmission behavior after the attachment program operates the file when it is running;

[0177] When data transfer occurs after the program of the attachment operates the file, it is determined that the attachment has a target attention behavior.

[0178] Optionally, the processor 410 is further configured to:

[0179] The operation behavior of the attachment program on the file during operation is monitored by operating the file log, wherein the operating file log is a system file log or a log recorded by a file filtering driver.

[0180] Optionally, the processor 410 is configured to:

[0181] Injecting the program of the attachment into a target program for monitoring, the target program including an interface associated with an operation file;

[0182] By monitoring the usage information of the interface by the program of the attachment, the operation behavior of the program of the attachment on the file when it is running is monitored.

[0183] Optionally, the processor 410 is configured to:

[0184] The network behavior of the attached program during operation is monitored through the system network log or the attached program's capture of data packets at the network layer.

[0185] Optionally, the processor 410 is configured to:

[0186] injecting the program of the attachment into a target program for monitoring, the target program including an interface associated with network operations;

[0187] By monitoring the usage information of the interface by the program of the attachment, the network behavior of the program of the attachment when it is running is monitored.

[0188] Optionally, the transceiver 430 is further configured to release the email when it is detected that the attachment does not have the target attention behavior.

[0189] The above description of the computer device 60 can be found in Figures 1 to 7 The description in part can be understood, and no further repetition will be given here.

[0190] The above computer device can also be a virtualized system. The computer device in the virtualized scenario is represented as follows: Fig. 9 As shown, the computer device in the virtualization scenario includes a hardware layer and a virtual machine monitor (VMM) 1001 running on the hardware layer, and multiple virtual machines 1002. One or more virtual machines can be selected as master nodes, and multiple virtual machines can be selected as working nodes.

[0191] Specifically, virtual machine 1002 is one or more virtual computers simulated on public hardware resources by virtual machine software, and these virtual machines work like real computers. Operating systems and applications can be installed on virtual machines, and virtual machines can also access network resources. For applications running in virtual machines, virtual machines are like working in real computers.

[0192] Hardware layer: The hardware platform on which the virtualized environment runs can be abstracted from the hardware resources of one or more physical hosts. The hardware layer may include a variety of hardware, such as a processor 1004 (such as a CPU) and a memory 1005, and may also include a network card 1003 (such as an RDMA network card), high-speed / low-speed input / output (I / O, Input / Output) devices, and other devices with specific processing functions.

[0193] In addition, the distributed system in the virtualization scenario may also include a host: as a management layer, it is used to complete the management and allocation of hardware resources; present a virtual hardware platform to virtual machines; and implement the scheduling and isolation of virtual machines. Among them, the Host may be a virtual machine monitor (VMM); in addition, sometimes the VMM and a privileged virtual machine cooperate, and the two are combined to form the Host. Among them, the virtual hardware platform provides various hardware resources to each virtual machine running on it, such as providing a virtual processor (such as VCPU), virtual memory, virtual disk, virtual network card, etc. Among them, the virtual disk can correspond to a file or a logical block device of the Host. The virtual machine runs on the virtual hardware platform prepared by the Host for it, and one or more virtual machines run on the Host.

[0194] Privileged virtual machine: A special virtual machine, also called a driver domain. For example, this special virtual machine is called Dom0 on the XenHypervisor platform. Drivers for real physical devices such as network cards and SCSI disks are installed in this virtual machine, which can detect and directly access these real physical devices. Other virtual machines use the corresponding mechanism provided by the Hypervisor to access real physical devices through the privileged virtual machine.

[0195] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0196] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center to another website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0197] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0198] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0199] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, which can include: ROM, RAM, disk or CD, etc.

[0200] The above is a detailed introduction to the email detection method, device, equipment and computer-readable storage medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting an email, characterized in that: include: Receive emails; Performing conventional detection on the email through a conventional detection system, wherein the conventional detection system is used to filter and intercept conventional viruses, ransomware viruses with existing signature codes, and new ransomware viruses that can pass the threshold interception; When the email passes the detection of the conventional detection system, the conventional detection system releases the email so that the email is delivered to the attachment existence judgment system; When the email arrives at the attachment existence determination system, the attachment existence determination system detects the location of the attachment or detects the body content of the email and the byte size of the email to determine whether the email includes an attachment; When it is detected that the email does not include the attachment, the email is delivered to a terminal of the email recipient; When it is detected that the email contains the attachment, the attachment is passed to a sandbox, the sandbox provides an isolated environment for the running program, the sandbox is constructed as a Windows-like operating system with a single function, a full range of office programs are installed in the sandbox and macros are started, the sandbox includes a file operation behavior monitoring module and a network behavior monitoring module, the sandbox is set on the email transmission link, and the sandbox is only used to monitor file operation behavior and network behavior; Running the attachment in the sandbox and monitoring whether the attachment has a target attention behavior, wherein the target attention behavior includes at least one of the file operation behavior and the network behavior; When it is detected in the sandbox that the attachment does not have the target attention behavior, transmitting the email to the terminal of the email recipient; When the attachment is detected to have the target attention behavior in the sandbox, it is determined that the attachment contains a ransomware virus, the email is intercepted, and an alarm prompt message is output to the security processing system to instruct the security personnel of the security processing system to detect the source of the email containing the ransomware virus and handle it from the source; Wherein, when the target attention behavior includes the file operation behavior, monitoring whether the attachment has the target attention behavior includes performing the following operations through the file operation behavior monitoring module: Inject the program of the attachment into the target program for monitoring; monitor the operation behavior of the program of the attachment on the file when it is running by monitoring the usage information of the program of the attachment on the interface associated with the operation file in the target program; or monitor the operation behavior of the program of the attachment on the file when it is running through the windows log; or monitor the operation behavior of the program of the attachment on the file when it is running through the log recorded by the file filtering driver, the file filtering driver is used to filter the input / output operations of one or more file systems or file system volumes and to record the operation behavior of the program of the attachment on the file when it is running; determine that the attachment has the target attention behavior when at least one of the following conditions is met: the operation frequency of the program of the attachment on the file is greater than the frequency threshold, and the number of files touched by the office program in a unit time exceeds the number threshold; the operation behavior includes encryption behavior, opening behavior and modification behavior of encrypting files using macro scripts or using the macro scripts to download encryption programs and start the encryption programs to encrypt files; Wherein, when the target attention behavior includes the network behavior, monitoring whether the attachment has the target attention behavior includes performing the following operations through the network behavior monitoring module: Inject the program of the attachment into the target program for monitoring; monitor the network behavior of the program of the attachment when it is running by monitoring the usage information of the interface associated with the operation file in the target program by the program of the attachment; or, monitor the network behavior of the program of the attachment when it is running through the Windows log; or, monitor the network behavior of the program of the attachment when it is running through the capture of data packets by the program of the attachment at the network layer; when the network behavior occurs after the program of the attachment operates the file, it is determined that the attachment has the target focus behavior; the network behavior includes key transmission behavior, and the key transmission behavior refers to sending a key back to the control end of the ransomware virus, the key is generated after the ransomware virus encrypts the file, and is used to decrypt the file when the control end of the ransomware virus receives the ransom.

2. An email detection device, characterized in that: include: A receiving program module for receiving e-mails; A module for performing the following steps: performing conventional detection on the email received by the receiving program module through a conventional detection system, wherein the conventional detection system is used to filter and intercept conventional viruses, ransomware viruses with existing signatures, and new ransomware viruses that can be intercepted through a threshold; A detection program module, used for, when the email passes the detection of the conventional detection system, the conventional detection system releases the email so that the email is delivered to the attachment existence judgment system; when the email arrives at the attachment existence judgment system, the attachment existence judgment system detects the location of the attachment or detects the text content of the email and the byte size of the email to determine whether the email contains an attachment; A module for executing the following steps: when the detection program module detects that the email does not include the attachment, delivering the email to a terminal of an email recipient; a delivery program module, used for delivering the attachment to a sandbox when the detection program module detects that the email contains the attachment, the sandbox providing an isolated environment for a running program, the sandbox being constructed as a Windows-like operating system with a single function, a full range of office programs being installed in the sandbox and macros being enabled, the sandbox including a file operation behavior monitoring module and a network behavior monitoring module, the sandbox being arranged on an email transmission link, and the sandbox being used only for monitoring file operation behavior and network behavior; A program running module, used for running the attachment delivered by the delivery program module in the sandbox; A monitoring program module, used for monitoring whether the attachment has a target attention behavior when the program running module runs the attachment, the target attention behavior including at least one of the file operation behavior and the network behavior; A processing program module, configured to transmit the email to a terminal of the email recipient when the monitoring program module detects that the attachment does not have the target attention behavior in the sandbox; The processing program module is further configured to intercept the email when the monitoring program module detects that the attachment has the target attention behavior in the sandbox and determines that the attachment contains a ransomware virus, and output an alarm prompt message to the security processing system to instruct the security personnel of the security processing system to detect the source of the email containing the ransomware virus and process it from the source; Wherein, when the target concerned behavior includes the file operation behavior, the monitoring program module is used to perform the following operations through the file operation behavior monitoring module: Inject the program of the attachment into the target program for monitoring; monitor the operation behavior of the attachment program on the file when it is running by monitoring the usage information of the attachment program on the interface associated with the operation file in the target program; or monitor the operation behavior of the attachment program on the file when it is running through the windows log; or monitor the operation behavior of the attachment program on the file when it is running through the log recorded by the file filtering driver, the file filtering driver is used to filter the input / output operations of one or more file systems or file system volumes and to record the operation behavior of the attachment program on the file when it is running; determine that the attachment has the target attention behavior when at least one of the following conditions is met: the operation frequency of the attachment program on the file is greater than the frequency threshold, and the number of files touched by the office program in a unit time exceeds the number threshold; the operation behavior includes encryption behavior, opening behavior and modification behavior of using a macro script to encrypt a file or using the macro script to download an encryption program and start the encryption program to encrypt the file; Wherein, when the target concerned behavior includes the network behavior, the monitoring program module is used to perform the following operations through the network behavior monitoring module: Inject the program of the attachment into the target program for monitoring; monitor the network behavior of the program of the attachment when it is running by monitoring the usage information of the interface associated with the operation file in the target program by the program of the attachment; or, monitor the network behavior of the program of the attachment when it is running through the Windows log; or, monitor the network behavior of the program of the attachment when it is running through the capture of data packets by the program of the attachment at the network layer; when the network behavior occurs after the program of the attachment operates the file, it is determined that the attachment has the target focus behavior; the network behavior includes key transmission behavior, and the key transmission behavior refers to sending a key back to the control end of the ransomware virus, the key is generated after the ransomware virus encrypts the file, and is used to decrypt the file when the control end of the ransomware virus receives the ransom.

3. A computer device, characterized in that: include: An input / output (I / O) interface, a processor, and a memory, wherein the memory stores the instructions for email detection according to claim 1; The processor is used to execute instructions for processing ransomware stored in the memory, and perform the steps of the email detection method according to claim 1.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the method according to claim 1 .

Images