A mail-based risk prompt information generation method and device and medium

Abstract

The application discloses a kind of risk prompt information generation method, device and medium based on mail, the method includes: obtaining target mail;SPF check is carried out to target mail, and prompt is generated according to check result;According to the probability value obtained by calculating sending domain name, the prompt is generated by combining confidence lower limit and spelling feature with probability value;Using neural network model, by splitting and real number conversion to uniform resource locator, prompt is generated;Macro attachment, suspected to be impersonated name and money information are analyzed by features, and the corresponding prompt is generated respectively;According to prompt, risk prompt information is generated.The application proposes a kind of risk prompt information generation method, device and medium based on mail, by comprehensive analysis and detection to target mail from six different angles, and then generate comprehensive risk prompt information, so it can solve the problem that it is difficult to generate effective comprehensive risk prompt information according to mail content, avoid the problem of missing reminder.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic mail, in particular to a mail-based risk prompt information generation method and device and medium. BACKGROUND

[0002] As a communication means, electronic mail has the characteristics of simple protocol, easy to obtain mailbox address and wide use, so in addition to normal communication and exchange, it is also targeted by people with ulterior motives for misuse to transmit junk information and phishing emails; compared with general junk mail, a well-designed phishing email is no different from a general email in terms of content and format, and a reader with insufficient experience can hardly accurately identify the fraudulent part contained therein; on the other hand, compared with cash fraud, transfer fraud and other fraud scenarios, the application of the user's initiative and the stimulation of the user's alertness to reduce the possibility of fraud success in the mail-based prevention scheme is still insufficient. The existing technical means mainly mark the strange mail and provide a pre-transfer page to prompt the user that the mail has a risk of use.

[0003] However, the direct marking and the provision of the transfer page are mechanical, which can easily lead to the user missing the mark and being cheated; moreover, the direct marking is performed by marking a number of abnormal points to remind the user multiple times, resulting in a high prompt frequency, poor user experience and easy omission of the reminder; although the mail client displays the real URL (Uniform Resource Locator) or [SPAM] mark, most users do not have enough knowledge to understand such characters and mark composition, resulting in ineffective marking; in addition, the provision of the transfer page can only determine whether the jump link is a domain name owned by the user, and the accuracy of the prompt is low. SUMMARY

[0004] The present application provides a mail-based risk prompt information generation method, device and medium to solve the problem of difficulty in generating effective comprehensive risk prompt information according to the mail content and avoiding omission of the reminder.

[0005] To solve the above problem, the present application provides a mail-based risk prompt information generation method, comprising:

[0006] obtaining a target mail;

[0007] performing SPF verification on the target mail, and generating a first prompt according to the verification result;

[0008] using a state transition probability method to calculate a probability value according to the spelling of the sending domain name in the target mail, and combining the probability value with a preset lower limit of confidence and spelling features in the target mail to generate a second prompt;

[0009] using a preset neural network model, generating a third prompt by splitting and real number conversion on a uniform resource locator in the target mail;

[0010] performing feature analysis on a macro-attached file, suspected name usurpation and money information in the target mail, respectively generating a fourth prompt, a fifth prompt and a sixth prompt;

[0011] generating risk prompt information according to the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt.

[0012] The application obtains corresponding prompts by taking different detection methods from six aspects of SPF verification, spelling of a sending domain name, a uniform resource locator, a macro-attached file, suspected name usurpation and money information, and then generates highly comprehensive risk prompt information, which can quickly and effectively perform risk prompting and protect the safety of the target mail. The probability value obtained by using the state transition probability method can reflect the degree of abnormality of the mailbox address of the target mail, so it can provide credibility support for the generation of the second prompt. The uniform resource locator is split using a neural network model, which can solve the problem of long uniform resource locator content, facilitate data analysis and accelerate the acquisition process of the third prompt.

[0013] Compared with the prior art, the application performs comprehensive analysis and detection on the target mail from six different aspects, and then generates comprehensive risk prompt information, which can effectively prompt the user at one time and avoid the omission of the prompting problem. Since the prompts are obtained by specific data analysis, they have high credibility and can avoid ambiguous and non-targeted risk prompt information, helping users to avoid risks, so the application can solve the problem of difficult generation of effective comprehensive risk prompt information from mail content and avoid the omission of the prompting problem.

[0014] As a preferred solution, according to the spelling of the sending domain name in the target mail, a probability value is calculated using a state transition probability method, and the probability value is combined with a preset lower limit of confidence and spelling features in the target mail to generate a second prompt, specifically:

[0015] using a preset N value, generating a character substring by traversing the sending domain name in the target mail using an N-Gram algorithm;

[0016] combining a preset character set, constructing all possible N-Gram tuples according to the character substring to obtain a state transition probability matrix;

[0017] The sending domain name in the state transition probability matrix is ​​split into several tuples;

[0018] The average state transition probability value of the aforementioned tuples is calculated to obtain the probability value;

[0019] The probability value and the lower confidence limit are compared, and the comparison result is combined with the spelling features in the target email to generate a second prompt.

[0020] This preferred solution involves detecting the sender's email address and then generating a second prompt based on it. Starting from the spelling of the sender's domain name, the process of constructing all possible N-Gram tuples based on character substrings is the process of building a Markov chain. By constructing a Markov chain based on the spelling to calculate the average state transition probability value as the probability value of the email address appearing, it is possible to provide probabilistic credibility support for the generation of the second prompt.

[0021] As a preferred embodiment, the probability value is compared with a preset confidence level lower limit, and the comparison result is combined with the spelling features in the target email to generate a second prompt, specifically:

[0022] The probability value is compared with a preset confidence level lower limit to obtain a comparison result; wherein, the confidence level lower limit is calculated by calculating the probability values ​​of all domains in the preset trusted domain name list;

[0023] The spelling features of vowels and special symbols in the target email are subjected to normalization detection to obtain the detection results;

[0024] The second prompt is generated based on the comparison results, the detection results, and the list of low-frequency communication top-level domains of the mailbox where the target email is located.

[0025] In this preferred solution, since the lower confidence limit is calculated by evaluating the probability values ​​of all domains in the preset trusted domain list, it represents the minimum credibility of the email. Therefore, comparing the probability values ​​with the lower confidence limit allows the official perspective to reflect the degree of anomaly in the target email's email address. By combining the target email's own character spelling feature detection results with the list of low-frequency communication top-level domains, the composition of the target email's email address and email addresses with fewer contacts can be considered. This ensures that the second prompt is not only generated from an external analysis of the target email but also includes meticulous consideration of internal details, making the second prompt more objective, accurate, and effective.

[0026] As a preferred embodiment, the confidence lower limit is calculated by evaluating the probability values ​​of all domains in a preset list of trusted domains, specifically as follows:

[0027] obtain a world comprehensive ranking list of websites, and use part of the information in the world comprehensive ranking list to build a list of trusted domain names;

[0028] calculate the probability values of all domain names in the list of trusted domain names to obtain a set of probability values;

[0029] use the minimum value in the set of probability values as the lower limit of confidence.

[0030] The list of trusted domain names in the preferred embodiment is built on the basis of the world comprehensive ranking list, and therefore has high reliability, so that the lower limit of confidence can be a comprehensive and reliable measure to be compared with the probability value to generate the second prompt.

[0031] As a preferred embodiment, a preset neural network model is used to split and convert the uniform resource locator in the target email to generate a third prompt, specifically:

[0032] The uniform resource locator in the target email is split into a first character set using a preset neural network model;

[0033] Characters in the first character set that are not in the preset character set are filtered out to obtain a second character set, and the character identifiers in the second character set are defined as unknown characters;

[0034] A preset beginning character and an ending character are added to the head and tail of the unknown characters respectively to obtain a numbered list about the second character set;

[0035] The numbered list is processed using a binary classification network structure in the neural network model to obtain an abnormal probability of the uniform resource locator, and the third prompt is generated according to the abnormal probability.

[0036] This preferred embodiment detects the uniform resource locator contained in the email and then generates a third prompt. By splitting and filtering the uniform resource locator in the target email, unknown characters can be obtained. By adding characters to the head and tail of the unknown characters, the characters in the numbered list can be clear and orderly, which facilitates faster conversion speed during transformation processing, accelerates the abnormal probability acquisition process of the uniform resource locator, and quickly generates the third prompt. Compared with the sending domain name, the uniform resource locator contained in the email is longer, so it is not suitable to use simple state transition probability and character number for judgment. By using the neural network model to convert the abnormal probability, the analysis time can be greatly saved, and the accuracy of the third prompt can be improved.

[0037] As a preferred solution, the macro-attached file in the target mail is subjected to feature analysis, and a fourth prompt is generated, specifically:

[0038] The macro-attached file in the target mail is obtained.

[0039] If a dangerous file in the list of key concerns appears in the macro-attached file, the fourth prompt is generated according to the dangerous file.

[0040] The list of key concerns is established according to the prohibited attachment type of the mailbox where the target mail is located and the preset key concern files.

[0041] This preferred solution detects the attachment carried by the mail, and then generates the fourth prompt based on this. By using the list of key concerns to determine whether the macro-attached file is a dangerous file, it can quickly determine whether the macro-attached file in the target mail poses an operational risk. The fourth prompt is generated in a simple and quick manner.

[0042] As a preferred solution, the suspected impersonation name in the target mail is subjected to feature analysis, and a fifth prompt is generated, specifically:

[0043] The mail header of the target mail is obtained, and the mail header is matched with a preset dictionary tree to obtain a first matching result. The dictionary tree is established according to the lists of government agencies, banks, and public security and procuratorial agencies, as well as the names of enterprise permanent establishments.

[0044] The entity name of the target mail is obtained, and the entity name is matched with a company list and a personal list in a sequence labeling algorithm to obtain a second matching result.

[0045] If the first matching result or the second matching result is a matching success, the sending email address of the target mail is checked, and the fifth prompt is generated according to the checking result.

[0046] This preferred solution detects whether the subject name of the mail is counterfeit, and then generates the fifth prompt based on this. First, by matching, it can be determined whether the target mail is a match, i.e., whether it constitutes a statement. Since a statement refers to a formal statement issued by government, enterprise, organization, or other official agencies, it is usually in response to a certain event or situation, expressing the official position and attitude, and its sending email address is generally official and formal. Therefore, after determining that it constitutes a statement, the sending email address is directly checked, which can quickly determine whether the target mail is counterfeit and obtain the fifth prompt.

[0047] As a preferred solution, the sending email address of the target mail is checked, and the fifth prompt is generated according to the checking result, specifically:

[0048] judging the category of the sending email address of the target email to obtain a declaration object of the target email;

[0049] If the declaration object is a government agency or a public security agency, checking whether the top-level domain of the target email belongs to a preset special top-level domain;

[0050] If the declaration object is a bank, an invoice service provider or an enterprise, checking whether the domain name used by the target email belongs to a preset list;

[0051] If the declaration object is an enterprise permanent establishment, checking whether the sender and the receiver of the target email constitute a same domain or a subdomain;

[0052] If the declaration object is a name, checking whether the declaration object is in a preset address book;

[0053] generating the fifth prompt according to the checking result.

[0054] In the preferred embodiment, since the top-level domain name of the email of the government agency and the public security agency usually has a special top-level domain name in most cases, the top-level domain name can be directly checked to know whether the email is abnormal; since the enterprise permanent establishments usually have a belonging relationship, whether the email is abnormal can be known by checking whether it constitutes a same domain or a subdomain; by using the preset list and the address book, whether the email of the bank or the individual is abnormal can be quickly and directly judged. The present embodiment provides corresponding checking methods for different sending email addresses from the perspectives of the government agency, the bank, the enterprise permanent establishment and the individual, and the checking method is highly targeted and can accelerate the generation process of the fifth prompt.

[0055] As a preferred embodiment, the money information in the target email is analyzed to generate a sixth prompt, specifically:

[0056] obtaining text information of the target email;

[0057] segmenting the text information using a preset classifier to obtain a plurality of strings;

[0058] matching the plurality of strings with a preset money word table to generate the sixth prompt according to a matching result;

[0059] wherein, the money word table is established according to preset financial fraud information. In the preferred embodiment, the text information is segmented using the classifier, which is equivalent to data segmentation and extraction of the original email text, so that the words in the obtained plurality of strings are convenient for comparison and matching with the money word table, and the acquisition process of the sixth prompt is accelerated.

[0060] The application further provides a mail-based risk prompt information generation device, comprising a mail acquisition module, a first generation module, a second generation module, a third generation module, a fourth generation module and a summary module.

[0061] The mail acquisition module is configured to acquire a target mail.

[0062] The first generation module is configured to perform SPF verification on the target mail and generate a first prompt according to a verification result.

[0063] The second generation module is configured to calculate a probability value by using a state transition probability method according to spelling of a sending domain name in the target mail, combine the probability value with a preset lower limit of confidence and spelling features in the target mail to generate a second prompt.

[0064] The third generation module is configured to use a preset neural network model to split and convert a uniform resource locator in the target mail into a real number to generate a third prompt.

[0065] The fourth generation module is configured to perform feature analysis on a macro-attached file, a suspected name and money information in the target mail to generate a fourth prompt, a fifth prompt and a sixth prompt respectively.

[0066] The summary module is configured to generate risk prompt information according to the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt.

[0067] As a preferred scheme, the second generation module comprises a character unit, a matrix unit, a splitting unit, a probability value unit and a comparison unit.

[0068] The character unit is configured to use a preset N value to traverse the sending domain name in the target mail by using an N-Gram algorithm to generate a character substring.

[0069] The matrix unit is configured to combine a preset character set to construct all possible N-Gram tuples according to the character substring to obtain a state transition probability matrix.

[0070] The splitting unit is configured to split the sending domain name in the state transition probability matrix to obtain a plurality of tuples.

[0071] The probability value unit is configured to calculate an average state transition probability value of the plurality of tuples to obtain the probability value.

[0072] The comparison unit is configured to compare the probability value with the lower bound of confidence, and combine a comparison result with spelling features in the target email to generate a second prompt.

[0073] As a preferred solution, the comparison unit comprises a first sub-unit, a second sub-unit and a third sub-unit.

[0074] The first sub-unit is configured to compare the probability value with a preset lower bound of confidence to obtain a comparison result.

[0075] The second sub-unit is configured to perform normative detection on character spelling features of vowel letters and special symbols in the target email to obtain a detection result.

[0076] The third sub-unit is configured to generate the second prompt according to the comparison result, the detection result and a list of low-frequency communication top-level domains of a mailbox where the target email is located.

[0077] As a preferred solution, the lower bound of confidence is obtained by calculating probability values of all domain names in a preset list of trusted domain names.

[0078] A list of world comprehensive rankings of websites is obtained, and part of the list information in the list of world comprehensive rankings is used to construct a list of trusted domain names.

[0079] Probability values of all domain names in the list of trusted domain names are calculated to obtain a set of probability values.

[0080] The minimum value in the set of probability values is taken as the lower bound of confidence.

[0081] As a preferred solution, the third generation module comprises a first segmentation unit, a screening unit, a reconstruction unit and a transformation unit.

[0082] The first segmentation unit is configured to use a preset neural network model to segment a uniform resource locator in the target email into a first character set.

[0083] The screening unit is configured to screen out characters in the first character set that are not in a preset character set to obtain a second character set, and define character identities of the second character set as unknown characters.

[0084] The reconstruction unit is configured to add a preset beginning character and an ending character to the head and tail of the unknown characters respectively to obtain a numbered list about the second character set.

[0085] The transformation unit is configured to transform the numbered list using a binary classification network structure in the neural network model to obtain an abnormal probability of the uniform resource locator, and generate the third prompt according to the abnormal probability.

[0086] As a preferred solution, the fourth generation module comprises a first acquisition unit and a first generation unit.

[0087] The first acquisition unit is configured to acquire the macro-enabled attachment in the target mail.

[0088] The first generation unit is configured to generate the fourth prompt according to the dangerous file if the dangerous file in the macro-enabled attachment appears in the watch list.

[0089] The watch list is established according to the prohibited attachment type of the mailbox where the target mail is located and the preset watch file.

[0090] As a preferred solution, the fourth generation module comprises a second acquisition unit, a first matching unit and a checking unit.

[0091] The second acquisition unit is configured to acquire the mail header of the target mail, match the mail header with a preset dictionary tree to obtain a first matching result, and the dictionary tree is established according to the list of government agencies, banks and public security agencies, and the name of enterprise permanent agency.

[0092] The first matching unit is configured to acquire the entity name of the target mail, match the entity name with the company list and the personal list in the sequence labeling algorithm to obtain a second matching result.

[0093] The checking unit is configured to check the sending mailbox address of the target mail if the first matching result or the second matching result is a matching success, and generate the fifth prompt according to the checking result.

[0094] As a preferred solution, the checking unit comprises a fourth sub-unit, a fifth sub-unit, a sixth sub-unit, a seventh sub-unit, an eighth sub-unit and a ninth sub-unit.

[0095] The fourth sub-unit is configured to perform category judgment on the sending mailbox address of the target mail to obtain a declarer of the target mail.

[0096] The fifth sub-unit is configured to check whether the top-level domain name of the target mail belongs to a preset special top-level domain if the declarer is a government agency or a public security agency.

[0097] The sixth subunit is configured to check whether the domain name used by the target email belongs to a pre-collected list if the declared object is a bank, an invoice service provider or an enterprise;

[0098] The seventh subunit is configured to check whether the sender and the recipient of the target email constitute a same domain or a subdomain if the declared object is an enterprise permanent establishment;

[0099] The eighth subunit is configured to check whether the declared object is in a preset address book if the declared object is a person name;

[0100] The ninth subunit is configured to generate the fifth prompt according to the checking result.

[0101] As a preferred solution, the fourth generation module comprises a third acquisition unit, a second segmentation unit and a second matching unit.

[0102] The third acquisition unit is configured to acquire the text information of the target email.

[0103] The second segmentation unit is configured to segment the text information using a preset classifier to obtain a plurality of strings.

[0104] The second matching unit is configured to match the plurality of strings with a preset money word table, and generate the sixth prompt according to a matching result.

[0105] The money word table is established according to a preset financial fraud information. The application further provides a storage medium, wherein the storage medium stores a computer program, the computer program is called and executed by a computer, and a mail-based risk prompt information generation method is realized. BRIEF DESCRIPTION OF DRAWINGS

[0106] Figure 1 is a flowchart of a mail-based risk prompt information generation method provided by an embodiment of the application;

[0107] Figure 2 is a structural diagram of a mail-based risk prompt information generation device provided by an embodiment of the application. DETAILED DESCRIPTION

[0108] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the application.

[0109] In the description of the present application, it is to be understood that the terms "first", "second", "third"... "tenth" are only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second", "third"... "tenth" can be explicitly or implicitly included one or more of the features. In the description of the present application, unless otherwise stated, the meaning of "several" is two or more.

[0110] The mail-based risk prompt information generation method described in the embodiments of the present application is mainly applied to the risk detection of the received target mail when using the electronic mailbox, so as to generate prompt information to make corresponding prompt for the user and improve the alertness of the user.

[0111] Embodiment one:

[0112] Please refer to Figure 1 The embodiments of the present application provide a mail-based risk prompt information generation method, which comprises S1-S6, and the specific implementation steps are as follows:

[0113] S1, obtaining a target mail.

[0114] The step S1 of the embodiments of the present application is specifically:

[0115] Obtaining the target mail from the mailbox system.

[0116] S2, performing SPF verification on the target mail, and generating a first prompt according to the verification result.

[0117] The step S2 of the embodiments of the present application is specifically:

[0118] Using SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) to verify the target mail, and generating a first prompt according to the verification result.

[0119] In the embodiment, since SMTP does not check the mail address of the sender, SPF can supplement the security of SMTP (Simple Mail Transfer Protocol) in the target mail; however, the SPF protocol has many problems in use, for example, some domain names lack strict SPF configurations, so that some mail that is not fake may not pass SPF authentication, therefore, not all mail that fails SPF authentication has serious risk problems, so that the user knows the SPF check result can help the user make a judgment; and, through DKIM and DMARC, SPF can further assist SPF to obtain a more perfect prompt, and provide more comprehensive prompt information for the user.

[0120] S3, according to the spelling of the sending domain name in the target mail, a probability value is calculated by using a state transition probability method, and the probability value is combined with a preset lower limit of confidence and spelling features in the target mail to generate a second prompt.

[0121] In step S3 of the embodiment of the application, S3 includes S3.1-S3.5, and specifically:

[0122] S3.1, converting the sending domain name in the target mail into a lowercase form;

[0123] Using a preset N value, the sending domain name in the target mail is traversed by using an N-Gram algorithm to generate a character substring.

[0124] For example, assuming that the sending domain name of the target mail is 123456.cn, and the specified N is 3, then after traversing the sending domain name by using the N-Gram algorithm, the final substring list is: “123, 234, 345, 456, 56., 6.c,.cn”.

[0125] S3.2, all possible N-Gram tuples are constructed according to the character substring in combination with a preset character set to obtain a state transition probability matrix; wherein the character set is established according to the character-related RFC standard that can be used in the sending domain name, and the source can be RFC 1035, RFC 1123, RFC 2181 and RFC 5892;

[0126] The sending domain name in the state transition probability matrix is split to obtain a plurality of tuples;

[0127] The average state transition probability value of the plurality of tuples is calculated to obtain a probability value.

[0128] In this step S3.2, N=2 can be specified to reduce the matrix size, thereby directly constructing all possible 2gram tuples, the size of which is M, and then forming an initial state transition matrix of MxM size, and then calculating the state transition probabilities between all 2gram tuples to obtain the state transition probability matrix.

[0129] The specific implementation of step S3.2 is as follows:

[0130] Suppose the corpus only has one sentence "I robot", and the N-Gram algorithm is used to traverse the sending domain name in the target email, it can be known that when N=3, the split tuples are "iro", "rob", "obo", and "bot". According to the order, it can be known that the transition object of the iro tuple is only the rob tuple, and other tuples are similar, so the transition probability values of a plurality of tuples are obtained as shown in Table 1.

[0131] Table 1: Tuple transition probability value table

[0132] iro rob obo bot iro 0 1 0 0 rob 0 0 1 0 obo 0 0 0 1 bot 0 0 0 0

[0133] In this application, referring to Table 1, Table 1 provides a tuple transition probability value table, which is the transition probability values of a plurality of tuples in the specific implementation example of step S3.2.

[0134] This embodiment starts from the spelling of the sending domain name, and the process of constructing all possible N-Gram tuples according to character substrings is the process of constructing a Markov chain. By constructing a Markov chain based on spelling to calculate the average state transition probability value as the probability value of the mailbox address, probability credibility support can be provided for the generation of the second prompt.

[0135] S3.3, compare the probability value with the preset confidence lower limit to obtain a comparison result; wherein the confidence lower limit is obtained by calculating the probability values of all domain names in the preset trusted domain name list;

[0136] The construction process of the confidence lower limit is specifically:

[0137] Obtain the AlexaRank ranking list (world comprehensive ranking list) of the website, and use the list information of the top 20000 in the AlexaRank ranking list to construct the trusted domain name list;

[0138] Calculate the probability values of all domain names in the trusted domain name list to obtain a probability value set;

[0139] The minimum value in the probability value set is taken as the confidence lower limit.

[0140] The trusted domain name list in the embodiment has high reliability because it is established on the basis of the world comprehensive ranking list, so that the lower limit of confidence can be ensured to be a comprehensive confidence measurement standard for comparison with the probability value, and then the second prompt is generated.

[0141] S3.4, the character spelling features of the vowels and special symbols in the target mail are standardized detected to obtain a detection result.

[0142] Specifically, the number of vowels and the number of special symbols (such as “-”, “_” and “.”) in the target mail are counted, and the domain names exceeding the upper limit of the threshold value calculated according to historical statistical data are determined to obtain the detection result.

[0143] The detection result can show the number of symbols with low usage rate and the number of vowels with low proportion.

[0144] S3.5, the second prompt is generated according to the comparison result, the detection result and the low-frequency communication top-level domain list of the mailbox where the target mail is located.

[0145] The construction process of the low-frequency communication top-level domain list is as follows:

[0146] The top-level domain name list is obtained by summarizing the pre-collected spam data and the security reports publicly disclosed by manufacturers. The selection conditions of the list include low usage frequency, low registration cost and high spam frequency.

[0147] The historical mail data of the user of the mailbox where the target mail is located is counted, and the top-level domain names with which the user has a high frequency of communication are calculated. If the top-level domain of the sending mailbox is not in the list, it is considered to be a top-level domain name with which the user has a low frequency of communication, and the low-frequency communication top-level domain name list is obtained.

[0148] The low-frequency communication top-level domain list is established according to the top-level domain name list and the low-frequency communication top-level domain name list.

[0149] From the whole, the step S3 in the embodiment has high importance for risk detection and reminder of the mailbox address because it is difficult for each security expert or recipient to identify whether a sender mailbox address may have a problem with the independent knowledge of the person.

[0150] The lower limit of confidence is obtained by calculating the probability value of all domain names in the preset trusted domain name list, so it represents the minimum value of the mail confidence. Therefore, the comparison result obtained by comparing the probability value with the lower limit of confidence can reflect the abnormal degree of the mailbox address of the target mail from the official point of view.

[0151] In addition, since the threshold lower limit of the state transition probability calculation uses the minimum value, it is relatively conservative, so by combining the character spelling feature detection result of the target email itself and the low-frequency communication top-level domain list, the mailbox address structure of the target email itself and the less frequent mailbox address can be considered, and the second prompt can not only be generated from the outside analysis of the target email, but also contain detailed internal details, making the second prompt more objective and accurate and effective.

[0152] S4, using a preset neural network model, generating a third prompt by splitting and real number conversion of the uniform resource locator in the target email.

[0153] In step S4 of the embodiment of the present application, S1 includes S4.1-S4.4, specifically:

[0154] S4.1, using a preset LSTM (Long Short-Term Memory) deep learning network structure, splitting the URL (Uniform Resource Locator) in the target email into a first character set; wherein the input processing of the LSTM deep learning network structure refers to the input word processing method of the large language model, and a large number of characters capable of supporting splitting are defined in the network structure.

[0155] S4.2, screening out characters in the first character set that are not in the preset character set to obtain a second character set, and defining the character identification of the second character set as an unknown character;

[0156] A preset beginning character and an ending character are added at the head and tail of the unknown character respectively to obtain a numbered list about the second character set.

[0157] S4.3, generating a comprehensive auxiliary prompt according to the IP host bit, short URL and external download link in the target email, specifically:

[0158] If the IP address of the host bit where the target email is located is not a intranet IP through regular detection, output the first auxiliary prompt to prompt that the IP address of the target email is not an intranet IP;

[0159] If the URL in the target email points to a browser download link at the end, output the second auxiliary prompt to prompt the target email to point to an external download link; for example, https: / / www.123.com / abc.png, since "png" is an image, the general browser will not trigger automatic download, so it is not an external download link, but if the URL is https: / / www.123.com / abc.exe, most browsers will parse it as a download link to pop up a save window, which constitutes a download link;

[0160] If the host bit of the target email is matched with the domain name in the pre-obtained short URL service list through regular matching, the third auxiliary prompt is output to prompt the target email to point to a short URL;

[0161] According to the first auxiliary prompt, the second auxiliary prompt and the third auxiliary prompt, a comprehensive auxiliary prompt is generated.

[0162] The embodiment is to generate a comprehensive auxiliary prompt according to the differences of IP as host bit, using a short URL, and pointing to an external download link in different scenarios. Since it is not suitable to check the URL based on spelling in these scenarios, the LSTM network cannot be used to detect these URLs, so by taking corresponding detection measures for the three kinds of information, a comprehensive auxiliary prompt can be obtained to perform relevant prompting.

[0163] S4.4, using a binary classification network structure in an LSTM deep learning network structure to perform softmax transformation on the number list to obtain an abnormal probability of the uniform resource locator, and generating an initial prompt according to the abnormal probability;

[0164] The initial prompt and the comprehensive auxiliary prompt are combined to obtain a third prompt.

[0165] It should be noted that in the embodiment of the application, the first-level domain name after excluding the top-level domain is combined with the top-level domain as the host position, and for multiple URLs with the same host position, only the first appearing URL is checked. For example, the host positions of 123.com.cn and 456.123.com.cn are both 123.com.cn, and 123.com and 123.cn are not the same host bit. Moreover, the softmax transformation is a mathematical transformation of the original variable, which uses the softmax function, also known as the normalized exponential function. It is a mathematical function, which is usually used to convert a set of arbitrary real numbers into real numbers representing a probability distribution.

[0166] The step S4 of the embodiment is as a whole, since the junk phishing email often uses the way of guiding the user to click the corresponding URL to achieve the purpose, therefore, the prompt of the URL which may exist in the target email, can play a more refined and accurate prompt effect than using the transfer page to transfer all external links;

[0167] The embodiment is to detect the uniform resource locator in the email, and then generate the third prompt. By splitting and screening the uniform resource locator in the target email, unknown characters can be obtained, and by adding characters at the head and tail of the unknown characters, the characters in the numbered list can be clear and orderly, which can help to obtain faster conversion speed when performing transformation processing, accelerate the abnormal probability acquisition process of the uniform resource locator, and quickly generate the third prompt;

[0168] Compared with the domain name of the message, the uniform resource locator content in the email is longer, and therefore it is not suitable to use simple state transition probability and character number for judgment. By using the neural network model to convert the abnormal probability, the analysis time can be greatly saved, and the prompt accuracy of the third prompt can be improved.

[0169] S5, performing feature analysis on the macro-attached file, suspected name and money information in the target email, and generating the fourth prompt, the fifth prompt and the sixth prompt respectively.

[0170] In the step S5 of the embodiment of the application, S5 includes S5.1-S5.3, specifically:

[0171] S5.1, obtaining the macro-attached file in the target email;

[0172] If the dangerous file in the key attention list appears in the macro-attached file, the fourth prompt is generated according to the dangerous file;

[0173] The key attention list is established according to the prohibited attachment type of the mailbox where the target email is located (for example, the attachment list type prohibited to be uploaded by outlook), and the preset key attention file.

[0174] The key attention file includes files that can be directly executed, such as ".exe", ".bat", ".ps" and ".sh", and macro files such as ".docm" and ".xlsm".

[0175] The embodiment is to detect the attachment carried in the mail, and then generate the fourth prompt. Since the above-mentioned focus file and its easy execution due to misoperation or the induced content of the mail, for example, the office file with macro is usually safe even if it carries the macro virus in the case of using the read-only mode and disabling the macro, but if the user enables the macro, it may be poisoned, so the judgment of whether the macro-attached attachment is a dangerous file by the focus list can quickly know whether the macro-attached attachment in the target mail exists operation risk, and timely remind the user, and the generation mode of the fourth prompt is simple and fast.

[0176] S5.2, obtain the mail header of the target mail, match the mail header with a preset dictionary tree to obtain a first matching result; wherein the dictionary tree is established according to the list of government agencies, banks and public security agencies, and the name of the enterprise permanent agency;

[0177] Obtain the entity name of the target mail, and match the entity name with the B-ORG (company or organization) list and the I-PER (personal) list in the sequence labeling algorithm to obtain a second matching result;

[0178] If the first matching result or the second matching result is a matching success, the sender email address of the target mail is judged for category to obtain a declaration object of the target mail;

[0179] If the declaration object is a government agency or a public security agency, check whether the top-level domain name of the target mail belongs to a preset special top-level domain (such as “.gov” and “.mit”);

[0180] If the declaration object is a bank, an invoice service provider or an enterprise, check whether the domain name used by the target mail belongs to a pre-collected list;

[0181] If the declaration object is an enterprise permanent agency, check whether the sender and the recipient of the target mail constitute a same domain or a subdomain;

[0182] If the declaration object is a name, check whether the declaration object is in a preset address book;

[0183] Generate a fifth prompt according to the check result.

[0184] The embodiment is to detect whether the subject name of the mail is counterfeit, and then generate the fifth prompt. Although SPF and other protocols have certain protection ability for fake mail addresses, they cannot cope with the behavior of using the visual effect of mail reading to impersonate others, so it is of great significance to know whether the subject name is counterfeit by finding and judging the entity;

[0185] Firstly, through matching, it can be known whether the target email is matched successfully, that is, whether it constitutes a statement. Since the statement refers to a formal statement issued by official agencies such as government, enterprise and organization, it is usually to respond to some event or situation, express the official position and attitude, and its sending email address is generally more official and formal. Therefore, after determining that it constitutes a statement, the sending email address is directly checked to quickly know whether the target email is imitated, and then the fifth prompt is obtained. Moreover, the generation of the second matching result uses the open source BiLSTM+CRF technology, which can provide a corresponding list for the key attention object to perform fast matching.

[0186] In addition, since the top-level domain name of the government agency and the public security agency will have a special top-level domain name in most cases, the top-level domain name can be directly checked to know whether the mailbox is abnormal. Since there is usually a belonging relationship between the enterprise regular agencies, whether it constitutes a same domain or a subdomain can be checked to know whether the mailbox is abnormal. Using the pre-collected list and the address book, it can be quickly and directly judged whether the bank or the personal mailbox is abnormal. The present scheme provides corresponding different sending email address checking methods from the perspectives of government agencies, banks, enterprise regular agencies and individuals. The checking method is highly targeted and can accelerate the generation process of the fifth prompt.

[0187] S5.3, obtaining text information of the target email;

[0188] The text information is cut by using a TextCNN (convolutional neural network) module as a classifier to obtain a plurality of string tokens. The classifier controls the physical size and occupied memory space by using a preset word table.

[0189] The plurality of string tokens are matched with a preset money word table, and tokens not in the money word table are masked (MASK) to obtain a matching result.

[0190] The sixth prompt is generated according to the matching result.

[0191] The money word table is established according to preset financial fraud information.

[0192] In the present embodiment, since general email classification only determines whether the email is a spam email and does not care about the specific type of spam email, but in all frauds, the one involving money is the most sensitive. Therefore, it is necessary to additionally remind the information involving money and possibly constituting fraud.

[0193] The text information is cut by using a classifier, which is equivalent to data segmentation and extraction of the original email text. The words in the obtained plurality of string tokens are convenient for comparison and matching with the money word table, and the acquisition process of the sixth prompt is accelerated.

[0194] S6, generating the risk prompt information according to the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt.

[0195] The step S6 in the embodiment of the application is specifically:

[0196] A unique id and a unique label are configured for the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt as labels, and according to a pre-established multilingual script dictionary and placeholders corresponding to the output of various labels, the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt corresponding to each label are integrated by passing in a language mark parameter to control the output, and the risk prompt information is obtained.

[0197] The multilingual script dictionary is obtained by manual writing.

[0198] The embodiment of the application can support multiple languages by formatting the output to control the generation result of the prompt, and compared with the method of using machine translation, the prompt script of the scheme is written by human, and the language is more appropriate and natural, which can enhance the experience of the user.

[0199] Overall, the embodiment of the application has the following beneficial effects:

[0200] The embodiment of the application obtains corresponding prompts by taking different detection methods from the six aspects of SPF verification, spelling of the sending domain name, uniform resource locator, macro-attached attachment, suspected name and money information, and then generates risk prompt information with high comprehensiveness, which can quickly and effectively prompt the risk at one time, avoids the occurrence of missing reminders, and protects the information security of the target email.

[0201] The potential non-corresponding identity declaration is recognized by a method based on entity recognition and knowledge base matching to prompt the possible impersonation email, which has a wide range and can reduce the risk of omission; the scheme based on entity recognition can find the organization name in the given text to discover the potential entity impersonation, which cannot be done by simply matching the contact person; and compared with the "one-size-fits-all" scheme that prohibits direct access to external links, the embodiment of the application uses a method combining experience knowledge and deep learning model to identify suspicious specific URLs, which can avoid the problem of user numbness and missing information prompts caused by too general prompts.

[0202] Embodiment two:

[0203] Please refer to Figure 2Embodiments of the present application provide a mail-based risk prompt information generation device, comprising a mail acquisition module 10, a first generation module 20, a second generation module 30, a third generation module 40, a fourth generation module 50 and a summary module 60.

[0204] The mail acquisition module 10 is configured to acquire a target mail.

[0205] The first generation module 20 is configured to perform SPF (Sender Policy Framework) verification on the target mail and generate a first prompt according to a verification result.

[0206] The second generation module 30 is configured to calculate a probability value using a state transition probability method according to a spelling of a sending domain name in the target mail, and generate a second prompt by combining the probability value with a preset lower limit of confidence and a spelling feature in the target mail.

[0207] The third generation module 40 is configured to use a preset neural network model to generate a third prompt by splitting and real number conversion on a uniform resource locator in the target mail.

[0208] The fourth generation module 50 is configured to perform feature analysis on a macro-attached file, a suspected impersonation name and money information in the target mail, and generate a fourth prompt, a fifth prompt and a sixth prompt, respectively.

[0209] The summary module 60 is configured to generate risk prompt information according to the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt.

[0210] In an embodiment, the mail acquisition module 10 is specifically configured as follows:

[0211] The target mail is acquired from a mailbox system.

[0212] In an embodiment, the first generation module 20 is specifically configured as follows:

[0213] The target mail is verified using SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance), and a first prompt is generated according to a verification result.

[0214] In the embodiment, since SMTP does not check the mail address of the sender, SPF can supplement the security of SMTP (Simple Mail Transfer Protocol) in the target mail; however, the SPF protocol has many problems in use, for example, some domains lack strict SPF configurations, so that some mails that are not fake may not pass SPF authentication, therefore, not all mails that fail in SPF authentication have serious risk problems, so that the user can make a judgment by knowing the SPF check result; and DKIM and DMARC can further assist SPF to obtain a more perfect prompt, and provide more comprehensive prompt information for the user.

[0215] In one embodiment, the second generation module 30 includes a character unit, a matrix unit, a splitting unit, a probability value unit, a matrix unit, a first sub-unit, a second sub-unit and a third sub-unit;

[0216] The character unit is configured to convert the sending domain name in the target mail into a lowercase form.

[0217] The character unit is further configured to use a preset N value to traverse the sending domain name in the target mail by using the N-Gram algorithm to generate character substrings.

[0218] For example, assuming that the sending domain name of the target mail is 123456.cn, and the specified N is 3, then after traversing the sending domain name by using the N-Gram algorithm, the final substring list is: “123, 234, 345, 456, 56., 6.c,.cn”.

[0219] The matrix unit is configured to construct all possible N-Gram tuples according to the character substrings in combination with a preset character set to obtain a state transition probability matrix; the character set is established according to the character-related RFC standards that can be used in the sending domain name, and the source can be RFC 1035, RFC 1123, RFC 2181 and RFC 5892.

[0220] The splitting unit is configured to split the sending domain name in the state transition probability matrix to obtain a plurality of tuples.

[0221] The probability value unit is configured to calculate the average state transition probability value of the plurality of tuples to obtain a probability value.

[0222] In the matrix unit, in order to reduce the size of the matrix, N=2 can be specified, thereby directly constructing all possible 2gram tuples, the size of which is M, and then forming an initial state transition matrix of MxM size, and then calculating the state transition probability between all 2gram tuples, so as to obtain the state transition probability matrix.

[0223] The specific implementation of the matrix unit, the splitting unit and the probability value unit is as follows:

[0224] Suppose the corpus only has one sentence "I robot", by traversing the sending domain name in the target mail through the N-Gram algorithm, it can be known that when N=3, the split tuple is "iro, rob, obo, bot". According to the order before and after, it can be known that the transition object of the iro tuple is only the rob tuple, and the other tuples are similar, so the transition probability values of a plurality of tuples are obtained as shown in Table 1.

[0225] Table 1: Tuple transition probability value table

[0226] iro rob obo bot iro 0 1 0 0 rob 0 0 1 0 obo 0 0 0 1 bot 0 0 0 0

[0227] In the application of the embodiment of the application, Table 1 provides a tuple transition probability value table, which is the transition probability value of a plurality of tuples in the specific implementation example of the matrix unit, the splitting unit and the probability value unit.

[0228] This embodiment starts from the spelling of the sending domain name, and the process of constructing all possible N-Gram tuples according to the character substring is the process of constructing a Markov chain. By constructing a Markov chain based on spelling to calculate the average state transition probability value as the probability value of the mailbox address, probability credibility support can be provided for the generation of the second prompt.

[0229] The first sub-unit is configured to compare the probability value with a preset confidence lower limit to obtain a comparison result; wherein the confidence lower limit is obtained by calculating the probability values of all domain names in the preset trusted domain name list;

[0230] The construction process of the confidence lower limit is specifically as follows:

[0231] An AlexaRank ranking list (world comprehensive ranking list) of a website is obtained, and the list information of the top 20000 in the AlexaRank ranking list is used to construct a trusted domain name list;

[0232] The probability values of all domain names in the trusted domain name list are calculated to obtain a probability value set;

[0233] The minimum value in the probability value set is taken as the confidence lower limit.

[0234] The trusted domain name list in this embodiment is established on the basis of the world comprehensive ranking list, and therefore has high reliability, so that the confidence lower limit can be ensured to be a comprehensive credibility measurement standard for comparison with the probability value, and then the second prompt is generated.

[0235] The second subunit is configured to perform normalization detection on the character spelling features of the vowels and special symbols in the target email to obtain a detection result.

[0236] Specifically, the number of vowels and the number of special symbols (for example, "-", "_", and ".") in the target email are counted, and a domain name that exceeds an upper limit of a threshold value calculated based on historical statistical data is determined to obtain the detection result.

[0237] The detection result can show the number of symbols with low usage rate and the number of vowels with low proportion.

[0238] The third subunit is configured to generate a second prompt according to the comparison result, the detection result, and a low-frequency communication top-level domain list of the mailbox where the target email is located.

[0239] The construction process of the low-frequency communication top-level domain list is as follows:

[0240] The top-level domain name list is obtained by summarizing pre-collected spam data and publicly disclosed security reports. The selection conditions of the list include low usage frequency, low registration cost, and high spam frequency.

[0241] The historical email data of the user of the mailbox where the target email is located is counted, and a list of top-level domain names with which the user has a high frequency of communication is calculated. If the top-level domain of the sender's mailbox is not in the list, it is considered to be a top-level domain name with which the user has a low frequency of communication, and a low-frequency communication top-level domain name list is obtained.

[0242] The low-frequency communication top-level domain list is established according to the top-level domain name list and the low-frequency communication top-level domain name list.

[0243] The second generation module 30 in this embodiment is important for risk detection and reminder of the mailbox address from the overall point of view, because it is difficult for each security expert or recipient to identify whether a sender's mailbox address may have a problem based on their own independent knowledge.

[0244] Since the lower limit of the confidence degree is calculated by calculating the probability value of all domain names in the preset trusted domain name list, it represents the minimum value of the email credibility. Therefore, the comparison result obtained by comparing the probability value with the lower limit of the confidence degree can reflect the degree of abnormality of the mailbox address of the target email from an official point of view.

[0245] In addition, since the threshold lower limit of the state transition probability calculation uses the minimum value, it is relatively conservative, so by combining the character spelling feature detection result of the target mail itself and the low-frequency communication top-level domain list, the mailbox address structure of the target mail itself and the less frequent mailbox address can be considered, and the second prompt can not only be generated by analyzing the target mail from the outside, but also contain detailed considerations of internal details, making the second prompt more objective and accurate and effective.

[0246] In one embodiment, the third generation module 40 includes a first segmentation unit, a screening unit, a reconstruction unit, an auxiliary unit, and a transformation unit.

[0247] The first segmentation unit is configured to use a preset LSTM (Long Short-Term Memory) deep learning network structure to segment the URL (Uniform Resource Locator) in the target mail into a first character set. The input processing of the LSTM deep learning network structure refers to the input word processing method of a large language model, and a large number of characters that can support segmentation are defined in the network structure.

[0248] The screening unit is configured to screen out characters in the first character set that are not in the preset character set to obtain a second character set, and define the character identifiers of the second character set as unknown characters.

[0249] The reconstruction unit is configured to add a preset beginning character and an ending character at the head and tail of the unknown characters, respectively, to obtain a numbered list of the second character set.

[0250] The auxiliary unit is configured to generate a comprehensive auxiliary prompt according to the IP host bit, short URL, and external download link in the target mail. Specifically:

[0251] If it is detected by regular expression that the IP address of the host bit where the target mail is located is not an intranet IP, a first auxiliary prompt is output to prompt that the IP address of the target mail is not an intranet IP.

[0252] If the URL in the target mail points to a browser download link at the end, a second auxiliary prompt is output to prompt that the target mail points to an external download link. For example, https: / / www.123.com / abc.png, since “png” is an image, the general browser will not trigger automatic download, so it is not an external download link. However, if the URL is https: / / www.123.com / abc.exe, most browsers will parse it as a download link to pop up a save window, which constitutes a download link.

[0253] If the host bit of the target email is matched with the domain name in the pre-acquired short URL service list through the regular, the third auxiliary prompt is outputted if the matching hits, which is used to prompt the target email pointing to the short URL;

[0254] The comprehensive auxiliary prompt is generated according to the first auxiliary prompt, the second auxiliary prompt and the third auxiliary prompt.

[0255] The embodiment is to generate the comprehensive auxiliary prompt according to the differences of IP as the host bit, using the short URL and pointing to the external download link in different scenes. Since the spelling-based method is not suitable for checking the URL in these scenes, the LSTM network cannot be used to detect these URLs, so by taking corresponding detection measures for the three kinds of information, a comprehensive comprehensive auxiliary prompt can be obtained to make relevant reminders.

[0256] The transformation unit is configured to perform softmax transformation on the number list using a binary classification network structure in the LSTM deep learning network structure to obtain an abnormal probability of the uniform resource locator, and generate an initial prompt according to the abnormal probability;

[0257] The transformation unit is also configured to combine the initial prompt and the comprehensive auxiliary prompt to obtain a third prompt.

[0258] It should be noted that in the embodiment of the application, the first-level domain name after excluding the top-level domain is combined with the top-level domain as the host position, and for multiple URLs with the same host position, only the first appearing URL is checked. For example, the host positions of 123.com.cn and 456.123.com.cn are both 123.com.cn, while 123.com and 123.cn are not the same host bit. Moreover, the softmax transformation is a mathematical transformation of the original variable, which uses the softmax function. The softmax function is also called a normalized exponential function, which is a mathematical function commonly used to convert a set of arbitrary real numbers into real numbers representing a probability distribution.

[0259] The third generation module 40 of the embodiment is from the whole, since the junk phishing email often uses the method of guiding the user to click the corresponding URL to achieve the purpose, so the URL with the risk in the target email is prompted, which can have a more refined and accurate prompting effect than using the transfer page to transfer all external links;

[0260] The embodiment is to detect the uniform resource locator carried in the mail, and then generate the third prompt. By splitting and screening the uniform resource locator in the target mail, unknown characters can be obtained. By adding characters at the head and tail of the unknown characters, the characters in the numbered list can be clear and orderly, which can help to obtain faster conversion speed during transformation processing, speed up the abnormal probability acquisition process of the uniform resource locator, and quickly generate the third prompt.

[0261] Compared with the domain name of the message, the uniform resource locator carried in the mail is longer, so it is not suitable to use simple state transition probability and character number to make judgment. By using the neural network model to convert the abnormal probability, the analysis time can be greatly saved, and the prompt accuracy of the third prompt can be improved.

[0262] In one embodiment, the fourth generation module 50 includes a first acquisition unit, a first generation unit, a second acquisition unit, a first matching unit, a fourth sub-unit, a fifth sub-unit, a sixth sub-unit, a seventh sub-unit, an eighth sub-unit, a ninth sub-unit, a third acquisition unit, a second division unit and a second matching unit.

[0263] The first acquisition unit is configured to acquire the macro-enabled attachment in the target mail.

[0264] The first generation unit is configured to generate a fourth prompt according to the dangerous file if the dangerous file in the macro-enabled attachment appears in the watch list.

[0265] The watch list is established according to the prohibited attachment type of the mailbox where the target mail is located (for example, the attachment list type prohibited to be uploaded by outlook), and the preset watch file.

[0266] The watch file includes files that can be directly executed, such as “.exe”, “.bat”, “.ps” and “.sh”, and macro files such as “.docm” and “.xlsm”.

[0267] The embodiment is to detect the attachment carried in the mail, and then generate the fourth prompt. Since the above-mentioned watch file and its easy-to-operate or mail-inducing content can be executed, for example, the office file with macro is usually safe even if it carries a macro virus in the read-only mode and disables the macro, but if the user enables the macro, it may be poisoned, so by judging whether the macro-enabled attachment is a dangerous file through the watch list, it can be quickly known whether the macro-enabled attachment in the target mail has an operation risk, and the user is timely reminded. The fourth prompt is generated in a simple and fast way.

[0268] The second acquisition unit is configured to acquire a mail header of the target mail, and match the mail header with a preset dictionary tree to obtain a first matching result. The dictionary tree is established according to a list of government agencies, banks and public security and procuratorial agencies, and names of enterprise permanent establishments.

[0269] The first matching unit is configured to acquire an entity name of the target mail, and match the entity name with a B-ORG (company or organization) list and an I-PER (person) list in a sequence labeling algorithm to obtain a second matching result.

[0270] The fourth sub-unit is configured to, if the first matching result or the second matching result is a matching success, perform category judgment on a sending mail address of the target mail to obtain a declarer of the target mail.

[0271] The fifth sub-unit is configured to, if the declarer is a government agency or a public security and procuratorial agency, check whether a top-level domain name of the target mail belongs to a preset special top-level domain (for example, “.gov” and “.mit”).

[0272] The sixth sub-unit is configured to, if the declarer is a bank, an invoice service provider or an enterprise, check whether a domain name used by the target mail belongs to a pre-collected list.

[0273] The seventh sub-unit is configured to, if the declarer is an enterprise permanent establishment, check whether a sender and a receiver of the target mail constitute a same domain or a sub-domain.

[0274] The eighth sub-unit is configured to, if the declarer is a person name, check whether the declarer is in a preset address book.

[0275] The ninth sub-unit is configured to generate a fifth prompt according to a check result.

[0276] The embodiment detects whether a subject name of the mail is counterfeit, and then generates the fifth prompt according to the detection result. Although an SPF protocol and the like have certain protection capability for a fake mail address, they cannot cope with the behavior of using the visual effect of mail reading to impersonate the name of others, so it is of great significance to find an entity and judge the entity to know whether the subject name is counterfeit.

[0277] Firstly, through matching, it can be known whether the target email is matched successfully, that is, whether it constitutes a statement. Since the statement refers to a formal statement issued by official agencies such as government, enterprise, organization, etc., it is usually to respond to some event or situation, express the official position and attitude, and its sending email address is generally more official and formal. Therefore, after determining that it constitutes a statement, the sending email address is directly checked to quickly know whether the target email is imitated, and then the fifth prompt is obtained. Moreover, the generation of the second matching result uses the open source BiLSTM+CRF technology, which can provide a corresponding list for the key attention object to perform fast matching;

[0278] In addition, since the top-level domain name of the government agency and the public security and procuratorial agencies will have a special top-level domain name in most cases, the top-level domain name can be directly checked to know whether the mailbox is abnormal. Since enterprises usually have a belonging relationship between the regular institutions, whether the mailbox is abnormal can be known by checking whether it constitutes a same domain or a subdomain. Using the pre-collected list and the address book, it can be quickly and directly judged whether the bank or the personal mailbox is abnormal. The present scheme provides corresponding different sending email address checking methods from the perspectives of government agencies, banks, enterprise regular institutions and individuals. The checking method is highly targeted and can accelerate the generation process of the fifth prompt.

[0279] The third acquisition unit is configured to acquire text information of the target email;

[0280] The second segmentation unit is configured to segment the text information using a TextCNN (convolutional neural network) module as a classifier to obtain a plurality of character strings tokens. The classifier is controlled in physical size and occupied memory space by a preset word table.

[0281] The second matching unit is configured to match the plurality of character strings with a preset money word table, mask (MASK) tokens not in the money word table, and obtain a matching result.

[0282] The second matching unit is further configured to generate a sixth prompt according to the matching result.

[0283] The money word table is established according to the preset financial fraud information.

[0284] In the embodiment, general email classification only determines whether the email is a spam email and does not care about the specific type of spam email. However, in all frauds, the one involving money is usually the most sensitive. Therefore, it is necessary to provide additional reminders for the information involving money and possibly constituting fraud.

[0285] The classifier is used to split the text information, which is equivalent to data segmentation and extraction of the original mail text, so that the words in the obtained several strings are convenient for comparison and matching with the money word table, and the acquisition process of the sixth prompt is accelerated.

[0286] In one embodiment, the summary module 60 is specifically:

[0287] A unique id and a unique label are configured for the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt as a label, and according to a pre-established multilingual script dictionary and the output of various labels corresponding to placeholders, the output of the first prompt, the second prompt, the third prompt, the fourth prompt, the fifth prompt and the sixth prompt corresponding to each label is controlled by passing in a language mark parameter, and the information after integration is obtained, and risk prompt information is obtained.

[0288] The multilingual script dictionary is obtained by manual writing.

[0289] The generation result of the prompt can support multiple languages by the format output method, and compared with the machine translation method, the prompt script of the scheme is written by artificial, the language is more appropriate and natural, and the experience of the user can be enhanced.

[0290] Overall, the embodiment of the application has the following beneficial effects:

[0291] The device obtains corresponding prompts by taking different detection methods from six aspects of SPF verification, spelling of the sending domain name, uniform resource locator, macro-attached attachment, suspected impersonation name and money information, and then generates risk prompt information with high comprehensiveness, so that the risk prompt can be quickly and effectively performed at one time, the occurrence of missing prompt problems is avoided, and the information security of the target mail is ensured.

[0292] The potential non-corresponding identity declaration is recognized by a method based on entity recognition and knowledge base matching to prompt the possible impersonation mail, the range covered is wide, and the missing risk can be reduced; the scheme based on entity recognition can find the organization name in the given text to find the potential entity impersonation, which cannot be achieved by simply matching the contact person; and compared with the "one-size-fits-all" scheme of prohibiting direct access to external links, the embodiment of the application uses a method combining experience knowledge and deep learning model to identify suspicious specific URLs, which can avoid the problem that the prompt is too general and the user is numb and the information prompt is missed.

[0293] Embodiment three:

[0294] The embodiment of the present application provides a computer readable storage medium, the computer readable storage medium comprises a stored computer program, wherein the computer readable storage medium is controlled by the computer program to execute the mail-based risk prompt information generation method when the computer program is running.

[0295] The mail-based risk prompt information generation method can be stored in a computer readable storage medium if the mail-based risk prompt information generation method is implemented in the form of a software function unit and used as an independent product. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. The computer program can implement the steps of the above-mentioned various method embodiments when the computer program is executed by a processor. The computer program comprises computer program code, and the computer program code can be in the form of source code, object code, an executable file or some intermediate form. The computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal and a software distribution medium and the like.

[0296] The above is the preferred embodiment of the present application, and it should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements are also considered to be within the protection scope of the present application.

Claims

1. A method for generating risk warning information based on email, characterized in that, include: Retrieve the target email; The target email is verified using the sender policy framework, domain key identification email standard, and email domain verification protocol, and a first prompt is generated based on the verification result. Based on the spelling of the sending domain name in the target email, a probability value is calculated using the state transition probability method. The probability value is then combined with a preset confidence lower limit and the spelling features in the target email to generate a second prompt. Using a preset neural network model, a third prompt is generated by segmenting and converting the Uniform Resource Locator (URL) in the target email into real numbers; The macro attachments, suspected impersonation of names, and monetary information in the target email are analyzed to generate a fourth, fifth, and sixth prompt message, respectively. Risk warning information is generated based on the first, second, third, fourth, fifth, and sixth prompts. Specifically, a unique ID and a unique label are configured for each of the first, second, third, fourth, fifth, and sixth prompts as tags. Based on a pre-established multilingual text dictionary and placeholders corresponding to the output of various tags, the information of the first, second, third, fourth, fifth, and sixth prompts corresponding to each tag is integrated by passing language tag parameters to obtain the risk warning information.

2. The method for generating risk warning information based on email as described in claim 1, characterized in that, Based on the spelling of the sending domain name in the target email, a probability value is calculated using the state transition probability method. This probability value is then combined with a preset confidence lower limit and the spelling features in the target email to generate a second prompt, specifically: The sending domain name in the target email is converted to lowercase. Using a preset N value, the sending domain name in the target email is traversed through the N-Gram algorithm to generate a character substring. By combining a preset character set, all possible N-Gram tuples are constructed based on the character substrings to obtain the state transition probability matrix; The sending domain name in the state transition probability matrix is ​​split into several tuples; The average state transition probability value of the aforementioned tuples is calculated to obtain the probability value; The probability value and the lower confidence limit are compared, and the comparison result is combined with the spelling features in the target email to generate a second prompt.

3. The method for generating email-based risk warning information as described in claim 2, characterized in that, The probability value is compared with a preset confidence lower limit, and the comparison result is combined with the spelling features in the target email to generate a second prompt, specifically: The probability value is compared with a preset confidence level lower limit to obtain a comparison result; wherein, the confidence level lower limit is calculated by calculating the probability values ​​of all domains in the preset trusted domain name list; The spelling features of vowels and special symbols in the target email are subjected to normalization detection to obtain the detection results; The second prompt is generated based on the comparison results, the detection results, and the list of low-frequency communication top-level domains of the mailbox where the target email is located.

4. The method for generating email-based risk warning information as described in claim 3, characterized in that, The confidence lower limit is calculated by evaluating the probability values ​​of all domains in a preset list of trusted domains, specifically as follows: Obtain a global comprehensive ranking list of websites, and use some information from the global comprehensive ranking list to construct a list of trusted domain names; Calculate the probability value of all domains in the trusted domain list to obtain the probability value set; The minimum value in the set of probability values ​​is taken as the lower confidence limit.

5. The method for generating risk warning information based on email as described in claim 1, characterized in that, Using a pre-defined neural network model, a third prompt is generated by segmenting and converting the Uniform Resource Locator (URL) in the target email into real numbers. Specifically: Using a pre-defined neural network model, the Uniform Resource Locators (URLs) in the target email are segmented into a first character set; Filter out characters from the first character set that are not in the preset character set to obtain the second character set, and define the character identifiers of the second character set as unknown characters; Preset start and end characters are added to the beginning and end of the unknown characters respectively to obtain a list of numbers for the second character set; The number list is transformed using the binary classification network structure in the neural network model to obtain the anomaly probability of the Uniform Resource Locator, and the third prompt is generated based on the anomaly probability.

6. The method for generating email-based risk warning information as described in claim 1, characterized in that, The macro-attached content in the target email is analyzed for features, and a fourth prompt is generated, specifically: Retrieve macro-attached files from the target email; If a dangerous file from the priority list appears in the macro attachment, the fourth prompt message is generated based on the dangerous file. The key attention list is established based on the types of attachments that are prohibited from being uploaded to the email address containing the target email, as well as preset key attention files.

7. The method for generating risk warning information based on email as described in claim 1, characterized in that, The suspected spoofed name in the target email is analyzed for features, and a fifth prompt is generated, specifically: Obtain the email header of the target email, match the email header with a preset trie, and obtain a first matching result; wherein, the trie is built based on the list of government agencies, banks, public security and judicial agencies, and the names of permanent establishments of enterprises; Obtain the entity name of the target email, and match the entity name with the company list and individual list in the sequence labeling algorithm to obtain a second matching result; If either the first or second matching result is successful, the sender's email address of the target email is checked, and the fifth prompt is generated based on the check result.

8. The method for generating email-based risk warning information as described in claim 7, characterized in that, The sender's email address of the target email is checked, and the fifth prompt message is generated based on the check results, specifically: The sender's email address of the target email is categorized to obtain the declaration object of the target email; If the object of the statement is a government agency or a public security, procuratorial or judicial agency, then check whether the top-level domain of the target email belongs to a preset special top-level domain; If the object of the statement is a bank, invoice service provider, or enterprise, then check whether the domain name used by the target email belongs to a pre-collected list; If the object of the statement is a permanent establishment of an enterprise, then check whether the sender and recipient of the target email are in the same domain or a subdomain. If the declared object is a person's name, then check whether the declared object is in the preset address book; The fifth prompt is generated based on the inspection results.

9. A method for generating email-based risk warning information as described in claim 1, characterized in that, The monetary information in the target email is analyzed for features, and a sixth prompt is generated, specifically: Obtain the text information of the target email; The text information is segmented using a preset classifier to obtain several strings; The strings are matched with a preset list of money-related terms, and the sixth prompt is generated based on the matching results. The money vocabulary is built based on preset financial fraud information.

10. A device for generating risk warning information based on email, characterized in that, It includes an email retrieval module, a first generation module, a second generation module, a third generation module, a fourth generation module, and a summary module; The email acquisition module is used to acquire the target email; The first generation module is used to verify the target email using the sender policy framework, domain key recognition email standard and email domain verification protocol, and generate a first prompt message based on the verification result; The second generation module is used to calculate a probability value based on the spelling of the sending domain name in the target email using the state transition probability method, and to generate a second prompt by combining the probability value with a preset confidence lower limit and the spelling features in the target email. The third generation module is used to generate a third prompt message by using a preset neural network model to segment and convert the Uniform Resource Locator (URL) in the target email into real numbers. The fourth generation module is used to perform feature analysis on the macro attachments, suspected impersonation names, and monetary information in the target email, and generate a fourth prompt, a fifth prompt, and a sixth prompt, respectively. The aggregation module is used to generate risk warning information based on the first, second, third, fourth, fifth, and sixth prompts. Specifically, it configures a unique ID and a unique label for each of the first, second, third, fourth, fifth, and sixth prompts as tags. Based on a pre-established multilingual text dictionary and placeholders corresponding to the output of various tags, it controls the output of the first, second, third, fourth, fifth, and sixth prompts corresponding to each tag by inputting language tag parameters, and integrates the information to obtain the risk warning information.

11. The risk warning information generation device based on email as described in claim 10, characterized in that, The second generation module includes character units, matrix units, splitting units, probability value units, and comparison units; The character unit is used to convert the sending domain name in the target email into lowercase form, and to generate a character substring by traversing the sending domain name in the target email using a preset N value and an N-Gram algorithm. The matrix unit is used to combine a preset character set and construct all possible N-Gram tuples based on the character substring to obtain a state transition probability matrix. The splitting unit is used to split the sending domain name in the state transition probability matrix to obtain several tuples; The probability value unit is used to calculate the average state transition probability value of the plurality of tuples to obtain the probability value; The comparison unit is used to compare the probability value and the confidence level lower limit, and combine the comparison result with the spelling features in the target email to generate a second prompt.

12. The risk warning information generation device based on email as described in claim 11, characterized in that, The comparison unit includes a first subunit, a second subunit, and a third subunit; The first subunit is used to compare the probability value with a preset confidence level lower limit to obtain a comparison result; wherein the confidence level lower limit is calculated by calculating the probability values ​​of all domains in a preset trusted domain name list; The second subunit is used to perform standardization detection on the character spelling features of vowels and special symbols in the target email, and obtain the detection results; The third subunit is used to generate the second prompt message based on the comparison result, the detection result, and the list of low-frequency communication top-level domains of the mailbox where the target email is located.

13. The risk warning information generation device based on email as described in claim 12, characterized in that, The confidence lower limit is calculated by evaluating the probability values ​​of all domains in a preset list of trusted domains, specifically as follows: Obtain a global comprehensive ranking list of websites, and use some information from the global comprehensive ranking list to construct a list of trusted domain names; Calculate the probability value of all domains in the trusted domain list to obtain the probability value set; The minimum value in the set of probability values ​​is taken as the lower confidence limit.

14. The risk warning information generation device based on email as described in claim 10, characterized in that, The third generation module includes a first segmentation unit, a filtering unit, a reconstruction unit, and a transformation unit; The first segmentation unit is used to segment the Uniform Resource Locator (URL) in the target email into a first character set using a preset neural network model. The filtering unit is used to filter out characters in the first character set that are not in the preset character set, to obtain a second character set, and to define the character identifiers of the second character set as unknown characters; The reconstruction unit is used to add preset beginning and ending characters to the beginning and end of the unknown characters respectively to obtain a number list about the second character set; The transformation unit is used to transform the number list using the binary classification network structure in the neural network model to obtain the anomaly probability of the Uniform Resource Locator, and generate the third prompt based on the anomaly probability.

15. The risk warning information generation device based on email as described in claim 10, characterized in that, The fourth generation module includes a first acquisition unit and a first generation unit; The first acquisition unit is used to acquire macro attachments in the target email. The first generation unit is used to generate the fourth prompt message based on the dangerous file if a dangerous file from the key concern list appears in the macro attachment; The key attention list is established based on the types of attachments that are prohibited from being uploaded to the email address containing the target email, as well as preset key attention files.

16. The risk warning information generation device based on email as described in claim 10, characterized in that, The fourth generation module includes a second acquisition unit, a first matching unit, and a checking unit; The second acquisition unit is used to acquire the email header of the target email, match the email header with a preset trie, and obtain a first matching result; wherein the trie is built based on a list of government agencies, banks, public security and judicial agencies, and the names of permanent establishments of enterprises. The first matching unit is used to obtain the entity name of the target email, and match the entity name with the company list and individual list in the sequence labeling algorithm to obtain the second matching result; The inspection unit is used to inspect the sending email address of the target email if either the first matching result or the second matching result is a successful match, and generate the fifth prompt message based on the inspection result.

17. The risk warning information generation device based on email as described in claim 16, characterized in that, The inspection unit includes a fourth subunit, a fifth subunit, a sixth subunit, a seventh subunit, an eighth subunit, and a ninth subunit; The fourth subunit is used to classify the sending email address of the target email to obtain the declaration object of the target email. The fifth subunit is used to check whether the top-level domain of the target email belongs to a preset special top-level domain if the declared object is a government agency or a public security, procuratorial or judicial agency. The sixth subunit is used to check whether the domain name used by the target email belongs to a pre-collected list if the declared object is a bank, invoice service provider or enterprise. The seventh subunit is used to check whether the sender and recipient of the target email are in the same domain or a subdomain if the declared object is a permanent establishment of an enterprise. The eighth subunit is used to check whether the declared object is in a preset address book if the declared object is a person's name. The ninth sub-unit is used to generate the fifth prompt based on the inspection results.

18. The risk warning information generation device based on email as described in claim 10, characterized in that, The fourth generation module includes a third acquisition unit, a second segmentation unit, and a second matching unit; The third acquisition unit is used to acquire the text information of the target email; The second segmentation unit is used to segment the text information using a preset classifier to obtain several strings; The second matching unit is used to match the plurality of strings with a preset list of money-related terms, and generate the sixth prompt based on the matching result; The money vocabulary is built based on preset financial fraud information.

19. A storage medium, characterized in that, The storage medium stores a computer program, which is called and executed by a computer to implement any one of the email-based risk warning information generation methods as described in claims 1 to 9.

Images