Phishing email detection method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides a phishing email detection method, device, electronic device and storage medium, which relates to the field of network security technology, wherein the method includes: obtaining a pre-trained phishing email detection model, internal enterprise information related to the enterprise mailbox business, and an email gateway log; determining the email features of the email to be detected based on the internal enterprise information and the email gateway log; inputting the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails. The present invention can reduce the probability of missed reports and false reports of phishing emails and improve the reliability of phishing email detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a phishing email detection method, device, electronic device and storage medium. Background Art

[0002] Email is an important tool for people to communicate in their daily work. Phishing emails are mainly sent by attackers to deceive recipients to visit malicious links or open malicious attachments, so as to control the recipient's host or steal the recipient's private data. For attackers, breaking through the boundaries of security protection through phishing emails is one of the common attack methods. In view of this, in order to reduce enterprise security risks, enterprises need to detect phishing emails from massive emails in a timely manner.

[0003] In the prior art, one method is to match email information by using keyword matching, and determine emails that match keywords as phishing emails. However, this method can only detect emails that contain keywords in the keyword library, and it is easy to generate false positives. Another method is to use an email sandbox to execute attachments on emails containing attachments, and then analyze and monitor the behavior of the attachment execution, and determine whether it is a phishing email based on the results of the analysis and monitoring, and then find attachments containing malicious code. However, if the attacker encrypts and compresses the attachment, it can bypass the detection of the email sandbox, resulting in poor detection reliability. Summary of the invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a phishing email detection method, device, electronic device and storage medium.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a phishing email detection method, the method comprising:

[0007] Obtain pre-trained phishing email detection models, internal corporate information related to corporate email services, and email gateway logs;

[0008] Determine the email characteristics of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0009] The email features of the email to be detected are input into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0010] Furthermore, the email feature includes at least one of the following:

[0011] Features used to distinguish whether an email is a disguised internal email include at least one of the following: whether the email contains attachments, the abnormality level corresponding to the email attachment type, whether the email attachment name contains Chinese characters, the similarity between the email attachment name and the intranet email attachment name, the similarity between the email subject and the intranet email subject, the similarity between the sender's email domain name and the intranet email domain name, the similarity between the sender's email name and the intranet email domain name, the similarity between the sender's nickname and the intranet email nickname, and the similarity between the sender's nickname and the internal organization of the enterprise;

[0012] Features used to distinguish whether the sender-receiver relationship in an email is a normal sender-receiver relationship, including at least one of the following: the number of emails sent from the external mailbox in history, the number of email recipients, the number of departments corresponding to the email recipients, the number of emails received from this sender by the recipient's department in history, the number of emails received from this sender by the recipient in history, and the number of emails received from the sender by the recipient in history from an external mailbox.

[0013] Further, the determining of the email feature of the email to be detected based on the internal enterprise information and the email gateway log includes at least one of the following:

[0014] If the value of the attachment field corresponding to the mail to be detected in the mail gateway log is not empty, it is determined that the mail to be detected contains an attachment; if the value of the attachment field corresponding to the mail to be detected is empty, it is determined that the mail to be detected does not contain an attachment;

[0015] Determine the abnormality level corresponding to the type of the email attachment of the email to be detected based on the file suffix of the email attachment of the email to be detected and the preset correspondence between the file suffix and the abnormality level;

[0016] In the case where the email attachment name of the email to be detected matches a preset regular expression, determining that the email attachment name contains Chinese characters; the regular expression is used to match whether the email attachment name contains Chinese characters; in the case where the email attachment name does not match the preset regular expression, determining that the email attachment name does not contain Chinese characters;

[0017] Extracting the name of the email attachment of at least one historical email whose sender's mailbox is an internal mailbox of the enterprise from the historical log; performing word segmentation on the email attachment name of each of the historical emails to obtain a phrase set; calculating the word frequency of each word in each of the phrase sets to obtain a word frequency set; performing word segmentation on the email attachment name of the email to be detected to obtain a text phrase; performing word frequency matching between the text phrase and the word frequency set to obtain the word frequency of each word in the text phrase; calculating the average of the word frequencies of each word in the text phrase; performing normalization processing on the average to obtain the similarity between the email attachment name and the intranet email attachment name;

[0018] Extract the email subjects of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; segment the email subjects of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; segment the email subject of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average to obtain the similarity between the email subject and the intranet email subject;

[0019] Extracting the sender's mailbox domain name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox domain name and the intranet mailbox domain name;

[0020] Extracting the sender's mailbox name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox name and the intranet mailbox domain name;

[0021] Extract the sender nicknames of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the sender nicknames of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the sender nickname of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; perform normalization processing on the average to obtain the similarity between the sender nickname and the nickname of the intranet mailbox;

[0022] Based on the enterprise internal organization information set, each internal organization is segmented to obtain a phrase set; the word frequency of each word in each phrase in each phrase set is calculated to obtain a word frequency set; the sender nickname of the email to be detected is segmented to obtain a text phrase; the text phrase is used to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; the average word frequency of each word in the text phrase is calculated; the average word frequency is normalized to obtain the similarity between the sender nickname and the enterprise internal organization;

[0023] Extract the number of historical emails sent from the sender's mailbox that is not an internal mailbox of the enterprise from the historical log to obtain the number of historical emails sent from the external mailbox;

[0024] Determine the number of email recipients based on the number of email recipient mailboxes of the email to be detected;

[0025] Extract the recipient mailbox name from the recipient mailbox of the email to be detected, and determine the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; perform deduplication statistics on the departments corresponding to the recipient mailbox to obtain the number of departments corresponding to the email recipient;

[0026] Extracting the recipient mailbox name from the recipient mailbox of the email to be detected, and determining the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; counting the number of emails received by the department corresponding to the recipient mailbox from the sender mailbox of the email to be detected within the target historical time from the historical log;

[0027] Counting the number of emails from the sender's mailbox of the email to be detected that are received by the recipient's mailbox of the email to be detected from the historical log;

[0028] The number of emails whose sender mailbox is an external mailbox and received by the recipient mailbox of the email to be detected is counted from the historical log.

[0029] Further, the determining of the email features of the email to be detected based on the internal enterprise information and the email gateway log includes:

[0030] In a case where the email attribute information of the email to be detected includes the sender's email address name, determining the email domain name information of the email to be detected based on the sender's email address name of the email to be detected;

[0031] When the internal enterprise information includes an internal enterprise mailbox domain name set, and the mailbox domain name information of the email to be detected does not match the internal enterprise mailbox domain name set, the email characteristics of the email to be detected are determined based on the internal enterprise information, the email gateway log and the email attribute information of the email to be detected.

[0032] Furthermore, before obtaining the pre-trained phishing email detection model, the internal enterprise information related to the enterprise mailbox service, and the email gateway log, the method further includes:

[0033] Obtain marked historical emails and internal information of the enterprise;

[0034] Based on the marked historical emails and the internal information of the enterprise, determining email features corresponding to the marked historical emails;

[0035] Based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails, a binary classification model is trained to obtain the phishing email detection model;

[0036] The marking value of the marked historical email is used to indicate whether the marked historical email is a phishing email.

[0037] Furthermore, the enterprise internal information includes at least one of the following:

[0038] Internal organizational information collection of enterprises;

[0039] Enterprise employee and department mapping information collection;

[0040] Internal mailbox collection of the enterprise;

[0041] A collection of corporate internal mailbox domain names.

[0042] Furthermore, the mail gateway log includes mail attribute information of N mails, and the mail attribute information includes at least one of the following:

[0043] Sender nickname;

[0044] Sender's email address;

[0045] Recipient's email address;

[0046] Email subject;

[0047] Email attachment name;

[0048] The type of email attachment.

[0049] In a second aspect, an embodiment of the present invention further provides a phishing email detection device, comprising:

[0050] An acquisition module is used to obtain a pre-trained phishing email detection model, internal enterprise information related to the enterprise email business, and email gateway logs;

[0051] A first determination module, configured to determine the email features of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0052] The detection module is used to input the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0053] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the phishing email detection method as described in the first aspect is implemented.

[0054] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the phishing email detection method as described in the first aspect.

[0055] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the phishing email detection method described in the first aspect.

[0056] The phishing email detection method, device, electronic device and storage medium provided in the embodiments of the present invention determine the email features of the email to be detected based on internal enterprise information and email gateway logs, use a pre-trained phishing email detection model to perform real-time phishing email detection, and judge whether the email to be detected is a phishing email. Since the phishing email detection model is a binary classification model trained based on the email features corresponding to marked historical emails and the tag values ​​of the marked historical emails, this makes the method have stronger generalization ability, can be applicable to different phishing email variants, can reduce the probability of missed reports and false alarms, and improve the reliability of phishing email detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 This is one of the flow charts of the phishing email detection method provided by an embodiment of the present invention;

[0059] Figure 2 Schematic diagram of a training method for a phishing email detection model provided by an embodiment of the present invention;

[0060] Figure 3 This is the second flow chart of the phishing email detection method provided by the embodiment of the present invention;

[0061] Figure 4 It is a structural diagram of a phishing email detection system provided by an embodiment of the present invention;

[0062] Figure 5 A schematic diagram of the structure of a phishing email detection device provided by an embodiment of the present invention;

[0063] Figure 6 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] Figure 1 FIG. 1 is a flow chart of a phishing email detection method provided by an embodiment of the present invention. Figure 1 As shown, the phishing email detection method includes the following steps:

[0066] Step 101: Obtain a pre-trained phishing email detection model, internal enterprise information related to the enterprise email service, and an email gateway log.

[0067] It should be noted that the phishing email detection method provided in the embodiment of the present invention can be applicable to the scenario of real-time detection of phishing emails. The execution subject of the method can be a phishing email detection device, such as an electronic device, or a control module in the phishing email detection device for executing the phishing email detection method. The electronic device can include a mobile phone, a tablet computer, or a desktop computer.

[0068] In the prior art, in order to increase the success rate of inducing recipients to visit malicious links or open malicious attachments, attackers often disguise phishing emails based on the basic information of the collected attack targets, such as the sender's nickname, sender's email address, email subject, email content, email attachment name, etc.

[0069] The embodiment of the present invention performs real-time detection of phishing emails by pre-training a phishing email detection model. The phishing email detection model is trained based on marked historical emails and internal enterprise information and is a machine learning model. The phishing email detection model is used to evaluate the email type of the email to be detected.

[0070] Optionally, the internal enterprise information mentioned in the embodiment of the present invention may include at least one of the following: an internal enterprise organization information set; an enterprise employee and department mapping information set; an internal enterprise mailbox set; and an internal enterprise mailbox domain name set.

[0071] Optionally, the mail gateway log may include a target log and a historical log of the mail gateway; the target log includes mail attribute information of N mails, the N mails include mails to be detected, and N is a positive integer. The target log of the mail gateway is, for example, a log generated by the mail gateway in real time. The historical log of the mail gateway is, for example, a log of the mail gateway within the target historical time; in practice, the historical log is extracted from the database according to the set target historical time range condition. For example, if the specified target historical time is within 6 months from the current date, the mail log within the past 6 months is extracted from the database as the historical log. It can be understood that any one of the N mails included in the target log can be used as a mail to be detected. Using the phishing mail detection method provided in the embodiment of the present invention, phishing mail detection can be performed on each of the N mails included in the target log, and it can be determined whether each mail is a phishing mail.

[0072] Optionally, the email attribute information mentioned in the embodiment of the present invention may include at least one of the following: sender nickname; sender mailbox; recipient mailbox; email subject; email attachment name; email attachment type.

[0073] Step 102: Determine the email features of the email to be detected based on the internal enterprise information and the email gateway log.

[0074] The email feature is used to distinguish whether the email is a disguised internal email, and / or to distinguish whether the sender and receiver relationship in the email is a normal sender and receiver relationship.

[0075] Optionally, the email feature is used by the phishing email detection model to evaluate the email type of the email to be detected. The email feature may include at least one of the following: 1) a feature for distinguishing whether the email is a disguised internal email; 2) a feature for distinguishing whether the sender and receiver relationship in the email is a normal sender and receiver relationship. Table 1 shows the specific content of the email features mentioned in the embodiment of the present invention.

[0076] Among them, the features used to distinguish whether an email is a disguised internal email include at least one of the following: whether the email contains attachments, the abnormality level corresponding to the email attachment type, whether the email attachment name contains Chinese, the similarity between the email attachment name and the intranet email attachment name, the similarity between the email subject and the intranet email subject, the similarity between the sender's email domain name and the intranet email domain name, the similarity between the sender's email name and the intranet email domain name, the similarity between the sender's nickname and the intranet email nickname, and the similarity between the sender's nickname and the internal organization of the enterprise;

[0077] Features used to distinguish whether the sender-receiver relationship in an email is a normal sender-receiver relationship, including at least one of the following: the number of emails sent from the external mailbox in history, the number of email recipients, the number of departments corresponding to the email recipients, the number of emails received from this sender by the recipient's department in history, the number of emails received from this sender by the recipient in history, and the number of emails received from the sender by the recipient in history from an external mailbox.

[0078] Table 1

[0079]

[0080] Step 103: input the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0081] It should be noted that the email attribute information mentioned in the embodiment of the present invention does not include the email content, that is, the email content is not used when extracting email features for the email to be detected. This can effectively ensure the privacy of the email to be detected, and based on the sender's nickname, sender's email address, recipient's email address, email subject, email attachment name, email attachment type and internal enterprise information of the email to be detected, email features are extracted that can distinguish whether the email is a disguised internal email, and / or distinguish whether the sender and recipient relationship in the email is a normal sender and recipient relationship, and then based on the pre-trained phishing email detection model, the email type of the email to be detected is determined.

[0082] The phishing email detection method provided in the embodiment of the present invention determines the email features of the email to be detected based on the internal information of the enterprise and the email gateway log, uses the pre-trained phishing email detection model to perform real-time phishing email detection, and judges whether the email to be detected is a phishing email. Since the phishing email detection model is a binary classification model trained based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails, this makes the method have stronger generalization ability, can be applicable to different phishing email variants, can reduce the probability of missed reports and false alarms, and improve the reliability of phishing email detection.

[0083] Optionally, for different email features, a determination method suitable for the email feature is adopted. Specifically, based on internal enterprise information and email gateway logs, the specific method for determining the email feature of the email to be detected may include at least one of the following methods:

[0084] Method 1: Email features include whether the email contains attachments:

[0085] If the value of the attachment field corresponding to the to-be-detected email in the target log is not empty, it is determined that the to-be-detected email contains an attachment; if the value of the attachment field corresponding to the to-be-detected email is empty, it is determined that the to-be-detected email does not contain an attachment.

[0086] Method 2: Email features include email attachment types and corresponding abnormality levels:

[0087] Based on the file suffix of the mail attachment of the mail to be detected and the preset correspondence between the file suffix and the abnormality level, the abnormality level corresponding to the mail attachment type of the mail to be detected is determined.

[0088] In practice, when the email to be detected contains an email attachment, the file suffix of the email attachment is extracted. For example, when the email attachment field value is "Product User Manual.zip", the extracted suffix value is "zip", and then the email attachment type corresponding to the abnormal level is matched from the preset correspondence between the file suffix and the abnormal level. The correspondence between the file suffix and the abnormal level can be found in the abnormal level table shown in Table 2. The abnormal level table can be a mapping table of the file suffix type and the abnormal level provided by the security analyst. The higher the abnormal level of the email to be detected, the greater the probability that the email to be detected is a phishing email.

[0089] Table 2

[0090]

[0091]

[0092] Method 3: Email features include whether the email attachment name contains Chinese characters:

[0093] When the email attachment name of the email to be detected matches a preset regular expression, it is determined that the email attachment name contains Chinese characters; the regular expression is used to match whether the email attachment name contains Chinese characters; when the email attachment name does not match the preset regular expression, it is determined that the email attachment name does not contain Chinese characters.

[0094] For example, when the mail to be detected has a mail attachment, a regular expression is used to match whether the mail attachment name contains Chinese characters. If the mail attachment name contains Chinese characters, the matching result is yes; if the mail attachment name does not contain Chinese characters, the matching result is no.

[0095] Mode 4: The email feature includes the similarity between the email attachment name and the intranet email attachment name. The implementation process of determining the email feature of the email to be detected includes steps 4_1 to 4_6, wherein:

[0096] Step 4_1, extracting the name of the email attachment of at least one historical email whose sender's email address is an internal email address of the enterprise from the historical log;

[0097] The historical log is, for example, a log of the mail gateway within the target historical time. The specified target historical time range is determined by expert analysts, such as within the past 6 months. In practice, the historical log is extracted from the database according to the set target historical time range conditions. For example, if the specified target historical time is within 6 months from the current date, the mail log within the past 6 months is extracted from the database as the historical log. The name of the mail attachment of at least one historical mail whose sender's mailbox is an internal mailbox of the enterprise is extracted from the historical log, and the historical mail includes the mailbox attachment.

[0098] Step 4_2, segmenting the names of the email attachments of each of the historical emails to obtain a phrase set;

[0099] Use the word segmentation algorithm to segment the name of the email attachment. For example, if the name of the email attachment is "Employee Benefit Adjustment Instructions", the phrase set obtained by the word segmentation algorithm is: "employee, benefit, adjustment, instructions".

[0100] Step 4_3, calculating the word frequency of each word in each of the phrase sets to obtain a word frequency set;

[0101] The calculation of the word frequency set uses the counting method to count the number of times a word appears in the attachment name. For example, within a specified time, there are three emails with attachment names, and their names are "employee welfare adjustment instructions, employee information, and holiday instructions". After word segmentation, three phrase sets are obtained: "employee, welfare, adjustment, instructions", "employee, information" and "holiday, instructions". The word frequency of the word "employee" is 2, the word frequency of the word "instructions" is 2, the word frequency of the word "welfare" is 1, the word frequency of the word "adjustment" is 1, and the word frequency of the word "holiday" is 1. The word frequency set of the email attachment name is shown in Table 3.

[0102] Table 3

[0103] Words Word frequency staff 2 illustrate 2 Welfare 1 Adjustment 1 Have a holiday 1

[0104] Step 4_4, segmenting the name of the email attachment of the email to be detected to obtain text phrases;

[0105] For example, if an email to be tested contains an attachment, and the name of the attachment is "holiday adjustment instructions.pdf", the text segmentation object is "holiday adjustment instructions", and the phrase obtained after segmentation is "holiday, adjustment, instructions".

[0106] Step 4_5, use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase;

[0107] For the phrase "holiday, adjustment, explanation", the numerical result matched from the word frequency set of the email attachment name in Table 3 is "1, 1, 2". If the word in the text phrase does not exist in the word frequency set, the corresponding word frequency is 0.

[0108] Step 4_6, calculate the average value of the frequency of each word in the text phrase; normalize the average value to obtain the similarity between the email attachment name and the intranet email attachment name.

[0109] The frequency of each word in the text phrase is summed up, and the obtained sum is divided by the number of words in the text phrase to obtain the average value; the average value is normalized to obtain the similarity between the email attachment name and the intranet email attachment name.

[0110] Among them, after the average value is normalized, the value obtained is less than or equal to 1, so the processed value is used to represent the similarity. The higher the similarity value is, the more similar the email attachment name is to the intranet email attachment name.

[0111] It should be noted that the contents of the normalization processing involved in any embodiment of the present patent application can refer to the above explanation, and will not be described one by one in the following to avoid repetition.

[0112] Method 5: Email features include the similarity between the email subject and the intranet email subject:

[0113] Extract the email subjects of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the email subjects of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the email subject of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average value to obtain the similarity between the email subject and the intranet email subject.

[0114] Method 6: Email features include the similarity between the sender’s email domain name and the intranet email domain name:

[0115] Extract the sender's mailbox domain name from the sender's mailbox of the email to be detected, and determine the similarity between the sender's mailbox domain name and the intranet mailbox domain name. For example, use a python algorithm library to determine the similarity between the sender's mailbox domain name and the intranet mailbox domain name.

[0116] For example, the intranet mailbox domain name is "mail.com"; the sender's mailbox is zhangsan@mail1.com, then the extracted sender's mailbox domain name is "mail1.com".

[0117] Method 7: Email features include the similarity between the sender’s email address and the intranet email domain name:

[0118] Extract the sender's mailbox name from the sender's mailbox of the email to be detected; determine the similarity between the sender's mailbox name and the intranet mailbox domain name.

[0119] For example, the intranet mailbox domain name is "mail.com" and the sender's mailbox is mail@qq.com, then the extracted sender's mailbox name is "mail".

[0120] Method 8: Email features include the similarity between the sender’s nickname and the intranet mailbox nickname:

[0121] Extract the sender nicknames of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the sender nicknames of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the sender nickname of the email to be detected to obtain a text phrase; use the text phrase to match the word frequency with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average to obtain the similarity between the sender nickname and the nickname of the intranet mailbox.

[0122] Method 9: Email features include sender nickname and similarity to the internal organization of the enterprise:

[0123] Based on the enterprise internal organization information set, each internal organization is segmented to obtain a phrase set; the word frequency of each word in each phrase in each phrase set is calculated to obtain a word frequency set; the sender nickname of the email to be detected is segmented to obtain a text phrase; the text phrase is used to match the word frequency with the word frequency set to obtain the word frequency of each word in the text phrase; the average word frequency of each word in the text phrase is calculated; the average word frequency is normalized to obtain the similarity between the sender nickname and the enterprise internal organization.

[0124] Method 10: Email features include the number of emails sent from the external mailbox in history:

[0125] The number of historical emails sent by a sender mailbox other than the internal mailbox of the enterprise is extracted from the historical log to obtain the number of historical emails sent by the external mailbox.

[0126] For example, a sender mailbox that does not belong to the company's internal mailbox collection is determined to be an external mailbox. Based on the mail gateway historical log within a given time range (such as the past 6 months), the number of historical emails sent by the external mailbox is counted according to the mailbox name.

[0127] Method 11: Email characteristics include the number of email recipients:

[0128] The number of email recipients is determined based on the number of email recipient mailboxes of the email to be detected.

[0129] In practice, one or more recipients can be selected when sending an email to be tested, and the number of recipient mailboxes of the email to be tested can be used as the number of email recipients.

[0130] Method 12: Email features include the number of departments to which the email recipients correspond:

[0131] The recipient's mailbox name is extracted from the recipient's mailbox of the email to be detected, and the department corresponding to the recipient's mailbox is determined based on the recipient's mailbox name and the enterprise employee and department mapping information set; the departments corresponding to the recipient's mailbox are deduplicated and counted to obtain the number of departments corresponding to the email recipients.

[0132] Method 13: Email features include the number of emails received by the recipient’s department from this sender:

[0133] The recipient's mailbox name is extracted from the recipient's mailbox of the email to be detected, and the department corresponding to the recipient's mailbox is determined based on the recipient's mailbox name and a set of enterprise employee and department mapping information; the number of emails received by the department corresponding to the recipient's mailbox from the sender's mailbox of the email to be detected within the target historical time is counted from the historical log.

[0134] Method 14: Email features include the number of emails the recipient has received from this sender:

[0135] The number of emails from the sender's mailbox of the email to be detected that are received by the recipient's mailbox of the email to be detected is counted from the historical log.

[0136] Method 15: Email features include the number of emails received by the recipient history and the number of emails received by the sender from an external mailbox:

[0137] The number of emails whose sender mailbox is an external mailbox and received by the recipient mailbox of the email to be detected is counted from the historical log.

[0138] Optionally, based on the internal enterprise information and the mail gateway log, the method for determining the mail feature of the mail to be detected may include:

[0139] Step 1: when the email attribute information of the email to be detected includes the sender's email address name, determine the email domain name information of the email to be detected based on the sender's email address name of the email to be detected;

[0140] Step 2: When the internal enterprise information includes an internal enterprise mailbox domain name set, and the mailbox domain name information of the email to be detected does not match the internal enterprise mailbox domain name set, determine the email characteristics of the email to be detected based on the internal enterprise information, the email gateway log and the email attribute information of the email to be detected.

[0141] Optionally, an embodiment of the present invention provides a training method for a phishing email detection model. The cycle of the model offline training is performed according to the time interval specified by the user. For example, if the user sets the model training time to be trained at midnight on Monday every week, the model offline training service will perform offline training at the specified time. Figure 2FIG. 1 is a schematic diagram of a training method for a phishing email detection model provided by an embodiment of the present invention. Figure 2 As shown, the phishing email detection method includes the following steps:

[0142] Step 201: Obtain model training dependency;

[0143] The model training relies on data including: marked historical emails and internal information of the enterprise.

[0144] 1) Marked email log information. The fields used in the email log information are sender nickname, sender mailbox name, recipient, email subject, email attachment name, and email attachment type.

[0145] 2) Internal enterprise information includes: internal enterprise organization information set, enterprise employee and department mapping information set, internal enterprise mailbox set, and internal enterprise mailbox domain name set.

[0146] When the model offline training service is started, the service will extract the marked historical email information and internal enterprise information from the database according to the given time range conditions. For example, if the specified time range is within 6 months, the email log information within the past 6 months will be extracted during data extraction.

[0147] Step 202: Determine the email features corresponding to the marked historical emails based on the marked historical emails and the internal information of the enterprise;

[0148] Optionally, based on the marked historical emails and the internal information of the enterprise, a specific method for determining the email feature corresponding to the marked historical emails may include at least one of the following methods:

[0149] Method a: Email features include whether the email contains attachments:

[0150] When the value of the attachment field corresponding to the marked historical email is non-empty, it is determined that the email to be detected contains an attachment; when the value of the attachment field corresponding to the email to be detected is empty, it is determined that the email to be detected does not contain an attachment.

[0151] Method b: Email features include email attachment types and corresponding abnormality levels:

[0152] Based on the file suffix of the mail attachment of the marked historical mail and the preset correspondence between the file suffix and the abnormality level, the abnormality level corresponding to the mail attachment type of the marked historical mail is determined.

[0153] Method c: Email features include whether the email attachment name contains Chinese characters:

[0154] When the mail attachment name of the marked historical mail matches the preset regular expression, it is determined that the mail attachment name contains Chinese; when the mail attachment name does not match the preset regular expression, it is determined that the mail attachment name does not contain Chinese.

[0155] For example, when a marked historical email has an email attachment, a regular expression is used to match whether the email attachment name contains Chinese characters. If the email attachment name contains Chinese characters, the matching result is yes; if the email attachment name does not contain Chinese characters, the matching result is no.

[0156] Method d, the email feature includes the similarity between the email attachment name and the intranet email attachment name, and the implementation process of determining the email feature of the marked historical email includes: extracting the email attachment name of at least one historical email whose sender's email address is an internal enterprise email address from the historical log; segmenting the email attachment name of each of the historical emails to obtain a phrase set; calculating the word frequency of each word in each of the phrase sets to obtain a word frequency set; segmenting the email attachment name of the marked historical email to obtain a text phrase; using the text phrase to match the word frequency set to obtain the word frequency of each word in the text phrase; calculating the average word frequency of each word in the text phrase; normalizing the average to obtain the similarity between the email attachment name and the intranet email attachment name.

[0157] Method e: Email features include the similarity between the email subject and the intranet email subject:

[0158] Extract the email subjects of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the email subjects of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the email subjects of the marked historical emails to obtain text phrases; use the text phrases to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average value to obtain the similarity between the email subject and the intranet email subject.

[0159] Method f: Email features include the similarity between the sender’s email domain name and the intranet email domain name:

[0160] Extract the sender's mailbox domain name from the sender's mailbox of the marked historical email; determine the similarity between the sender's mailbox domain name and the intranet mailbox domain name.

[0161] For example, if the sender's email address is zhangsan@mail1.com, the extracted sender's email domain name is "mail1.com"; assuming that the intranet email domain name is "mail.com".

[0162] Method g: Email features include the similarity between the sender’s email address and the intranet email domain name:

[0163] Extract the sender mailbox name from the sender mailbox of the marked historical email; determine the similarity between the sender mailbox name and the intranet mailbox domain name.

[0164] For example, if the sender's email address is mail@qq.com, the extracted sender's email address name is "mail"; assuming that the intranet email domain name is "mail.com".

[0165] Method h: Email features include the similarity between the sender’s nickname and the intranet mailbox nickname:

[0166] Extract the sender nicknames of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the sender nicknames of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the sender nicknames of the marked historical emails to obtain text phrases; use the text phrases and the word frequency set to perform word frequency matching to obtain the word frequency of each word in the text phrases; calculate the average word frequency of each word in the text phrases; normalize the average value to obtain the similarity between the sender nickname and the nickname of the intranet mailbox.

[0167] Method i: Email features include sender nickname and similarity with the internal organization of the enterprise:

[0168] Based on the enterprise internal organization information set, each internal organization is segmented to obtain a phrase set; the word frequency of each word in each phrase in each phrase set is calculated to obtain a word frequency set; the sender nickname of the marked historical email is segmented to obtain a text phrase; the text phrase is used to match the word frequency with the word frequency set to obtain the word frequency of each word in the text phrase; the average word frequency of each word in the text phrase is calculated; the average word frequency is normalized to obtain the similarity between the sender nickname and the enterprise internal organization.

[0169] Method j: Email features include the number of emails sent from the external mailbox in history:

[0170] The number of historical emails sent by a sender mailbox other than the internal mailbox of the enterprise is extracted from the historical log to obtain the number of historical emails sent by the external mailbox.

[0171] For example, a sender mailbox that does not belong to the company's internal mailbox collection is determined to be an external mailbox. Based on the mail gateway historical log within a given time range (such as the past 6 months), the number of historical emails sent by the external mailbox is counted according to the mailbox name.

[0172] Method k, email characteristics include the number of email recipients:

[0173] The number of email recipients is determined based on the number of marked recipient mailboxes of historical emails.

[0174] In practice, when sending a marked historical email, one or more recipients can be selected, and the number of recipient mailboxes of the marked historical email can be used as the number of email recipients.

[0175] Method L, email features include the number of departments corresponding to the email recipients:

[0176] The recipient mailbox name is extracted from the recipient mailbox of the marked historical emails, and the department corresponding to the recipient mailbox is determined based on the recipient mailbox name and the enterprise employee and department mapping information set; the departments corresponding to the recipient mailbox are deduplicated and counted to obtain the number of departments corresponding to the email recipients.

[0177] Method m, email features include the number of emails received by the recipient's department from this sender in the past:

[0178] Extract the recipient's mailbox name from the recipient's mailbox of the marked historical email, and determine the department corresponding to the recipient's mailbox based on the recipient's mailbox name and a set of enterprise employee and department mapping information; count the number of emails received by the department corresponding to the recipient's mailbox from the sender's mailbox of the marked historical email within the target historical time from the historical log.

[0179] Method n, email features include the number of emails the recipient has received from this sender:

[0180] The number of emails received by the mailbox of the recipient of the marked historical email from the mailbox of the sender of the marked historical email is counted from the historical log.

[0181] Method p, email features include the number of recipients' history of receiving emails from external mailboxes:

[0182] Count the number of emails whose sender mailbox is an external mailbox received by the recipient mailbox of the marked historical emails from the historical log.

[0183] Step 203: Based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails, a binary classification model is trained to obtain the phishing email detection model; wherein the tag value of the marked historical email is used to indicate whether the marked historical email is a phishing email.

[0184] During model training, at least one of the email features shown in Table 1 and the tag value of the marked historical emails can be used to train the binary classification model through the extreme gradient boosting (eXtreme Gradient Boosting, XGBoost) algorithm. After the model offline training service completes the training, the trained phishing email detection model file and model dependency files are sent to the model real-time detection service for real-time detection of email gateway logs.

[0185] Figure 3 FIG. 2 is a flow chart of the phishing email detection method provided by an embodiment of the present invention. Figure 3 As shown, the phishing email detection method includes the following steps:

[0186] Step 301: Load the pre-trained phishing email detection model, internal enterprise information related to the enterprise email service, and historical logs of the email gateway;

[0187] When the detection service of the phishing email detection model is started, the phishing email detection model file and the data relied on in the model detection process, such as internal enterprise information, are first loaded into the memory.

[0188] Step 302: Obtain a target log of the mail gateway in real time; the target log includes mail attribute information of N mails, and the N mails include the mail to be detected;

[0189] After the model real-time detection service is started, the target log of the mail gateway is obtained in real time to detect phishing emails.

[0190] Step 303, determine whether the mailbox domain name information of the mail to be detected matches the enterprise internal mailbox domain name set: if the mailbox domain name information of the mail to be detected does not match the enterprise internal mailbox domain name set, go to step 304; if the mailbox domain name information of the mail to be detected matches the enterprise internal mailbox domain name set, exit the phishing mail detection process;

[0191] In practice, after receiving the target log information of the mail gateway, when the mail attribute information of the mail to be detected includes the sender's mail box name, the mail box domain name information of the mail to be detected is determined based on the sender's mail box name of the mail to be detected; the mail box domain name information of the mail to be detected is compared with the internal mail box domain name set of the enterprise to determine whether the mail to be detected is an internal mail; if the mail to be detected is determined to be an internal mail, the phishing mail detection process is directly exited; if the mail to be detected is determined not to be an internal mail, go to step 304 to further determine whether the mail to be detected is a phishing mail.

[0192] Step 304: After the email is determined to be an external email, the email feature of the email to be detected is determined based on the internal information of the enterprise, the historical log and the email attribute information of the email to be detected.

[0193] For example, the email features of the email to be detected are calculated based on the loaded internal enterprise information and the sender nickname, sender email name, email subject, recipient email name, and email attachment information in the email to be detected.

[0194] Step 305: Input the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email type includes phishing emails and non-phishing emails. If the phishing email detection model determines that the email to be detected is a phishing email, go to step 306; if the phishing email detection model determines that the email to be detected is a normal email, exit the phishing email detection process.

[0195] Step 306: Generate a corresponding phishing email warning event and send it to the warning module.

[0196] The phishing email detection method provided by the embodiment of the present invention uses various features extracted from less sensitive attribute information in email information to effectively distinguish whether an email is a disguised internal email; uses various features extracted from less sensitive sender and receiver information and historical email sending and receiving behaviors in email information to distinguish whether an email is an abnormal sending and receiving relationship; only less sensitive attributes in email information are used during feature analysis, effectively ensuring the privacy of the email; because the phishing email detection method based on the phishing email detection model has stronger generalization capabilities, it can be applied to different phishing email variants, can solve the problem of incomplete detection of encrypted compressed attachments by the email sandbox, and solve the problem of incomplete coverage of keyword matching, reduce the probability of missed reports and false positives, and improve the reliability of phishing email detection.

[0197] Figure 4 is a schematic diagram of the structure of a phishing email detection system provided by an embodiment of the present invention. Figure 4 As shown, the phishing email detection system includes: an email gateway log module 401, a model offline training service module 402, a model real-time detection service module 403 and a phishing email warning service module 404, wherein:

[0198] The email gateway log module 401 is a data source for the entire system analysis and detection. Each email log contains the sender's nickname, sender's email address, email subject, recipient's email address, email content, attachment information, etc.

[0199] The model offline training service module 402 trains a model for phishing email detection based on marked historical email log information and internal enterprise information combined with a machine learning algorithm.

[0200] The model real-time detection service module 403 performs real-time anomaly detection on the email gateway log based on the offline trained phishing email detection model, and generates corresponding alarm events for the email logs determined to be phishing emails and sends them to the phishing email alarm service module 404

[0201] The phishing email warning service module 404 receives the warning event sent by the model real-time detection service module 403 and issues a corresponding warning notification.

[0202] The embodiment of the present invention trains a machine learning model based on the email log information of the email enterprise's email gateway and the sending and receiving behavior data between mailboxes, and performs real-time detection of phishing emails through the trained model.

[0203] The phishing email detection device provided by the present invention is described below. The phishing email detection device described below and the phishing email detection method described above can be referenced to each other.

[0204] Figure 5 A schematic diagram of the structure of a phishing email detection device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the phishing email detection device 500 includes: an acquisition module 501, a first determination module 502 and a detection module 503; wherein,

[0205] The acquisition module 501 is used to acquire the pre-trained phishing email detection model, the internal enterprise information related to the enterprise email service, and the email gateway log;

[0206] A first determination module 502 is used to determine the email feature of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0207] The detection module 503 is used to input the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0208] The phishing email detection device provided by the embodiment of the present invention determines the email features of the email to be detected based on the internal information of the enterprise and the email gateway log, and uses the pre-trained phishing email detection model to perform real-time detection of phishing emails to determine whether the email to be detected is a phishing email. Since the phishing email detection model is a binary classification model trained based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails, this makes the method have stronger generalization ability, can be applicable to different phishing email variants, can reduce the probability of missed reports and false alarms, and improve the reliability of phishing email detection.

[0209] Optionally, the email feature includes at least one of the following:

[0210] Features used to distinguish whether an email is a disguised internal email include at least one of the following: whether the email contains attachments, the abnormality level corresponding to the email attachment type, whether the email attachment name contains Chinese characters, the similarity between the email attachment name and the intranet email attachment name, the similarity between the email subject and the intranet email subject, the similarity between the sender's email domain name and the intranet email domain name, the similarity between the sender's email name and the intranet email domain name, the similarity between the sender's nickname and the intranet email nickname, and the similarity between the sender's nickname and the internal organization of the enterprise;

[0211] Features used to distinguish whether the sender-receiver relationship in an email is a normal sender-receiver relationship, including at least one of the following: the number of emails sent from the external mailbox in history, the number of email recipients, the number of departments corresponding to the email recipients, the number of emails received from this sender by the recipient's department in history, the number of emails received from this sender by the recipient in history, and the number of emails received from the sender by the recipient in history from an external mailbox.

[0212] Optionally, the first determining module 502 is specifically configured to perform at least one of the following:

[0213] If the value of the attachment field corresponding to the mail to be detected in the mail gateway log is not empty, it is determined that the mail to be detected contains an attachment; if the value of the attachment field corresponding to the mail to be detected is empty, it is determined that the mail to be detected does not contain an attachment;

[0214] Determine the abnormality level corresponding to the type of the email attachment of the email to be detected based on the file suffix of the email attachment of the email to be detected and the preset correspondence between the file suffix and the abnormality level;

[0215] In the case where the email attachment name of the email to be detected matches a preset regular expression, determining that the email attachment name contains Chinese characters; the regular expression is used to match whether the email attachment name contains Chinese characters; in the case where the email attachment name does not match the preset regular expression, determining that the email attachment name does not contain Chinese characters;

[0216] Extracting the name of the email attachment of at least one historical email whose sender's mailbox is an internal mailbox of the enterprise from the historical log; performing word segmentation on the email attachment name of each of the historical emails to obtain a phrase set; calculating the word frequency of each word in each of the phrase sets to obtain a word frequency set; performing word segmentation on the email attachment name of the email to be detected to obtain a text phrase; performing word frequency matching between the text phrase and the word frequency set to obtain the word frequency of each word in the text phrase; calculating the average of the word frequencies of each word in the text phrase; performing normalization processing on the average to obtain the similarity between the email attachment name and the intranet email attachment name;

[0217] Extract the email subjects of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; segment the email subjects of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; segment the email subject of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average to obtain the similarity between the email subject and the intranet email subject;

[0218] Extracting the sender's mailbox domain name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox domain name and the intranet mailbox domain name;

[0219] Extracting the sender's mailbox name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox name and the intranet mailbox domain name;

[0220] Extract the sender nicknames of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the sender nicknames of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the sender nickname of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; perform normalization processing on the average to obtain the similarity between the sender nickname and the nickname of the intranet mailbox;

[0221] Based on the enterprise internal organization information set, each internal organization is segmented to obtain a phrase set; the word frequency of each word in each phrase in each phrase set is calculated to obtain a word frequency set; the sender nickname of the email to be detected is segmented to obtain a text phrase; the text phrase is used to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; the average word frequency of each word in the text phrase is calculated; the average word frequency is normalized to obtain the similarity between the sender nickname and the enterprise internal organization;

[0222] Extract the number of historical emails sent from the sender's mailbox that is not an internal mailbox of the enterprise from the historical log to obtain the number of historical emails sent from the external mailbox;

[0223] Determine the number of email recipients based on the number of email recipient mailboxes of the email to be detected;

[0224] Extract the recipient mailbox name from the recipient mailbox of the email to be detected, and determine the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; perform deduplication statistics on the departments corresponding to the recipient mailbox to obtain the number of departments corresponding to the email recipient;

[0225] Extracting the recipient mailbox name from the recipient mailbox of the email to be detected, and determining the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; counting the number of emails received by the department corresponding to the recipient mailbox from the sender mailbox of the email to be detected within the target historical time from the historical log;

[0226] Counting the number of emails from the sender's mailbox of the email to be detected that are received by the recipient's mailbox of the email to be detected from the historical log;

[0227] The number of emails whose sender mailbox is an external mailbox and received by the recipient mailbox of the email to be detected is counted from the historical log.

[0228] Optionally, the first determining module 502 is specifically configured to:

[0229] In a case where the email attribute information of the email to be detected includes the sender's email address name, determining the email domain name information of the email to be detected based on the sender's email address name of the email to be detected;

[0230] When the internal enterprise information includes an internal enterprise mailbox domain name set, and the mailbox domain name information of the email to be detected does not match the internal enterprise mailbox domain name set, the email characteristics of the email to be detected are determined based on the internal enterprise information, the email gateway log and the email attribute information of the email to be detected.

[0231] Optionally, the device further comprises:

[0232] An acquisition module, used to acquire marked historical emails and internal information of the enterprise;

[0233] A second determination module is used to determine the email feature corresponding to the marked historical email based on the marked historical email and the internal information of the enterprise;

[0234] A training module, used to perform binary classification model training based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails to obtain the phishing email detection model;

[0235] The marking value of the marked historical email is used to indicate whether the marked historical email is a phishing email.

[0236] Optionally, the enterprise internal information includes at least one of the following:

[0237] Internal organizational information collection of enterprises;

[0238] Enterprise employee and department mapping information collection;

[0239] Internal mailbox collection of the enterprise;

[0240] A collection of corporate internal mailbox domain names.

[0241] Optionally, the email gateway log includes email attribute information of N emails, and the email attribute information includes at least one of the following:

[0242] Sender nickname;

[0243] Sender's email address;

[0244] Recipient's email address;

[0245] Email subject;

[0246] Email attachment name;

[0247] The type of email attachment.

[0248] Figure 6 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 6As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the following method:

[0249] Obtain pre-trained phishing email detection models, internal corporate information related to corporate email services, and email gateway logs;

[0250] Determine the email characteristics of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0251] The email features of the email to be detected are input into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0252] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0253] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following method is implemented:

[0254] Obtain pre-trained phishing email detection models, internal corporate information related to corporate email services, and email gateway logs;

[0255] Determine the email characteristics of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0256] The email features of the email to be detected are input into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0257] In another aspect, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following method is implemented:

[0258] Obtain pre-trained phishing email detection models, internal corporate information related to corporate email services, and email gateway logs;

[0259] Determine the email characteristics of the email to be detected based on the internal information of the enterprise and the email gateway log;

[0260] The email features of the email to be detected are input into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email types include phishing emails and non-phishing emails; the phishing email detection model is obtained by training a binary classification model based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails.

[0261] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0262] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0263] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting phishing emails, characterized in that: include: Obtain pre-trained phishing email detection models, internal corporate information related to corporate email services, and email gateway logs; Determine the email characteristics of the email to be detected based on the internal information of the enterprise and the email gateway log; Inputting the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email type includes phishing emails and non-phishing emails; The phishing email detection model is obtained by training a binary classification model based on email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails; The determining the email feature of the email to be detected based on the internal enterprise information and the email gateway log includes: In the case where the email to be detected includes the sender's email address name, determining the email address domain name information of the email to be detected based on the sender's email address name of the email to be detected; When the internal enterprise information includes an internal enterprise mailbox domain name set, and the mailbox domain name information of the email to be detected does not match the internal enterprise mailbox domain name set, the email characteristics of the email to be detected are determined based on the internal enterprise information, the email gateway log and the email attribute information of the email to be detected.

2. The phishing email detection method according to claim 1, characterized in that: The email features include at least one of the following: Features used to distinguish whether an email is a disguised internal email include at least one of the following: whether the email contains attachments, the abnormality level corresponding to the email attachment type, whether the email attachment name contains Chinese characters, the similarity between the email attachment name and the intranet email attachment name, the similarity between the email subject and the intranet email subject, the similarity between the sender's email domain name and the intranet email domain name, the similarity between the sender's email name and the intranet email domain name, the similarity between the sender's nickname and the intranet email nickname, and the similarity between the sender's nickname and the internal organization of the enterprise; Features used to distinguish whether the sender-receiver relationship in an email is a normal sender-receiver relationship, including at least one of the following: the number of emails sent from the external mailbox in history, the number of email recipients, the number of departments corresponding to the email recipients, the number of emails received from this sender by the recipient's department in history, the number of emails received from this sender by the recipient in history, and the number of emails received from the sender by the recipient in history from an external mailbox.

3. The phishing email detection method according to claim 2, characterized in that: The determining of the email feature of the email to be detected based on the internal enterprise information and the email gateway log includes at least one of the following: If the value of the attachment field corresponding to the mail to be detected in the mail gateway log is not empty, it is determined that the mail to be detected contains an attachment; if the value of the attachment field corresponding to the mail to be detected is empty, it is determined that the mail to be detected does not contain an attachment; Determine the abnormality level corresponding to the type of the email attachment of the email to be detected based on the file suffix of the email attachment of the email to be detected and the preset correspondence between the file suffix and the abnormality level; In the case where the email attachment name of the email to be detected matches a preset regular expression, determining that the email attachment name contains Chinese characters; the regular expression is used to match whether the email attachment name contains Chinese characters; in the case where the email attachment name does not match the preset regular expression, determining that the email attachment name does not contain Chinese characters; Extracting the name of the email attachment of at least one historical email whose sender's mailbox is an internal mailbox of the enterprise from the historical log; performing word segmentation on the email attachment name of each of the historical emails to obtain a phrase set; calculating the word frequency of each word in each of the phrase sets to obtain a word frequency set; performing word segmentation on the email attachment name of the email to be detected to obtain a text phrase; performing word frequency matching between the text phrase and the word frequency set to obtain the word frequency of each word in the text phrase; calculating the average of the word frequencies of each word in the text phrase; performing normalization processing on the average to obtain the similarity between the email attachment name and the intranet email attachment name; Extract the email subjects of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; segment the email subjects of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; segment the email subject of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; normalize the average to obtain the similarity between the email subject and the intranet email subject; Extracting the sender's mailbox domain name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox domain name and the intranet mailbox domain name; Extracting the sender's mailbox name from the sender's mailbox of the email to be detected; determining the similarity between the sender's mailbox name and the intranet mailbox domain name; Extract the sender nicknames of historical emails whose sender mailbox is an internal mailbox of the enterprise from the historical log; perform word segmentation on the sender nicknames of each of the historical emails to obtain a phrase set; calculate the word frequency of the words in each phrase in each of the phrase sets to obtain a word frequency set; perform word segmentation on the sender nickname of the email to be detected to obtain a text phrase; use the text phrase to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; calculate the average word frequency of each word in the text phrase; perform normalization processing on the average to obtain the similarity between the sender nickname and the nickname of the intranet mailbox; Based on the enterprise internal organization information set, each internal organization is segmented to obtain a phrase set; the word frequency of each word in each phrase in each phrase set is calculated to obtain a word frequency set; the sender nickname of the email to be detected is segmented to obtain a text phrase; the text phrase is used to perform word frequency matching with the word frequency set to obtain the word frequency of each word in the text phrase; Calculating the average frequency of each word in the text phrase; performing normalization processing on the average value to obtain the similarity between the sender nickname and the internal organization of the enterprise; Extract the number of historical emails sent from the sender's mailbox that is not an internal mailbox of the enterprise from the historical log to obtain the number of historical emails sent from the external mailbox; Determine the number of email recipients based on the number of email recipient mailboxes of the email to be detected; Extracting a recipient mailbox name from the recipient mailbox of the email to be detected, and determining the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; De-duplicate the departments corresponding to the recipient mailboxes and obtain the number of departments corresponding to the email recipients; Extracting the recipient mailbox name from the recipient mailbox of the email to be detected, and determining the department corresponding to the recipient mailbox based on the recipient mailbox name and the enterprise employee and department mapping information set; counting the number of emails received by the department corresponding to the recipient mailbox from the sender mailbox of the email to be detected within the target historical time from the historical log; Counting the number of emails from the sender's mailbox of the email to be detected that are received by the recipient's mailbox of the email to be detected from the historical log; The number of emails whose sender mailbox is an external mailbox and received by the recipient mailbox of the email to be detected is counted from the historical log.

4. The phishing email detection method according to claim 1, characterized in that: Before obtaining the pre-trained phishing email detection model, the internal enterprise information related to the enterprise mailbox service, and the email gateway log, the method further includes: Obtain marked historical emails and internal information of the enterprise; Based on the marked historical emails and the internal information of the enterprise, determining email features corresponding to the marked historical emails; Based on the email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails, a binary classification model is trained to obtain the phishing email detection model; The marking value of the marked historical email is used to indicate whether the marked historical email is a phishing email.

5. The phishing email detection method according to any one of claims 1 to 4, characterized in that: The enterprise internal information includes at least one of the following: Internal organizational information collection of enterprises; Enterprise employee and department mapping information collection; Internal mailbox collection of the enterprise; A collection of corporate internal mailbox domain names.

6. The phishing email detection method according to any one of claims 1 to 4, characterized in that: The email gateway log includes email attribute information of N emails, and the email attribute information includes at least one of the following: Sender nickname; Sender's email address; Recipient's email address; Email subject; Email attachment name; The type of email attachment.

7. A phishing email detection device, characterized in that: include: An acquisition module is used to obtain a pre-trained phishing email detection model, internal enterprise information related to the enterprise email business, and email gateway logs; A first determination module, configured to determine the email features of the email to be detected based on the internal information of the enterprise and the email gateway log; A detection module, used for inputting the email features of the email to be detected into the phishing email detection model to obtain the email type of the email to be detected output by the phishing email detection model; the email type includes phishing emails and non-phishing emails; The phishing email detection model is obtained by training a binary classification model based on email features corresponding to the marked historical emails and the tag values ​​of the marked historical emails; The first determining module is specifically configured to: In the case where the email to be detected includes the sender's email address name, determining the email address domain name information of the email to be detected based on the sender's email address name of the email to be detected; When the internal enterprise information includes an internal enterprise mailbox domain name set, and the mailbox domain name information of the email to be detected does not match the internal enterprise mailbox domain name set, the email characteristics of the email to be detected are determined based on the internal enterprise information, the email gateway log and the email attribute information of the email to be detected.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the phishing email detection method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the phishing email detection method as described in any one of claims 1 to 6 is implemented.

10. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the phishing email detection method as described in any one of claims 1 to 6.

Images