An Optimization Allocation Method for Email Security Defense Resources

Abstract

An optimization allocation method for email security defense resources, the optimization allocation method for email security defense resources includes the following steps: preprocessing of the user email access data set; determining the upper bound of the resource optimization rate; resource allocation between time intervals; resource allocation between nodes. In the context of limited defense resources, quantitatively give the minimum security defense resources required by the email system, and in the context of given security defense resources, determine the optimal allocation scheme of defense resources among different time periods and different email users, so as to achieve the optimal allocation of defense resources.

Description

Technical Field

[0001] The present invention relates to the field of network technologies, and particularly relates to a method for optimizing the allocation of email security defense resources. Background Art

[0002] Currently, the popularity of email has made it an ideal carrier for attackers to deliver any type of threat to any target. Botnets, advanced persistent threats (APTs), and ransomware, as the most prevalent current cybersecurity threats, mostly carry out activities using email at some point, such as spam advertising, malicious code transmission, and phishing attacks. For this reason, researchers have proposed various defense technologies based on custom rules, black and white lists, keywords, and email content, effectively alleviating various threats based on email. With the emergence of new artificial intelligence technologies represented by deep learning, attackers and security researchers have started to focus on more advanced automated and intelligent attack and defense technologies based on email. Among them, the automatic generation and recognition of phishing emails have become a research hotspot for both the attacking and defending sides.

[0003] The article "Efficient defense strategy against spam and phishing email: An evolutionary game model" proposed an optimized defense solution for spam and phishing emails, established an evolutionary game model between attackers and defenders, and could provide the minimum number of email users that need to be defended for the email security defense of a given target network. However, this solution is based on the game model between attackers and defenders, and the optimal defense quantity given depends on the attack cost, benefit, and detected loss of the attackers. Obviously, the relevant parameters of different attackers vary greatly. Therefore, it is not very feasible to predict the possible attackers and determine the optimal defense quantity accordingly.

[0004] Chinese invention patent CN 105227570B provides a secure email system with comprehensive defense, providing a comprehensive defense for emails through authentication, encryption, reputation filtering, and remote sandbox detection. However, this technical solution has high requirements for the professional capabilities of email users, and requires users to judge suspicious emails and initiate the remote sandbox. Obviously, with the use of intelligent technologies, the deception of phishing emails is very strong, and effective defense technologies should be able to protect users and prevent users from being deceived, rather than relying on users to identify suspicious emails.

[0005] Chinese Patent Invention CN 108111478A proposes a phishing recognition method and device based on semantic understanding, which characterizes the semantics of website texts based on word features, and then uses machine learning algorithms to construct a phishing website detection model to achieve the detection of phishing websites. Similarly, a spam or phishing email detection model based on semantics can be trained, but all models based on deep semantic information consume a large amount of defense resources, and the use of defense resources needs to be optimized in practice.

[0006] With the escalation of the offensive and defensive confrontation, attack techniques have become more complex; at the same time, defense techniques have also become more complex and consume more defense resources. It has become both infeasible and impossible to provide an all-weather, real-time, and in-depth complete defense solution for all users. Therefore, in the context of limited defense resources, the industry urgently needs an optimal allocation technology for email security defense resources. Summary of the Invention

[0007] The problems solved by the technology of the present invention are: how to determine the minimum defense resources required by the email system using relevant information, and how to optimize the allocation of defense resources among different time periods and different user nodes.

[0008] An optimal allocation method for email security defense resources is provided. In the context of limited defense resources, the minimum security defense resources required by the email system are quantitatively given, and under the background of given security defense resources, the optimal allocation scheme of defense resources among different time periods and different email users is determined to achieve the optimal configuration of defense resources.

[0009] The technical solution adopted by the method of the present invention to solve the above problems is: an optimal allocation method for email security defense resources, and the optimal allocation method for email security defense resources includes the following steps:

[0010] Step 1: Preprocessing of the user email access data set;

[0011] Step 2: Determining the upper bound of the resource optimization rate;

[0012] Step 3: Resource allocation among time intervals;

[0013] Step 4: Resource allocation among nodes.

[0014] Furthermore, the preprocessing of the user email access data set is based on the email login and sending / receiving records of the user within one cycle.

[0015] Furthermore, the preprocessing of the user email access data set includes the following steps:

[0016] Count the login times of each user in each time period within one cycle to obtain a user login time zone frequency table;

[0017] Calculate the generalized login probability of each user in each time period to obtain the generalized probability table of user login time zones;

[0018] Calculate the frequency of email sending and receiving among internal users of the email system to obtain the email network structure diagram.

[0019] Among them, the email network structure is represented as a binary tuple Enet = (Nodes, Edges), the set Nodes = {N i | i = 1,..., n} represents the set of user nodes, n represents the total number of users, and the directed edge set Edges = {<N i , N j > | user i has sent an email to user j} represents the email sending and receiving relationship between users.

[0020] Furthermore, the algorithm for determining the upper bound of the resource optimization rate includes the following steps:

[0021] Based on the generalized probability table of user login time zones, calculate the information entropy of each user

[0022]

[0023] Among them, U inf shan(user i ) is the information entropy of user i, is the generalized login probability of user i in time zone j, LoginDay(j) is the number of days the user logs in in time zone j within the period, is the total number of login days obtained by summing over different time zones; T represents the number of time segments divided per day, that is, the number of time zones.

[0024] Calculate the information entropy of the group of users

[0025]

[0026] Among them, AUshan is the information entropy of the group of users, and n is the total number of users.

[0027] Based on the information entropy of the group of users, calculate the upper bound of the resource optimization rate

[0028] ResoSRate = 1 - 2 AUshan / 24,

[0029] Among them, ResoSRate is the upper bound of the resource optimization rate.

[0030] Furthermore, the algorithm for resource allocation between time zones includes the following steps:

[0031] Based on the frequency table of user login time zones, calculate the total probability of time zone login of all users in the email system

[0032]

[0033] Among them, P j is the total login probability of all users in time zone j, P ij is obtained by dividing the number of days when user i logs in in time zone j by the total number of days.

[0034] Calculate the security defense resource quota for each time zone

[0035]

[0036] Among them, ResoAll is all security defense resources, and Reso j is the security defense resources allocated to the j-th time zone.

[0037] Furthermore, the algorithm for resource allocation between nodes is as follows:

[0038] Allocate defense resources to each node in each time zone with probability φ i until all resources are allocated.

[0039]

[0040] Among them, q ikj is the weight of the edge <N i , N k > in the j-th time zone. β i and δ i are the login weight coefficient and the received mail weight coefficient of node i respectively, and m i is the out-degree of node N i .

[0041] An email security defense resource optimization allocation system for implementing the above-mentioned email security defense resource optimization allocation method, including:

[0042] A preprocessing module for preprocessing the user mail access data set;

[0043] A resource optimization module for determining the upper bound of the resource optimization rate;

[0044] A time zone resource allocation module for resource allocation between time zones;

[0045] A node resource allocation module for resource allocation between user nodes.

[0046] Furthermore, the preprocessing module preprocesses the user mail access data set based on the mail login and sending / receiving records of the user within one cycle.

[0047] A storage medium for receiving a user input program, and the stored computer program can enable an electronic device to execute the above-mentioned method for optimizing the allocation of email security defense resources, including the following steps:

[0048] Preprocessing of the user mail access data set;

[0049] Determining the upper bound of the resource optimization rate;

[0050] Resource allocation in time intervals;

[0051] Resource allocation between nodes.

[0052] The beneficial effects of the present invention are as follows: It can quantitatively give the minimum security defense resources required by the mail system, and determine the optimal allocation scheme of the defense resources among different time periods and different mail users under the background of the given security defense resources, so as to realize the optimal allocation of the defense resources. Description of the Drawings

[0053] By reading the detailed description of the preferred embodiments below, the solutions and advantages of the present application will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments and are not considered as limiting the present invention.

[0054] In the drawings:

[0055] Figure 1 is a schematic flow chart of a method for optimizing the allocation of email security defense resources in Embodiment 1 of the present invention;

[0056] Figure 2 is a schematic flow chart of preprocessing the user mail access data set in Embodiment 1;

[0057] Figure 3 is a schematic flow chart of determining the upper bound of the resource optimization rate in Embodiment 1;

[0058] Figure 4 is a schematic flow chart of resource allocation in time intervals in Embodiment 1;

[0059] Figure 5 is a schematic module diagram of a system for optimizing the allocation of email security defense resources in Embodiment 2. Detailed Embodiments

[0060] The following will describe the exemplary embodiments of the present disclosure in more detail with reference to the drawings. It should be noted that these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. The present disclosure can be implemented in various forms and should not be limited by the embodiments described herein.

[0061] Embodiment 1

[0062] See Figure 1 , Figure 1 , which is a schematic flowchart of a method for optimizing the allocation of email security defense resources according to the present invention. The method for optimizing the allocation of email security defense resources includes the following steps:

[0063] S101: Preprocessing of the user email access data set;

[0064] S102: Determining the upper bound of the resource optimization rate;

[0065] S103: Resource allocation among time intervals;

[0066] S104: Resource allocation among nodes.

[0067] Whether it is spam emails for advertising, virus emails for delivering malicious code, or spear-phishing emails, whether the goal can be achieved depends on whether the user will log in to the email system, open the email, or even click on the link or attachment. At the same time, the user's access to their own email system has certain patterns. Therefore, predicting the user's email access behavior helps to determine when and how to defend, and thus achieve the optimal allocation of defense resources.

[0068] Furthermore, in S101 provided in this embodiment, the preprocessing of the user email access data set is based on the email login and sending / receiving records of the user within one cycle, and the time length of one cycle is selected as one month.

[0069] See Figure 2 , furthermore, the preprocessing of the user email access data set includes the following steps:

[0070] S201: Count the number of logins of each user in each time period within one cycle to obtain the user login time zone frequency table;

[0071] S202: Calculate the generalized probability of login of each user in each time period to obtain the user login time zone generalized probability table;

[0072] S203: Calculate the email sending and receiving frequencies between users within the email system to obtain the email network structure diagram.

[0073] Among them, the email network structure is represented as a binary tuple Enet = (Nodes, Edges), the set Nodes = {N i | i = 1,..., n} represents the user node set, n represents the total number of users, and the directed edge set Edges = {<N i , N j > | user i has sent an email to user j} represents the email sending and receiving relationship between users.

[0074] See Figure 3, Further, in S102 provided in this embodiment, the algorithm for determining the upper bound of the resource optimization rate includes the following steps:

[0075] S301: Calculate the information entropy of each user based on the generalized probability table of user login time zones

[0076]

[0077] where Uinfshan(user i ) is the information entropy of user i, is the generalized login probability of user i in time zone j, LoginDay(j) is the number of days the user logs in in time zone j within the period, is the total number of login days obtained by summing over different time zones; T represents the number of time segments divided per day, that is, the number of time zones.

[0078] S302: Calculate the information entropy of the group of users

[0079]

[0080] where AUshan is the information entropy of the group of users and n is the total number of users.

[0081] S303: Calculate the upper bound of the resource optimization rate based on the information entropy of the group of users

[0082] ResoSRate = 1 - 2 AUshan / 24,

[0083] where ResoSRate is the upper bound of the resource optimization rate. The minimum defense resources = the total resources required for complete defense * (1 - ResoSRate), that is, the minimum defense resources are equal to the complete defense resources minus the maximum savable resources determined by the upper bound of the resource optimization rate.

[0084] See Figure 4 , Further, in S103 provided in this embodiment, the algorithm for resource allocation between time zones includes the following steps:

[0085] S401: Calculate the total login probability of all users in the mail system in each time zone based on the user login time zone frequency table

[0086]

[0087] where P j is the total login probability of all users in time zone j, P ij is obtained by dividing the number of days user i has logged in in time zone j by the total number of days.

[0088] S402: Calculate the security defense resource quota for each time zone

[0089]

[0090] Among them, ResoAll is all security defense resources, and Reso j is the security defense resources allocated in the j-th time zone.

[0091] Furthermore, in S104 provided in this embodiment, the algorithm for resource allocation between nodes is as follows:

[0092] Allocate defense resources to each node in each time zone with probability φ i until all resources are allocated, that is, the probability corresponding to node i is φ i ,

[0093]

[0094] where q ikj is the weight of the edge <N i , N k > in the j-th time zone. β i and δ i are the login weight coefficient and the receiving weight coefficient of node i respectively, and m i is the out-degree of node N i .

[0095] The beneficial effect of the present invention is that it can quantitatively give the minimum security defense resources required by the email system, and determine the optimal allocation scheme of defense resources among different time periods and different email users in the context of given security defense resources, so as to realize the optimal allocation of defense resources.

[0096] Embodiment 2

[0097] Refer to Figure 5 , this embodiment provides an email security defense resource optimization allocation system for implementing the above-mentioned email security defense resource optimization allocation method, including:

[0098] A preprocessing module for preprocessing the user email access data set;

[0099] A resource optimization module for determining the upper bound of the resource optimization rate;

[0100] A time zone resource allocation module for resource allocation between time zones;

[0101] A node resource allocation module for resource allocation between user nodes.

[0102] Furthermore, the preprocessing module preprocesses the user email access data set based on the email login and sending / receiving records of the user within one cycle.

[0103] In combination with Figure 1 , the present invention also provides a storage medium for receiving a user input program, and the stored computer program can enable an electronic device to execute the above-mentioned optimized allocation method for email security defense resources, including the following steps:

[0104] S101: Preprocessing of the user mail access data set;

[0105] S102: Determining the upper bound of the resource optimization rate;

[0106] S103: Resource allocation in time intervals;

[0107] S104: Resource allocation between nodes.

[0108] As mentioned above, the above are only the preferred specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes, increases or decreases that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. An optimized allocation method for email security defense resources, characterized in that, The method for optimizing the allocation of email security defense resources includes the following steps: Preprocessing of the user email access data set; Determining the upper bound of the resource optimization rate; Resource allocation between time intervals; The algorithm for resource allocation between time intervals includes the following steps: Based on the user login time zone frequency table, calculate the total probability of all users' time zone logins in the email system where P j is the total login probability of all users in time zone j; is the number of days that user i has logged in in time zone j divided by the total number of days, Calculate the security defense resource quota for each time zone Among them, ResoAll is all security defense resources, and Reso j is the security defense resources allocated in the j-th time zone; Resource allocation between nodes; The algorithm for resource allocation between nodes is: Allocate defense resources for each node in each time zone with probability φ i until all resources are allocated where q ikj is the weight of edge <N i , N k > in the j-th time zone, β i and δ i are the login weight coefficient and the recipient weight coefficient of node i respectively, m i is the out-degree of node N i , 2. The method for optimizing the allocation of email security defense resources according to claim 1, wherein The preprocessing of the user email access data set is based on the email login and sending / receiving records of the user within one cycle.

3. The method for optimizing the allocation of email security defense resources according to claim 2, wherein The preprocessing of the user email access data set includes the following steps: Count the number of logins of each user in each time period within one cycle to obtain the user login time zone frequency table; Calculate the generalized probability of each user's login in each time period to obtain the user login time zone generalized probability table; Calculate the frequency of email sending and receiving between users within the email system to obtain the email network structure diagram, Among them, the email network structure is represented as a binary tuple Enet = (Nodes, Edges), where the set Nodes = {N i | i = 1,..., n} represents the set of user nodes, n represents the total number of users, and the directed edge set Edges = {<N i , N j > | user i has sent an email to user j} represents the relationship of sending and receiving emails between users.

4. A method for optimizing the allocation of email security defense resources according to claim 1, characterized in that, The algorithm for determining the upper bound of the resource optimization rate includes the following steps: Based on the user login time zone generalized probability table, calculate the information entropy of each user Among them, Uinfshan(user i ) is the information entropy of user i; is the generalized login probability of user i in time zone j. LoginDay(j) is the number of days the user logs in in time zone j within the period, is the total number of login days obtained by summing over different time zones; T represents the number of time segments divided per day, that is, the number of time zones; Calculate the information entropy of the group of users where AUshan is the information entropy of the group of users and n is the total number of users, Based on the information entropy of the group of users, calculate the upper bound of the resource optimization rate ResoSRate = 1 - 2 AUshan / 24, where ResoSRate is the upper bound of the resource optimization rate.

5. An email security defense resource optimization allocation system for implementing the email security defense resource optimization allocation method according to any one of claims 1 to 4, includes: A preprocessing module for preprocessing the user email access data set; A resource optimization module for determining the upper bound of the resource optimization rate; A time zone resource allocation module for resource allocation between time intervals; A node resource allocation module for resource allocation between user nodes.

6. The optimized allocation system for email security defense resources according to claim 5, characterized in that, The preprocessing module preprocesses the user email access data set based on the email login and sending / receiving records of the user within one cycle.

7. A storage medium storing a program for receiving user input, and the stored computer program can enable an electronic device to execute any one of claims 1 to 4, including the following steps: Preprocessing of the user email access data set; Determining the upper bound of the resource optimization rate; Resource allocation between time intervals; Resource allocation between nodes.

Images