Method, device, electronic device and storage medium for detecting phishing emails

Abstract

The present application discloses a method for detecting phishing emails, the method comprising: obtaining at least one uniform resource locator (URL) link in a target email, and determining at least one first-level domain name in at least one of the URL links; deleting known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is the intersection of the at least one first-level domain name and a safe domain name set; if the suspicious URL set is not empty, outputting a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link. The present application can improve the accuracy of detecting phishing emails. The present application also discloses a phishing email detection device, an electronic device, and a storage medium, which have the above beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for detecting phishing emails, an electronic device, and a storage medium. Background Art

[0002] Phishing emails typically trick recipients into returning account information, such as account numbers and passwords, or direct them to a specially crafted website. Phishing emails often target websites disguised as legitimate ones, such as banking or financial management websites, to trick users into entering their credit card or bank card numbers, account names, and passwords, leading to theft. Therefore, detecting phishing emails is a key focus for network security professionals.

[0003] In the related art, phishing emails are mainly identified based on the mailbox name and sender IP address. However, since the mailbox name and sender IP address are easy to disguise and change, the accuracy of the above scheme in detecting phishing emails is low.

[0004] Therefore, how to improve the accuracy of detecting phishing emails is a technical problem that those skilled in the art currently need to solve. Summary of the Invention

[0005] The purpose of this application is to provide a method and device for detecting phishing emails, an electronic device and a storage medium, which can improve the accuracy of detecting phishing emails.

[0006] To solve the above technical problems, the present application provides a method for detecting phishing emails, which includes:

[0007] Obtaining at least one uniform resource locator (URL) link in a target email, and determining at least one first-level domain name in at least one of the URL links;

[0008] Deleting known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is an intersection of the at least one first-level domain name and the safe domain name set;

[0009] If the suspicious URL set is not empty, the phishing email detection result is output according to the similarity between the suspicious URL set and the safe URL link.

[0010] Optionally, outputting a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link includes:

[0011] If the similarity between the suspicious URL set and the safe URL link is within a first similarity interval, a detection result indicating that the target email is a phishing email is output.

[0012] Optionally, also include:

[0013] If the similarity between the suspicious URL set and the safe URL link is not within the first similarity interval, characters of the suspicious URL set are replaced to obtain a new suspicious URL set, and the similarity between the new suspicious URL set and the safe URL link is determined to be within the second similarity interval.

[0014] Optionally, also include:

[0015] If the similarity between the new suspicious URL set and the safe URL link is within the second similarity range, a detection result indicating that the target email is a phishing email is output.

[0016] Optionally, performing character replacement on the suspicious URL set to obtain a new suspicious URL set includes:

[0017] The suspicious URL set is subjected to homographic character replacement and / or punycode replacement to obtain the new suspicious URL set.

[0018] Optionally, also include:

[0019] If the similarity between the new suspicious URL set and the safe URL link is not within the second similarity interval, extracting the core keywords of each safe domain name in the safe domain name set;

[0020] Determining whether the suspicious URL set includes the core keyword;

[0021] If so, the target email is determined to be a phishing email.

[0022] Optionally, extracting the core keyword of each secure domain name in the secure domain name set includes:

[0023] The difference between the first-level domain name and the top-level domain name of each security domain name in the security domain name set is extracted as the core keyword.

[0024] Optionally, after determining at least one first-level domain name in at least one of the URL links, the method further includes:

[0025] Remove duplicate segments from the first-level domain name.

[0026] Optionally, also include:

[0027] If the target email is a phishing email, the first-level domain name in the URL link is added to a URL blacklist, and the disguise type of the URL link is marked.

[0028] The present application also provides a device for detecting phishing emails, the device comprising:

[0029] A domain name determination module, configured to obtain at least one uniform resource locator (URL) link in a target email and determine at least one first-level domain name in at least one of the URL links;

[0030] a suspicious URL determination module, configured to delete known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is an intersection of the at least one first-level domain name and the safe domain name set;

[0031] The judgment module is used to output a phishing email detection result according to the similarity between the suspicious URL set and the safe URL link if the suspicious URL set is not empty.

[0032] The present application also provides a storage medium on which a computer program is stored, and when the computer program is executed, the steps of the above-mentioned phishing email detection method are implemented.

[0033] The present application also provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the above-mentioned phishing email detection method are implemented.

[0034] The present application provides a method for detecting phishing emails, comprising: obtaining at least one uniform resource locator (URL) link in a target email, and determining at least one first-level domain name in at least one of the URL links; deleting known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is the intersection of the at least one first-level domain name and a safe domain name set; and if the suspicious URL set is not empty, outputting a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link.

[0035] The present application obtains at least one URL link in the target email, and compares at least one first-level domain name of at least one URL link with a known domain name. Since the page jump of phishing emails is mainly realized through URL links, if the first-level domain name belongs to the safe domain name set, it means that the address corresponding to the URL link is not a tampered web page. If the suspicious URL set is not empty, it means that the URL link contains other domain names outside the safe domain name set, and the safe URL link can continue to be used to judge the similarity between the suspicious URL set and the safe URL link. The present application realizes the detection of phishing emails based on the content of the URL link of the target email, is not affected by changes in the mailbox name and the sender's IP address, can effectively identify disguised phishing emails, and improves the accuracy of detecting phishing emails. The present application also provides a phishing email detection device, an electronic device and a storage medium, which have the above-mentioned beneficial effects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 A flowchart of a method for detecting phishing emails provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of a method for detecting phishing emails based on URL link comparison provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of a keyword-based phishing email detection method provided in an embodiment of the present application;

[0040] Figure 4 A flowchart of a phishing email detection method based on identifying obfuscated URLs provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of the structure of a phishing email detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0043] See below Figure 1 , Figure 1 A flowchart of a method for detecting phishing emails provided in an embodiment of the present application.

[0044] Specific steps may include:

[0045] S101: Obtain at least one URL (Uniform Resource Locator) link in a target email, and determine at least one first-level domain name in the at least one URL link;

[0046] This embodiment can be applied to electronic devices such as firewalls, security integrated devices, and mailbox servers. The target email can be an email of unknown type sent from other terminals. Before obtaining the URL link in the target email, it can be determined whether the target email includes a URL link. If so, the relevant steps of S101 are executed. If not, the target email can be determined to be a normal email.

[0047] The target email may include any number of URL links. After obtaining at least one URL link in the target email, this embodiment can obtain at least one first-level domain name in the at least one URL link. Furthermore, this embodiment can obtain all URL links in the target email and determine all first-level domain names in each URL link to improve the accuracy of phishing email detection. The domain names in the URL link are separated by periods. Counting from right to left, all characters to the right of the first period are the top-level domain name, all characters to the right of the second period are the first-level domain name, and so on. The next-level domain name includes all the contents of the previous-level domain name. For example, in www.abc.def.com, the top-level domain name is .com, the first-level domain name is .def.com, and the second-level domain name is .abc.def.com.

[0048] Furthermore, after determining the first-level domain name in the URL link, repeated segments within the first-level domain name can be removed. Specifically, this embodiment can identify content in the URL link with a number of repeated bytes greater than a preset value as repeated segments. By removing repeated segments, the computational complexity of the phishing email detection process can be reduced, thereby improving the efficiency of phishing email detection.

[0049] S102: Delete at least one known domain name from the first-level domain name to obtain a suspicious URL set;

[0050] After determining the first-level domain name of the URL link, this embodiment can match the first-level domain name with the safe domain name set, and then use the intersection of at least one first-level domain name and the safe domain name set as the known domain name. In this step, the known domain names in all first-level domain names of all URL links can be deleted to obtain a set of suspicious URLs. The safe domain name is a known and safe domain name.

[0051] S103: If the suspicious URL set is empty, the target email is determined to be a normal email;

[0052] Among them, if the suspicious URL set is empty, it means that the first-level domain name of the URL link is a safe domain name and can be safely accessed. At this time, the target email can be determined to be a normal email.

[0053] S104: If the suspicious URL set is not empty, output the phishing email detection result according to the similarity between the suspicious URL set and the safe URL link.

[0054] Among them, if the suspicious URL set is not empty, it means that the security of some content of the first-level domain name of the URL link is unknown. The content in the suspicious URL set can be compared with the safe URL link for similarity, and then the phishing email detection result can be output based on the similarity comparison result.

[0055] Specifically, if the similarity between the suspicious URL set and the safe URL link is high, it means that the content in the first-level domain name other than the known domain name is safe content, and the target email can be determined to be a normal email. If the similarity between the suspicious URL set and the safe URL link is low, it means that the security of the content in the first-level domain name other than the known domain name is unknown. In this case, the target email can be determined to be a phishing email, and character replacement and keyword matching methods can be used to further detect the suspicious URL set. Safe URLs are known safe URLs.

[0056] As a feasible implementation, after detecting that a target email is a phishing email, the first-level domain name in the URL link can be added to a URL blacklist, and the URL link's disguise type can be marked. Specifically, the first-level domain name added to the URL blacklist is the first-level domain name that causes the target email to be identified as a phishing email. These disguise types may include: domain name similarity disguise, domain name character substitution disguise, and domain name keyword disguise. When receiving emails, the URL blacklist can be used to filter emails containing URL links, improving network security.

[0057] This embodiment obtains at least one URL link in the target email, and compares at least one first-level domain name of at least one URL link with a known domain name. Since the page jump of phishing emails is mainly realized through URL links, if the first-level domain name belongs to the safe domain name set, it means that the address corresponding to the URL link is not a tampered web page. If the suspicious URL set is not empty, it means that the URL link contains other domain names outside the safe domain name set, and the safe URL link can continue to be used to judge the similarity between the suspicious URL set and the safe URL link. This embodiment realizes the detection of phishing emails based on the content of the URL link of the target email, is not affected by changes in the mailbox name and the sender's IP address, can effectively identify disguised phishing emails, and improves the accuracy of detecting phishing emails.

[0058] See Figure 2 , Figure 2 This is a flowchart of a method for detecting phishing emails based on URL link comparison provided in an embodiment of the present application. Figure 1Further introduction to the method for detecting phishing emails when the suspicious URL set is not empty in the corresponding embodiment, this embodiment can be compared with Figure 1 Corresponding embodiments are combined to obtain further implementation methods. This embodiment may include the following steps:

[0059] S201: Calculate the similarity between the suspicious URL set and the safe URL link.

[0060] S202: Determine whether the similarity between the suspicious URL set and the safe URL link is within a first similarity interval; if so, proceed to S206; if not, proceed to S203.

[0061] S203: Perform character replacement on the suspicious URL set to obtain a new suspicious URL set.

[0062] S204: Determine whether the similarity between the new suspicious URL set and the safe URL link is within the second similarity interval; if so, proceed to S206; if not, proceed to S205.

[0063] S205: Determine whether the target email is a normal email.

[0064] S206: Determine whether the target email is a phishing email.

[0065] It is understandable that when hackers generate phishing emails, they often disguise them by adding illegal domain names similar to safe domain names to URL links to avoid easy identification by users. Therefore, in the above embodiment, a similarity comparison is first performed between the safe URL links and the suspicious URL set. If the similarity between the suspicious URL set and the safe URL links falls within a first similarity range, a detection result indicating that the target email is a phishing email is output. If the similarity between the suspicious URL set and the safe URL links does not fall within the first similarity range, character replacement is performed on the suspicious URL set to prevent hackers from forging phishing emails through character replacement. Specifically, this embodiment can use punycode (domain name code) to replace characters in the suspicious URL set to obtain the new suspicious URL set. This embodiment can also use homographs to replace characters in the suspicious URL set to obtain the new suspicious URL set. If the similarity between the new suspicious URL set and the safe URL links falls within a second similarity range, a detection result indicating that the target email is a phishing email is output. The first similarity range can be 70% to 95%, and the second similarity range can be 60% to 85%.

[0066] See Figure 3 , Figure 3 This is a flowchart of a keyword-based phishing email detection method provided in an embodiment of the present application. Figure 2For further introduction to the method for identifying phishing emails in the corresponding embodiment, this embodiment can be combined with the corresponding embodiment 2 to obtain a further implementation method. This embodiment may include the following steps:

[0067] S301: If the similarity between the new suspicious URL set and the safe URL link is not within the second similarity range, extract the core keywords of each safe domain name in the safe domain name set;

[0068] After obtaining the suspicious URL set, this embodiment can extract the difference between the first-level domain name and the top-level domain name of each safe domain name in the safe domain name set as the core keyword. To illustrate the above process, for the safe domain name www.abc.com, the difference between the first-level domain name .abc.com and the top-level domain name .com is .abc, and .abc can be used as the core keyword.

[0069] S302: Determine whether the suspicious URL set includes the core keyword; if so, proceed to S303; if not, proceed to S304;

[0070] S303: Determine whether the target email is a phishing email;

[0071] S304: Determine whether the target email is a normal email.

[0072] If the suspicious URL set has a low similarity to the safe URL link, and the similarity between the suspicious URL set and the safe URL link after character replacement is also low, it is possible that hackers have forged phishing emails by adding core keywords. Therefore, this application further determines whether the suspicious URL set contains core keywords, improving the coverage of phishing email detection.

[0073] In related technologies, social engineering, UEBA technology, text binary classification models, etc. are usually used to detect phishing emails. However, the above methods are not able to effectively detect phishing emails with obfuscated URLs carefully constructed by hackers. Currently, there is no such phishing email technology specifically for identifying obfuscated URLs.

[0074] The following is an example of an actual application to illustrate the process described in the above embodiment. Figure 4 , Figure 4This is a flowchart of a phishing email detection method based on identifying obfuscated URLs provided in an embodiment of the present application. This embodiment proposes a method for detecting phishing emails that identify obfuscated URLs to fill the current gap. This embodiment first detects the URL in the email and extracts the first-level domain name from the URL, and determines whether the first-level domain name exists in the well-known domain name set loaded locally (i.e., the safe domain name set). If not, the first-level domain name is used to calculate the similarity with the well-known domain name stored locally (i.e., the safe domain name). If the similarity is high, it is a high-risk phishing email; if the similarity is low, the core keywords (the difference between the first-level domain name and the top-level domain name) are continuously loaded to determine whether the core keywords exist in the URL link of the email. If so, it can be determined as a high-risk phishing email. This embodiment may include the following steps:

[0075] Step 1: Load the user's email log data and check whether there is a URL link in the email body; if so, proceed to step 2; if not, directly determine that the email is a normal email.

[0076] Step 2: De-duplicate the URL links and obtain the corresponding first-level domain name. If the first-level domain name intersects with the well-known domain name set, delete the intersection and the remaining content is the suspicious URL set; if the suspicious URL set is empty, the email is directly judged as a normal email.

[0077] Step 3: The suspicious URL set is traversed one by one, and the similarity between the suspicious URLs and the well-known URLs is calculated. If the similarity is within the upper and lower thresholds, it is determined to be a high-risk phishing email. If it is not within the upper and lower thresholds, the next step of detection is continued.

[0078] Step 4: Replace similar characters in the suspicious URL set one by one using Punycode. Then, calculate the similarity between the replaced suspicious URL set and well-known URLs. If the similarity is within the upper and lower thresholds, it is determined to be a high-risk phishing email. If no high-risk email is found, proceed to the next step of detection.

[0079] Step 5: Load the core keywords of the well-known domain name from the local computer, extract the difference between the first-level domain name and the top-level domain name, and determine whether the keyword exists in the suspicious URL set. If so, it is determined that a phishing email has been detected; otherwise, the email is determined to be a normal email.

[0080] Existing phishing email detection methods do not use the similarity matching calculation between the page content of the URL in the email and the page content of well-known URLs, nor do they use Punycode codes and homographs for replacement, nor do they use the difference between the first-level domain name and the top-level domain name to detect obfuscated URLs. However, many phishing emails currently exist in which hackers use techniques that imitate well-known URLs, including Punycode codes and homographs for replacement, and the placement of keywords from well-known domain names in other locations in the URL to deceive users and cause user account information to be leaked. By identifying such URL obfuscation techniques, this embodiment can prevent such phishing email attacks, thereby protecting users' basic interests from loss.

[0081] See Figure 5 , Figure 5 A schematic diagram of the structure of a phishing email detection device provided in an embodiment of the present application;

[0082] The device may include:

[0083] The domain name determination module 501 is configured to obtain at least one uniform resource locator (URL) link in a target email and determine at least one first-level domain name in at least one of the URL links;

[0084] Suspicious URL determination module 502, configured to delete known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is an intersection of the at least one first-level domain name and the safe domain name set;

[0085] The judgment module 503 is configured to output a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link if the suspicious URL set is not empty.

[0086] This embodiment obtains at least one URL link in the target email, and compares at least one first-level domain name of at least one URL link with a known domain name. Since the page jump of phishing emails is mainly realized through URL links, if the first-level domain name belongs to the safe domain name set, it means that the address corresponding to the URL link is not a tampered web page. If the suspicious URL set is not empty, it means that the URL link contains other domain names outside the safe domain name set, and the safe URL link can continue to be used to judge the similarity between the suspicious URL set and the safe URL link. This embodiment realizes the detection of phishing emails based on the content of the URL link of the target email, is not affected by changes in the mailbox name and the sender's IP address, can effectively identify disguised phishing emails, and improves the accuracy of detecting phishing emails.

[0087] Furthermore, the judgment module 503 is configured to output a detection result that the target email is a phishing email if the similarity between the suspicious URL set and the safe URL link is within a first similarity interval.

[0088] Furthermore, it also includes:

[0089] A character replacement module is used to replace characters in the suspicious URL set to obtain a new suspicious URL set if the similarity between the suspicious URL set and the safe URL link is not within a first similarity interval, and to determine whether the similarity between the new suspicious URL set and the safe URL link is within a second similarity interval.

[0090] Furthermore, it also includes:

[0091] The new set detection module is configured to output a detection result that the target email is a phishing email if the similarity between the new suspicious URL set and the safe URL link is within a second similarity interval.

[0092] Furthermore, the judgment module 503 includes:

[0093] The character replacement unit is used to perform homographic character replacement and / or punycode replacement on the suspicious URL set to obtain the new suspicious URL set.

[0094] Furthermore, it also includes:

[0095] a keyword extraction module, configured to extract core keywords of each safe domain name in the safe domain name set if the similarity between the new suspicious URL set and the safe URL link is not within the second similarity interval;

[0096] The keyword detection module is used to determine whether the suspicious URL set includes the core keyword; if so, determine that the target email is a phishing email.

[0097] Furthermore, the keyword extraction module is used to extract the difference between the first-level domain name and the top-level domain name of each safe domain name in the safe domain name set as the core keyword.

[0098] Furthermore, it also includes:

[0099] The deduplication module is used to remove duplicate segments in the first-level domain name after determining at least one first-level domain name in at least one of the URL links.

[0100] Furthermore, it also includes:

[0101] The blacklist maintenance module is used to add the first-level domain name in the URL link to the URL blacklist if the target email is a phishing email, and mark the disguise type of the URL link.

[0102] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, and they will not be repeated here.

[0103] The present application also provides a storage medium having a computer program stored thereon, which, when executed, can implement the steps provided in the above embodiments. The storage medium may include: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, among other media capable of storing program code.

[0104] The present application also provides an electronic device that may include a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps provided in the above embodiment may be implemented. Of course, the electronic device may also include various network interfaces, a power supply, and other components.

[0105] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method section. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0106] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A method for detecting phishing emails, characterized in that: include: Obtaining at least one uniform resource locator (URL) link in a target email, and determining at least one first-level domain name in at least one of the URL links; Deleting known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is an intersection of the at least one first-level domain name and the safe domain name set; If the suspicious URL set is not empty, outputting the phishing email detection result according to the similarity between the suspicious URL set and the safe URL link; If the similarity between the suspicious URL set and the safe URL link is not within the first similarity interval, characters of the suspicious URL set are replaced to obtain a new suspicious URL set, and the similarity between the new suspicious URL set and the safe URL link is determined to be within the second similarity interval.

2. The method for detecting phishing emails according to claim 1, wherein: Outputting a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link includes: If the similarity between the suspicious URL set and the safe URL link is within a first similarity interval, a detection result indicating that the target email is a phishing email is output.

3. The method for detecting phishing emails according to claim 2, wherein: Also includes: If the similarity between the new suspicious URL set and the safe URL link is within the second similarity interval, a detection result indicating that the target email is a phishing email is output.

4. The method for detecting phishing emails according to claim 1, wherein: Performing character replacement on the suspicious URL set to obtain a new suspicious URL set includes: The suspicious URL set is subjected to homographic character replacement and / or punycode replacement to obtain the new suspicious URL set.

5. The method for detecting phishing emails according to claim 1, wherein: Also includes: If the similarity between the new suspicious URL set and the safe URL link is not within the second similarity interval, extracting the core keywords of each safe domain name in the safe domain name set; Determining whether the suspicious URL set includes the core keyword; If so, the target email is determined to be a phishing email.

6. The method for detecting phishing emails according to claim 5, characterized in that: Extracting the core keywords of each security domain name in the security domain name set includes: The difference between the first-level domain name and the top-level domain name of each security domain name in the security domain name set is extracted as the core keyword.

7. The method for detecting phishing emails according to claim 1, wherein: After determining at least one first-level domain name in at least one of the URL links, the method further includes: Remove duplicate segments from the first-level domain name.

8. The method for detecting phishing emails according to any one of claims 1 to 7, characterized in that: Also includes: If the target email is a phishing email, the first-level domain name in the URL link is added to a URL blacklist, and the disguise type of the URL link is marked.

9. A phishing email detection device, characterized in that: include: a domain name determination module, configured to obtain at least one uniform resource locator (URL) link in a target email and determine at least one first-level domain name in at least one of the URL links; a suspicious URL determination module, configured to delete known domain names from the at least one first-level domain name to obtain a suspicious URL set; wherein the known domain name is an intersection of the at least one first-level domain name and the safe domain name set; a judgment module, configured to output a phishing email detection result based on the similarity between the suspicious URL set and the safe URL link if the suspicious URL set is not empty; A character replacement module is used to replace characters in the suspicious URL set to obtain a new suspicious URL set if the similarity between the suspicious URL set and the safe URL link is not within a first similarity interval, and to determine whether the similarity between the new suspicious URL set and the safe URL link is within a second similarity interval.

10. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the method for detecting phishing emails according to any one of claims 1 to 8 are implemented.

11. A storage medium, characterized in that: The storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the method for detecting phishing emails according to any one of claims 1 to 8.

Images