Mail analysis method, device, system, electronic device and storage medium

Abstract

The application relates to a mail analysis method, device, system, electronic device and storage medium, wherein the mail analysis method comprises the following steps: obtaining first user information and a basic mail list, obtaining a legal IP address according to the first user information, and obtaining an illegal IP address according to the basic mail list and the legal IP address; obtaining matter information, obtaining a matter relationship topology result according to the matter information and the first user information; outputting first matter mail information and a matter mail time sequence according to the matter relationship topology result; and generating a first mail analysis report according to the illegal IP address, the matter relationship topology result, the first matter mail information and the matter mail time sequence. Through the application, the problems of low mail analysis accuracy and efficiency are solved, the automatic analysis of matter mails is realized quickly and accurately, and the work efficiency of mail analysis is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mail analysis, and in particular to a mail analysis method, device, system, electronic device and storage medium. BACKGROUND

[0002] Sending and receiving emails on the computer has been widely used in today's society, and with the rapid development of communication technology, sending and receiving emails through mobile phones has also been more and more widely used. However, new communication methods are also being applied to some illegal activities, such as email fraud, email virus or spam email, etc.

[0003] In the related art, it is usually necessary to manually arrange the mail list when checking the mail, which has high labor cost, resulting in low accuracy and efficiency of mail analysis; or in the related art, a black and white list is set to determine and isolate spam emails, but this method may cause the mail to be mis-screened, resulting in low accuracy of mail analysis.

[0004] At present, there is no effective solution to the problem of low accuracy and efficiency of mail analysis in the related art. SUMMARY

[0005] A mail analysis method, device, system, electronic device and storage medium are provided in the present embodiment to solve the problem of low accuracy and efficiency of mail analysis in the related art.

[0006] In a first aspect, a mail analysis method is provided in the present embodiment, which comprises:

[0007] Obtaining first user information and a basic mail list, obtaining a legal IP address according to the first user information, and obtaining an illegal IP address according to the basic mail list and the legal IP address;

[0008] Obtaining transaction information, obtaining a transaction relationship topology result according to the transaction information and the first user information, and outputting first transaction mail information and a transaction mail time sequence according to the transaction relationship topology result;

[0009] Generating a first mail analysis report according to the illegal IP address, the transaction relationship topology result, the first transaction mail information and the transaction mail time sequence.

[0010] In some embodiments, obtaining transaction information and obtaining a transaction relationship topology result according to the transaction information and the first user information comprise:

[0011] Obtaining the transaction information, and constructing a transaction corpus according to the transaction information;

[0012] performing entity recognition and relationship recognition on the matter corpus by using a first deep learning model to obtain a recognition result, and performing part-of-speech tagging according to the recognition result to obtain a matter correlation analysis result;

[0013] constructing a matter knowledge graph according to the matter correlation analysis result;

[0014] obtaining the matter relationship topology according to a matter occurrence time in the first user information and the matter knowledge graph.

[0015] In some embodiments, the obtaining of the illegal IP address according to the basic mail list and the legal IP address comprises:

[0016] obtaining original mail meta information, obtaining a basic mail list according to the original mail meta information, comparing the basic mail list with the legal IP address to obtain an illegal IP address.

[0017] In some embodiments, after the comparison of the basic mail list with the legal IP address to obtain an illegal IP address, the method further comprises:

[0018] obtaining a legal nickname list, matching the legal nickname list with the original mail meta information, and recording the original mail meta information that fails to match as illegal nickname information if the matching result indicates a failure;

[0019] obtaining mail nickname impersonation information according to the illegal nickname information; wherein the legal nickname list comprises a sender domain name and a sender nickname, and the sender domain name and the sender nickname are in one-to-one correspondence;

[0020] generating a second mail analysis report according to the mail nickname impersonation information, and outputting the second mail analysis report to a terminal device.

[0021] In some embodiments, after the comparison of the basic mail list with the legal IP address to obtain an illegal IP address, the method further comprises:

[0022] performing impersonation domain name recognition on the basic mail list to obtain impersonation domain name registration information;

[0023] generating a third mail analysis report according to the impersonation domain name registration information, and outputting the third mail analysis report to a terminal device.

[0024] In some embodiments, the performing impersonation domain name recognition on the basic mail list to obtain impersonation domain name registration information comprises:

[0025] acquire website domain names to build a domain name corpus; perform word segmentation on word vectors in the domain name corpus using a word segmentation algorithm to obtain domain name word vector features; input the domain name word vector features into a second deep learning model to train a pseudo domain name detection model;

[0026] input the basic mail list into the pseudo domain name detection model to obtain the fake domain name registration information.

[0027] In a second aspect, a mail analysis device is provided in the present embodiment, and the device comprises a verification module, an analysis module, and an output module.

[0028] The verification module acquires first user information and a basic mail list, obtains a legal IP address according to the first user information, and obtains an illegal IP address according to the basic mail list and the legal IP address.

[0029] The analysis module acquires transaction information, obtains a transaction relationship topology result according to the transaction information and the first user information, and outputs first transaction mail information and a transaction mail time sequence according to the transaction relationship topology result.

[0030] The output module generates a first mail analysis report according to the illegal IP address, the transaction relationship topology result, the first transaction mail information, and the transaction mail time sequence.

[0031] In a third aspect, a mail analysis system is provided in the present embodiment, and the system comprises a terminal device, a transmission device, and a server device; the terminal device is connected to the server device through the transmission device.

[0032] The server device is configured to execute the mail analysis method of any one of the first aspect.

[0033] The transmission device is configured to transmit the illegal IP address, the transaction relationship topology, the first transaction mail information, and the transaction mail time sequence result to the terminal device.

[0034] The terminal device is configured to generate a first mail analysis report according to the illegal IP address, the transaction relationship topology, the first transaction mail information, and the transaction mail time sequence, and output the first mail analysis report.

[0035] In a fourth aspect, an electronic device is provided in the present embodiment, and the device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor; the processor executes the computer program to implement the mail analysis method of the first aspect.

[0036] In a fifth aspect, the present embodiment provides a storage medium having stored thereon a computer program which, when executed by a processor, implements the mail analysis method of the first aspect.

[0037] Compared with the related art, the mail analysis method, device, system, electronic device and storage medium provided in the present embodiment, by obtaining first user information and a basic mail list, obtaining a legal IP address according to the first user information, and obtaining an illegal IP address according to the basic mail list and the legal IP address, obtaining transaction information, obtaining a transaction relationship topology result according to the transaction information and the first user information, outputting first transaction mail information and a transaction mail time sequence according to the transaction relationship topology result, and generating a first mail analysis report according to the illegal IP address, the transaction relationship topology result, the first transaction mail information and the transaction mail time sequence, solve the problems of low accuracy and efficiency of mail analysis, realize fast and accurate automatic analysis of transaction mails, and improve the work efficiency of mail analysis.

[0038] The details of one or more embodiments of the present application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the present application will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings, which are included to provide a further understanding of the present application and are incorporated in and constitute a part of this application, illustrate embodiments of the present application and serve to explain the present application. In the drawings:

[0040] Figure 1 An application scenario diagram of the mail analysis method in an embodiment;

[0041] Figure 2 A flowchart of the mail analysis method in an embodiment;

[0042] Figure 3 A flowchart of the mail analysis method in a preferred embodiment;

[0043] Figure 4 A structural block diagram of the mail analysis device in an embodiment;

[0044] Figure 5 An internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0045] In order to make the objects, technical solutions and advantages of the present application clearer, the present application is described and explained below in conjunction with the drawings and embodiments.

[0046] Unless otherwise defined, technical terms and scientific terms used in the present application shall have the same meaning as those commonly understood by a person of ordinary skill in the art to which the present application belongs. The terms "one", "a", "an", "the", "these", and similar terms in the present application do not mean "only one" or "exactly one", but can mean "one or more". The terms "include", "contain", "have", and any variant thereof in the present application are intended to cover the non-exclusive inclusion; for example, a process, method, and system, product or device containing a series of steps or modules (units) are not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. The terms "connect", "connected", "coupled" and the like in the present application do not mean physical or mechanical connection, but can include electrical connection, whether direct or indirect. The term "multiple" in the present application means two or more. The term "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. Generally, the character " / " means that the objects before and after are "or" relationship. The terms "first", "second", "third" and the like in the present application are only used to distinguish similar objects, and do not mean a specific order of the objects.

[0047] The mail analysis method provided by the present application can be applied to the application environment as shown in Figure 1 The terminal device 102 and the server device 104 communicate through the network. The server device 104 obtains first user information and a basic mail list, obtains a legal IP address according to the first user information, and obtains an illegal IP address according to the basic mail list and the legal IP address; The server device 104 obtains transaction information, obtains transaction relationship topology results according to the transaction information and the first user information; The server device 104 outputs the first transaction mail information and the transaction mail time sequence according to the transaction relationship topology results; The server device 104 generates a first mail analysis report according to the illegal IP address, the transaction relationship topology results, the first transaction mail information and the transaction mail time sequence, and sends the first mail analysis report to the terminal device 102. The terminal device 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices, and the server device 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0048] In the present embodiment, a mail analysis method is provided, Figure 2 is a flowchart of the mail analysis method of the present embodiment, as shown in Figure 2As shown, the flow includes the following steps:

[0049] In step S202, first user information and a basic mail list are obtained, a legal IP address is obtained according to the first user information, and an illegal IP address is obtained according to the basic mail list and the legal IP address.

[0050] The first user information refers to the user information of a first user, and the first user refers to a mail user who needs to be tracked and located. The first user information can include a first user mail address, first user mail server information, a second user mail address, second user mail server information, and a substantive matter time. The second user refers to a person who knows and contacts the first user in relation to the mail. The illegal IP address refers to an IP address in the basic mail list that is inconsistent with the legal IP address. The basic mail list can be obtained by tabulating the obtained original mail meta-information, manually input by a person, or obtained by a crawler, which will not be described here.

[0051] It should be noted that the substantive matter time refers to the time when the matter actually occurs. The matter refers to the event related to the mail that needs to be tracked and located. For example, the event can be an event implemented by impersonating others, and the substantive matter time refers to the time when the benefit is successfully obtained by impersonation. The event can also be a business event, and the substantive matter time refers to the time when the business behavior reaches a consensus. The event can also be any event that is contacted and implemented through mail, which will not be described here.

[0052] Specifically, the above steps can be as follows. First, the first user information is obtained to obtain the first user mail address, the first user mail server, and the second user mail address, the second user mail server. The above information is parsed to obtain the IP addresses of the first user and the second user as legal IP addresses. Second, all original mail related to the case is obtained, and all original mail is preprocessed to obtain original mail meta-information. The original mail meta-information is tabulated to obtain a basic mail list. Finally, each IP address in the basic mail list is matched with the legal IP address. The IP address in the basic mail list that is not matched is the illegal IP address.

[0053] It should be noted that the original mail meta-information refers to the attribute information of all original mail, including the sender IP address, sender domain name, sender nickname, receiver IP address, receiver domain name, mail title, number of URLs in the mail, URL address, URL domain name, picture, number of pictures, text, attachment, and additional encryption of all original mail. Non-text information in the original mail meta-information is extracted and stored in the basic mail list in text form.

[0054] Step S204, obtaining the matter information, obtaining the matter relationship topology result according to the matter information and the first user information; outputting the first matter email information and the matter email time sequence according to the matter relationship topology result.

[0055] The matter information refers to the element information of the related person, event, time and place of each item of the mail matter summarized according to artificial experience or collected from historical matter data; the matter relationship topology refers to the relationship topology result between the matter entities generated after the entity information of each element in the matter and the relationship information between each element entity are obtained by associating and analyzing the matter information according to the substantial matter time of the first user information; the first matter email information refers to the meta information of the first original mail involved in the case; and the matter email time sequence refers to the sequence obtained by arranging the matter emails according to the time development order from the first matter email information.

[0056] Specifically, the matter information is obtained, the entity information of each element in the matter and the relationship information between each element entity are obtained by associating and analyzing the matter information according to the substantial matter time of the first user information, so as to output the matter relationship topology result; the first matter email information is outputted according to the matter relationship topology result, and the matter email time sequence is obtained by arranging the matter emails according to the time development order from the first matter email information.

[0057] Step S206, generating the first mail analysis report according to the illegal IP address, the matter relationship topology result, the first matter email information and the matter email time sequence.

[0058] Through the above steps, the tracked person implementing the matter by the mail can generally forge the server domain name and cannot forge the IP address, the illegal IP address is obtained by comparing with the legal IP address, the illegal IP address can be quickly screened, the personnel inside or around the first user is investigated by comparing with the mail IP address of the first user, and the real physical position of the tracked person is further quickly located; meanwhile, since the original mail meta information contains the sender IP address and the receiver IP address, the mail transfer path from the sender IP address to the receiver IP address, that is, the server information passed through by the mail transmission, can be traced back according to the sender IP address and the receiver IP address, so as to further judge the matter related personnel around the first user, quickly locate the real physical position of the tracked person from a large amount of mail information; the matter relationship topology result is obtained according to the matter information, and the first matter mail information and the matter mail time sequence are output, which can quickly and accurately form the development context of the same type of matter according to the artificial experience and the historical matter record, obtain the first matter mail information in the matter, generate the matter mail time sequence, help to analyze the development of the matter in detail, and further judge whether the tracked person collects the personal information of the first user through other channels according to the analysis result, so as to provide the collection range of other information of the matter; in the application, the first mail analysis report is generated according to the illegal IP address, the matter relationship topology result, the first matter mail information and the matter mail time sequence, the key information for solving the matter can be conveniently, quickly and accurately extracted from a large amount of mails, and a simple and easy-to-understand mail analysis report is generated, the problems of low accuracy and low efficiency of mail analysis in the related art are solved, and the quick and accurate analysis of a large amount of mails is realized.

[0059] In some embodiments, the obtaining the matter information, obtaining the matter relationship topology result according to the matter information and the first user information comprises:

[0060] Obtaining the matter information, constructing a matter corpus according to the matter information;

[0061] Performing entity recognition and relationship recognition on the matter corpus by using a first deep learning model to obtain a recognition result, and performing part-of-speech tagging according to the recognition result to obtain a matter correlation analysis result;

[0062] Constructing a matter knowledge graph according to the matter correlation analysis result;

[0063] Obtaining the matter relationship topology according to the matter occurrence time in the first user information and the matter knowledge graph.

[0064] The matter information refers to the element information of persons, events, time, and places related to each matter summarized according to artificial experience or collected from historical matter data; the first deep learning model refers to a model trained according to a time progression relationship, which can be a Long Short-Term Memory (LSTM) model in the present application; the entity recognition refers to the extraction of elements of persons, events, time, and places in the matter corpus; the relationship recognition refers to the association of the relationships between the extracted entities; the knowledge graph is drawn and visualized by a graph construction tool on the basis of the recognition results, and the matter knowledge graph construction tool can be neo4j or other graph databases for constructing knowledge graphs; each node in the matter knowledge graph represents an element entity, and the entities are filled with relationship, event attribute, and event content; the matter relationship topology refers to the relationship topology result between matter entities generated after the association analysis of the matter information according to the matter time of the first user information and the entity information of each element in the matter and the relationship information between each element entity.

[0065] Specifically, first, the element information of persons, events, time, and places related to each matter summarized according to artificial experience or collected from historical matter data is generated into matter information, and the matter information is constructed into a matter corpus; second, the first deep learning model is used to perform entity recognition and relationship recognition on the matter corpus to obtain recognition results, and the entities of the recognition results are tagged with parts of speech, and the entities, relationships between entities, event attributes, and event content are constructed into a matter knowledge graph by a graph tool, and the entity nodes, relationship attributes, and event content are labeled in the matter knowledge graph; and finally, the matter relationship topology is constructed according to the matter occurrence time in the first user information and the matter knowledge graph.

[0066] Preferably, before the first deep learning model is used to perform entity recognition and relationship recognition, the text data in the original email needs to be segmented by using the jieba word segmentation to remove stop words, and then a word vector is obtained by using a word segmentation algorithm, and a word frequency result is obtained by using a word frequency statistical method, and the word frequency result is multiplied by the word vector to obtain a text vector, which is input into the first deep learning model for recognition training to identify entity information, relationship information, and attribute information from the text data, and then the recognized data is input into a graph construction tool in the form of entity-relationship-entity-attribute to construct a matter knowledge graph.

[0067] Preferably, the word segmentation algorithm can be a word2vec algorithm; the term frequency statistical algorithm can be a TF-IDF (term frequency-inverse document frequency) algorithm; the entity information generally includes names, company names, organizations and institutions; the relationship information generally includes the relationships between each person and the person, company, institution; and the attribute information generally includes the quantity and type characteristics of the person, institution and organization.

[0068] Through the above steps, the transaction information is generated according to artificial experience summary or historical transaction data collection, and a corpus is constructed, which can comprehensively describe the transaction characteristics of similar transactions. The first deep learning model is used for entity recognition on the transaction corpus, and the recognition result is constructed into a transaction knowledge graph, which realizes the identification of the meta information of the transaction email according to the transaction development sequence, identifies the characteristics presented by the email in each period corresponding to the transaction, such as email tactics and methods, and facilitates subsequent convenient and clear expansion of the transaction email for query and analysis. At the same time, according to the transaction occurrence time in the first user information, the transaction knowledge graph is referred to, and the accurate transaction relationship topology can be obtained conveniently, the graph structure of the email file elements is realized, the speed of email analysis is improved, and the problems of low accuracy and low efficiency of email analysis are solved.

[0069] In some embodiments, the obtaining of the illegal IP address according to the basic email list and the legal IP address includes: obtaining original email meta information, and obtaining a basic email list according to the original email meta information; and comparing the basic email list with the legal IP address to obtain the illegal IP address.

[0070] Through the above steps, the basic email list is compared with the legal IP address to obtain the illegal IP address, which can quickly screen the illegal IP address, and by comparing with the email IP address of the first user, the personnel inside or around the first user can be investigated, so as to further quickly locate the real physical location of the tracked person.

[0071] The basic email list is obtained by tabulating the obtained original email meta information; the original email meta information refers to the attribute information of all original correspondence emails, including: the sender IP address, sender domain name, sender nickname, receiver IP address, receiver domain name, email title, number of URLs in the email, URL address, URL domain name, picture, number of pictures, text, attachment, and additional encryption of all original emails; and the non-text information in the original email meta information is extracted and stored in the basic email list in the form of text.

[0072] In some embodiments, after comparing the basic mail list with the legal IP address, an illegal IP address is obtained, and the method further comprises:

[0073] A legal nickname list is obtained, and the legal nickname list is matched with the original mail meta-information. If the matching result indicates a failure, the failed original mail meta-information is recorded as illegal nickname information.

[0074] Mail nickname impersonation information is obtained according to the illegal nickname information. The legal nickname list includes a sender domain name and a sender nickname, and the sender domain name and the sender nickname are in one-to-one correspondence.

[0075] A second mail analysis report is generated according to the mail nickname impersonation information, and the second mail analysis report is output to a terminal device.

[0076] The legal nickname list includes a sender domain name and a sender nickname, and is obtained by extracting a mail address book of a first user or collected before the mail analysis action is started.

[0077] Specifically, after obtaining the legal nickname list, the sender domain name in the basic mail list is matched with the sender domain name in the legal nickname list. After the corresponding sender domain name is matched, the sender nickname of the sender domain name is compared with the sender nickname of the sender domain name. If the two are inconsistent, the matching result indicates a failure. The sender nickname that fails to match is illegal nickname information. According to the illegal nickname information, the sender domain name and the sender IP address corresponding to the sender nickname in the basic mail list are found, and mail nickname impersonation information is obtained. According to the mail nickname impersonation information, a second mail analysis report is generated, and the second mail analysis report is output to a terminal device 102.

[0078] Through the above steps, the sender information of all mails related to the matter is matched with the legal nickname list to obtain an illegal nickname list and further obtain mail nickname impersonation information. The account impersonating the nickname in all matter mails can be quickly found, and a report is generated for terminal display. The mail sender impersonating the nickname is checked, the speed of mail analysis is improved, and the problems of low accuracy and efficiency of mail analysis are solved.

[0079] In some embodiments, after comparing the basic mail list with the legal IP address, an illegal IP address is obtained, and the method further comprises: performing impersonation domain name identification on the basic mail list to obtain impersonation domain name registration information; generating a third mail analysis report according to the impersonation domain name registration information, and outputting the third mail analysis report to a terminal device.

[0080] The counterfeit domain name identification refers to training a domain name corpus obtained by a crawler through a second deep learning model to obtain a counterfeit domain name detection model; then detecting a basic mail list by using the counterfeit domain name detection model to obtain counterfeit domain name registration information; and finally generating a third mail analysis report according to the counterfeit domain name registration information and outputting the third mail analysis report to the terminal device 102.

[0081] Through the above steps, the counterfeit domain name identification is performed on the basic mail list, the counterfeit domain name registration information is obtained, and a report is generated for terminal display, thereby realizing accurate investigation of counterfeit domain names of a mail sender, improving the speed of mail analysis, and solving the problems of low accuracy and efficiency of mail analysis.

[0082] In some embodiments, the counterfeit domain name identification of the basic mail list and the obtaining of the counterfeit domain name registration information include: obtaining website domain names to construct a domain name corpus; performing word segmentation on word vectors in the domain name corpus by using a word segmentation algorithm to obtain domain name word vector features; inputting the domain name word vector features into a second deep learning model to train and generate a pseudo domain name detection model; and inputting the basic mail list into the pseudo domain name detection model to obtain the counterfeit domain name registration information.

[0083] Specifically, the counterfeit domain name identification of the basic mail list refers to first obtaining domain names of some websites by a crawler as a domain name corpus, obtaining domain name information word vectors by using a word segmentation algorithm according to the collected domain name corpus; inputting the domain name information word vectors as inputs of a second deep learning model, training the second deep learning model, and thereby constructing a counterfeit domain name detection model; second, detecting sender domain names in the basic mail list by using the counterfeit domain name detection model to obtain pseudo domain name detection results; and finally comparing the detected pseudo domain name detection results with normal domain names obtained by network query to determine final counterfeit domain name registration information.

[0084] The word segmentation algorithm refers to an algorithm for segmenting words and phrases in the domain name corpus. The word segmentation algorithm preferably uses a Word2vec algorithm, which does not cause vector sparseness and high latitude problems, can map words and phrases to a low-dimensional space, and can also make semantically similar words closer in space. The word segmentation algorithm can also be a one-hot algorithm and other algorithms known to those skilled in the art. The second deep learning model preferably uses a bidirectional long short-term memory neural network (Bi-LSTM) algorithm, which can learn information of forward and reverse sequences and can more accurately train data of the domain name corpus.

[0085] Through the above steps, the basic mail list is subjected to the impersonation domain name identification, the impersonation domain name registration information is obtained, and a report is generated for terminal display, so that the impersonation domain name of the mail sender is accurately investigated, the mail analysis speed is improved, and the problems of low mail analysis accuracy and efficiency are solved.

[0086] In the preferred embodiment, a mail analysis method is provided, Figure 3 The flowchart of the mail analysis method of the preferred embodiment is shown in Figure 3 The method first acquires original mails, and pre-processes all the original mails to convert the mails in PST format into mails in EML format for analysis, and parses a basic mail list; at the same time, a first user mail address, a first user mail server domain name, a second user mail address, and a substantive matter time are acquired, a legal IP address is parsed according to the above data, and the basic mail list is subjected to IP legality comparison according to the legal IP address, a forged sender address is marked, and a network query is performed to output the information of the place of origin of the illegal IP; the domain names in the basic mail list are subjected to address similarity comparison, and an impersonation domain name is marked, and a network query is performed and the registration information of the impersonation domain name is output; secondly, the content of the matter is acquired, and content correlation analysis is performed, so that the mail application reply in the basic mail list is analyzed in combination with the above substantive matter time, a matter correlation mail transmission topology is obtained, and is output; thirdly, the first mail information in the matter is parsed from the basic mail list in combination with the above substantive matter time, the information of the person who knows the matter before the matter occurs and the matter mail time sequence containing time zone information are output.

[0087] It should be understood that, although Figure 3 the steps in the flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows; for example, the step of marking the nickname impersonation in the mail header analysis can be performed after the step of marking the impersonation domain name in the address similarity comparison, or before the step of marking the forged sender address in the IP legality comparison.

[0088] It should be understood that, although Figures 2-3 the steps in the flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, Figures 2-3 at least part of the steps in may include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0089] In the embodiment, a mail analysis apparatus is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and the description of which has been made above. The terms "module", "unit", "sub-unit" and the like used below can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation of hardware, or a combination of software and hardware, is also possible and contemplated.

[0090] Figure 4 is a structural block diagram of the mail analysis apparatus of the embodiment, as shown in the figure, the apparatus comprises a verification module 20, an analysis module 30 and an output module 40; Figure 4 The verification module 20 obtains first user information and a basic mail list, obtains a legal IP address according to the first user information, and obtains an illegal IP address according to the basic mail list and the legal IP address;

[0091] The analysis module 30 obtains transaction information, obtains a transaction relationship topology result according to the transaction information and the first user information, and outputs first transaction mail information and a transaction mail time sequence according to the transaction relationship topology result;

[0092] The output module 40 generates a first mail analysis report according to the illegal IP address, the transaction relationship topology result, the first transaction mail information and the transaction mail time sequence.

[0093] The specific limitations of the mail analysis apparatus can refer to the limitations of the mail analysis method described above, and will not be repeated here. Each module in the above mail analysis apparatus can be implemented by software, hardware and a combination thereof in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to each of the above modules.

[0094] In the embodiment, a mail analysis system is also provided, which comprises a terminal device, a transmission device and a server device; wherein the terminal device is connected to the server device through the transmission device;

[0095] The server device is used to execute the steps of any one of the above mail analysis methods;

[0096] The transmission device is used to transmit the illegal IP address, the transaction relationship topology, the first transaction mail information and the transaction mail time sequence result to the terminal device;

[0097] The transmission device is used to transmit the illegal IP address, the transaction relationship topology, the first transaction mail information and the transaction mail time sequence result to the terminal device;

[0098] The terminal device is configured to form a first mail analysis report according to the illegal IP address, the matter relationship topology, the first matter mail information and the matter mail time sequence, and output the first mail analysis report.

[0099] In the embodiment, an electronic device is also provided, which comprises a memory and a processor, the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the above method embodiments.

[0100] Optionally, the electronic device can further comprise a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0101] Optionally, in the embodiment, the processor can be configured to execute the following steps through the computer program:

[0102] S1, obtaining first user information and a basic mail list, obtaining a legal IP address according to the first user information, and obtaining an illegal IP address according to the basic mail list and the legal IP address;

[0103] S2, obtaining matter information, obtaining a matter relationship topology result according to the matter information and the first user information, and outputting first matter mail information and a matter mail time sequence according to the matter relationship topology result;

[0104] S3, generating a first mail analysis report according to the illegal IP address, the matter relationship topology result, the first matter mail information and the matter mail time sequence.

[0105] It should be noted that the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein again.

[0106] In addition, in combination with the mail analysis method provided in the above embodiments, a storage medium can also be provided to implement the mail analysis method in the embodiment. The storage medium stores a computer program; when the computer program is executed by a processor, any of the above mail analysis methods is implemented.

[0107] In one embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 5As shown in the figure. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The network interface of the computer device is used to communicate with the external terminal through the network connection. The computer program is executed by the processor to implement a mail analysis method.

[0108] Those skilled in the art can understand that, Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0109] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM) and the like.

[0110] It should be understood that the specific embodiments described herein are used to explain this application, but not to limit it. According to the embodiments provided by the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0111] It is apparent that the drawings depicted are only a few example embodiments of the present application and that a person of ordinary skill in the art would be able to adapt the present application to other similar situations without paying creative labor. In addition, it is understood that, although the work done in developing the present application can be complex and long, certain modifications, such as design, manufacture or production, made by a person of ordinary skill in the art based on the technical content disclosed in the present application, should not be regarded as a lack of disclosure.

[0112] The word "embodiment" in the present application means that the specific features, structures or characteristics described in connection with the embodiments can be included in at least one embodiment of the present application. The presence of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean independence or alternatives to other embodiments. It is clear or implicitly understood by those of ordinary skill in the art that the embodiments described in the present application can be combined with other embodiments without conflict.

[0113] The above-described embodiments only express several implementation manners of the present application, which are described in detail and specifically, but should not be understood as a limitation on the scope of patent protection. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, which are all within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A mail analysis method characterized by, The method comprises: obtaining first user information and a basic mail list, obtaining a legal IP address according to the first user information, and obtaining an illegal IP address according to the basic mail list and the legal IP address; generating item information according to element information of persons, events, time and places related to each item collected by artificial experience summary or historical event data, constructing an item corpus according to the item information, performing entity recognition and relationship recognition on the item corpus by using a first deep learning model to obtain a recognition result, and performing part-of-speech tagging according to the recognition result to obtain an item correlation analysis result; constructing an item knowledge graph according to the item correlation analysis result; obtaining an item relationship topology result according to the item occurrence time in the first user information and the item knowledge graph; outputting first item mail information according to the item relationship topology result, and arranging item mails according to the time development sequence to obtain an item mail time sequence starting from the first item mail information; the item relationship topology result refers to a relationship topology result between item entities generated after correlating analysis of each element entity and the relationship information between each element entity according to the substantial item time in the first user information and the item information; the first item mail information refers to the meta information of the first original mail involved in the case; and the first deep learning model is a long short-term memory network model; generating a first mail analysis report according to the illegal IP address, the item relationship topology result, the first item mail information and the item mail time sequence.

2. The mailpiece analysis method of claim 1, wherein, The obtaining of the illegal IP address according to the basic mail list and the legal IP address comprises: obtaining original mail meta information, obtaining a basic mail list according to the original mail meta information, and comparing the basic mail list with the legal IP address to obtain an illegal IP address.

3. The mailpiece analysis method of claim 2 wherein, After the comparison of the basic mail list with the legal IP address to obtain the illegal IP address, the method further comprises: obtaining a legal nickname list, matching the legal nickname list with the original mail meta information, recording the original mail meta information of a failed matching result as illegal nickname information if the matching result indicates a failure, and obtaining mail nickname impersonation information according to the illegal nickname information; wherein the legal nickname list comprises a sender domain name and a sender nickname, and the sender domain name and the sender nickname are in one-to-one correspondence; generating a second mail analysis report according to the mail nickname impersonation information, and outputting the second mail analysis report to a terminal device. After the comparison of the basic mail list with the legal IP address to obtain the illegal IP address, the method further comprises:

4. The mailpiece analysis method of claim 2 wherein, performing impersonation domain name recognition on the basic mail list to obtain impersonation domain name registration information; generating a third mail analysis report according to the impersonation domain name registration information, and outputting the third mail analysis report to a terminal device. The impersonation domain name recognition on the basic mail list to obtain the impersonation domain name registration information comprises:

5. The mailpiece analysis method of claim 4 wherein, ​ Acquire website domain names to build a domain name corpus; perform word segmentation on the word vectors in the domain name corpus using a word segmentation algorithm to obtain domain name word vector features; input the domain name word vector features into a second deep learning model to train a pseudo domain name detection model; Input the basic mail list into the pseudo domain name detection model to obtain the fake domain name registration information.

6. A mail piece analysis apparatus, characterized by: Comprise: A verification module, an analysis module, and an output module; The verification module acquires first user information and a basic mail list, obtains a legal IP address based on the first user information, and obtains an illegal IP address based on the basic mail list and the legal IP address; The analysis module generates matter information based on the elements information of persons, events, times, and places related to each matter collected from historical matter data or summarized based on artificial experience, and constructs a matter corpus based on the matter information; Perform entity recognition and relationship recognition on the matter corpus using a first deep learning model to obtain a recognition result, and perform part-of-speech tagging based on the recognition result to obtain a matter correlation analysis result; Construct a matter knowledge graph based on the matter correlation analysis result; Obtain a matter relationship topology result based on the matter occurrence time in the first user information and the matter knowledge graph, output a first matter mail information based on the matter relationship topology result, and arrange matter mails in chronological order based on the time sequence of the first matter mail information; the matter relationship topology result refers to the relationship topology result between matter entities generated based on the entity information of each element in the matter and the relationship information between each element entity after correlating analysis of the matter information based on the substantial matter time in the first user information; the first matter mail information refers to the meta information of the first original mail involved in the case; the first deep learning model is a long short-term memory network model; The output module generates a first mail analysis report based on the illegal IP address, the matter relationship topology result, the first matter mail information, and the matter mail time sequence.

7. A mail analysis system characterized by comprising: Comprise: A terminal device, a transmission device, and a server device; wherein the terminal device is connected to the server device through the transmission device; The server device is configured to execute the mail analysis method of any one of claims 1 to 5; The transmission device is configured to transmit the illegal IP address, the matter relationship topology, the first matter mail information, and the matter mail time sequence result to the terminal device; The terminal device is configured to form a first mail analysis report based on the illegal IP address, the matter relationship topology, the first matter mail information, and the matter mail time sequence, and output the first mail analysis report. 8.An electronic device comprising a memory and a processor, the electronic device comprising: The memory stores a computer program, and the processor is configured to run the computer program to execute the mail analysis method of any one of claims 1 to 5.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the mail analysis method of any one of claims 1 to 5.

Images