Email Detection Method and Device, Computer Readable Storage Medium

Abstract

The present disclosure relates to a method and apparatus for email detection, and a computer-readable storage medium. The method includes: parsing an email sample to obtain text information, performing clause segmentation and word segmentation operations on the text information, and extracting multi-level text features; performing a feature fusion operation on the multi-level text features to obtain an email feature fusion vector; extracting the email feature fusion vector to obtain an email feature vector, where the email feature vector is used to represent the interdependent relationship between email sentences; decoding the email feature vector to obtain an email context vector, where the email context vector is used to represent the deep semantic information of the email text; and classifying and predicting the email sample according to the email context vector. The present disclosure can detect phishing emails based on multi-level text features, reducing the false positive rate in the phishing email detection task.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular, to a method and device for email detection, and a computer-readable storage medium. Background Art

[0002] From individuals to enterprises, companies, and even governments, email communication is an efficient and professional way of information transmission for each entity. The content and text of these emails are very likely to contain highly confidential information of high value to the entity. Therefore, the security issue of emails has become increasingly prominent. Among them, phishing emails are a threat worthy of attention, which can use social engineering and technology to steal user identity data and account information to further achieve criminal activities such as money extortion, stealing sensitive data, or infiltrating the intranet system. Summary of the Invention

[0003] The inventors found through research that: the related technology-based phishing email detection method usually only uses text features at the word level as input. However, for text content, features at the character and sentence levels can obtain more key semantic information. Therefore, the existing detection methods for phishing emails have problems such as single feature level and high false positive rate. Therefore, how to extract multi-level features and feature fusion in email samples has become an urgent problem to be solved.

[0004] In view of at least one of the above technical problems, the present disclosure provides a method and device for email detection, and a computer-readable storage medium, which can detect phishing emails based on multi-level text features and reduce the false positive rate in the phishing email detection task.

[0005] According to one aspect of the present disclosure, there is provided a method for email detection, including:

[0006] Parsing an email sample to obtain text information, performing sentence splitting and word segmentation operations on the text information, and extracting multi-level text features;

[0007] Performing a feature fusion operation on the multi-level text features to obtain a mail feature fusion vector;

[0008] Extracting a mail feature vector from the mail feature fusion vector, where the mail feature vector is used to represent the mutual dependence relationship between mail sentences;

[0009] Decoding the mail feature vector to obtain a mail context vector, where the mail context vector is used to represent the deep semantic information of the mail text;

[0010] Classifying and predicting the email sample according to the email context vector. [[ID=3,6]]

[0011] In some embodiments of the present disclosure, the multi-level text features include character-level features, word-level features, and sentence-level features.

[0012] In some embodiments of the present disclosure, the extraction of multi-level text features includes:

[0013] Obtain a character-level feature vector, a word-level feature vector, and a sentence-level feature vector.

[0014] In some embodiments of the present disclosure, the obtaining of the character-level feature vector includes:

[0015] Look up the table for each character of the word segmentation to complete the character vector conversion;

[0016] Obtain the character-level feature vector of each word segmentation through convolutional operation and max pooling operation.

[0017] In some embodiments of the present disclosure, the obtaining of the word-level feature vector includes:

[0018] Obtain the one-hot encoded vector of the word segmentation;

[0019] Construct a word vector matrix centered on the current word segmentation, and multiply the one-hot encoded vector by the word vector matrix to obtain the central word vector;

[0020] Taking the sentence as a unit, add a start-of-sentence marker and an end-of-sentence marker before and after the sentence;

[0021] Concatenate the character-level feature vector and the central word vector;

[0022] Obtain the word-level feature vector of the word sequence based on the pre-trained model.

[0023] In some embodiments of the present disclosure, the obtaining of the sentence-level feature vector includes:

[0024] Perform a pooling operation on the word-level feature vector to obtain the sentence-level feature vector.

[0025] In some embodiments of the present disclosure, the email feature fusion vector includes a first-level feature fusion vector and a second-level feature fusion vector.

[0026] In some embodiments of the present disclosure, the feature fusion operation on the multi-level text features to obtain the email feature fusion vector includes:

[0027] Concatenate the character-level feature vector and the word-level feature vector to obtain the character and word feature matrix of the email sample, and obtain the first-level feature fusion vector through max pooling operation;

[0028] Concatenate the first-level feature fusion vector and the sentence-level feature vector to obtain the second-level feature fusion vector.

[0029] In some embodiments of the present disclosure, the extraction of the mail feature fusion vector to obtain the mail feature vector includes:

[0030] Obtain the forward calculation vector and the backward calculation vector of the second-level feature fusion vector;

[0031] Concatenate the forward calculation vector and the backward calculation vector to obtain the mail feature vector.

[0032] In some embodiments of the present disclosure, the decoding of the mail feature vector to obtain the mail context vector includes:

[0033] Randomly initialize the matrix and the bias value, and map and calculate the alignment model vector of each mail feature vector and the document;

[0034] Calculate the weight of each mail feature vector in the mail document according to the alignment model vector;

[0035] Determine the mail context vector for all mail feature vectors and the weight of each mail feature vector in the mail document.

[0036] In some embodiments of the present disclosure, the classification prediction of the mail sample according to the mail context vector includes:

[0037] Determine the classification prediction value of the mail sample according to the mail context vector;

[0038] Judge whether the classification prediction value of the mail sample is greater than the classification threshold;

[0039] In the case where the classification prediction value of the mail sample is greater than the classification threshold, determine the mail sample as a phishing mail.

[0040] According to another aspect of the present disclosure, there is provided a mail detection device, including:

[0041] A mail multi-level text feature extraction module, configured to parse a mail sample to obtain text information, perform sentence splitting and word segmentation operations on the text information, and extract multi-level text features;

[0042] A multi-level feature fusion module, configured to perform a feature fusion operation on the multi-level text features to obtain a mail feature fusion vector;

[0043] A mail feature extraction module, configured to extract the mail feature fusion vector to obtain a mail feature vector, wherein the mail feature vector is used to represent the mutual dependence relationship between mail sentences;

[0044] A mail feature decoding module, configured to decode the mail feature vector to obtain a mail context vector, wherein the mail context vector is used to represent the deep semantic information of the mail text;

[0045] The phishing email classification module is configured to perform classification prediction on email samples according to the email context vector.

[0046] In some embodiments of the present disclosure, the multi-level text features include character-level features, word-level features, and sentence-level features.

[0047] In some embodiments of the present disclosure, the email multi-level text feature extraction module is configured to obtain a character-level feature vector, a word-level feature vector, and a sentence-level feature vector.

[0048] In some embodiments of the present disclosure, when the email multi-level text feature extraction module obtains the character-level feature vector, it is configured to complete character vector conversion by looking up a table for the characters of each word segmentation; and obtain the character-level feature vector of each word segmentation through convolution operation and max pooling operation.

[0049] In some embodiments of the present disclosure, when the email multi-level text feature extraction module obtains the word-level feature vector, it is configured to obtain the one-hot encoding vector of the word segmentation; construct a word vector matrix centered on the current word segmentation, and multiply the one-hot encoding vector by the word vector matrix to obtain the central word vector; take the sentence as a unit, and add a start-of-sentence marker and an end-of-sentence marker before and after the sentence; splice the character-level feature vector and the central word vector; and obtain the word-level feature vector of the word sequence based on a pre-trained model.

[0050] In some embodiments of the present disclosure, when the email multi-level text feature extraction module obtains the sentence-level feature vector, it is configured to perform a pooling operation on the word-level feature vector to obtain the sentence-level feature vector.

[0051] In some embodiments of the present disclosure, the email feature fusion vector includes a first-level feature fusion vector and a second-level feature fusion vector.

[0052] In some embodiments of the present disclosure, when the multi-level feature fusion module performs feature fusion operation on the multi-level text features to obtain the email feature fusion vector, it is configured to splice the character-level feature vector and the word-level feature vector to obtain the character and word feature matrix of the email sample, and obtain the first-level feature fusion vector through max pooling operation; splice the first-level feature fusion vector and the sentence-level feature vector to obtain the second-level feature fusion vector.

[0053] In some embodiments of the present disclosure, when the email feature extraction module extracts the email feature fusion vector to obtain the email feature vector, it is configured to obtain the forward calculation vector and the backward calculation vector of the second-level feature fusion vector; and splice the forward calculation vector and the backward calculation vector to obtain the email feature vector.

[0054] In some embodiments of the present disclosure, the email feature decoding module, when decoding the email feature vector to obtain the email context vector, is configured to randomly initialize the matrix and the bias value, and map and calculate the alignment model vector of each email feature vector and the document; calculate the weight of each email feature vector in the email document according to the alignment model vector; and determine the email context vector based on all the email feature vectors and the weight of each email feature vector in the email document.

[0055] In some embodiments of the present disclosure, the phishing email classification module, when classifying and predicting phishing emails according to the email context vector, is configured to determine the classification prediction value of the email sample according to the email context vector; judge whether the classification prediction value of the email sample is greater than the classification threshold; and when the classification prediction value of the email sample is greater than the classification threshold, determine the email sample as a phishing email.

[0056] According to another aspect of the present disclosure, there is provided an email detection device, including:

[0057] A memory, configured to store instructions;

[0058] A processor, configured to execute the instructions, so that the email detection device performs operations to implement the email detection method as described in any of the above embodiments.

[0059] According to another aspect of the present disclosure, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the email detection method as described in any of the above embodiments is implemented.

[0060] The present disclosure can detect phishing emails based on multi-level text features, reducing the false positive rate in the phishing email detection task. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0062] Figure 1 It is a schematic diagram of some embodiments of the email detection method of the present disclosure.

[0063] Figure 2 It is a schematic diagram of other embodiments of the email detection method of the present disclosure.

[0064] Figure 3This is the architecture diagram of the NNMBMTF neural network in some embodiments of the present disclosure.

[0065] Figure 4 This is a schematic diagram of feature fusion for multi-level text features in some embodiments of the present disclosure.

[0066] Figure 5 This is a schematic diagram of some embodiments of the email detection device of the present disclosure.

[0067] Figure 6 This is a structural schematic diagram of other embodiments of the email detection device of the present disclosure. Detailed implementation manners

[0068] Next, the technical solutions in the embodiments of the present disclosure will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and in no way limits the present disclosure and its application or use. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts shall fall within the scope of protection of the present disclosure.

[0069] Unless otherwise specifically stated, the relative arrangements of components and steps, numerical expressions, and numerical values set forth in these embodiments do not limit the scope of the present disclosure.

[0070] Meanwhile, it should be understood that, for the sake of description, the sizes of the various parts shown in the accompanying drawings are not drawn in actual proportional relationships.

[0071] For technologies, methods, and devices known to those of ordinary skill in the relevant art, detailed discussions may not be made, but where appropriate, the technologies, methods, and devices should be regarded as part of the authorization specification.

[0072] In all the examples shown and discussed here, any specific value should be construed as merely exemplary, rather than as a limitation. Therefore, other examples of the exemplary embodiments may have different values.

[0073] It should be noted that: like reference numerals and letters denote like items in the following drawings, and thus, once an item is defined in one drawing, further discussion thereof in subsequent drawings is not required.

[0074] Figure 1 This is a schematic diagram of some embodiments of the email detection method of the present disclosure. Figure 2 This is a schematic diagram of other embodiments of the email detection method of the present disclosure. Preferably, this embodiment can be executed by the email detection device of the present disclosure. As Figure 1 and Figure 2As shown, the disclosed email detection method may include at least one of steps 11 to 15, where:

[0075] Step 11: Parse the email sample to obtain text information, perform sentence splitting and word segmentation operations on the text information, and extract multi-level text features.

[0076] In some embodiments of the present disclosure, the email sample may be an unknown external email received in the mailbox, and it is necessary to determine whether there may be a phishing risk in the external email.

[0077] In some embodiments of the present disclosure, the text information may include text contents such as the sender, honorific title, and body text.

[0078] In some embodiments of the present disclosure, the multi-level text features may include character-level features, word-level features, and sentence-level features.

[0079] In some embodiments of the present disclosure, step 11 may include: parsing the email sample to obtain text contents such as the sender, honorific title, and body text, performing sentence splitting and word segmentation operations on the text contents, and respectively obtaining feature extraction work at three levels of characters, words, and sentences.

[0080] In some embodiments of the present disclosure, step 11 may include: using NNMBMTF (Neural Network Model Based on Multi-level Text Features) to implement the extraction of multi-level text features.

[0081] In some embodiments of the present disclosure, as Figure 3 shown, in step 11, the step of extracting multi-level text features may include: obtaining a character-level feature vector (the first-level text feature), a word-level feature vector (the second-level text feature), and a sentence-level feature vector (the third-level text feature).

[0082] Figure 3 This is the NNMBMTF neural network architecture diagram in some embodiments of the present disclosure. As shown in FIGS. 2 and Figure 3 shown, the method for extracting multi-level text features of the present disclosure (for example Figure 1 or Figure 2 step 11 of the embodiment) may include at least one of steps 111 to 115, where:

[0083] Step 111: Parse the email sample, parse the email sample to obtain text contents such as the sender and body text, and perform sentence splitting and word segmentation operations on the text contents.

[0084] In some embodiments of the present disclosure, as Figure 2 andFigure 3 As shown in Figure 3 , step 111 may include: parsing the email sample to obtain text contents such as the sender and the body; segmenting the text contents such as the sender and the body to obtain a sequence of segmented sentences Sentence i , where the sequence of segmented sentences includes n segmented sentences, Sentence i ∈{Sentence1, Sentence2, …, Sentence n}, where i ∈ [1, n], and n is the number of sentences in an email sample; segmenting each segmented sentence in the sequence of segmented sentences to obtain a sequence of segmented words Word ij , where the sequence of segmented words Word ij includes m segmented words, Word ij ∈{Word i1 , Word i2 , …, Word im}, where i ∈ [1, n], j ∈ [1, m], n is the number of sentences in an email sample, and m is the number of segmented words in a sentence.

[0085] Step 112, use CNN (Convolutional Neural Networks) to obtain the expression of character-level feature vectors (the first-level text features).

[0086] In some embodiments of the present disclosure, step 112 includes: performing character look-up table for each segmented word to complete character vector conversion; obtaining the character-level feature vectors of each segmented word through convolution operation and max pooling operation.

[0087] In some embodiments of the present disclosure, as Figure 2 and Figure 3 shown, step 112 may include: performing character look-up table for each segmented word to complete character vector conversion, obtaining the expression of character-level feature vectors of each segmented word through convolution operation and max pooling operation, that is, generating a sequence of character-level feature vector expressions ch ij ∈{ch i1 , ch i2 , …, ch im}, where i ∈ [1, n], j ∈ [1, m], m is the number of segmented words in a sentence, n is the number of sentences in an email sample, and ch ij represents the character-level feature vector of the j-th word in the i-th sentence in an email sample.

[0088] Step 113, obtain the word embedding expression.

[0089] In some embodiments of the present disclosure, step 113 may include: obtaining a one-hot encoding vector of the word segmentation; constructing a word vector matrix centered on the current word segmentation, and multiplying the one-hot encoding vector by the word vector matrix to obtain a central word vector.

[0090] In some embodiments of the present disclosure, as Figure 2 and Figure 3 shown, step 113 may include: obtaining a one-hot encoding vector of the word segmentation, constructing a word vector matrix centered on the current word segmentation based on Word2Vec (word to vector, a related model for generating word vectors), and multiplying the one-hot encoding vector by the word vector matrix to obtain a central word vector representation, that is, the word embedding representation wv of the word segmentation ij ∈{wv i1 ,wv i2 ,…,wv im}, where i ∈ [1, n], j ∈ [1, m], m is the number of word segmentations in a sentence, n is the number of sentences in an email sample, and wv ij represents the word embedding representation of the j-th word in the i-th sentence in an email sample.

[0091] Step 114, using BERT to generate a word-level feature (second-level text feature) vector representation.

[0092] In some embodiments of the present disclosure, step 114 may include: taking the sentence as a unit, adding a start-of-sentence marker and an end-of-sentence marker before and after the sentence; splicing the character-level feature vector and the central word vector; obtaining the word-level feature vector of the word sequence based on a pre-trained model.

[0093] In some embodiments of the present disclosure, as Figure 2 and Figure 3 shown, step 114 may include: taking the sentence as a unit, adding special markers before and after the sentence, where "[CLS]" is the start-of-sentence marker and "[SEP]" is the end-of-sentence marker; splicing the character-level feature vector representation ch ij with the word embedding representation wv ij ; obtaining the word-level feature vector representation of the word sequence based on the BERT (Bidirectional Encoder Representations from Transformer) Base pre-trained model, that is, generating a word-level feature vector representation sequence wd ij ∈{wd i1 ,wd i2 ,…,wd im}, where i ∈ [1, n], j ∈ [1, m], wd ijIt represents the word-level feature vector of the j-th word in the i-th sentence of an email sample.

[0094] Step 115: Perform a pooling operation on the word-level feature vector to obtain a sentence-level feature vector (the third-level text feature).

[0095] In some embodiments of the present disclosure, as Figure 2 and Figure 3 shown, step 115 may include: performing a pooling operation on the word-level feature vector representation to obtain a sentence-level feature vector representation, and then a sequence of sentence-level feature vector representations sent i ∈{sent1, sent2, …, sent n}, where i ∈ [1, n], and n is the number of sentences in an email sample.

[0096] Step 12: Perform a feature fusion operation on the multi-level text features to obtain an email feature fusion vector.

[0097] In some embodiments of the present disclosure, the email feature fusion vector includes a first-level feature fusion vector and a second-level feature fusion vector.

[0098] In some embodiments of the present disclosure, step 12 may be executed by a multi-level feature fusion module. Step 12 aims to better utilize features at different levels, jointly model different features, and improve the performance of the method.

[0099] Figure 4 It is a schematic diagram of feature fusion for multi-level text features in some embodiments of the present disclosure. As Figure 2 and Figure 4 shown, the steps of feature fusion for multi-level text features in the present disclosure (such as Figure 1 or Figure 2 step 12 of the embodiment) may include at least one of step 121 and step 122, where:

[0100] Step 121: First-level feature fusion of the character-level feature vector representation and the word-level feature vector representation.

[0101] In some embodiments of the present disclosure, as Figure 2 and Figure 4 shown, step 121 may include: concatenating the character-level feature vector ch ij representation and the word-level feature vector representation wd ij , obtaining a character and word feature matrix of the email sample, and obtaining a first-level fused feature vector through a max pooling operation.

[0102] Step 122, perform secondary feature fusion of the first-level feature fusion vector and the sentence-level feature vector.

[0103] In some embodiments of the present disclosure, as Figure 2 and Figure 4 shown, step 122 may include: concatenating the first-level feature fusion vector representation and the sentence-level feature vector representation to obtain a secondary feature fusion vector cnt i ∈{cnt1, cnt2, …, cnt n}.

[0104] Step 13, extract the email feature fusion vector to obtain an email feature vector, where the email feature vector is used to represent the interdependence between email sentences.

[0105] In some embodiments of the present disclosure, as Figure 2 shown, step 13 may be performed by an email feature extraction module. Step 13 uses a Bi-LSTM (Bi-directional Long Short-Term Memory) network to complete the email feature extraction operation, aiming to obtain the interdependence between sentences in the email sample and further extract the deep semantic features of the entire email sample.

[0106] In some embodiments of the present disclosure, step 13 may include: respectively obtaining the forward calculation vector and the backward calculation vector of the secondary feature fusion vector sequence, and concatenating the forward calculation vector and the backward calculation vector to obtain a bidirectional calculation vector of the email sample, that is, the email feature vector

[0107] Step 14, decode the email feature vector to obtain an email context vector, where the email context vector is used to represent the deep semantic information of the email text.

[0108] In some embodiments of the present disclosure, as Figure 2 shown, step 14 may be performed by an email feature decoding module. Step 14 may use an attention mechanism to complete the decoding operation of the email feature, aiming to decode the feature information that is more important for prediction from the email feature and prepare for prediction classification.

[0109] In some embodiments of the present disclosure, as Figure 2 shown, step 14 may include at least one of steps 141 to 143, where:

[0110] Step 141, obtain an alignment model vector.

[0111] In some embodiments of the present disclosure, step 141 may include: randomly initializing the matrix W s and the bias value b s , and using the concat mapping to calculate the alignment model vector doc of each email feature vector and the document, which can be specifically obtained by formula (1). i , specifically, it can be obtained by using formula (1).

[0112] doc i = tanh(W s h i + b s ) (1)

[0113] Step 142, calculate the weight of the email feature vector.

[0114] In some embodiments of the present disclosure, step 142 may include: randomly initializing the email document vector doc s , and using formula (2) to calculate the weight of each email feature vector in the email document. The present disclosure believes that the email feature vectors with higher weight values contribute more to the prediction task.

[0115]

[0116] Step 143, obtain the email feature decoding vector.

[0117] In some embodiments of the present disclosure, step 143 may include: performing a weighted sum on all email feature vectors to obtain the email context vector, that is, obtaining the email feature decoding vector. Specifically, it can be obtained by using formula (3).

[0118] u = ∑ i α i h i (3)

[0119] Step 15, classify and predict the email sample according to the email context vector.

[0120] In some embodiments of the present disclosure, step 15 may include: determining the classification prediction value of the email sample according to the email context vector; judging whether the classification prediction value of the email sample is greater than the classification threshold α; in the case where the classification prediction value of the email sample is greater than the classification threshold α, determining the email sample as a phishing email.

[0121] In some embodiments of the present disclosure, step 15 may include: in actual use, by setting the classification threshold α, the original email sample with a classification prediction value greater than α is identified as a phishing email, otherwise it is identified as a normal email.

[0122] In some embodiments of the present disclosure, step 15 may be executed by the phishing email classification module.

[0123] In some embodiments of the present disclosure, the phishing email classification module includes a classification prediction model, wherein the classification prediction model includes a linear connection and a fully connected layer, and finally uses the sigmoid function or the Softmax function to obtain the classification prediction value, and uses the BCE (Binary Cross Entropy) loss function to train the classification prediction model.

[0124] The above embodiments of the present disclosure propose a phishing email detection method based on multi-level text features. The above embodiments of the present disclosure construct a phishing email detection process based on multi-level text features, extract features from email samples at the character level, word level, and sentence level respectively, and perform feature fusion on the three-layer features. At the same time, the above embodiments of the present disclosure convert the phishing email detection task into a text binary classification task, and for the first time propose a neural network model based on multi-level text features, which realizes the extraction and decoding operations of phishing email text features based on Bi-LSTM and the attention mechanism, and finally completes the classification task, thereby reducing the false alarm rate in the phishing email detection task.

[0125] The present disclosure will be described below through specific embodiments.

[0126] Taking an unknown external email received in the mailbox as an example, execute Figure 1 or Figure 2 Steps 11 to 15 of the embodiment, and then determine whether there may be a phishing risk in the external email.

[0127] Step 11: Parse the email sample. Specifically, it includes: parsing the sender information and the body information of the email sample, and performing sentence segmentation and word segmentation operations on the above text information; extracting multi-level text features of the email. Specifically, it includes: obtaining the character-level feature vector expression using CNN, generating the word-level feature vector expression using BERT, and obtaining the sentence-level feature vector expression through pooling operations.

[0128] Step 12: Multi-level feature fusion. Specifically, it includes: concatenating the character-level feature vector expression and the word-level feature vector expression to obtain the character and word feature matrix of the email sample, and obtaining the first-level fused feature vector through max pooling operation; concatenating the first-level feature fusion vector expression and the sentence-level feature vector expression to obtain the second-level feature fusion vector.

[0129] Step 13: Use Bi-LSTM to complete the email feature extraction operation. Specifically, it includes: respectively obtaining the forward calculation vector and the backward calculation vector of the second-level feature fusion vector sequence, and concatenating the forward calculation vector and the backward calculation vector to obtain the bidirectional calculation vector of the email sample, that is, the email feature vector.

[0130] Step 14: Use the Attention mechanism to complete the decoding operation of email features. Specifically, it includes: calculating the alignment model vector for each email feature vector using the concat mapping, calculating the weights of the email feature vectors, and obtaining the email context vector through weighted summation, that is, obtaining the email feature decoding vector.

[0131] Step 15: Classification prediction. Specifically, it includes: after the output head passes through the linear connection and the fully connected layer, the sigmoid function is used to obtain the classification prediction value, and the binary cross-entropy loss function is used for training. In actual use, by setting the classification threshold α, the original email samples with classification prediction values greater than α are identified as phishing emails, otherwise they are identified as normal emails.

[0132] Regarding the problem of single feature level and high false positive rate in the detection method for phishing emails in related technologies, the above embodiments of the present disclosure propose a detection method and device for phishing emails based on multi-level text features. The above embodiments of the present disclosure construct a detection process for phishing emails based on multi-level text features, extract features from email samples at the character level, word level, and sentence level respectively, and perform feature fusion on the three-layer features. At the same time, the above embodiments of the present disclosure convert the phishing email detection task into a text binary classification task, and for the first time propose a neural network model based on multi-level text features, and design a brand-new neural network model for phishing email detection based on multi-level text features, Bi-LSTM, and the Attention mechanism. Among them, Bi-LSTM and the Attention mechanism are used to extract and decode the text features of phishing emails, and finally complete the classification task, thereby reducing the false positive rate in the phishing email detection task.

[0133] Figure 5 It is a schematic diagram of some embodiments of the email detection device of the present disclosure. As Figure 5 shown, the email detection device of the present disclosure may include an email multi-level text feature extraction module 51, a multi-level feature fusion module 52, an email feature extraction module 53, an email feature decoding module 54, and a phishing email classification module 55, where:

[0134] The email multi-level text feature extraction module 51 is configured to parse the email sample to obtain text information, perform sentence splitting and word segmentation operations on the text information, and extract multi-level text features.

[0135] In some embodiments of the present disclosure, the email multi-level text feature extraction module 51 may be configured to obtain an email sample, parse the sample, and perform three-level feature extraction work on the parsed email sample to generate character-level, word-level, and sentence-level features respectively.

[0136] In some embodiments of the present disclosure, the multi-level text feature extraction module 51 may be configured to perform three-level feature extraction on the parsed email samples, generating character-level, word-level, and sentence-level features respectively, including: parsing the email samples, obtaining the character-level feature vector representation using a convolutional neural network, generating the word-level feature vector representation using BERT, and obtaining the sentence-level feature vector representation through a pooling operation.

[0137] In some embodiments of the present disclosure, the multi-level text features may include character-level features, word-level features, and sentence-level features.

[0138] In some embodiments of the present disclosure, the multi-level text feature extraction module 51 may be configured to obtain character-level feature vectors, word-level feature vectors, and sentence-level feature vectors.

[0139] In some embodiments of the present disclosure, when the multi-level text feature extraction module 51 obtains the character-level feature vectors, it may be configured to complete the character vector conversion by looking up the table for each tokenized character; obtain the character-level feature vectors for each token through convolutional operations and max pooling operations.

[0140] In some embodiments of the present disclosure, when the multi-level text feature extraction module 51 obtains the word-level feature vectors, it may be configured to obtain the one-hot encoded vector of the token; construct a word vector matrix centered on the current token, multiply the one-hot encoded vector by the word vector matrix to obtain the central word vector; add a start-of-sentence marker and an end-of-sentence marker at the beginning and end of the sentence respectively; concatenate the character-level feature vectors and the central word vector; obtain the word-level feature vectors of the word sequence based on a pre-trained model.

[0141] In some embodiments of the present disclosure, when the multi-level text feature extraction module 51 obtains the sentence-level feature vectors, it may be configured to perform a pooling operation on the word-level feature vectors to obtain the sentence-level feature vectors.

[0142] The multi-level feature fusion module 52 is configured to perform a feature fusion operation on the multi-level text features to obtain the email feature fusion vector.

[0143] In some embodiments of the present disclosure, the email feature fusion vector may include a first-level feature fusion vector and a second-level feature fusion vector.

[0144] In some embodiments of the present disclosure, the multi-level feature fusion module 52 may be configured to perform a secondary fusion operation on the three-level features in order to better utilize the features of different levels, jointly model different features, and improve the performance of the present method.

[0145] In some embodiments of the present disclosure, the multi-level feature fusion module 52 may be configured to better utilize features at different levels, jointly model different features, and improve the performance of the present method, including: the first-level feature fusion of the character-level feature vector representation and the word-level feature vector representation, and the second-level feature fusion of the first-level feature fusion vector and the sentence-level feature vector representation.

[0146] In some embodiments of the present disclosure, when the multi-level feature fusion module 52 performs a feature fusion operation on multi-level text features to obtain a mail feature fusion vector, it may be configured to splice the character-level feature vector and the word-level feature vector to obtain a character and word feature matrix of the mail sample, and obtain a first-level feature fusion vector through a max pooling operation; splice the first-level feature fusion vector and the sentence-level feature vector to obtain a second-level feature fusion vector.

[0147] The mail feature extraction module 53 is configured to extract a mail feature vector from the mail feature fusion vector, where the mail feature vector is used to represent the interdependence between mail sentences.

[0148] In some embodiments of the present disclosure, the mail feature extraction module 53 may be configured to use a Bi-LSTM to complete the mail feature extraction operation, aiming to obtain the interdependence between sentences in the mail sample, further extract the deep semantic features of the entire mail sample, and generate a mail feature vector.

[0149] In some embodiments of the present disclosure, when the mail feature extraction module 53 extracts a mail feature vector from the mail feature fusion vector, it may be configured to obtain the forward calculation vector and the backward calculation vector of the second-level feature fusion vector; splice the forward calculation vector and the backward calculation vector to obtain the mail feature vector.

[0150] The mail feature decoding module 54 is configured to decode the mail feature vector to obtain a mail context vector, where the mail context vector is used to represent the deep semantic information of the mail text.

[0151] In some embodiments of the present disclosure, the mail feature decoding module 54 may be configured to use an Attention mechanism to complete the decoding operation of the mail feature, aiming to decode the feature information that is more important for prediction from the mail feature, generate a mail feature decoding vector, and prepare for prediction classification.

[0152] In some embodiments of the present disclosure, the email feature decoding module 54, when decoding the email feature vector to obtain the email context vector, may be configured to randomly initialize the matrix and bias value, and map and calculate the alignment model vector of each email feature vector and the document; calculate the weight of each email feature vector in the email document according to the alignment model vector; determine the email context vector for all email feature vectors and the weight of each email feature vector in the email document.

[0153] The phishing email classification module 55 is configured to perform classification prediction on the email sample according to the email context vector.

[0154] In some embodiments of the present disclosure, the phishing email classification module 55 may be configured to use the sigmoid function for classification operation to determine whether the original email sample is a phishing email.

[0155] In some embodiments of the present disclosure, the phishing email classification module 55, when performing classification prediction on the phishing email according to the email context vector, may be configured to determine the classification prediction value of the email sample according to the email context vector; determine whether the classification prediction value of the email sample is greater than the classification threshold; in the case where the classification prediction value of the email sample is greater than the classification threshold, determine the email sample as a phishing email.

[0156] To solve the problems of single feature level and high false positive rate in phishing email detection in related technologies, the above embodiments of the present disclosure propose a phishing email detection device based on multi-level text features, and for the first time propose a neural network model based on multi-level text features. The email detection device of the above embodiments of the present disclosure includes 5 modules: email multi-level text feature extraction, multi-level feature fusion module, email feature extraction module, email feature decoding module, phishing email classification module.

[0157] The above embodiments of the present disclosure first parse the email sample to obtain text contents such as the sender, honorific title, and body text, and perform sentence splitting and word segmentation operations on the text contents to respectively obtain feature extraction work at the character, word, and sentence three levels; the above embodiments of the present disclosure perform feature fusion operation on the three-level features to obtain an email feature vector expression sequence with character, word, and sentence three-level features; the above embodiments of the present disclosure use Bi-LSTM to extract email features to obtain the mutual dependence relationship between email sentences; the above embodiments of the present disclosure perform feature decoding based on the attention mechanism to obtain the deep semantic information of the email text; the above embodiments of the present disclosure finally use the sigmoid function to complete the phishing email classification task.

[0158] Figure 6 It is a structural schematic diagram of another embodiment of the email detection device of the present disclosure. As Figure 6As shown, the disclosed email detection device may include a memory 61 and a processor 62.

[0159] The memory 61 is used to store instructions. The processor 62 is coupled to the memory 61 and is configured to execute, based on the instructions stored in the memory, the email detection method as described in any of the above embodiments (e.g., Figure 2 or Figure 3 an embodiment).

[0160] As Figure 6 shown, the email detection device further includes a communication interface 63 for information interaction with other devices. At the same time, the email detection device further includes a bus 64, through which the processor 62, the communication interface 63, and the memory 61 complete their mutual communication.

[0161] The memory 61 may include a high-speed RAM memory and may also include a non-volatile memory (Non-volatile Memory), such as at least one disk memory. The memory 61 may also be a memory array. The memory 61 may also be partitioned, and the partitions may be combined into virtual volumes according to certain rules.

[0162] In addition, the processor 62 may be a central processing unit CPU, or may be an application-specific integrated circuit ASIC, or may be one or more integrated circuits configured to implement the embodiments of the present disclosure.

[0163] The technical problem of the related art is that: in the related art, the detection method of phishing emails has problems such as a single feature level and a high false alarm rate. Therefore, how to extract multi-level features and feature fusion in email samples has become an urgent problem to be solved.

[0164] The above embodiments of the present disclosure propose a phishing email detection device based on multi-level text features. The above embodiments of the present disclosure construct a phishing email detection process based on multi-level text features, extract features from email samples at the character level, word level, and sentence level respectively, and perform feature fusion on the three-layer features. At the same time, the above embodiments of the present disclosure convert the phishing email detection task into a text binary classification task, and for the first time propose a neural network model based on multi-level text features, and implement the extraction and decoding operations of phishing email text features based on Bi-LSTM and attention mechanism, and finally complete the classification task, thereby reducing the false alarm rate in the phishing email detection task.

[0165] According to another aspect of the present disclosure, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the email detection method as described in any of the above embodiments (e.g., Figures 1 to 4 any embodiment) is implemented.

[0166] In some embodiments of the present disclosure, the computer-readable storage medium may be a non-transitory computer-readable storage medium.

[0167] The above embodiments of the present disclosure belong to the technical field of phishing email detection in network and information security.

[0168] The above embodiments of the present disclosure provide a phishing email detection method and device based on multi-level text features. The above embodiments of the present disclosure construct a phishing email detection process based on multi-level text features, extract features from email samples at the character level, word level, and sentence level respectively, and perform feature fusion on the three-layer features to obtain semantic information of email samples in more dimensions and improve the detection accuracy.

[0169] The above embodiments of the present disclosure can obtain multi-level text features of email samples, obtain more key semantic information from the three levels of characters, words, and sentences, and solve the problem of single input features in the original phishing email detection method.

[0170] The above embodiments of the present disclosure propose a phishing email detection method and device based on multi-level text features. The above embodiments of the present disclosure construct a phishing email detection process based on multi-level text features, extract features from email samples at the character level, word level, and sentence level respectively, and perform feature fusion on the three-layer features to obtain the semantic features of email samples to the greatest extent.

[0171] The above embodiments of the present disclosure convert the phishing email detection task into a text binary classification task, and for the first time propose a neural network model based on multi-level text features, which ensures the detection accuracy of phishing emails and reduces the false positive rate.

[0172] The above embodiments of the present disclosure have the ability to detect malicious phishing emails in a timely manner, avoiding or reducing losses.

[0173] When detecting phishing emails in the above embodiments of the present disclosure, it is necessary to extract multi-layer features from the body text to reduce the false positive rate.

[0174] Through the solution of the above embodiments of the present disclosure, malicious phishing emails can be accurately predicted, malicious phishing behaviors can be captured in a timely manner, virus emails in the email system can be intercepted, and losses can be effectively avoided or reduced.

[0175] The above embodiments of the present disclosure meet the access control requirements for email security in the network security level protection system 2.0.

[0176] Those skilled in the art should understand that the embodiments of the present disclosure may be provided as a method, an apparatus, or a computer program product. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transitory storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) that contain computer-usable program code.

[0177] The present disclosure is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for realizing the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or the combination of blocks.

[0178] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device that realizes the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or the combination of blocks.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for realizing the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or the combination of blocks.

[0180] The email detection device, multi-level text feature extraction module, multi-level feature fusion module, email feature extraction module, email feature decoding module, and phishing email classification module described above can be implemented as a general-purpose processor, programmable logic controller (PLC), digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or any suitable combination thereof for performing the functions described in this application.

[0181] So far, the present disclosure has been described in detail. To avoid obscuring the concept of the present disclosure, some details well known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0182] Those of ordinary skill in the art can understand that all or part of the steps for implementing the above embodiments can be completed by hardware or by a program instructing relevant hardware. The program can be stored in a non-transitory computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk, an optical disc, or the like.

[0183] The description of the present disclosure is given for purposes of illustration and description, and is not intended to be exhaustive or to limit the present disclosure to the disclosed form. Many modifications and variations are obvious to those of ordinary skill in the art. The embodiments were chosen and described in order to best explain the principles of the present disclosure and its practical application, and to enable those of ordinary skill in the art to understand the present disclosure so as to design various embodiments with various modifications suitable for a particular purpose.

Claims

1. A mail detection method, comprising: Parsing a mail sample to obtain text information, performing sentence splitting and word segmentation operations on the text information, and extracting multi-level text features, wherein the multi-level text features include character-level features, word-level features, and sentence-level features; Performing a feature fusion operation on the multi-level text features to obtain a mail feature fusion vector, including: concatenating the character-level feature vector and the word-level feature vector to obtain a character and word feature matrix of the mail sample, performing a max pooling operation to obtain a first-level feature fusion vector, and concatenating the first-level feature fusion vector and the sentence-level feature vector to obtain a second-level feature fusion vector, wherein the mail feature fusion vector includes the first-level feature fusion vector and the second-level feature fusion vector; Extracting the mail feature fusion vector to obtain a mail feature vector, including: obtaining a forward calculation vector and a backward calculation vector of the second-level feature fusion vector, and concatenating the forward calculation vector and the backward calculation vector to obtain a mail feature vector, wherein the mail feature vector is used to represent the mutual dependence relationship between mail sentences; Decoding the mail feature vector to obtain a mail context vector, including: calculating an alignment model vector of each mail feature vector and the mail document, calculating the weight of each mail feature vector in the mail document according to the alignment model vector, and determining the mail context vector according to all the mail feature vectors and the weight of each mail feature vector in the mail document, wherein the mail context vector is used to represent the deep semantic information of the mail text; Performing classification prediction on the mail sample according to the mail context vector.

2. The email detection method according to claim 1, wherein The extracting of the multi-level text features includes: Obtaining a character-level feature vector, a word-level feature vector, and a sentence-level feature vector.

3. The email detection method according to claim 2, wherein, The obtaining of the character-level feature vector includes: Completing character vector conversion by looking up a table for the characters of each segmented word; Obtaining the character-level feature vector of each segmented word through a convolution operation and a max pooling operation.

4. The email detection method according to claim 2, wherein, The obtaining of the word-level feature vector includes: Obtaining a one-hot encoding vector of the segmented word; Constructing a word vector matrix centered on the current segmented word, and multiplying the one-hot encoding vector by the word vector matrix to obtain a central word vector; Taking the sentence as a unit, adding a sentence start marker and a sentence end marker before and after the sentence; Concatenating the character-level feature vector and the central word vector; Obtaining the word-level feature vector of the word sequence based on a pre-trained model.

5. The email detection method according to claim 2, wherein, The obtaining of the sentence-level feature vector includes: Performing a pooling operation on the word-level feature vector to obtain a sentence-level feature vector.

6. The email detection method according to any one of claims 1-5, wherein, The decoding of the mail feature vector to obtain a mail context vector includes: Randomly initializing a matrix and a bias value, and mapping and calculating an alignment model vector of each mail feature vector and the document; Calculating the weight of each mail feature vector in the mail document according to the alignment model vector; Determining the mail context vector for all the mail feature vectors and the weight of each mail feature vector in the mail document.

7. The email detection method according to any one of claims 1-5, wherein, The performing of classification prediction on the mail sample according to the mail context vector includes: Determining a classification prediction value of the mail sample according to the mail context vector; Judging whether the classification prediction value of the mail sample is greater than a classification threshold; When the classification prediction value of the email sample is greater than the classification threshold, the email sample is determined as a phishing email.

8. An email detection device, comprising: An email multi-level text feature extraction module, configured to parse the email sample to obtain text information, perform sentence splitting and word segmentation operations on the text information, and extract multi-level text features, where the multi-level text features include character-level features, word-level features, and sentence-level features; A multi-level feature fusion module, configured to perform feature fusion operations on the multi-level text features to obtain an email feature fusion vector, including: concatenating the character-level feature vector and the word-level feature vector to obtain a character and word feature matrix of the email sample, performing a max pooling operation to obtain a first-level feature fusion vector, and concatenating the first-level feature fusion vector and the sentence-level feature vector to obtain a second-level feature fusion vector, where the email feature fusion vector includes the first-level feature fusion vector and the second-level feature fusion vector; An email feature extraction module, configured to extract the email feature fusion vector to obtain an email feature vector, including: obtaining a forward calculation vector and a backward calculation vector of the second-level feature fusion vector, and concatenating the forward calculation vector and the backward calculation vector to obtain the email feature vector, where the email feature vector is used to represent the mutual dependence relationship between email sentences; An email feature decoding module, configured to decode the email feature vector to obtain an email context vector, including: calculating the alignment model vector of each email feature vector and the email document, calculating the weight of each email feature vector in the email document according to the alignment model vector, and determining the email context vector according to all email feature vectors and the weight of each email feature vector in the email document, where the email context vector is used to represent the deep semantic information of the email text; A phishing email classification module, configured to classify and predict the email sample according to the email context vector.

9. The email detection device according to claim 8, wherein: The email multi-level text feature extraction module is configured to obtain a character-level feature vector, a word-level feature vector, and a sentence-level feature vector.

10. The email detection device according to claim 9, wherein: The email multi-level text feature extraction module, when obtaining the character-level feature vector, is configured to complete character vector conversion by looking up a table for each segmented character; and obtain the character-level feature vector of each segmented character through a convolution operation and a max pooling operation.

11. The email detection device according to claim 10, wherein: The email multi-level text feature extraction module, when obtaining the word-level feature vector, is configured to obtain a one-hot encoding vector of the segmented word; construct a word vector matrix centered on the current segmented word, multiply the one-hot encoding vector by the word vector matrix to obtain a central word vector; add a sentence start marker and a sentence end marker before and after the sentence in units of sentences; Concatenate the character-level feature vector and the central word vector; and obtain the word-level feature vector of the word sequence based on a pre-trained model.

12. The email detection device according to claim 10, wherein: The multi-level text feature extraction module of the email is configured to perform a pooling operation on the word-level feature vectors to obtain sentence-level feature vectors when obtaining sentence-level feature vectors.

13. The email detection device according to any one of claims 8-12, wherein: The email feature decoding module, when decoding the email feature vectors to obtain email context vectors, is configured to randomly initialize the matrix and bias values, and map and calculate the alignment model vectors of each email feature vector and the document; calculate the weights of each email feature vector in the email document according to the alignment model vectors; determine the email context vectors for all email feature vectors and the weights of each email feature vector in the email document.

14. The email detection device according to any one of claims 8-12, wherein: The phishing email classification module, when classifying and predicting phishing emails according to the email context vectors, is configured to determine the classification prediction value of the email sample according to the email context vectors; Judge whether the classification prediction value of the email sample is greater than the classification threshold; If the classification prediction value of the email sample is greater than the classification threshold, determine the email sample as a phishing email.

15. An email detection device, comprising: A memory configured to store instructions; A processor configured to execute the instructions, so that the email detection device performs operations to implement the email detection method according to any one of claims 1-7.

16. A computer-readable storage medium, wherein, The computer-readable storage medium stores computer instructions, and when the instructions are executed by the processor, the email detection method according to any one of claims 1-7 is implemented.

Images