Email security detection method, device, electronic device and storage medium

Abstract

The present application relates to the field of network security technology, and discloses an email security detection method, device, electronic device and storage medium, which can accurately detect malicious XSS payloads in emails to prevent mailbox users from being attacked by XSS. The method comprises: obtaining an email to be detected, and splitting the email to be detected into multiple parts according to a preset splitting method; detecting whether each part contains a cross-site scripting attack XSS payload according to a detection method corresponding to each part after the split; if an XSS payload is detected, transferring the email to be detected to a mail isolation area.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an email security detection method, device, electronic device and storage medium. Background Art

[0002] With the increasing popularity of Internet applications, email security has become a growing concern. Among the existing attack methods that threaten email security, cross-site scripting (XSS) is an attack method in which the target user performs unintended operations on the currently logged-in web mailbox. The attacker can force the user to perform the operation selected by the attacker by exploiting the front-end XSS vulnerability of the web mailbox. For example, if the user has logged into the web mailbox and viewed emails containing XSS malicious scripts, his email authentication COOKIE or other information will be obtained by the attacker, so that the attacker can directly log in to the user's mailbox without the user's password. In addition, the XSS vulnerability of the mailbox is generally a storage type, which can hijack the user's browser without the user's induction, and use it for mining or other malicious behaviors. Summary of the invention

[0003] The embodiments of the present application provide an email security detection method, device, electronic device and storage medium, which can accurately detect malicious XSS payloads in emails and protect email users from XSS attacks.

[0004] On the one hand, an embodiment of the present application provides an email security detection method, comprising:

[0005] Obtaining an email to be detected, and splitting the email to be detected into multiple parts according to a preset splitting method;

[0006] According to the detection method corresponding to each part after splitting, detect whether each part contains cross-site scripting attack XSS payload;

[0007] If an XSS payload is detected, the email to be detected is transferred to the mail quarantine area.

[0008] Optionally, splitting the to-be-detected email into multiple parts according to a preset splitting method includes:

[0009] The email to be detected is parsed, and based on the parsing result, the email to be detected is split into an email header, an email title, an email body and an email attachment.

[0010] Optionally, the detecting whether each part contains a cross-site scripting attack XSS payload according to the detection method corresponding to each part after the splitting includes:

[0011] Check if the default identifier in the email header contains an XSS payload;

[0012] The JS code contained in the email title is simulated and executed. If the simulation execution result meets the preset conditions, it is determined that the email title contains an XSS payload;

[0013] The JS code contained in the email body is simulated and executed. If the intended execution result meets the preset conditions, it is determined that the email title contains an XSS payload;

[0014] The JS code contained in the name of the email attachment is simulated and executed, and the attachment content of the email attachment is detected for viruses. Based on the simulation execution result and the virus detection result, it is determined whether the email attachment contains an XSS payload.

[0015] Optionally, the method further comprises:

[0016] Defuse the part containing the XSS payload;

[0017] Reorganizing the parts of the to-be-detected email after the harmless processing to obtain a safe email;

[0018] The secure email is sent to a target mailbox server.

[0019] Optionally, the harmless processing of the portion containing the XSS payload includes:

[0020] The email display content is extracted from the part containing the XSS payload, and a harmless processing result corresponding to the part is generated based on the email display content.

[0021] Optionally, the method further comprises:

[0022] If an XSS payload is detected, a warning email is generated for the email to be detected, and the warning email is sent to the target mailbox server.

[0023] Optionally, the method further comprises:

[0024] If no XSS payload is detected, the email to be detected is forwarded to the target mailbox server.

[0025] On the one hand, an embodiment of the present application provides an email security detection device, including:

[0026] The mail splitting module is used to obtain the email to be detected and split the email to be detected into multiple parts according to a preset splitting method;

[0027] The email detection module is used to detect whether each part contains a cross-site scripting attack XSS payload according to the detection method corresponding to each part after splitting;

[0028] The mail isolation module is used to transfer the email to be detected to the mail isolation area if an XSS payload is detected.

[0029] On the one hand, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the computer program.

[0030] On the one hand, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and the computer program instructions implement the steps of any of the above methods when executed by a processor.

[0031] On the one hand, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in any of the above-mentioned various optional implementations of controlling TCP transmission performance.

[0032] The email security detection method, device, electronic device and storage medium provided in the embodiments of the present application can detect whether the email is at risk of being attacked by XSS in a more comprehensive and detailed manner by breaking down the email into smaller parts and performing targeted security detection on each part, thereby improving the precision and accuracy of security detection, and judging whether the email contains XSS payloads through behavior and simulation execution results, thereby preventing attackers from circumventing the protection system by bypassing the rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A schematic diagram of an application scenario of the email security detection method provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of a process flow of an email security detection method provided in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of the structure of an email security detection device provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0039] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work are within the scope of protection of this application.

[0040] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present application, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0041] For ease of understanding, the terms involved in the embodiments of the present application are explained below:

[0042] XSS: The abbreviation of Cross Site Scripting, which is a cross-site scripting attack, refers to the use of website vulnerabilities to maliciously steal information from users.

[0043] JS: Short for JavaScript, it is a lightweight, interpreted or just-in-time compiled programming language with function priority.

[0044] COOKIE: is an authentication variable stored on the website visitor's computer.

[0045] Any number of elements in the drawings is for illustration and not limitation, and any naming is for distinction only and does not have any limiting meaning.

[0046] In practice, web mailbox developers will protect against XSS attacks by optimizing code security, but this method is very passive for XSS defense because XSS attack scripts are small in size, vary a lot, and have different characteristics. For existing mail servers, most of the existing solutions in the prior art are aimed at wide-area XSS type attacks, and cannot comprehensively and specifically detect, warn or intercept XSS attacks carried by emails. Therefore, a method for security detection and analysis of emails itself is needed, so that mailbox users can receive more comprehensive security protection and avoid email XSS attacks.

[0047] To this end, the present application provides an email security detection method, which first performs detailed segmentation of the email, and then combines the possible vulnerabilities and attacks suffered by each part after the segmentation to perform targeted security detection on each part, so as to more comprehensively and finely detect whether each part is at risk of being attacked by XSS, improve the accuracy of security detection, and store emails containing malicious XSS payloads in the mail quarantine area, and will not send the emails directly to users, thereby preventing mailbox users from being attacked by XSS. In addition, compared with the regular matching detection method used in the prior art, the security detection method provided by the present application mainly determines whether there is an XSS payload in each part of the email through behavior and simulation execution results, thus preventing new XSS payloads from bypassing the regular matching rules.

[0048] After introducing the design ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0049] refer to Figure 1 , which is a schematic diagram of an application scenario of the email security detection method provided in an embodiment of the present application. The application scenario includes multiple terminal devices 101, a first mail server 102 and a second mail server 103, and the terminal devices 101, the first mail server 102 and the second mail server 103 are connected via a wireless or wired network. The terminal device 101 includes but is not limited to electronic devices such as desktop computers, mobile phones, mobile computers, tablet computers, smart wearable devices, etc. The first mail server 102 and the second mail server 103 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0050] Assume that the email account used by the attacker is attacker@a.com, and the attacker uses one of the terminal devices 101 to send an email containing an XSS payload to the victim whose email account is target@b.com. The email sent by the attacker is first sent to the first mail server 102, and the first mail server 102 forwards the email to the second mail server 103 according to the email account of the recipient. The second mail server 103 then sends the email to the victim, and the victim can log in to the mailbox through the terminal device 101 used by him and view the email. If the attacker's purpose is to obtain the victim's mailbox cookie and password, then the attacker will embed two JS codes with different functions in the email. One is to trigger the XSS payload when the victim views the email, so as to send the mailbox cookie to the receiving background set up by the attacker through the network request packet. The second is to redirect the victim's browser to another phishing page that simulates the normal mailbox crash interface after the sending is completed, so as to simulate the situation where the mailbox reports an error and asks the victim to log in again, thereby inducing the victim to enter the mailbox password and other private information in the phishing page. In the absence of security detection and defense measures for the user and the mailbox server, the user will lose his mailbox cookie and password, etc., so that the attacker can log in to the user's mailbox and obtain the user's email content and communication list, etc. For this purpose, a security detection program for emails can be implanted in the first mail server 102 or the second mail server 103, and the emails received by the mailbox server are security-checked, and the safe emails are forwarded to the corresponding users, while the malicious emails containing the XSS payload are transferred to the mail isolation area of ​​the mailbox server to prevent the mailbox users from being attacked by XSS.

[0051] Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenarios shown can also be used in other possible application scenarios, and the embodiments of the present application are not limited thereto. Figure 1 The functions that can be implemented by each device in the application scenario shown will be described in the subsequent method embodiments, and will not be described in detail here.

[0052] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0053] It should be noted that the email security detection method provided in the embodiment of the present application can be applied to the mailbox server corresponding to the email sender, the mailbox server corresponding to the email receiver, and the terminal device used by the email receiver. Figure 1 The application scenario shown illustrates the technical solution provided by the embodiment of the present application.

[0054] refer to Figure 2 The present application embodiment provides an email security detection method, which can be applied to the mailbox server of the email sender, including the following steps:

[0055] S201, obtaining an email to be detected, and splitting the email to be detected into multiple parts according to a preset splitting method.

[0056] In specific implementation, the email can be split into four parts: the email header, email title, email body and email attachment according to the email's own characteristics. Specifically, the email to be detected can be parsed first to obtain the code corresponding to the email, and the codes corresponding to the email header, email title, email body and email attachment can be extracted from the parsed code, so as to split the email to be detected into four parts: the email header, email title, email body and email attachment, and then use different detection mechanisms to accurately detect the attack payload that may be contained in the code of each part.

[0057] S202: Detect whether each part contains an XSS payload according to the detection method corresponding to each part after the splitting.

[0058] During specific implementation, a unique detection method for each part can be developed based on the possible vulnerabilities and attacks suffered by each part of the email, so as to more accurately detect whether each part contains XSS payloads.

[0059] For the email header, you can detect whether the preset identifiers in the email header contain XSS payloads. For example, the identifiers in the email header that can be used to implant attack payloads include From, CC, BCC, X-Mailer, Received, etc. For this purpose, you can locate these identifiers in the code corresponding to the email header and detect whether these identifiers contain XSS payloads. If the preset identifiers in the email header contain XSS payloads, it indicates that the email to be detected has XSS risks.

[0060] Some email servers do not limit the length of email titles and special symbols (such as '<', #, etc.), allowing attackers to insert XSS payloads in email titles. To this end, for email titles, the JS code contained in the email title can be simulated and executed. If the simulation execution result meets the preset conditions, it is determined that the email title contains XSS payload.

[0061] Specifically, first detect whether the code corresponding to the email title contains JS code. If not, it indicates that there is no risk in the email title. If it contains JS code, use the simulator to run the detected JS code and obtain the simulation execution result. The simulation execution result includes: whether the JS code can be fully executed, whether the JS code sends a web request to the outside domain after execution, whether the IP or domain name of the web request is in the preset threat engine library, etc. Then, based on the model execution result, determine whether the JS code in the email title is an XSS payload.

[0062] For the email body, the JS code contained in the email body can be simulated and executed. If the intended execution result meets the preset conditions, it is determined that the email title contains an XSS payload.

[0063] Since the email body often contains multiple types of data, we can first filter out the content in the email body that cannot be inserted into the JS script (such as pictures), and then detect the content that may be inserted into the JS script (such as html type tag elements). Taking html type tag elements as an example, we first detect whether each tag element of html contains JS scripts, especially tag elements that can trigger the execution of JS scripts, such as The onerror event of the tag is then used to simulate the execution of the code containing the JS script using the simulator. The simulation execution results include: whether the JS code can be fully executed, whether a web request is sent to the outside of the domain after the JS code is executed, whether the IP or domain name of the web request is in the preset threat engine library, etc. Then, based on the model execution results, it is determined whether the JS code in the email title is an XSS payload.

[0064] Since the mailbox server often directly loads and displays the name of the email attachment in the email page, the name of the email attachment is often the location where the attacker inserts the XSS payload. Therefore, for the email attachment, the JS code contained in the name of the email attachment can be simulated and executed, and the email attachment can be tested for viruses. Based on the simulation execution results and the virus detection results, it can be determined whether the email attachment contains the XSS payload.

[0065] Specifically, it can detect whether the name of the email attachment contains a JS script; if the name of the email attachment contains a JS script, the detected JS code is run using a simulator to obtain the simulation execution results, including: whether the JS code can be fully executed, whether a web request is sent outside the domain after the JS code is executed, whether the IP or domain name of the web request is in the preset threat engine library, etc., and then determine whether the JS code in the email title is an XSS payload based on the model execution results; if the name of the email attachment does not contain a JS script, the attachment content is checked for viruses. If there is a virus in the attachment content, it is determined that the email attachment contains an XSS payload, otherwise it is determined that there is no risk in this part of the email attachment.

[0066] Of course, the name and content of the email attachment may also be checked at the same time. As long as at least one of them has a security risk, it is determined that the email attachment has a security risk.

[0067] In an embodiment of the present application, the preset conditions for judgment can be set according to the actual scenario. For example, if the JS code can be completely executed and a web request is sent to an external domain after the JS code is executed, it is considered that the email title contains an XSS payload; or, if the JS code can be completely executed and a web request is sent to an external domain after the JS code is executed, and the IP or domain name of the web request is in the preset threat engine library, it is considered that the email title contains an XSS payload.

[0068] The simulator in the embodiment of the present application is a virtual terminal device running in other operating environments. The simulator is used to simulate the execution of the JS code, thereby obtaining the data generated when the JS code is running on the terminal device.

[0069] S203: If an XSS payload is detected, the email to be detected is transferred to the mail quarantine area.

[0070] During specific implementation, a mail quarantine area for storing suspicious mails may be set up in the mailbox server, and the emails containing XSS payloads detected by the detection method of step S202 may be stored in the mail quarantine area, so that users cannot access emails with security risks.

[0071] In specific implementation, after the email is stored in the mail quarantine area, the email server can use other more professional security vulnerability detection tools to conduct detailed inspections on the emails in the mail quarantine area, or notify staff to conduct manual inspections on the emails to determine whether the emails really have security vulnerabilities. If it is determined that the emails in the mail quarantine area do not have security vulnerabilities, the emails can be forwarded to the corresponding target email server, so that the user can check the emails normally.

[0072] S204: If no XSS payload is detected, the email to be detected is forwarded to a target mailbox server.

[0073] The target mailbox server refers to the mail server corresponding to the recipient address in the email to be detected.

[0074] Based on the above-mentioned email security detection method, the email sent by the attacker is first directed to the email security detection program, and the email is accurately split by the email security detection program, and the JS code contained in the content of each split part is dynamically parsed and simulated. If malicious attack behaviors such as XSS load are found, the email is immediately stored in the mail quarantine area to prevent the mailbox user from being attacked by XSS. The email security detection method provided by the embodiment of the present application, by the detailed splitting of the email, and the targeted security detection of each part, so as to more comprehensively and finely detect whether the email has the risk of being attacked by XSS, improve the precision and accuracy of security detection, and judge whether the email has XSS load by behavior and simulation execution results, which can prevent the attacker from bypassing the protection system by means of rules. In addition, since it is only necessary to implant the email security detection program in the mail server without modifying the mail server code, the email security detection method provided by the embodiment of the present application can be efficiently and conveniently applied to various mail servers.

[0075] In actual applications, attackers can intercept normal emails, add XSS payloads to the emails, and then forward them to the mailbox server. In order to prevent users from missing important emails, based on any of the above implementations, emails containing malicious XSS payloads can be rendered harmless to remove the malicious XSS payloads in the emails, and the harmless emails can be forwarded to users, ensuring the safety of mailbox users while users can check their emails normally.

[0076] Specifically, the part of the email containing the XSS payload can be rendered harmless; the parts of the email to be detected after the harmless processing can be reorganized to obtain a safe email; and the safe email can be sent to the target mailbox server.

[0077] In specific implementation, the part containing the XSS payload can be rendered harmless in the following way: extract the email display content from the part containing the XSS payload, and generate the corresponding harmless processing result of the part based on the email display content. Among them, the email display content refers to the text, pictures and other information displayed to the user when the email is opened on the terminal device, that is, the content that the user can see, including the email title, sender, email body content, attachment name, etc., excluding background data.

[0078] Specifically, the email can be regenerated in the email format based on the email display content only, thereby filtering out the XSS payload, and sending the newly generated email to the target mailbox server. Alternatively, for the email body, a screenshot corresponding to the email body content to be displayed can be directly generated, and the screenshot can be used to replace the body content in the original email, so that after the user opens the email, he can only see the screenshot corresponding to the content, and cannot trigger the XSS attack.

[0079] It should be noted that the part containing the XSS payload must be rendered harmless; the part not containing the XSS payload can be rendered harmless or not. When the part not containing the XSS payload is chosen not to be rendered harmless, the rendering result corresponding to the part containing the XSS payload and the part not containing the XSS payload are reassembled to obtain a secure email. When the part not containing the XSS payload is chosen to be rendered harmless, the rendering results of each part are reassembled to obtain a secure email.

[0080] Based on any of the above implementations, the email security method of the embodiment of the present application also includes the following steps: if an XSS payload is detected, an alarm email is generated for the email to be detected, and the alarm email is sent to the target mailbox server.

[0081] In specific implementation, after the email to be detected is stored in the mail quarantine area, an alarm email for the email to be detected can be sent to the target mailbox server, so that the user can know the specific situation of not receiving the email through the alarm email. Alternatively, when the safe email corresponding to the email to be detected is sent to the target mailbox server, an alarm email can be sent to the target mailbox server at the same time to remind the user of the security risk of the email.

[0082] The email security detection method provided in the embodiment of the present application can also be applied to the mailbox server corresponding to the email recipient, and specifically includes the following steps: obtaining the email to be detected, splitting the email to be detected into multiple parts according to a preset splitting method; detecting whether each part contains an XSS payload according to the detection method corresponding to each part after the splitting; if the XSS payload is detected, the email to be detected is transferred to the mail quarantine area; if the XSS payload is not detected, the email to be detected is pushed to the email recipient corresponding to the email to be detected. The email to be detected here refers to the email that the mailbox server needs to forward to the terminal device, and emails with security risks are stored in the mail quarantine area, and emails without security risks are pushed to the email recipient.

[0083] For a more detailed specific implementation of the email security detection method in the mailbox server corresponding to the email recipient, please refer to the embodiment of the email security detection method in the mailbox server corresponding to the email sender, which will not be repeated here.

[0084] The email security detection method provided in the embodiment of the present application can also be applied to terminal devices, specifically including the following steps: obtaining the email to be detected, splitting the email to be detected into multiple parts according to a preset splitting method; detecting whether each part contains an XSS payload according to the detection method corresponding to each part after the splitting; if an XSS payload is detected, transferring the email to be detected to the mail quarantine area. The email to be detected here refers to the email forwarded to the terminal device by the mailbox server. The mail quarantine area can be set in the terminal device to store emails with security risks, and an alarm message for the email can also be generated to remind the user not to open the email at will.

[0085] For a more detailed specific implementation of the email security detection method in the terminal device, please refer to the implementation example of the email security detection method in the mailbox server, which will not be repeated here.

[0086] like Figure 3 As shown, based on the same inventive concept as the above-mentioned email security detection method, the embodiment of the present application further provides an email security detection device 30, comprising:

[0087] The mail splitting module 301 is used to obtain the email to be detected and split the email to be detected into multiple parts according to a preset splitting method;

[0088] The email detection module 302 is used to detect whether each part contains a cross-site scripting attack XSS payload according to the detection method corresponding to each part after the split;

[0089] The mail isolation module 303 is used to transfer the email to be detected to the mail isolation area if an XSS payload is detected.

[0090] Optionally, the email security detection device 30 further includes an email forwarding module 304, which is used to forward the email to be detected to a target mailbox server if no XSS payload is detected.

[0091] Optionally, the email splitting module 301 is specifically used to: parse the email to be detected, and split the email to be detected into an email header, an email title, an email body and an email attachment based on the parsing result.

[0092] Optionally, the email detection module 302 is specifically used to: detect whether the preset identifier in the email header contains an XSS payload; simulate the execution of the JS code contained in the email title, and if the simulated execution result meets the preset conditions, determine that the email title contains the XSS payload; simulate the execution of the JS code contained in the email body, and if the proposed execution result meets the preset conditions, determine that the email title contains the XSS payload; simulate the execution of the JS code contained in the name of the email attachment, and perform virus detection on the attachment content of the email attachment, and determine whether the email attachment contains the XSS payload based on the simulated execution result and the virus detection result.

[0093] Optionally, the email security detection device 30 further includes a harmless processing module 305, which is used to: perform harmless processing on the part containing the XSS payload; and reorganize the parts of the email to be detected after the harmless processing to obtain a safe email. Correspondingly, the email forwarding module 304 is also used to: send the safe email generated by the harmless processing module to the target mailbox server.

[0094] Optionally, the harmless processing module 305 is specifically used to extract the email display content from the part containing the XSS payload, and generate a harmless processing result corresponding to the part based on the email display content.

[0095] Optionally, the email security detection device 30 further includes an alarm module 306, which is used to generate an alarm email for the email to be detected if an XSS payload is detected, and send the alarm email to the target mailbox server.

[0096] The email security detection device proposed in the embodiment of the present application adopts the same inventive concept as the above-mentioned email security detection method and can achieve the same beneficial effects, which will not be described in detail here.

[0097] Based on the same inventive concept as the above-mentioned email security detection method, the embodiment of the present application also provides an electronic device, which can be a control device or control system inside a smart device, or an external device that communicates with the smart device, such as a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), a server, etc. Figure 4 As shown, the electronic device 40 may include a processor 401 and a memory 402 .

[0098] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor (DigitalSignal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor to be executed, or a combination of hardware and software modules in the processor can be executed.

[0099] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0100] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; the above computer storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to: mobile storage devices, random access memory (RAM, Random Access Memory), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)) and other media that can store program codes.

[0101] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: a mobile storage device, a random access memory (RAM, Random Access Memory), a magnetic storage device (such as a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical storage device (such as CD, DVD, BD, HVD, etc.), and a semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), a solid-state drive (SSD)) and other various media that can store program codes.

[0102] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An email security detection method, characterized in that: include: Obtaining an email to be detected, and splitting the email to be detected into multiple parts according to a preset splitting method; According to the detection method corresponding to each part after splitting, detect whether each part contains cross-site scripting attack XSS payload; If an XSS payload is detected, the email to be detected is transferred to the mail quarantine area; Defuse the part containing the XSS payload; Reorganizing the parts of the to-be-detected email after the harmless processing to obtain a safe email; Sending the secure email to a target mailbox server; The harmless processing of the part containing the XSS payload includes: extracting email display content from the part containing the XSS payload, and generating a harmless processing result corresponding to the part based on the email display content; wherein the email display content refers to the content displayed to the user when the email is opened on the terminal device, and the email display content does not include background data that the user cannot directly see.

2. The method according to claim 1, characterized in that The step of splitting the email to be detected into multiple parts according to a preset splitting method includes: The email to be detected is parsed, and based on the parsing result, the email to be detected is split into an email header, an email title, an email body and an email attachment.

3. The method according to claim 2, characterized in that According to the detection method corresponding to each part after the splitting, detecting whether each part contains a cross-site scripting attack XSS payload includes: Check if the default identifier in the email header contains an XSS payload; The JS code contained in the email title is simulated and executed. If the simulation execution result meets the preset conditions, it is determined that the email title contains an XSS payload; The JS code contained in the email body is simulated and executed. If the intended execution result meets the preset conditions, it is determined that the email title contains an XSS payload; The JS code contained in the name of the email attachment is simulated and executed, and the attachment content of the email attachment is detected for viruses. Based on the simulation execution result and the virus detection result, it is determined whether the email attachment contains an XSS payload.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: If an XSS payload is detected, a warning email is generated for the email to be detected, and the warning email is sent to the target mailbox server.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: If no XSS payload is detected, the email to be detected is forwarded to the target mailbox server.

6. An email security detection device, characterized in that: include: The mail splitting module is used to obtain the email to be detected and split the email to be detected into multiple parts according to a preset splitting method; The email detection module is used to detect whether each part contains a cross-site scripting attack XSS payload according to the detection method corresponding to each part after splitting; The mail isolation module is used to transfer the email to be detected to the mail isolation area if an XSS payload is detected; The harmless processing module is used to: perform harmless processing on the part containing the XSS payload; reorganize the parts of the email to be detected after the harmless processing to obtain a safe email; The mail forwarding module is also used to: send the secure email to a target mailbox server; The harmless processing module is specifically used to: extract the email display content from the part containing the XSS payload, and generate the harmless processing result corresponding to the part based on the email display content; wherein, the email display content refers to the content displayed to the user when the email is opened on the terminal device, and the email display content does not include background data that the user cannot directly see.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images