Mail attachment processing method and device

Abstract

The present invention provides a method and device for processing mail attachments, the method comprising: obtaining a first sub-packet when a transmission message corresponding to a mail includes multiple sub-packets; determining an abnormal judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length; and caching the first sub-packet and the second sub-packet to a preset sub-packet cache unit when the first sub-packet is an abnormal sub-packet. The method of the present invention reduces the occupancy of device memory by judging the abnormality of the first sub-packet and only adding the abnormal sub-packet and its subsequent sub-packets to the sub-packet cache unit, can maintain the stability of terminal operation during multiple sessions, and improves the detection efficiency of attachments.

Description

Technical Field

[0001] The present invention relates to the technical field of mail processing, and in particular to a mail attachment processing method and device. Background Art

[0002] Email is an important tool for users to communicate at work, and malicious attacks on email are becoming more and more frequent. Emails usually spread viruses through attachments.

[0003] Related technologies usually identify the suffix of the email attachment name or the attachment content to determine the file type, but it cannot be correctly identified if the file name is tampered with. When identifying the attachment content, the entire email needs to be cached. If the attachment is too large, more device memory needs to be called, causing the device to run slowly. When there are many sessions, it is difficult to achieve the expected detection effect, resulting in missed detection. Summary of the invention

[0004] The present invention provides a method and device for processing email attachments, which are used to solve the problem that the existing technology caches all the attachment contents of larger attachments to detect the attachment type, resulting in slow device operation, serious waste of system space, and easy missed detection when there are many sessions, thereby improving the stability of device operation and the efficiency of email attachment detection.

[0005] The present invention provides a mail attachment processing method, comprising:

[0006] In the case where the transmission message corresponding to the email attachment includes multiple subpackets, obtaining a first subpacket, the first subpacket includes at least one of a file name subpacket, a content subpacket, and a type feature subpacket of the email attachment, the type feature subpacket is used to identify the type of the email attachment, and the multiple subpackets are arranged in a preset order;

[0007] Determine an abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length;

[0008] In the case that the first subpacket is an abnormal subpacket, the first subpacket and the second subpacket are cached in a preset subpacket cache unit, and the second subpacket is a subpacket located after a corresponding position of the first subpacket among the multiple subpackets.

[0009] According to a mail attachment processing method provided by the present invention, the first sub-packet includes the file name sub-packet, and the abnormality judgment result of the first sub-packet is determined based on the data length of the first sub-packet and a preset data length threshold, including:

[0010] When the data length of the file name sub-packet is less than a preset first data length, it is determined that the file name sub-packet is an abnormal sub-packet.

[0011] According to a mail attachment processing method provided by the present invention, the first sub-packet includes the file name sub-packet and the content sub-packet, and the abnormality judgment result of the first sub-packet is determined based on the data length of the first sub-packet and a preset data length threshold, and further includes:

[0012] When the file name subpacket is a normal subpacket and the data length of the content subpacket is less than a preset second data length, it is determined that the content subpacket is an abnormal subpacket.

[0013] According to a mail attachment processing method provided by the present invention, the first sub-packaging includes the file name sub-packaging, the content sub-packaging and the type feature sub-packaging, and the abnormality judgment result of the first sub-packaging is determined based on the data length of the first sub-packaging and a preset data length threshold, and further includes:

[0014] In the case that the file name sub-packaging and the content sub-packaging are both normal sub-packaging, parsing the type feature sub-packaging to obtain a parsing result;

[0015] When the data length of the parsing result is less than the third data length and the type of the email attachment is not obtained, it is determined that the type feature sub-packaging is an abnormal sub-packaging.

[0016] According to a mail attachment processing method provided by the present invention, the sub-packet cache unit includes a pointer and a storage space, and the step of caching the first sub-packet and the second sub-packet into a preset sub-packet cache unit includes:

[0017] Establishing an association between the pointer and the abnormal subpacket;

[0018] Based on the association, the abnormal subpacket and a second subpacket corresponding to the abnormal subpacket are sent to a storage space corresponding to the pointer.

[0019] According to a mail attachment processing method provided by the present invention, after caching the first sub-packet and the second sub-packet in a preset sub-packet caching unit, the method further includes:

[0020] When the type of the mail attachment is obtained, the cache content of the sub-packetization cache unit is cleared.

[0021] The present invention also provides a mail attachment processing device, comprising:

[0022] an acquisition module, configured to acquire a first sub-packet when a transmission message corresponding to an email attachment includes multiple sub-packets, wherein the first sub-packet includes at least one of a file name sub-packet, a content sub-packet, and a type feature sub-packet of the email attachment, wherein the type feature sub-packet is used to identify a type of the email attachment, and the multiple sub-packets are arranged in a preset order;

[0023] A judgment module, used for determining an abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length;

[0024] A cache module is used to cache the first subpacket and the second subpacket to a preset subpacket cache unit when the first subpacket is an abnormal subpacket, and the second subpacket is a subpacket located after the corresponding position of the first subpacket among the multiple subpackets.

[0025] According to a mail attachment processing device provided by the present invention, the device also includes:

[0026] The processing module is used for clearing the cache content of the sub-packet cache unit after caching the first sub-packet and the second sub-packet in the preset sub-packet cache unit and obtaining the type of the email attachment.

[0027] The present invention also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned mail attachment processing methods is implemented.

[0028] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for processing mail attachments as described above is implemented.

[0029] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned methods for processing mail attachments.

[0030] The email attachment processing method and device provided by the present invention reduce the memory usage of the device by judging the abnormal situation of the first subpacket and only adding the abnormal subpacket and its subsequent subpackets to the subpacket cache unit, can maintain the stability of terminal operation in multiple sessions, and improve the detection efficiency of attachments. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 This is one of the flow charts of the method for processing email attachments provided by the present invention;

[0033] Figure 2 This is the second flow chart of the method for processing email attachments provided by the present invention;

[0034] Figure 3 It is a structural schematic diagram of the mail attachment processing device provided by the present invention;

[0035] Figure 4 It is a schematic diagram of the physical structure of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Combine the following Figure 1-Figure 3 The present invention describes a mail attachment processing method and device.

[0038] Figure 1 FIG. 1 is one of the flow charts of the method for processing mail attachments provided by the present invention, such as Figure 1 As shown, the present invention provides a method for processing mail attachments, comprising the following steps:

[0039] Step 110: When the transmission message corresponding to the email attachment includes multiple subpackets, obtain a first subpacket, the first subpacket includes at least one of a file name subpacket, a content subpacket, and a type feature subpacket of the email attachment, the type feature subpacket is used to identify the type of the email attachment, and the multiple subpackets are arranged in a preset order.

[0040] In this step, the email can transmit the message in packets through the email transmission protocol, that is, the attachment identifier, attachment name and attachment content are packetized and sent to the receiving end in a preset order.

[0041] It should be noted that the method for identifying the type of email attachment can be implemented through the following steps: find the encoding format of the attachment (for example, the identifier is "Content-Transfer-Encoding", the encoding format is "base64") and the attachment identifier (for example, the attachment identifier is "Content-Disposition: attachment") through a specific identifier in the email, the attachment identifier will be followed by an attachment name keyword (for example, "filename"), the attachment name keyword will be followed by the attachment name, the attachment name will be followed by the starting position of the attachment, and the attachment content after the starting position will be decoded, and the decoded content will be sent to the file identification interface for detection, so as to identify the attachment type.

[0042] In this embodiment, the first subpacket can be a subpacket, for example, the file name subpacket, content subpacket and type feature subpacket of the email attachment are sent in a preset order. When there is no abnormality in the file name subpacket and the content subpacket, only the type feature subpacket is judged, and the feature subpacket and subsequent messages are cached.

[0043] In this embodiment, the first subpacket can be multiple subpackets. For example, the first subpacket includes a file name subpacket, a content subpacket and a type feature subpacket. Each subpacket is sent in a preset order. When the file name subpacket is an abnormal subpacket, it is necessary to detect the multiple subpackets sent in sequence.

[0044] Step 120: Determine an abnormality judgment result of the first subpacket based on the data length of the first subpacket and a preset data length.

[0045] In this step, the preset data length can be set according to user requirements.

[0046] In this step, when the first sub-packet includes multiple sub-packets, the data lengths referenced by different sub-packets are all different.

[0047] In this step, the abnormality judgment result of the first sub-packet includes whether the first sub-packet is a normal sub-packet or an abnormal sub-packet.

[0048] In this embodiment, the position of the starting characters of the first sub-packet is first determined. If the first sub-packet truncates the attachment name keyword of the message, for example, filename=", or truncates the attachment name, it is impossible to determine the type of the attachment by obtaining the attachment name keyword or the attachment name. In this case, the first sub-packet is determined to be an abnormal sub-packet.

[0049] Figure 2 This is a second flow chart of the method for processing email attachments provided by the present invention. Figure 2 In the illustrated embodiment, when the file name subpackaging, content subpackaging and type feature subpackaging of the email attachment are all normal subpackaging, the result of the attachment row can be directly determined based on the above multiple first subpackagings without caching the first subpackagings.

[0050] Step 130: When the first subpacket is an abnormal subpacket, cache the first subpacket and the second subpacket in a preset subpacket cache unit, wherein the second subpacket is a subpacket located after a corresponding position of the first subpacket among the multiple subpackets.

[0051] In this step, if the first sub-packet is detected as an abnormal sub-packet, it means that the attachment file type cannot be detected based on the current first sub-packet. It is necessary to cache the first sub-packet and subsequent sub-packets after the first sub-packet to ensure that the cache content includes type feature information, which is used to detect the attachment type.

[0052] In this embodiment, when the first subpacket includes multiple subpackets, for example, the first subpacket includes a file name subpacket, a content subpacket, and a type feature subpacket, no matter which subpacket has a problem, the subpacket and its subsequent subpackets are all cached.

[0053] An embodiment of the present invention provides a method for processing email attachments. By judging the abnormal situation of the first subpacket and only adding the abnormal subpacket and its subsequent subpackets to the subpacket cache unit, the device memory occupancy is reduced, the stability of the terminal operation can be maintained during multiple sessions, and the efficiency of attachment detection is improved.

[0054] In some embodiments, the first subpacket includes a file name subpacket, and based on the data length of the first subpacket and a preset data length threshold, an abnormality judgment result of the first subpacket is determined, including: when the data length of the file name subpacket is less than a preset first data length, determining that the file name subpacket is an abnormal subpacket.

[0055] In this embodiment, the first subpacket includes one subpacket, that is, when the message information before the file name subpacket is not abnormal, if the file name subpacket is an abnormal subpacket, the file name subpacket and other subpackets or messages after the file name subpacket position are sent to the subpacket cache unit.

[0056] In this embodiment, the first data length can be customized according to user needs. For example, the first data length can be any number of bytes between 20 bytes and 30 bytes.

[0057] In this embodiment, an attachment identifier can be found in the current message, and the attachment identifier is followed by a file name sub-packet. It is determined whether the remaining message length after the attachment identifier is less than 20 bytes. If so, it means that the attachment name or the attachment name keyword is truncated. At this time, a cache mark is returned to the cache module. The cache mark is used to cache the message in the file name sub-packet and its subsequent messages.

[0058] The embodiment of the present invention provides a method for processing email attachments, which determines whether the file name subpacketization is abnormal through the first data length, and then determines the number of subpackets to be cached in the subpacketization cache unit. When the first subpacketization is only the file name subpacketization, the success rate of email attachment type detection is improved.

[0059] In some embodiments, the first subpacket includes a file name subpacket and a content subpacket. Based on the data length of the first subpacket and a preset data length threshold, the abnormality judgment result of the first subpacket is determined, and it also includes: when the file name subpacket is a normal subpacket and the data length of the content subpacket is less than a preset second data length, determining that the content subpacket is an abnormal subpacket.

[0060] In this embodiment, when the first subpackaging includes the file name subpackaging and content subpackaging arranged in sequence, if the file name subpackaging is an abnormal subpackaging, there is no need to continue to judge the abnormality of the content subpackaging. Otherwise, when the file name subpackaging is a normal subpackaging, the abnormality of the content subpackaging is judged.

[0061] In this embodiment, the second data length can be customized according to user needs. For example, the second data length can be any number of bytes between 4 bytes and 10 bytes.

[0062] In this embodiment, the attachment name can be correctly obtained from the file name subpacket in the current message, but the attachment starting position identifier (for example, two line breaks) is truncated for the content subpacket after the file name subpacket. At this time, it is determined whether the remaining message length after the file name subpacket is less than 4 bytes. If so, it means that the attachment starting position is definitely truncated. At this time, a new cache mark is returned to the cache module, and the new cache mark is used to cache the content subpacket and its subsequent messages.

[0063] An embodiment of the present invention provides a method for processing email attachments, which determines whether the content subpacketization is abnormal through the second data length, and then determines the number of subpackets to be cached in the subpacket cache unit. When the first subpacket includes two subpackets, the success rate of email attachment type detection is improved and the coverage of attachment type detection is increased.

[0064] In this embodiment, the first subpackaging includes file name subpackaging, content subpackaging and type feature subpackaging. Based on the data length of the first subpackaging and a preset data length threshold, the abnormal judgment result of the first subpackaging is determined, and it also includes: when the file name subpackaging and the content subpackaging are both normal subpackaging, the type feature subpackaging is parsed to obtain a parsing result; when the data length of the parsing result is less than the third data length and the type of the email attachment is not obtained, the type feature subpackaging is determined to be an abnormal subpackaging.

[0065] In this embodiment, when the first subpackaging includes the file name subpackaging, content subpackaging and type feature subpackaging arranged in sequence, if the file name subpackaging or the content subpackaging is an abnormal subpackaging, there is no need to continue the abnormal situation of the type feature subpackaging. Otherwise, when the file name subpackaging and the content subpackaging are both normal subpackaging, it is judged whether the type feature subpackaging is abnormal.

[0066] In this embodiment, the third data length can be customized according to user needs. For example, the third data length can be any number of bytes between 80 bytes and 120 bytes.

[0067] In this embodiment, when it is determined that both the file name sub-packaging and the content sub-packaging are normal sub-packaging, and the correct attachment name and attachment starting position identifier can be obtained, the attachment content in the current message is sent to the decoding interface for decoding starting from the attachment starting position (corresponding to the content sub-packaging), and the decoded content is sent to the file identification interface to identify the file type. If the length of the decoded content is less than 100 bytes and the attachment type is not identified, a cache mark is returned to the cache module at this time, and the current position is pointed to the beginning position of the attachment content. The cache mark is used to cache the content from the beginning position of the attachment content to the end of the current message and subsequent messages.

[0068] exist Figure 2 In the illustrated embodiment, if any one of the file name subpacket, content subpacket and type feature subpacket is an abnormal subpacket, the abnormal subpacket needs to be input into the subpacket cache unit for cache processing, that is, after determining the abnormal subpacket, first apply for memory from the system space, and confirm the length of the cached content of the abnormal subpacket and its second subpacket, and then cache the abnormal subpacket and its second subpacket to the end of the attachment, and finally determine the attachment type result based on the cached content in the subpacket cache unit.

[0069] An embodiment of the present invention provides a method for processing email attachments, which determines whether the content subpacketization is abnormal through the second data length, and then determines the number of subpackets to be cached in the subpacket cache unit. When the first subpacket includes multiple subpackets, the success rate of email attachment type detection is improved and the coverage of attachment type detection is increased.

[0070] In some embodiments, the subpacket cache unit includes a pointer and a storage space, and caches the first subpacket and the second subpacket to a preset subpacket cache unit, including: establishing an association between the pointer and the abnormal subpacket; based on the association, sending the abnormal subpacket and the second subpacket corresponding to the abnormal subpacket to the storage space corresponding to the pointer.

[0071] In this embodiment, the storage space size of the sub-packet cache unit can be set according to user requirements. For example, the storage space size of the sub-packet cache unit can be between ().

[0072] It should be noted that the return of exception packet processing requires a cache mark, that is, 201 bytes of memory are applied to the system space. The memory is associated with the current session through a pointer. The pointer occupies little memory. Not every session applies for cache memory. In a concurrent mode with a large number of sessions and a small number of exception packets, using pointers can save system overhead.

[0073] In this embodiment, the content to be cached in the packet cache unit is the message after the current position returned in the abnormal packet processing, and the subsequent messages of the current message. When the attachment is large, that is, the cached content length of the abnormal packet and its subsequent messages exceeds the preset byte length, that is, when the attachment content is less than the preset byte length, the cache ends at the attachment.

[0074] In this embodiment, the preset byte length is smaller than the storage space of the packet buffer unit. For example, when applying for 201 bytes of memory from the system space, the preset byte length is 200.

[0075] The embodiment of the present invention provides a method for processing email attachments. By establishing an association between a pointer and an abnormal subpacket, only the abnormal subpacket and its subsequent messages are cached in a subpacket cache unit through the pointer, thereby achieving reasonable utilization of system memory, and using key marking points in the processing flow more accurately, and the processing process is more efficient.

[0076] In some embodiments, after caching the first sub-packet and the second sub-packet in a preset sub-packet cache unit, the method further includes: when the type of the email attachment is obtained, clearing the cache content of the sub-packet cache unit.

[0077] In this embodiment, the attachment type is detected by the content cached in the sub-packet cache unit, and the storage space of the sub-packet cache unit is initialized after the detection is completed, so that the storage space can be reused when abnormal sub-packeting occurs again.

[0078] The embodiment of the present invention provides a mail attachment processing method, which realizes the reuse of the storage space of the sub-packet cache unit by initializing the storage space of the sub-packet cache unit after completing the detection of the attachment type, thereby saving the overhead of applying for memory from the system.

[0079] The following is a description of the mail attachment processing device provided by the present invention. The mail attachment processing device described below and the mail attachment processing method described above can be referred to each other.

[0080] Figure 3 Schematic diagram of the structure of the mail attachment processing device provided by the present invention. Figure 3 As shown, the present invention further provides a mail attachment processing device, including an acquisition module 310 , a determination module 320 and a cache module 330 .

[0081] The acquisition module 310 is used to acquire a first sub-packet when the transmission message corresponding to the email attachment includes multiple sub-packets, the first sub-packet includes at least one of a file name sub-packet, a content sub-packet and a type feature sub-packet of the email attachment, the type feature sub-packet is used to identify the type of the email attachment, and the multiple sub-packets are arranged in a preset order;

[0082] A judgment module 320, configured to determine an abnormality judgment result of the first subpacket based on a data length of the first subpacket and a preset data length;

[0083] The cache module 330 is used to cache the first subpacket and the second subpacket to a preset subpacket cache unit when the first subpacket is an abnormal subpacket, and the second subpacket is a subpacket located after the corresponding position of the first subpacket among the multiple subpackets.

[0084] An embodiment of the present invention provides an email attachment processing device, which reduces the memory usage of the device by judging the abnormal situation of the first subpacket and only adds the abnormal subpacket and its subsequent subpackets to the subpacket cache unit, can maintain the stability of terminal operation in multiple sessions, and improves the detection efficiency of attachments.

[0085] In some embodiments, the email attachment processing device further includes: a processing module for clearing cache content of the sub-packet cache unit after caching the first sub-packet and the second sub-packet in a preset sub-packet cache unit and obtaining the type of the email attachment.

[0086] The embodiment of the present invention provides a mail attachment processing device, which realizes the reuse of the storage space of the sub-packet cache unit by initializing the storage space of the sub-packet cache unit after completing the detection of the attachment type, thereby saving the overhead of applying for memory from the system.

[0087] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 complete mutual communication through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the mail attachment processing method, the method comprising: obtaining a first sub-packet when the transmission message corresponding to the mail attachment includes multiple sub-packets, the first sub-packet includes at least one of the file name sub-packet, the content sub-packet and the type feature sub-packet of the mail attachment, the type feature sub-packet is used to identify the type of the mail attachment, and the multiple sub-packets are arranged in a preset order; based on the data length of the first sub-packet and the preset data length, determining the abnormal judgment result of the first sub-packet; when the first sub-packet is an abnormal sub-packet, caching the first sub-packet and the second sub-packet to a preset sub-packet cache unit, the second sub-packet is a sub-packet located after the corresponding position of the first sub-packet in the multiple sub-packets.

[0088] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the email attachment processing method provided by the above-mentioned methods, the method including: in the case where the transmission message corresponding to the email attachment includes multiple subpackets, obtaining a first subpacket, the first subpacket including at least one of a file name subpacket, a content subpacket and a type feature subpacket of the email attachment, the type feature subpacket is used to identify the type of the email attachment, and the multiple subpackets are arranged in a preset order; based on the data length of the first subpacket and the preset data length, determining the abnormal judgment result of the first subpacket; in the case where the first subpacket is an abnormal subpacket, caching the first subpacket and the second subpacket to a preset subpacket cache unit, the second subpacket being a subpacket located after the corresponding position of the first subpacket among the multiple subpackets.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the email attachment processing method provided by the above-mentioned methods, the method comprising: in a case where a transmission message corresponding to the email attachment includes multiple subpackets, obtaining a first subpacket, the first subpacket including at least one of a file name subpacket, a content subpacket and a type feature subpacket of the email attachment, the type feature subpacket being used to identify the type of the email attachment, and the multiple subpackets being arranged in a preset order; based on the data length of the first subpacket and a preset data length, determining an abnormal judgment result of the first subpacket; in a case where the first subpacket is an abnormal subpacket, caching the first subpacket and the second subpacket to a preset subpacket cache unit, the second subpacket being a subpacket located after the corresponding position of the first subpacket among the multiple subpackets.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing mail attachments, characterized in that: include: In the case where the transmission message corresponding to the email attachment includes multiple subpackets, obtaining a first subpacket, wherein the first subpacket includes a file name subpacket, a content subpacket, and a type feature subpacket of the email attachment, wherein the type feature subpacket is used to identify the type of the email attachment, and the multiple subpackets are arranged in a preset order; Determine an abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length threshold; In the case where the first sub-packet is an abnormal sub-packet, the first sub-packet and the second sub-packet are cached in a preset sub-packet cache unit, and the second sub-packet is a sub-packet located after the corresponding position of the first sub-packet among the multiple sub-packets; The abnormality judgment result of the first sub-package is also determined by whether the attachment name keyword or the attachment name in the first sub-package is truncated; If one of the file name subpacket, the content subpacket and the type feature subpacket is abnormal, the subpacket and subsequent subpackets of the subpacket are all cached.

2. The method for processing mail attachments according to claim 1, characterized in that: The first sub-packet includes the file name sub-packet, and the determining the abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length threshold includes: When the data length of the file name sub-packet is less than a preset first data length, the file name sub-packet is determined to be an abnormal sub-packet.

3. The mail attachment processing method according to claim 1, characterized in that: The first sub-packet includes the file name sub-packet and the content sub-packet, and the determining the abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length threshold value further includes: When the file name subpacket is a normal subpacket and the data length of the content subpacket is less than a preset second data length, it is determined that the content subpacket is an abnormal subpacket.

4. The method for processing mail attachments according to claim 1, characterized in that: The first sub-packet includes the file name sub-packet, the content sub-packet and the type feature sub-packet, and the determining the abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length threshold value further includes: In the case that the file name sub-packaging and the content sub-packaging are both normal sub-packaging, parsing the type feature sub-packaging to obtain a parsing result; When the data length of the parsing result is less than the third data length and the type of the email attachment is not obtained, it is determined that the type feature sub-packaging is an abnormal sub-packaging.

5. The method for processing mail attachments according to claim 1, characterized in that: The sub-packet cache unit includes a pointer and a storage space, and the step of caching the first sub-packet and the second sub-packet to a preset sub-packet cache unit includes: Establishing an association between the pointer and the abnormal subpacket; Based on the association, the abnormal subpacket and a second subpacket corresponding to the abnormal subpacket are sent to a storage space corresponding to the pointer.

6. The mail attachment processing method according to claim 1 or 5, characterized in that: After caching the first sub-packet and the second sub-packet in a preset sub-packet caching unit, the method further includes: When the type of the mail attachment is obtained, the cache content of the sub-packetization cache unit is cleared.

7. A mail attachment processing device, characterized in that: include: an acquisition module, configured to acquire a first sub-packet when a transmission message corresponding to an email attachment includes multiple sub-packets, wherein the first sub-packet includes a file name sub-packet, a content sub-packet, and a type feature sub-packet of the email attachment, wherein the type feature sub-packet is used to identify a type of the email attachment, and the multiple sub-packets are arranged in a preset order; A judgment module, used for determining an abnormality judgment result of the first sub-packet based on the data length of the first sub-packet and a preset data length threshold; a cache module, configured to cache the first subpacket and the second subpacket to a preset subpacket cache unit when the first subpacket is an abnormal subpacket, wherein the second subpacket is a subpacket located after a corresponding position of the first subpacket among the multiple subpackets; The abnormality judgment result of the first sub-package is also determined by whether the attachment name keyword or the attachment name in the first sub-package is truncated; The cache module is specifically used to cache all of the subpacket and subsequent subpackets of the subpacket when one of the file name subpacket, the content subpacket and the type feature subpacket is abnormal.

8. The mail attachment processing device according to claim 7, characterized in that: The device also includes: The processing module is used for clearing the cache content of the sub-packet cache unit after caching the first sub-packet and the second sub-packet in the preset sub-packet cache unit and obtaining the type of the email attachment.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the mail attachment processing method according to any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for processing mail attachments as claimed in any one of claims 1 to 6 is implemented.

Images