A method and system for detecting malicious emails

Abstract

The embodiment of the present invention discloses a malicious email detection method and system. The method includes: obtaining mailbox client information; generating a public blacklist library of mailbox domain names according to the mailbox client information; generating a private whitelist library of mailbox domain names according to the mailbox client information; monitoring the email information sent to each email account to obtain the email contact mailbox domain name received by each email mailbox; matching the email contact mailbox domain name received by each email mailbox and the public blacklist library of mailbox domain names; matching the email contact mailbox domain name received by each email mailbox and the private whitelist library of mailbox domain names; judging whether there are abnormal emails in the email information sent to the email account; if there are, isolating the abnormal emails; generating abnormal email warning information. By implementing the method of the embodiment of the present invention, it is possible to effectively identify variable malicious emails.

Description

Technical Field

[0001] The invention relates to an email security analysis method, and more specifically to a malicious email detection method and system thereof. Background Art

[0002] Traditional malicious email detection and identification is based on known email domain blacklists and email content features. Specifically, the email source contact email domain is detected to see if it matches the existing email domain blacklist; at the same time, the email content is detected to see if it matches the existing malicious code feature library. However, since this method relies on its own relevant matching rules or strategies, it often results in a large number of false positives and missed positives in security issues, and is often at a disadvantage in intelligence updates and threat sniffing. At the same time, since its security judgment is based on rules, and the rules are often a collection of known threats, malicious emails can bypass detection and attack. Therefore, the current malicious email detection and identification methods cannot effectively identify the ever-changing malicious emails.

[0003] Therefore, it is necessary to design a new method to effectively identify malicious emails with various formats. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the prior art and provide a malicious email detection method and system.

[0005] To achieve the above object, the present invention adopts the following technical solution: a malicious email detection method, characterized in that it includes:

[0006] Get email client information;

[0007] Generate a public blacklist database of email domain names according to the email client information;

[0008] Generate a private whitelist library of email domain names according to the email client information;

[0009] Monitor email messages sent to each email account to obtain the email contact email domain name received by each email account;

[0010] Matching the email contact email domain name received by each email mailbox with the public blacklist library of the email domain name to obtain a first matching result;

[0011] Matching the email contact email domain name received by each email box with the email domain name private whitelist library to obtain a second matching result;

[0012] Determining whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result;

[0013] If there are any abnormal emails among the email messages sent to the email account, the abnormal emails are quarantined;

[0014] Generates abnormal email alert information.

[0015] Preferably, the mailbox client information includes email account information, email sent email contact information, email received email contact information and email blacklist contact information.

[0016] Preferably, generating a public blacklist database of mailbox domain names according to the mailbox client information comprises:

[0017] Calculate the set of email blacklist contact information of all email boxes to obtain the original public blacklist library;

[0018] Regularly crawl and collect malicious domain name lists in the public malicious domain name intelligence database to supplement the public blacklist database;

[0019] The original public blacklist database and the supplementary public blacklist database are deduplicated, arranged and integrated to obtain a mailbox domain name public blacklist database.

[0020] Preferably, generating a private whitelist library of email domain names according to the email client information comprises:

[0021] The intersection of the contact information of the emails sent by each email box and the contact information of the emails received by each email box is calculated to obtain the private whitelist library of the email domain name of each email box.

[0022] Preferably, the matching of the email contact email domain name received by each email mailbox and the email domain name public blacklist library to obtain a first matching result includes:

[0023] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name;

[0024] If the email contact email domain name received by the email mailbox belongs to an element in the email domain public blacklist library, then determine that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library to obtain a first matching result;

[0025] If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain public blacklist library, it is determined that the email contact email domain name received by the email mailbox does not belong to the email domain public blacklist library to obtain a first matching result.

[0026] Preferably, the matching of the email contact email domain name received by each email box and the email domain private whitelist library to obtain a second matching result includes:

[0027] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the private whitelist library of the email domain name;

[0028] If the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library, then determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library to obtain a second matching result;

[0029] If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain private whitelist library, it is determined that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library to obtain a second matching result.

[0030] Preferably, judging whether there is any abnormal email in the email information sent to the email account according to the first matching result and the second matching result includes:

[0031] When the first matching result is that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email;

[0032] When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of email domain names, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of email domain names, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email;

[0033] When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain blacklist library, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain whitelist library, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

[0034] Preferably, after determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the method further includes:

[0035] If there are no abnormal emails in the email information sent to the email account, the non-abnormal emails are allowed to reach the corresponding email account, the unknown emails are quarantined, and an alarm for the unknown emails is issued.

[0036] The present invention also provides a malicious email detection system, comprising:

[0037] An acquisition unit, used to acquire mailbox client information;

[0038] A blacklist library generating unit, used to generate a public blacklist library of mailbox domain names according to the mailbox client information;

[0039] A whitelist library generation unit, used to generate a private whitelist library of an email domain name according to the email client information;

[0040] A monitoring unit, used to monitor the email messages sent to each email account to obtain the email contact email domain name received by each email account;

[0041] A first matching unit, configured to match the email contact mailbox domain name received by each email mailbox with the mailbox domain name public blacklist library to obtain a first matching result;

[0042] A second matching unit is used to match the email contact email domain name received by each email mailbox with the email domain private whitelist library to obtain a second matching result;

[0043] a judging unit, configured to judge whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result;

[0044] A first isolation unit, configured to isolate abnormal emails if there are any abnormal emails in the email messages sent to the email account;

[0045] The information generating unit is used to generate abnormal email warning information.

[0046] Its further technical solution is: the blacklist library generating unit includes:

[0047] A set calculation subunit, used to calculate the set of email blacklist contact information of all email boxes to obtain an original public blacklist library;

[0048] The crawling subunit is used to regularly crawl and collect the malicious domain name list in the public malicious domain name intelligence library to supplement the public blacklist library;

[0049] The processing subunit is used to remove duplicates, sort and integrate the original public blacklist library and the supplementary public blacklist library to obtain the mailbox domain name public blacklist library.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention detects the email contact email domain name received by each email mailbox, and identifies and judges based on the email domain name public blacklist library and the corresponding email domain name private whitelist library. When there is an abnormal email, an alarm is issued and the corresponding email is blocked from reaching the corresponding email mailbox, which can realize accurate malicious email detection and effectively identify variable malicious emails.

[0051] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0053] Figure 1 A schematic diagram of an application scenario of a malicious email detection method provided by an embodiment of the present invention;

[0054] Figure 2 A schematic diagram of a flow chart of a malicious email detection method provided by an embodiment of the present invention;

[0055] Figure 3 A schematic diagram of a sub-process of a malicious email detection method provided by an embodiment of the present invention;

[0056] Figure 4 A schematic diagram of a sub-process of a malicious email detection method provided by an embodiment of the present invention;

[0057] Figure 5 A schematic diagram of a sub-process of a malicious email detection method provided by an embodiment of the present invention;

[0058] Figure 6 A schematic block diagram of a malicious email detection system provided by an embodiment of the present invention;

[0059] Figure 7 A schematic block diagram of a blacklist library generating unit of a malicious email detection system provided by an embodiment of the present invention;

[0060] Figure 8 A schematic block diagram of a first matching unit of a malicious email detection system provided by an embodiment of the present invention;

[0061] Fig. 9 A schematic block diagram of a second matching unit of a malicious email detection system provided by an embodiment of the present invention;

[0062] Fig.10 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0065] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0066] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0067] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of a malicious email detection method provided by an embodiment of the present invention. Figure 2A schematic flow chart of a malicious email detection method provided by an embodiment of the present invention. The malicious email detection method is applied in a server. The server interacts with various terminals for data, each terminal represents a mailbox client, that is, an email mailbox, and the server builds a public blacklist library and an independent whitelist library for email mailbox domain names, monitors sender email mailbox domain names, detects abnormal email mailbox domain names, and when there are abnormal email mailbox domain names, determines whether the email is a malicious email and issues an alarm.

[0068] Figure 2 FIG. 1 is a flow chart of a malicious email detection method provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S200.

[0069] S110, obtaining email client information.

[0070] In this embodiment, the mailbox client information includes email account information, email sent email contact information, email received email contact information, and email blacklist contact information.

[0071] Specifically, the mailbox client information is obtained by installing agent software on the terminal of each email system; the mailbox client information is obtained from the email system user terminal group G, G is all email system user terminals; the mailbox client information acquisition operation is performed once when a new email is added.

[0072] For example: In one embodiment, the email system user terminal group G includes three user terminals, namely G{GO, GP, GQ}, and the corresponding three protected email accounts are O, P, and Q respectively; the email client information is obtained by installing agent software on the three terminals G{GO, GP, GQ} to independently collect the information of the three email accounts O, P, and Q. On the GO terminal, the information of the email account O is collected, and the contact list of sent emails of the email account O is {nancy@a.com, lisa@b.com, thomas@c.com}, the contact list of received emails is {charles@d.com, susan@e.com, richard@f.com}, and the blacklist contact list is {hacker1@attack1.com}; on the GP terminal, the information of the email account P is collected, and the contact list of sent emails of the email account P is {jennifer@a.com, william@b.com, maria@c.com}, and the contact list of received emails is {david@d.com, jennifer@a.co m, william@b.com}, and the blacklist contact list is {michael@b.com}; on the GQ terminal, the information of the email account Q is collected. The sent email contact list of the email account Q is {linda@a.com, robert@b.com, john@c.com}, the received email contact list is {linda@a.com, james@d.com, mary@e.com}, and the blacklist contact list is {hacker2@attack2.com, hacker3@attack2.com}.

[0073] S120: Generate a public blacklist database of email domain names according to the email client information.

[0074] In this embodiment, the mailbox domain name public blacklist library refers to a collection of blacklists of email mailbox domain names.

[0075] In one embodiment, see Figure 3 , the above-mentioned step S120 may include steps S121 to S123.

[0076] S121. Calculate the set of email blacklist contact information of all email boxes to obtain an original public blacklist database.

[0077] In this embodiment, the original public blacklist library refers to a collection of email blacklist contact information of all email boxes.

[0078] Specifically, there is an algorithm T1, which generates an original public blacklist library B for the mailbox client information obtained from the email system user terminal group G. 1 ; Algorithm T1 is specifically implemented as follows: for the email system user terminal group G, obtain the email account information of each terminal {A i1 , A i2 , ... A in}, blacklist contact information of each terminal email account {K i1 , K i1 , ... K in}, calculate the blacklist contact email domain name set under each terminal email account. Suppose the current email system user terminal group is G x , the current email account information dataset is A x , the corresponding email blacklist contact data set is K x , that is, calculate T1(A x , K x ); if T1(A x , K x )=0, which means that there is no blacklist contact in any email account in the current email system user terminal group. 1 is empty; if T1(A x , K x )=1, which means that there is at least one email account in the current email system user terminal group that has a blacklist contact. 1 For the email system user terminal group G x The original public blacklist library under .

[0079] For example: Based on the email account information obtained from each terminal, use the algorithm T 1 Analyze the email account information of each terminal A x is {O, P, Q}, and the corresponding blacklist contact list K under the email account x is {{hacker1@attack1.com}, {michael@b.com}, {hacker2@attack2.com, hacker3@attack2.com}}. That is, calculate T 1 (A x , K x)=({O, P, Q}, {{hacker1@attack1.com}, {michael@b.com}, {hacker2@attack2.com, hacker3@attack2.com}}), at this time, the original public blacklist library B of the current email system user terminal group is generated 1 for {attack1.com, b.com, attack2.com}, T 1 =1.

[0080] S122. Regularly crawl and collect malicious domain name lists in a public malicious domain name intelligence database to supplement the public blacklist database.

[0081] In this embodiment, supplementing the public blacklist library refers to a collection of malicious domain name lists in a public malicious domain name intelligence library.

[0082] Specifically, there is an algorithm T 2 The algorithm targets the public malicious domain name intelligence database, regularly crawls and collects malicious domain name lists, and generates a supplementary public blacklist database B 2 ; Algorithm T 2 The specific implementation is as follows: for the known public malicious intelligence library, obtain the public malicious intelligence library interface data set {F 1 , F 2 , ... F n}, the crawling collection interval is U, which defaults to 24 hours, and the malicious domain name set crawled by each public malicious intelligence library interface is calculated. Suppose the current public malicious intelligence library interface data set is F x , the crawling collection time interval is U x , that is, calculate T 2 (F x , U x ); if T 2 (F x , U x )=0, that is, the public malicious intelligence database crawling and collection failed, or there is no malicious domain name under the public malicious intelligence database interface, at this time, the public blacklist database B is supplemented 2 Is empty; if T 2 (F x , U x )=1, which means that at least one public interface in the current public malicious intelligence library interface data set has collected malicious domain names. 2 To publicly disclose the malicious intelligence library interface dataset F x A supplementary public blacklist library under .

[0083] For example: Based on the email account information obtained from each terminal, use the algorithm T 2Analysis is performed and the public malicious intelligence library interface set F is defined x is {threatcrowd, threatbook, virustotal}, and the crawling collection interval U is 24 hours. That is, calculate T 2 (F x , U x )=({threatcrowd, threatbook, virustotal}, 24), at this time, the supplementary public blacklist library B generated by crawling under the current public malicious intelligence library interface set is generated 2 for {attack3.com, attack4.com,...attackn.com}, T 2 =1.

[0084] S123, de-duplicate, sort and integrate the original public blacklist library and the supplementary public blacklist library to obtain a mailbox domain name public blacklist library.

[0085] In this embodiment, there is an algorithm T 3 , the algorithm targets the original public blacklist library B 1 And supplement the public blacklist library B 2 , generate the official public blacklist library B 3 ; Algorithm T 3 The specific implementation is as follows: for the original public blacklist library B 1 , get the original public blacklist database blacklist dataset {B 11 , B 12 , ... B 1n}; To supplement the public blacklist library B 2 , obtain the blacklist dataset of the supplementary public blacklist library {B 21 , B 22 , ... B 2n}, calculate the result set after de-reordering and integrating the two data sets. Suppose the current original public blacklist library is B 1x , add the public blacklist library to B 2x , that is, calculate T 3 (B 1x , B 2x ); if T 3 (B 1x , B 2x )=0, which means the official public blacklist library B 3 If the generation fails, at least one of the original public blacklist library and the supplementary public blacklist library has an exception. 3 is an empty set; if T 3 (B 1x , B 2x)=1, which means that both the original public blacklist and the supplementary public blacklist are normal. 3 The original public blacklist library B 1x And supplement the public blacklist library B 2x Generated official public blacklist library.

[0086] For example: According to the original public blacklist library B 1 And supplement the public blacklist library B 2 , using the algorithm T 3 Analysis, original public blacklist library B 1 Supplement the public blacklist library B for {attack1.com, b.com, attack2.com} 2 is {attack3.com, attack4.com, ... attackn.com}. That is, calculate T 3 (B 1 , B 2 )=({attack1.com, b.com, attack2.com}, {attack3.com, attack4.com, ... attackn.com}), at this time, the official public blacklist library B is generated 3 for {b.com, attack1.com, attack2.com, attack3.com, attack4.com,...attackn.com}, T 3 =1.

[0087] S130: Generate a private whitelist library of email domain names according to the email client information.

[0088] In this embodiment, the mailbox domain private whitelist library refers to a set of mailbox domain names that can normally receive mailboxes corresponding to each electronic mailbox.

[0089] The intersection of the contact information of the emails sent by each email box and the contact information of the emails received by each email box is calculated to obtain the private whitelist library of the email domain name of each email box.

[0090] Specifically, there is an algorithm T 4 The algorithm generates a formal private whitelist library set W for each email account based on the email client information obtained from the email system user terminal group G 1 ; Algorithm T 4 The specific implementation is as follows: for the email system user terminal group G, obtain the email account information of each terminal {A i1 , A i2 , ... A in}, each terminal email account has sent email contact information {S i1 , S i1 , ... S in}, each terminal email account has received email contact information {R i1 , R i1 , ... R in}, calculate the intersection of the contact information of sent emails and received emails for each email account, and generate an independent whitelist email domain name set based on each email account. Suppose the current email system user terminal group is G x , the current email account information dataset is A x , the corresponding email account has sent email contacts data set S x , the email account received email contact data set is R x , that is, calculate T 4 {(S x , R x ), A x}; If T 4 {(S x , R x ), A x}=0, which means that the formal private whitelist library set generation failed, and there is an abnormality in the private whitelist library of at least one email account. 1 is an empty set; if T 4 {(S x , R x ), A x}=1, which means that the formal private whitelist library set is generated successfully. At this time, W 1 A is the email account information dataset x The official private whitelist library set under the , the official private whitelist library corresponding to each email account is {W 11 , W 12 , ...W 1x}.

[0091] For example: Using the algorithm T 4 Analyze the email account information of each terminal A x is {O, P, Q}, and the corresponding terminal email accounts have sent email contact information S xFor {{nancy@a.com, lisa@b.com, thomas@c.com}, {jennifer@a.com, william@b.com, maria@c.com}, {linda@a.com, robert@b.com, john@c.com}}, the corresponding terminal email accounts have received email contact information R x for {{charles@d.com, susan@e.com, richard@f.com}, {david@d.com, jennifer@a.com, william@b.com}, {linda@a.com, james@d.com, mary@e.com}}. That is, calculate T 4 {(S x , R x ), A x}={({{nancy@a.com, lisa@b.com, thomas@c.com}, {jennifer@a.com, william@b.com, maria@c.com}, {linda@a.com, robert@b.com, john@c.com}}, {{charles@d.com, susan@e.com, richard@f.com}, {david@d.com, jennifer@a.com, william@b.com}, {linda@a.com, james@d.com, mary@e.com}}), {O, P, Q}}, now generate the official private whitelist library W of the mailbox account O 1O For {}, the official private whitelist library W of the mailbox account P 1P For {a.com, b.com}, the official private whitelist library W of the email account Q 1Q For {a.com}, T 4O =0, T 4P =1,T 4Q =1.

[0092] S140: Monitor the email information sent to each email account to obtain the email contact email domain name received by each email account.

[0093] In this embodiment, the email contact email domain name received by each email mailbox refers to the email domain name of the sender of the email received by each email mailbox.

[0094] Specifically, there is an algorithm T 5The algorithm targets the email client information obtained from the email system user terminal group G, monitors the email information sent to each email account, and generates the contact email domain name D sent to each email account i ; Algorithm T 5 The specific implementation is as follows: for the email system user terminal group G, obtain the email account information of each terminal {A i1 , A i2 , ... A in}, monitor the collection of emails sent to each email account {E i1 , E i2 , ... E in}, calculate the contact email domain name sent to each email account. Assume that the current email system user terminal group is G x , the current email account information is A ix , the email address of the corresponding monitored email account is E ix , that is, calculate T 5 (A ix , E ix ); if T 5 (A ix , E ix )=0, which means that no email has been received in the current email account. At this time, the contact email domain name D sent to the email account ix Is empty; if T 5 (A ix , E ix )=1, which means that there is an email sent to the current email account. ix The email domain name of the email contacts received by the current email account.

[0095] For example, using the algorithm T5 to analyze the email account information A of each terminal x is {O, P, Q}, and the corresponding set of emails sent to each mailbox account is E ix For {{E O1}, {E P1 , E P2}, {E Q1 , E Q2 , E Q3}}. That is, calculate T 5 (A x , E ix )=({O,P,Q},{{E O1}, {E P1 , E P2}, {E Q1 , E Q2 , E Q3}}), at this time, the sender email domain list D sent to email account O is generated O For {c.com}, sender email domain list D sent to email account P P For {a.com, b.com}, sender email domain list D sent to email account Q Q For {attack1.com}, T 5O =1,T 5P =1,T 5Q =1.

[0096] S150: Match the email contact mailbox domain name received by each email mailbox with the mailbox domain name public blacklist library to obtain a first matching result.

[0097] In this embodiment, the first matching result refers to whether the email contact email domain name received by each email mailbox belongs to an element in the public blacklist library of email domain names.

[0098] In one embodiment, see Figure 4 , the above-mentioned step S150 may include steps S151 to S153.

[0099] S151, determining whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of email domain names;

[0100] S152: If the email contact email domain name received by the email mailbox belongs to an element in the email domain public blacklist library, determine that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library to obtain a first matching result;

[0101] S153: If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain public blacklist library, determine that the email contact email domain name received by the email mailbox does not belong to the email domain public blacklist library to obtain a first matching result.

[0102] Specifically, there is an algorithm T 6 , the algorithm targets the email contact email domain D received by each email account i , compare with the public blacklist database of email domain names, and determine whether the contact email domain name belongs to the public blacklist database of email domain names; Algorithm T 6 The specific implementation is as follows: for the current email account, obtain the email contact email domain name D received by the email account i ; Calculate whether the email domain name D exists in the public blacklist database of the email domain name i. Assume that the email contact email domain name received by the current email account is D ix , the public blacklist database of email domain name is B 3 , that is, calculate T 6 (D ix , B 3 ); if T 6 (D ix , B 3 )=0, which means The current contact's email domain name does not match the public blacklist of email domain names; if T 6 (D ix , B 3 )=0, which means D ix ∈B 3 , the current contact's email domain name matches the public blacklist database of email domain names.

[0103] For example: the public blacklist database B3 of email domains is {b.com, attack1.com, attack2.com, attack3.com, attack4.com, ..., attackn.com}, and the sender email domain list D of emails sent to email account O is O For {c.com}, sender email domain list D sent to email account P P For {a.com, b.com}, sender email domain list D sent to email account Q Q is {attack1.com}. That is, calculate T 6 (D O , B 3 ), T 6 (D P , B 3 ), T 6 (D Q , B 3 ),at this time T 6O =T 6 (D O {c.com}, B 3 )=0; T 6P1 =T 6 (D P {a.com}, B 3 )=0;D P {b.com}∈B 3 , T 6P2 = T 6 (D P {b.com}, B 3 )=1;D Q{attack1.com}∈B 3 , T 6Q1 =T 6 (D Q {attack1.com}, B 3 )=1.

[0104] S160: Match the email contact email domain name received by each email box with the email domain name private whitelist library to obtain a second matching result.

[0105] In this embodiment, the second matching result refers to whether the email contact email domain name received by each email mailbox belongs to an element in the email domain private whitelist library.

[0106] In one embodiment, see Figure 5 , the above-mentioned step S160 may include steps S161 to S163.

[0107] S161, determining whether the email contact email domain name received by the email mailbox belongs to an element in the private whitelist library of the email domain name;

[0108] S162: If the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library to obtain a second matching result;

[0109] S163. If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library to obtain a second matching result.

[0110] Specifically, there is an algorithm T 7 , the algorithm targets the email contact email domain D received by each email account i , compare with the private whitelist database of email domain names corresponding to each email account, and determine whether the contact email domain name belongs to the private whitelist database of email domain names; Algorithm T 7 The specific implementation is as follows: for the current email account, obtain the email contact email domain name D received by the email account i ; Calculate whether the corresponding email domain name D exists in the private whitelist database i . Assume that the email contact email domain name received by the current email account is Dix, and the private whitelist database of the email domain name is W 1x , that is, calculate T 7 (D ix , W1x ); if T 7 (D ix , W 1x )=0, which means The current contact's email domain name does not match the private whitelist of email domain names; if T 7 (D ix , W 1x )=1, which means D ix ∈W 1x , the current contact's email domain name matches the private whitelist library of email domain names.

[0111] For example: the private whitelist database W of the email domain of email account O 1O For {}, the private whitelist database W of the mailbox domain of the mailbox account P 1P For {a.com, b.com}, the private whitelist database W of the email domain of the email account Q 1Q is {a.com}; sender email domain name list D sent to email account O O For {c.com}, sender email domain list D sent to email account P P For {a.com, b.com}, sender email domain list D sent to email account Q Q is {attack1.com}. That is, calculate T 7 (D O , W 1O ), T 7 (D P , W 1P ), T 7 (D Q , W 1Q ),at this time T 7O =T 7 (D O {c.com}, W 1O )=0;D P {a.com}∈W 1P , T 7P1 =T 7 (D P {a.com}, W 1P )=1;D P {b.com}∈W 1P , T 7P2 =T 7 (D P {b.com}, W 1P )=1; T 7Q1 =T 7 (D Q {attack1.com}, W1Q )=0.

[0112] In this embodiment, the email system user can submit the email domain blacklist information through the terminal agent software, and the blacklist information will be added to the official public blacklist database B after the administrator reviews and approves it. 3 Email system users can submit email domain private whitelist applications through the terminal agent software. After the administrator reviews and approves the application, the whitelist will be added to the official private whitelist database of the email user who submitted the application. 1x middle.

[0113] S170. Determine whether there are any abnormal emails in the email information sent to the email account according to the first matching result and the second matching result.

[0114] In this embodiment, when the first matching result is that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email;

[0115] When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of email domain names, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of email domain names, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email;

[0116] When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain blacklist library, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain whitelist library, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

[0117] Specifically, when T 5 =1, it means that there is an email sent to a protected email account, and malicious email detection will be performed. 3 =1, the public blacklist database of the email sender's email domain name is checked. If T 6 =1, the email domain name matches the public blacklist database successfully, the email is isolated, and a malicious email alert is issued; if T 6 = 0 and T 4=1, the email sender's email domain name is checked against the private whitelist database. If T 7 =1, the email domain private whitelist database matches successfully, the email sender's email domain is in the whitelist, and the email arrives at the email account normally; if T 6 = 0 and T 7 =0, indicating that neither the public blacklist database nor the private whitelist database of the mailbox domain name has been successfully matched, the email is isolated, and an unknown email alarm is issued, pending administrator review. 3 With T 4 They can be executed independently without affecting each other's results.

[0118] S180, if there is an abnormal email in the email information sent to the email account, isolate the abnormal email;

[0119] S190: Generate abnormal email warning information.

[0120] S200: If there are no abnormal emails in the email information sent to the email account, allow the non-abnormal emails to reach the corresponding email account, isolate the unknown emails, and issue an alarm for the unknown emails.

[0121] For example: T 1 =1,T 2 =1,T 3 =1; T 4O =0, T 4P =1,T 4Q =1; T 5O =1,T 5P =1,T 5Q =1; T 6O =0, T 6P1 =0, T 6P2 =1,T 6Q1 =1; T 7O =0, T 7P1 =1,T 7P2 =1, T 7Q1 = 0. T 6P2 =1, that is, E P2 For abnormal emails; T 6Q1 =1, that is, E Q1 For abnormal emails; T 7O =0, that is, E O For abnormal emails; T 7Q1 =0, that is, E Q1 It is an abnormal email. Therefore, the abnormal email is E O 、E P2 , E Q1 .

[0122] The public blacklist information and private whitelist applications submitted by the terminal mailbox users are integrated into the mailbox domain public blacklist database and mailbox domain private whitelist database respectively after the administrator reviews them. Mailbox account O submits blacklist information with the domain name {hack1.com, hack2.com}. If the administrator reviews it, it will be officially included in the public blacklist database B. 3 {hack1.com, hack2.com, b.com, attack1.com, attack2.com, attack3.com, attack4.com, ... attackn.com}; email account Q submits a private whitelist application with the domain name {m.com}. If the administrator approves it, the official private whitelist library W1Q of email account Q will be {a.com, m.com}.

[0123] In this example, the email E O 、E P2 、E Q1 Will be quarantined. O , due to T 6O = 0 and T 7O =0, the email sender's email domain name does not belong to the public blacklist of email domain names and does not belong to the private whitelist of email domain names of email account O, and an unknown email abnormality alarm will be issued; for email E P2 , T 6P2 =1 and T 7P2 =1, that is, the email sender's email domain belongs to the public blacklist of email domains and also belongs to the private whitelist of email domains of email account P, but the priority of the public blacklist of email domains is higher than that of the private whitelist of email domains, and an abnormal alarm for malicious emails will be issued; for email E Q1 , T 6Q1 =1 and T 7Q1 =0, that is, the email sender's email domain name belongs to the public email domain blacklist library but does not belong to the email domain private whitelist library of email account Q, and a malicious email abnormality alarm will be issued.

[0124] The above-mentioned malicious email detection method detects the email contact email domain name received by each email mailbox, and identifies and judges based on the email domain name public blacklist library and the corresponding email domain name private whitelist library. When there is an abnormal email, an alarm is issued and the corresponding email is blocked from reaching the corresponding email mailbox. It can realize accurate malicious email detection and effectively identify various malicious emails.

[0125] Figure 6FIG. 3 is a schematic block diagram of a malicious email detection system 300 provided in an embodiment of the present invention. Figure 6 As shown, corresponding to the above malicious email detection method, the present invention also provides a malicious email detection system 300. The malicious email detection system 300 includes a unit for executing the above malicious email detection method, and the device can be configured in a server. Figure 6 The malicious email detection system 300 includes an acquisition unit 301, a blacklist library generation unit 302, a whitelist library generation unit 303, a monitoring unit 304, a first matching unit 305, a second matching unit 306, a judgment unit 307, a first isolation unit 308 and an information generation unit 309.

[0126] The acquisition unit 301 is used to acquire the mailbox client information; the blacklist library generation unit 302 is used to generate the mailbox domain name public blacklist library according to the mailbox client information; the whitelist library generation unit 303 is used to generate the mailbox domain name private whitelist library according to the mailbox client information; the monitoring unit 304 is used to monitor the email information sent to each email account to obtain the email contact email domain name received by each email mailbox; the first matching unit 305 is used to match the email contact email domain name received by each email mailbox and the mailbox domain name public blacklist library to obtain a first matching result; the second matching unit 306 is used to match the email contact email domain name received by each email mailbox and the mailbox domain name private whitelist library to obtain a second matching result; the judgment unit 307 is used to judge whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result; the first isolation unit 308 is used to isolate the abnormal email if there is an abnormal email in the email information sent to the email account; the information generation unit 309 is used to generate abnormal email warning information.

[0127] In one embodiment, the above-mentioned malicious email detection system includes a processing unit 310, which is used to allow non-abnormal emails to reach the corresponding email account if there are no abnormal emails in the email information sent to the email account, isolate the unknown emails, and issue an alarm for unknown emails.

[0128] In one embodiment, if Figure 7 As shown, the blacklist library generating unit 302 includes a set calculating subunit 3021 , a crawling subunit 3022 and a processing subunit 3023 .

[0129] The set calculation subunit 3021 is used to calculate the set of email blacklist contact information of all email boxes to obtain the original public blacklist library; the crawling subunit 3022 is used to regularly crawl and collect the malicious domain name list in the public malicious domain name intelligence library to obtain the supplementary public blacklist library; the processing subunit 3023 is used to deduplicate, arrange and integrate the original public blacklist library and the supplementary public blacklist library to obtain the email domain name public blacklist library.

[0130] In one embodiment, if Figure 8 As shown, the first matching unit 305 includes a first judging subunit 3051 , a first determining subunit 3052 and a second determining subunit 3053 .

[0131] The first judging subunit 3051 is used to judge whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name; the first determining subunit 3052 is used to determine that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name if the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, so as to obtain a first matching result; the second determining subunit 3053 is used to determine that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, so as to obtain a first matching result.

[0132] In one embodiment, if Fig. 9 As shown, the second matching unit 306 includes a second judging subunit 3061 , a third determining subunit 3062 and a fourth determining subunit 3063 .

[0133] The second judgment subunit 3061 is used to judge whether the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library; the third determination subunit 3062 is used to determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library if the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library, so as to obtain a second matching result; the fourth determination subunit 3063 is used to determine that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library, so as to obtain a second matching result.

[0134] In one embodiment, the judgment unit 307 is used to, when the first matching result is that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of the email domain name, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public whitelist library of the email domain name, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

[0135] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned malicious email detection system 300 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0136] The malicious email detection system 300 can be implemented in the form of a computer program. Fig.10 Runs on the computer device shown.

[0137] See also Fig.10 , Fig.10 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0138] See also Fig.10 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0139] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a malicious email detection method.

[0140] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0141] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a malicious email detection method.

[0142] The network interface 505 is used to communicate with other devices over the network. Fig.10 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0143] The processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps:

[0144] Acquire mailbox client information; generate a public blacklist library of mailbox domain names according to the mailbox client information; generate a private whitelist library of mailbox domain names according to the mailbox client information; monitor email information sent to each email account to obtain the email contact email domain names received by each email box; match the email contact email domain names received by each email box with the public blacklist library of mailbox domain names to obtain a first matching result; match the email contact email domain names received by each email box with the private whitelist library of mailbox domain names to obtain a second matching result; determine whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result; if there are abnormal emails in the email information sent to the email account, isolate the abnormal emails; generate abnormal email alarm information.

[0145] The email client information includes email account information, email sent email contact information, email received email contact information, and email blacklist contact information.

[0146] In one embodiment, when the processor 502 implements the step of generating a public blacklist library of mailbox domain names according to the mailbox client information, the processor 502 specifically implements the following steps:

[0147] Calculate the set of email blacklist contact information of all email boxes to obtain the original public blacklist library; regularly crawl and collect the malicious domain name list in the public malicious domain name intelligence library to obtain the supplementary public blacklist library; deduplicate, arrange and integrate the original public blacklist library and the supplementary public blacklist library to obtain the email domain name public blacklist library.

[0148] In one embodiment, when the processor 502 implements the step of generating a private whitelist library of email domain names according to the email client information, the processor 502 specifically implements the following steps:

[0149] The intersection of the contact information of the emails sent by each email box and the contact information of the emails received by each email box is calculated to obtain the private whitelist library of the email domain name of each email box.

[0150] In one embodiment, when the processor 502 implements the step of matching the email contact email domain name received by each email mailbox with the public blacklist library of the email domain name to obtain the first matching result, the processor 502 specifically implements the following steps:

[0151] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name; if the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name, determine that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, so as to obtain a first matching result; if the email contact email domain name received by the email mailbox does not belong to an element in the public blacklist library of the email domain name, determine that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, so as to obtain a first matching result.

[0152] In one embodiment, when the processor 502 implements the step of matching the email contact email domain name received by each email mailbox with the email domain name private whitelist library to obtain the second matching result, the processor 502 specifically implements the following steps:

[0153] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library; if the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library to obtain a second matching result; if the email contact email domain name received by the email mailbox does not belong to an element in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library to obtain a second matching result.

[0154] In one embodiment, when the processor 502 implements the step of determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the processor 502 specifically implements the following steps:

[0155] When the first matching result is that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of the email domain name, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public whitelist library of the email domain name, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

[0156] In one embodiment, after implementing the step of determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the processor 502 further implements the following steps:

[0157] If there are no abnormal emails in the email information sent to the email account, the non-abnormal emails are allowed to reach the corresponding email account, the unknown emails are quarantined, and an alarm for the unknown emails is issued.

[0158] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit 310 (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0159] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0160] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps:

[0161] Acquire mailbox client information; generate a public blacklist library of mailbox domain names according to the mailbox client information; generate a private whitelist library of mailbox domain names according to the mailbox client information; monitor email information sent to each email account to obtain the email contact email domain names received by each email box; match the email contact email domain names received by each email box with the public blacklist library of mailbox domain names to obtain a first matching result; match the email contact email domain names received by each email box with the private whitelist library of mailbox domain names to obtain a second matching result; determine whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result; if there are abnormal emails in the email information sent to the email account, isolate the abnormal emails; generate abnormal email alarm information.

[0162] The email client information includes email account information, email sent email contact information, email received email contact information, and email blacklist contact information.

[0163] In one embodiment, when the processor executes the computer program to implement the step of generating a public blacklist library of mailbox domain names according to the mailbox client information, the processor specifically implements the following steps:

[0164] Calculate the set of email blacklist contact information of all email boxes to obtain the original public blacklist library; regularly crawl and collect the malicious domain name list in the public malicious domain name intelligence library to obtain the supplementary public blacklist library; deduplicate, arrange and integrate the original public blacklist library and the supplementary public blacklist library to obtain the email domain name public blacklist library.

[0165] In one embodiment, when the processor executes the computer program to implement the step of generating a private whitelist library of email domain names according to the email client information, the processor specifically implements the following steps:

[0166] The intersection of the contact information of the emails sent by each email box and the contact information of the emails received by each email box is calculated to obtain the private whitelist library of the email domain name of each email box.

[0167] In one embodiment, when the processor executes the computer program to implement the step of matching the email contact email domain name received by each email mailbox with the public blacklist library of the email domain name to obtain the first matching result, the processor specifically implements the following steps:

[0168] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name; if the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name, determine that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, so as to obtain a first matching result; if the email contact email domain name received by the email mailbox does not belong to an element in the public blacklist library of the email domain name, determine that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, so as to obtain a first matching result.

[0169] In one embodiment, when the processor executes the computer program to implement the step of matching the email contact email domain name received by each email mailbox with the email domain name private whitelist library to obtain the second matching result, the processor specifically implements the following steps:

[0170] Determine whether the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library; if the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library to obtain a second matching result; if the email contact email domain name received by the email mailbox does not belong to an element in the email domain private whitelist library, determine that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library to obtain a second matching result.

[0171] In one embodiment, when the processor executes the computer program to implement the step of determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the processor specifically implements the following steps:

[0172] When the first matching result is that the email contact email domain name received by the email mailbox belongs to the public blacklist library of the email domain name, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of the email domain name, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email; when the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of the email domain name, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public whitelist library of the email domain name, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

[0173] In one embodiment, after executing the computer program to implement the step of determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the processor further implements the following steps:

[0174] If there are no abnormal emails in the email information sent to the email account, the non-abnormal emails are allowed to reach the corresponding email account, the unknown emails are quarantined, and an alarm for the unknown emails is issued.

[0175] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0176] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0177] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0178] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in various embodiments of the present invention can be integrated into a processing unit 310, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0179] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0180] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for detecting malicious emails, characterized in that: include: Get email client information; Generate a public blacklist database of email domain names according to the email client information; Generate a private whitelist library of email domain names according to the email client information; Monitor email messages sent to each email account to obtain the email contact email domain name received by each email account; Matching the email contact email domain name received by each email mailbox with the public blacklist library of the email domain name to obtain a first matching result; Matching the email contact email domain name received by each email box with the email domain name private whitelist library to obtain a second matching result; Determining whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result; If there are any abnormal emails among the email messages sent to the email account, the abnormal emails are quarantined; Generate abnormal email alert information; The generating of a public blacklist database of mailbox domain names according to the mailbox client information comprises: Calculate the set of email blacklist contact information of all email boxes to obtain the original public blacklist library; Regularly crawl and collect malicious domain name lists in the public malicious domain name intelligence database to supplement the public blacklist database; De-duplicate, sort, and integrate the original public blacklist database and the supplementary public blacklist database to obtain a mailbox domain name public blacklist database; There is an algorithm T3, which generates a formal public blacklist library B3 for the original public blacklist library B1 and the supplementary public blacklist library B2; the specific implementation of algorithm T3 is as follows: for the original public blacklist library B1, the blacklist dataset of the original public blacklist library {B 11 , B 12 , ... B 1n }; For the supplementary public blacklist library B2, obtain the blacklist data set of the supplementary public blacklist library {B 21 , B 22 , ... B 2n }, calculate the result set after de-reordering and integrating the two data sets; let the current original public blacklist library be B 1x , add the public blacklist library to B 2x , that is, calculate T3(B 1x , B 2x ); if T3(B 1x , B 2x )=0, which means that the generation of the official public blacklist library B3 fails, then at least one of the original public blacklist library and the supplementary public blacklist library has an exception, and B3 is an empty set; if T3(B 1x , B 2x )=1, which means that both the original public blacklist and the supplementary public blacklist are normal. At this time, B3 is the original public blacklist B 1x And supplement the public blacklist library B 2x Generated official public blacklist library.

2. A malicious email detection method according to claim 1, characterized in that: The mailbox client information includes email account information, email sent email contact information, email received email contact information and email blacklist contact information.

3. A malicious email detection method according to claim 1, characterized in that: The generating of a private whitelist library of email domain names according to the email client information includes: The intersection of the contact information of the emails sent by each email box and the contact information of the emails received by each email box is calculated to obtain the private whitelist library of the email domain name of each email box.

4. A malicious email detection method according to claim 1, characterized in that: The matching of the email contact email domain name received by each email mailbox and the email domain name public blacklist library to obtain a first matching result includes: Determine whether the email contact email domain name received by the email mailbox belongs to an element in the public blacklist library of the email domain name; If the email contact email domain name received by the email mailbox belongs to an element in the email domain public blacklist library, then determine that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library to obtain a first matching result; If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain public blacklist library, it is determined that the email contact email domain name received by the email mailbox does not belong to the email domain public blacklist library to obtain a first matching result.

5. A malicious email detection method according to claim 4, characterized in that: The matching of the email contact email domain name received by each email mailbox and the email domain private whitelist library to obtain a second matching result includes: Determine whether the email contact email domain name received by the email mailbox belongs to an element in the private whitelist library of the email domain name; If the email contact email domain name received by the email mailbox belongs to an element in the email domain private whitelist library, then determine that the email contact email domain name received by the email mailbox belongs to the email domain private whitelist library to obtain a second matching result; If the email contact email domain name received by the email mailbox does not belong to the elements in the email domain private whitelist library, it is determined that the email contact email domain name received by the email mailbox does not belong to the email domain private whitelist library to obtain a second matching result.

6. A malicious email detection method according to claim 5, characterized in that: The determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result includes: When the first matching result is that the email contact email domain name received by the email mailbox belongs to the email domain public blacklist library, there is an abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an abnormal email; When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public blacklist library of email domain names, and the second matching result is that the email contact email domain name received by the email mailbox belongs to the public whitelist library of email domain names, there is no abnormal email in the email information sent to the email account, and the email corresponding to the email contact email domain name received by the email mailbox is confirmed as a non-abnormal email; When the first matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain blacklist library, and the second matching result is that the email contact email domain name received by the email mailbox does not belong to the public email domain whitelist library, the email corresponding to the email contact email domain name received by the email mailbox is confirmed as an unknown email.

7. A malicious email detection method according to claim 6, characterized in that: After determining whether there is an abnormal email in the email information sent to the email account according to the first matching result and the second matching result, the method further includes: If there are no abnormal emails in the email information sent to the email account, the non-abnormal emails are allowed to reach the corresponding email account, the unknown emails are quarantined, and an alarm for the unknown emails is issued.

8. A malicious email detection system, characterized in that: include: An acquisition unit, used to acquire mailbox client information; A blacklist library generating unit, used to generate a public blacklist library of mailbox domain names according to the mailbox client information; A whitelist library generation unit, used to generate a private whitelist library of an email domain name according to the email client information; A monitoring unit, used to monitor the email messages sent to each email account to obtain the email contact email domain name received by each email account; A first matching unit, configured to match the email contact mailbox domain name received by each email mailbox with the mailbox domain name public blacklist library to obtain a first matching result; A second matching unit is used to match the email contact email domain name received by each email mailbox with the email domain private whitelist library to obtain a second matching result; a judging unit, configured to judge whether there are abnormal emails in the email information sent to the email account according to the first matching result and the second matching result; A first isolation unit, configured to isolate abnormal emails if there are any abnormal emails in the email messages sent to the email account; An information generating unit, used for generating abnormal email warning information; The blacklist database generating unit comprises: A set calculation subunit, used to calculate the set of email blacklist contact information of all email boxes to obtain an original public blacklist library; The crawling subunit is used to regularly crawl and collect the malicious domain name list in the public malicious domain name intelligence library to supplement the public blacklist library; A processing subunit, used for deduplicating, arranging and integrating the original public blacklist library and the supplementary public blacklist library to obtain a mailbox domain name public blacklist library; There is an algorithm T3, which generates a formal public blacklist library B3 for the original public blacklist library B1 and the supplementary public blacklist library B2; the specific implementation of algorithm T3 is as follows: for the original public blacklist library B1, the blacklist dataset of the original public blacklist library {B 11 , B 12 , ... B 1n }; For the supplementary public blacklist library B2, obtain the blacklist data set of the supplementary public blacklist library {B 21 , B 22 , ... B 2n }, calculate the result set after de-reordering and integrating the two data sets; let the current original public blacklist library be B 1x , add the public blacklist library to B 2x , that is, calculate T3(B 1x , B 2x ); if T3(B 1x , B 2x )=0, which means that the generation of the official public blacklist library B3 fails, then at least one of the original public blacklist library and the supplementary public blacklist library has an exception, and B3 is an empty set; if T3(B 1x , B 2x )=1, which means that both the original public blacklist and the supplementary public blacklist are normal. At this time, B3 is the original public blacklist B 1x And supplement the public blacklist library B 2x Generated official public blacklist library.

Images