A method, device and system for detecting email security

Abstract

The present invention discloses an email security detection method, device and system, and relates to the field of information security technology. The method implementation method may include: matching an email attachment sent by an email security gateway with a feature set of one or more viruses stored, wherein the feature set of one or more viruses includes virus features determined based on historical email attachments; determining the security detection result of the email attachment according to the matching result, and returning the security detection result to the email security gateway in response to the result acquisition request of the email security gateway, so that the email security gateway processes the email attachment according to the security detection result; in the case where the security detection result of the email attachment indicates that the attachment is legal, sending the email attachment to a cloud sandbox, so that the cloud sandbox performs security analysis on the email attachment; in the case where the security analysis result indicates that the attachment is illegal, updating the feature set based on the email attachment or the security analysis result. This effectively reduces the underreporting of email virus attachments and improves email security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a mail security detection method, device and system. Background Art

[0002] Phishing emails have long been the main means of cyber attacks. It is reported that 70% of cyber attacks start with phishing emails. Virus emails, as a common type of phishing emails, refer to emails that contain viruses, which trigger virus files when browsing links in emails or downloading attachments, causing computers to be infected by viruses. In particular, for virus attachments, the character strings included in virus attachments may have many deformations, and the accuracy of using existing feature codes or hash values ​​generated based on the file content in virus attachments (character strings in virus attachments, etc.) to match email attachment blacklists or email attachment whitelists is poor. For example, once the file content in a virus attachment changes or deforms, its feature code or hash value will also change. At this time, it is difficult to find the deformed virus attachment through feature code or hash value matching, resulting in missed detection of virus attachments, and there are still relatively large risks in email security. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides an email security detection method, device and system, which can effectively reduce the underreporting of email virus attachments and improve email security.

[0004] To achieve the above objectives, in a first aspect, an embodiment of the present invention provides an email security detection method, comprising:

[0005] Accepting a detection result query of a file hash value of a specific email attachment from an email security gateway, and returning the detection result of the email attachment, so that the email security gateway processes the email attachment according to the security detection result;

[0006] Receiving an email attachment sent by an email security gateway, matching the email attachment with a stored feature set of one or more viruses, and determining a security detection result of the email attachment based on the matching result. The feature set of one or more viruses includes virus features that are determined based on historical email attachments;

[0007] If the security detection result of the email attachment indicates that the attachment is legal, sending the email attachment to the cloud sandbox so that the cloud sandbox performs a security analysis on the email attachment;

[0008] A security analysis result for the email attachment is obtained from the cloud sandbox, and when the security analysis result indicates that the attachment is illegal, the feature set is updated based on the security analysis result for the email attachment.

[0009] Optionally, the email security detection method further includes:

[0010] When the email security gateway cannot find a detection record based on the file hash value of the email attachment, the step of receiving the email attachment sent by the email security gateway is performed.

[0011] Optionally, the above-mentioned email security detection method also includes: reading virus features from the security analysis results for the email attachment sent by the cloud sandbox, and combining the virus features into a feature set.

[0012] Optionally, the email security detection method further includes:

[0013] Storing the received email attachment sent by the email security gateway to a local disk;

[0014] The sending of the email attachment to the cloud sandbox includes:

[0015] The email attachment indicating legitimacy stored in the local disk is sent to the cloud sandbox.

[0016] Optionally, the email security detection method further includes:

[0017] Send a resource acquisition request to the operating platform equipped with the cloud sandbox, and receive available resources for the cloud sandbox fed back by the operating platform;

[0018] The step of sending the email attachment to the cloud sandbox is performed based on available resources for the cloud sandbox.

[0019] Optionally, after receiving the email attachment sent by the email security gateway, the method further includes:

[0020] Generate a security detection task for the email attachment, determine initial information and task management information for the security detection task based on the email attachment, and store the initial information, task status and task management information in a database;

[0021] The task management information is updated according to a result of matching the email attachment with a stored feature set of one or more viruses or a security analysis result of the cloud sandbox on the email attachment.

[0022] Optionally, the email security detection method further includes:

[0023] Regularly obtain the attachment information of the safety detection task in the task status indication detection from the database;

[0024] According to the attachment information, a security analysis result for the email attachment is obtained from the cloud sandbox.

[0025] Optionally, the step of receiving an email attachment sent by an email security gateway and matching the email attachment with a stored feature set of one or more viruses; when the email security gateway queries the email attachment detection result, the step of determining the security detection result of the email attachment and returning the security detection result to the email security gateway and the step of sending the email attachment to the cloud sandbox are implemented based on the front-end service interface;

[0026] The step of obtaining the security analysis result for the email attachment from the cloud sandbox and the step of determining and updating a new feature set based on the security analysis result of the email attachment are implemented based on a background service module.

[0027] In a second aspect, an embodiment of the present invention provides an email security detection device, comprising: a query module, a security detection module and a management module, wherein:

[0028] The security detection module is used to receive an email attachment sent by an email security gateway, match the email attachment with a stored feature set of one or more viruses, wherein the virus features included in the feature set of one or more viruses are determined based on historical email attachments; determine a security detection result of the email attachment based on the matching result; and when the security detection result of the email attachment indicates that the attachment is legal, send the email attachment to a cloud sandbox so that the cloud sandbox performs a security analysis on the email attachment;

[0029] The query module is used to respond to the result acquisition request of the email security gateway and return the security detection result to the email security gateway so that the email security gateway processes the email attachment according to the security detection result; receive the query of the email security gateway on the security detection result of the email attachment and return the security detection result to the email security gateway so that the email security gateway processes the email attachment according to the security detection result;

[0030] The management module is used to obtain a security analysis result for the email attachment from the cloud sandbox, and when the security analysis result indicates that the attachment is illegal, determine and store a new feature set based on the email attachment or the security analysis result.

[0031] In a third aspect, an embodiment of the present invention provides an email security detection system, including: a cloud sandbox and the email security detection device provided in the embodiment of the second aspect above.

[0032] One embodiment of the above invention has the following advantages or beneficial effects: by matching the email attachment sent by the email security gateway with the feature set of one or more stored viruses, the email attachment is security checked to obtain a security test result. Compared with the cloud sandbox detecting the security of the email attachment by running the email attachment, the feature set matching method has a higher detection efficiency, so that the email security gateway can intercept or release the email attachment in time according to the security test result. In addition, in the case where the security test result of the email attachment indicates that the attachment is legal, further security analysis is performed through the cloud sandbox. After the cloud sandbox security analysis result indicates that the attachment is illegal, a new feature set is determined. By updating the feature set, the feature set of the virus is expanded. Subsequently, the virus can be quickly matched based on the feature set, which ensures the efficiency of the email attachment security test while effectively improving the accuracy of the email attachment security test and improving the security of the email.

[0033] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0035] Figure 1 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0036] Figure 2 is a schematic diagram of the main process of an email security detection method according to an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of the main process of task management in the email security detection method according to an embodiment of the present invention;

[0038] Figure 4 is a schematic diagram of main modules of an email security detection device according to an embodiment of the present invention;

[0039] Figure 5 is a schematic diagram of main devices of a mail security detection system according to an embodiment of the present invention;

[0040] Figure 6 It is a schematic diagram of the main process of processing email attachments by the front-end service interface and the email security gateway according to an embodiment of the present invention;

[0041] Figure 7 It is a schematic diagram of the main process of combining the backend service module and the cloud sandbox to perform email security detection according to an embodiment of the present invention;

[0042] Figure 8It is a structural diagram of a computer system of a device including a front-end service interface and a back-end service module suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0043] As described in the background technology, the existing rule-based static detection technology for email attachments is mainly divided into the following two methods:

[0044] Signature rule detection: Use signature rules to match the file content of email attachments. If a match is found, it is considered a malicious file. The matched file content may be binary data, or it may be the result of signature rule calculation such as text strings or operation codes.

[0045] Hash value detection: mainly matches the hash value of the email attachment with the hash value maintained by the blacklist. The hash value may be an md5 value or a sha256 value.

[0046] Both methods have the effect of rapid detection and are one of the current mainstream email security gateway implementation methods and one of the main implementation methods of antivirus software. That is, existing email attachments are either detected by the email security gateway or implemented by the antivirus software installed on the client or email security gateway. However, the game relationship between viruses and antivirus determines the continuous mutation characteristics of viruses. After the virus mutates, the signature code and hash value will change, resulting in missed reports. This leads to the fact that the virus detection method relies heavily on the support of threat intelligence, and it is necessary to maintain a huge signature library composed of signature codes and hash values ​​for a long time. For the internal system of an enterprise, it is obviously difficult to maintain a huge threat intelligence signature library, and the only way is to regularly update the virus signature library of the email security gateway.

[0047] Based on this situation, some email security gateways have combined sandbox technology to launch email security gateways with cloud sandboxes. Some gateways even have built-in cloud sandbox detection, which can automatically detect malicious code, executable files, malware, and determine whether there are abnormal network behaviors, create processes and other advanced threats in an independent and isolated environment, thereby greatly improving the recognition rate of unknown malware. However, since the cloud sandbox detection process is mainly to execute the unknown executable files included in the email attachments, and determine whether the email attachments are malicious files based on the results of the execution. Since it takes a certain amount of time for the cloud sandbox to execute unknown executable files, during the cloud sandbox detection period, in order to ensure the timeliness of the email, the email security gateway generally sends the email to the client, but the email security cannot be guaranteed.

[0048] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0049] Figure 1 An exemplary system architecture 100 is shown to which the email security detection method or email security detection device according to the embodiment of the present invention can be applied.

[0050] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, a network 103, a mail system server 104, a mail gateway server 105, a mail security detection front end 106, a mail security detection back end server 107, a database 108, and a cloud sandbox device 109. The network 103 is used to provide a medium for communication links between the terminal devices 101, 102 and the mail system server 104, between the mail system server 104 and the mail gateway server 105, between the mail gateway server 105 and the mail security detection front end 106, between the mail security detection front end 106 and the database 108, between the mail security detection back end server 107 and the database 108, between the mail security detection front end 106 and the cloud sandbox device 109, and between the mail security detection back end server 107 and the cloud sandbox device 109. The network 103 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0051] The mail gateway server 105 can perform security checks on received mails by means of feature codes or hash values, and send the received mails to the mail security detection front end 106 , and send mails that it detects as safe and that are also detected as safe by the mail security detection front end 106 to the mail system server 104 .

[0052] The mail system server 104 can display the mails sent by the mail gateway on the terminal devices 101 and 102 through the mail client or browser.

[0053] The email security detection front end 106 receives the detection result query request about the hash value of the specific email attachment file sent by the email gateway server 105, and queries the corresponding detection result in the database 108, and then provides the result to the email gateway server 105, so that the email gateway server 105 performs corresponding processing according to the detection result of the email attachment. The email security detection front end 106 stores the email attachment sent by the received email gateway server 105 to the disk, and matches the content in the email attachment with the stored virus feature set, and determines that the email attachment is a virus file when the feature set is matched for the email attachment. In the case where the feature set is not matched for the email attachment, the email attachment stored on the disk is sent to the cloud sandbox device 109. In addition, the email security detection front end 106 determines the initial data, detection status, detection result and other information of the email attachment, and stores this information in the database 108.

[0054] The email security detection backend server 107 obtains a security analysis report for email attachments from the cloud sandbox device 109, obtains features and detection results from the security analysis report, updates the obtained features to the feature set used by the email security detection front end 106, and updates the detection results to the database 108.

[0055] The cloud sandbox device 109 may be provided with a plurality of virtual machines, each of which is equipped with a cloud sandbox. The cloud sandboxes equipped with each virtual machine perform security checks on different email attachments respectively.

[0056] The terminal devices 101 and 102 may be various electronic devices having a display screen and supporting web browsing, including but not limited to desktop computers, smart phones, tablet computers, and the like.

[0057] It should be noted that the email security detection method provided in the embodiment of the present invention is generally completed by the cooperation of the email security detection front end 106 and the email security detection background server 107 equipped with a cloud sandbox device 109. Accordingly, the various modules of the email security detection device can be separately arranged in the email security detection front end 106 and the email security detection background server 107.

[0058] It should be understood that Figure 1 The number of terminal devices, networks, mail system servers, mail gateway servers, mail security detection front-ends, mail security detection back-end servers, databases, and cloud sandbox devices in the present invention is only illustrative. According to the implementation requirements, there may be any number of terminal devices, networks, mail system servers, mail gateway servers, mail security detection front-ends, mail security detection back-end servers, databases, and cloud sandbox devices.

[0059] Figure 2FIG. 1 is a schematic diagram of the main flow of an email security detection method according to an embodiment of the present invention. Figure 2 As shown, the email security detection method may include the following steps:

[0060] Step S201: receiving an email attachment sent by an email security gateway, and matching the email attachment with a stored feature set of one or more viruses, wherein the feature set of one or more viruses includes virus features determined based on historical email attachments;

[0061] The email attachment may be an Office document, PDF, executable file, script or other file in any format sent along with the email.

[0062] Among them, virus features generally refer to the parts of a virus or virus file that do not change, such as feature strings, feature bytecodes, feature executable file segment names, feature hash values, etc.

[0063] Among them, historical mail attachments generally refer to mail attachments processed or received before the current time. In addition, the historical mail attachments can also be virus files stored in a maintained virus library, etc.

[0064] The specific implementation of determining the virus features included in the feature set based on historical email attachments can be: reading the virus features from the security analysis results for email attachments obtained from the cloud sandbox, and merging the virus features with the feature sets of one or more current viruses into a new virus feature set.

[0065] Step S202: determining the security detection result of the email attachment according to the matching result, and returning the security detection result to the email security gateway in response to the result acquisition request of the email security gateway, so that the email security gateway processes the email attachment according to the security detection result;

[0066] It can be understood that after the matching result indicates that the email attachment matches the feature set, the security check result of the email attachment can be determined as the attachment is illegal; after the matching result indicates that the email attachment does not match the feature set, the security check result of the email attachment is determined as the attachment is legal. Among them, illegal attachment generally means that the email attachment may contain virus threats and is unsafe. Legal attachment generally means that the email attachment does not contain virus threats and is safe. Step S203: In the case where the security check result of the email attachment indicates that the attachment is legal, send the email attachment to the cloud sandbox, so that the cloud sandbox performs a security analysis on the email attachment;

[0067] That is, after the email security detection module uses one or more virus feature sets to match email attachments, email attachments that do not match any features will be further analyzed for security through the cloud sandbox to reduce the occurrence of missed detections.

[0068] Step S204: Obtain the security analysis result for the email attachment from the cloud sandbox. If the security analysis result indicates that the attachment is illegal, update the feature set based on the email attachment or the security analysis result.

[0069] That is, when the result of matching the email attachment with the feature set of one or more stored viruses indicates that the email attachment is legitimate, a security analysis is further performed through the cloud sandbox. Not only does the cloud sandbox processing not affect the email security gateway processing process, but the feature set can be updated based on the results of the cloud sandbox security analysis in the future, so that missed detections can be corrected in the subsequent detection process, thereby improving detection efficiency and accuracy.

[0070] It is worth noting that the solution provided by the embodiment of the present invention will neither actively send any data to the email security gateway nor modify any data of the email security gateway in the process of providing services for the email security gateway, but will only return the execution result, such as the detection result of the email attachment, when the email security gateway sends a request, so as to avoid intrusive modification to the email security gateway.

[0071] In addition, the email security detection method provided by the embodiment of the present invention is implemented by the cooperation of the "front-end service interface" and the "back-end service module". Among them, the cloud sandbox involved in the embodiment of the present invention provides dynamic detection services for the solution or product provided by the embodiment of the present invention, and the cloud sandbox will not actively send data to the "front-end service interface" and "back-end service module" involved in the product provided by the embodiment of the present invention. It only returns the execution result when the "front-end service interface" and "back-end service module or back-end server" send a request to the cloud sandbox. For example, the execution result can be whether the attachment is uploaded successfully, whether the cloud sandbox has completed the detection of a specific attachment, etc.

[0072] exist Figure 2 In the provided embodiment, the email attachment sent by the email security gateway is matched with the feature set of one or more stored viruses to perform security detection on the email attachment to obtain a security detection result. Compared with the cloud sandbox detecting the security of the email attachment by running the email attachment, the detection efficiency of this feature set matching method is higher, so that the email security gateway can timely intercept or release the email attachment according to the security detection result. In addition, in the case where the security detection result of the email attachment indicates that the attachment is legal, further security analysis is performed through the cloud sandbox. After the cloud sandbox security analysis structure indicates that the attachment is illegal, a new feature set is determined, and the feature set of the virus is expanded. Subsequently, the virus can be quickly matched based on the feature set, which ensures the efficiency of the email attachment security detection while effectively improving the accuracy of the email attachment security detection and improving the security of the email.

[0073] The embodiment of the present invention is based on the principle of virus locality, that is, once an attacker sends a virus email to a user within an enterprise, he is likely to send virus emails to other users within the enterprise again soon after, so the same virus can be matched through feature matching in a short time.

[0074] Furthermore, the above-mentioned email security detection method may also include: when the email security gateway detects that the email attachment is legitimate, executing the step of receiving the email attachment sent by the email security gateway. That is, the embodiment of the present invention mainly further processes the email attachment detected by the email security gateway as legitimate, so as to reduce the occurrence of missed detection of email attachments.

[0075] Furthermore, the above-mentioned email security detection method may also include: storing the received email attachments sent by the email security gateway to the local disk; by storing them to the local disk, it is convenient to send the email attachments to the cloud sandbox later, so as to improve the efficiency of email security detection.

[0076] Furthermore, the above-mentioned email security detection method also includes: sending a resource acquisition request to an operating platform equipped with a cloud sandbox, and receiving available resources for the cloud sandbox fed back by the operating platform; based on the available resources for the cloud sandbox, executing the step of sending the email attachment to the cloud sandbox.

[0077] Specifically, the specific implementation of sending the email attachment to the cloud sandbox includes: sending the email attachment indicated as legitimate stored in the local disk to the cloud sandbox. That is, only the email attachment indicated as legitimate is sent to the cloud sandbox for further security detection, and the cloud sandbox does not need to further detect the illegal email attachment, so as to ensure the efficiency of email attachment security detection.

[0078] Furthermore, the email security detection method further includes: deleting the email attachments and feature sets stored in the local disk according to a preset deletion policy, that is, regularly clearing the email attachments and feature sets stored in the local disk to ensure that storage space is available.

[0079] Since the same or modified email attachments based on the same virus are usually sent in a period of time, there is no need to store viruses or legitimate email attachments that have appeared for a long time to ensure the availability of storage space.

[0080] Further, after receiving the email attachment sent by the email security gateway, such as Figure 3 As shown, the email security detection method may further include the following steps:

[0081] Step S301: Generate a security detection task for the email attachment, determine initial information and task management information for the security detection task based on the email attachment, and store the initial information, task status and task management information in a database;

[0082] Among them, the initial information may include the name of the email attachment, the task creation time, the task start time, etc. The task management information may include the status of the task such as pending detection, detecting, detection interrupted, detection completed, etc., and the task detection results such as not detected, legal, illegal, etc.

[0083] Step S302: updating the task management information according to the result of matching the email attachment with one or more stored virus feature sets or the result of the cloud sandbox security analysis on the email attachment.

[0084] Specifically, the specific implementation conditions of the above step S301 are: when no information of the email attachment can be found in the database, the email attachment sent by the email security gateway is received, and a security detection task is generated for the email attachment.

[0085] The security detection process and security detection results of each email attachment are managed through task management information, which makes it easy to find the detection results of email attachments and the processing process of email attachments.

[0086] Furthermore, the above-mentioned email security detection method may further include: the background service module periodically obtains the attachment information of the security detection task in the task status indication detection from the database; according to the attachment information, sends a result acquisition request to the cloud sandbox to obtain the security analysis results for the email attachment from the cloud sandbox.

[0087] Furthermore, the above-mentioned email security detection method also includes: reading virus features from the security analysis results for email attachments sent by the cloud sandbox, and combining the virus features into a feature set.

[0088] The above process is used to expand and update the feature set to further improve the accuracy of security detection.

[0089] Furthermore, the above-mentioned email security detection method may further include: receiving an email attachment sent by an email security gateway, and matching the email attachment with a stored feature set of one or more viruses; when the email security gateway queries the email attachment detection result, determining the security detection result of the email attachment, returning the security detection result to the email security gateway, and sending the email attachment to the cloud sandbox are implemented based on the front-end service interface;

[0090] The steps of obtaining the security analysis results for the email attachments from the cloud sandbox and updating the feature set are implemented based on the background service module.

[0091] That is to say, for steps involving feature sets, such as feature set updates, the technical solution provided by the embodiment of the present invention implements "obtaining security analysis results based on email attachments from the cloud sandbox to update feature sets" through background services. "Determining whether feature sets are updated", "loading feature sets", and "matching email attachments using feature sets" are implemented through the front-end service interface.

[0092] The feature set updated by the background service is loaded through the front-end service interface, feature matching is performed, and the security detection results corresponding to the feature matching are determined. The background service module interacts with the cloud sandbox to obtain the cloud sandbox security analysis results and update the feature set, so as to decouple the steps of feature matching and determining the security detection results corresponding to feature matching from the steps of determining the cloud sandbox detection results and updating the feature set, so as to facilitate the separate regulation and improvement of different steps, and avoid the subsequent cloud sandbox detection results and the steps of updating the feature set from affecting the efficiency of the feature matching process, thereby effectively ensuring the efficiency of the feature matching process.

[0093] The following describes a specific embodiment of the email security detection method in detail. The email security detection method may include the following steps:

[0094] Step A1: When the email security gateway detects that the email attachment is legitimate, accept the email security gateway's query about the email attachment.

[0095] For example, the email security gateway receives legal email attachment 1 in email 1, illegal email attachment 2 in email 2, and illegal email attachment 3 in email 3. First, the email security gateway detects that all three email attachments are legal, so the email security gateway calculates the file hash values ​​of the three email attachments and sends query requests to the query module in turn according to the file hash values. Since there are no records of the three email attachments in the database of the email security detection system at this time, the return value is "record does not exist".

[0096] Step A2: The mail gateway sends all three mail attachments to the mail security detection device provided by the embodiment of the present invention.

[0097] The security detection module receives the detection request sent by the email security gateway and the corresponding email attachment file that needs to be detected.

[0098] Step B: Store the email attachment to the local disk;

[0099] For example, the received email attachment 2 is stored in the local disk.

[0100] Step C: Generate a security detection task for the email attachment, determine initial information and task management information for the security detection task based on the email attachment, and store the initial information, task status and task management information in a database;

[0101] The safety detection task, initial information, and task management information can be maintained through the task table.

[0102] For example, a security detection task is generated for the email attachment 2 received above, and the initial information of the email attachment 2, such as the name of the email attachment 2, the task creation time, etc., the task management information, such as the current status of the task, such as to be detected, in detection, completed detection, etc., and the task detection results, such as legal, illegal, not detected, etc., are determined.

[0103] Step D: matching the email attachment with one or more stored virus feature sets, wherein the virus features included in the one or more virus feature sets are determined based on historical email attachments;

[0104] Before each match, this step will first determine whether the virus feature set has been updated. If it has not been updated at this time, it will be matched directly.

[0105] This step is to match the content in the email attachment with the features in the feature set of one or more viruses. Email attachments belonging to the same virus or a virus deformation generally have the same features.

[0106] The detection process of this step takes a very short time, so if a mass phishing email is encountered, the subsequent email security gateway will query the detection result of the email attachment again after a very short time, and it can immediately respond to the query request of the email security gateway and return the detection result.

[0107] Step E: updating the task management information according to the result of matching the email attachment with the characteristic set of one or more stored viruses;

[0108] For example, after the above-mentioned email attachment detection is completed, the task status in the task management information corresponding to email attachment 1, email attachment 2, and email attachment 3 is modified to rule matching completed. Among them, email attachment 1 and email attachment 2 do not match any virus features, while email attachment 3 matches the virus features, so the detection result of email attachment 1 is legal, the detection result of email attachment 2 is legal, and the detection result of email attachment 3 is illegal.

[0109] Step F: the security detection module 402 sends a resource acquisition request to the operating platform equipped with the cloud sandbox, and receives available resources for the cloud sandbox fed back by the operating platform;

[0110] Step G: The security detection module 402 sends the email attachment that needs to be detected to the available cloud sandbox;

[0111] For example, since email attachment 1 and email attachment 2 do not match any virus features, in order to enhance the detection accuracy, it is necessary to enter the cloud sandbox and use the dynamic detection method to detect again. At the same time, the task status in the task management information corresponding to email attachment 1 and email attachment 2 is updated to cloud sandbox detection.

[0112] Step H: The management module 403 runs regularly, obtains the tasks in the cloud sandbox, and obtains the running results of the corresponding tasks from the cloud sandbox.

[0113] For example, the tasks with the task status of "cloud sandbox detection" at this time are the tasks corresponding to email attachment 1 and email attachment 2. The management module requests the cloud sandbox for the task execution results, and the cloud sandbox returns the execution results of the two tasks respectively, in which email attachment 1 is legal and email attachment 2 is illegal.

[0114] Further, update the task status in the task management information corresponding to email attachment 1 and email attachment 2 to cloud sandbox detection completed

[0115] Furthermore, the management module analyzes the detailed detection content in the detection result of the email attachment 2 and extracts available features.

[0116] Furthermore, the management module updates the virus features in the email attachment 2 to one or more virus feature sets currently in use, and merges them into a new virus feature set.

[0117] Step I: The query module receives a query request sent by the email security gateway, and queries the detection result corresponding to the file hash value of a certain email attachment.

[0118] This step is the same as step A1, except that the queried file hash value may be different.

[0119] Furthermore, for example, if the file hash value of the email attachment 4 is the same as that of the email attachment 1, the query module directly returns that it is legal.

[0120] Furthermore, for example, if the file hash value of email attachment 5 is the same as that of email attachment 3, the query module directly returns an invalid value.

[0121] Furthermore, for example, if the query module cannot find the file hash value of the email attachment 6 in the database, it will return that the record does not exist.

[0122] Step J: The security detection module receives the detection request and the corresponding email attachment sent by the email gateway.

[0123] This step is the same as step D, except that the email attachment file submitted may be different. Therefore, following the previous step, the email attachment is email attachment 6.

[0124] Similar to step D, the security detection module will still first determine whether the virus signature set has been updated. At this time, due to the operation of step H, the status of the virus signature set is updated.

[0125] Furthermore, the content of email attachment 6 is matched with the features in the updated feature set of one or more viruses. Since email attachments belonging to the same virus or a variant of a virus generally have the same features, and the virus in email attachment 6 and the virus in email attachment 2 are variants of the same family, the virus features are matched.

[0126] Step K: updating the task management information according to the result of matching the email attachment 6 with the characteristic set of one or more stored viruses;

[0127] For example, the task status of email attachment 6 is rule matching completed, and the detection result is illegal.

[0128] So far, this case has collected all the legitimate email attachment information received by the email security gateway recently, as well as the malicious email attachment information that can be matched through virus features. At the same time, by updating the virus feature set, malicious email attachments that originally needed to enter the cloud sandbox to be detected can also be quickly detected through virus feature set matching.

[0129] Figure 4 Schematic diagram of the structure of a mail security detection device provided by an embodiment of the present invention. Figure 4 As shown, the email security detection 400 may include: a query module 401, a security detection module 402 and a management module 403, wherein:

[0130] The query module 401 is used to respond to the result acquisition request of the email security gateway and return the security detection result to the email security gateway so that the email security gateway processes the email attachment according to the security detection result;

[0131] The security detection module 402 is used to receive an email attachment sent by the email security gateway, match the email attachment with a stored feature set of one or more viruses, wherein the virus features included in the feature set of one or more viruses are determined based on historical email attachments; determine a security detection result of the email attachment based on the matching result; and when the security detection result of the email attachment indicates that the attachment is legal, send the email attachment to the cloud sandbox so that the cloud sandbox performs a security analysis on the email attachment.

[0132] In the embodiment of the present invention, the security detection module 402 is further used to receive the email attachment sent by the email security gateway if the information of the email attachment cannot be found in the database, and generate a security detection task for the email attachment. After matching the email attachment using one or more virus feature sets, the matching result is written into the database.

[0133] In the embodiment of the present invention, the security detection module 402 is further used to store the received email attachment sent by the email security gateway to the local disk;

[0134] The security detection module 402 is further used to generate a security detection task for the email attachment, determine the initial information and task management information for the security detection task based on the email attachment, and store the initial information, task status and task management information in the database; update the task management information based on the result of matching the email attachment with the feature set of one or more stored viruses.

[0135] The security detection module 402 is further used to send the email attachment indicating legality stored in the local disk to the cloud sandbox.

[0136] In an embodiment of the present invention, the management module 403 is used to obtain the security analysis results for the email attachment from the cloud sandbox. When the security analysis results indicate that the attachment is illegal, the virus features of the email attachment are extracted based on the email attachment or the security analysis results, and are merged with the feature sets of one or more current viruses into a new virus feature set.

[0137] Further, after obtaining the cloud sandbox analysis result, the task status in the task management information corresponding to the email attachment in the database is updated to cloud sandbox detection completed.

[0138] In the embodiment of the present invention, the query module 401 and the security detection module 402 are arranged in the front-end service interface; the management module 403 is a background service module.

[0139] like Figure 5 As shown, an embodiment of the present invention provides an email security detection system 500, and the email security detection system 500 may include: a cloud sandbox 501 and the email security detection device 400 provided in the above embodiment.

[0140] Below Figure 5 Taking the interaction between various devices in the given system as an example, the mail case detection method is described in detail, such as Figure 6 and Figure 7 As shown. Among them, Figure 6 The figure shows the process of the front-end API and the email security gateway processing email attachments at the same time. Specifically, Figure 6As shown, in the process where the front-end API and the email security gateway simultaneously process email attachments, the email security detection method may include the following steps:

[0141] Step S601: The email security gateway sends a query request about the hash value of a specific email attachment file to the front-end service interface (hereinafter referred to as the front-end API) of the security detection module in this case.

[0142] Step S602: The front-end API returns the detection result about the hash of the email attachment file, or returns that the record does not exist.

[0143] If the front-end API finds the corresponding email attachment in the database based on the file hash value of the email attachment and finds that the detection result is legal or illegal, it will be returned to the email gateway. The email gateway will process the email attachment and the corresponding email accordingly based on the detection result. If the front-end API cannot find a record in the database based on the file hash value of the email attachment, proceed to the next step.

[0144] Step S603: The email security gateway sends the email attachment to the front-end API of the email security detection device.

[0145] Step S604: The front-end API stores the email attachment to the local disk.

[0146] Step S605: The front-end API generates a security detection task for the email attachment, and determines initial information and task management information for the security detection task based on the email attachment.

[0147] Step S606: The front-end API stores the initial information, task status and task management information in the database.

[0148] Step S607: the front-end API determines whether the virus signature set has been updated, and if so, loads the updated virus signature set.

[0149] Furthermore, the virus signature set is updated by the background service module.

[0150] Furthermore, the front-end API will load the virus signature set when the system starts, so if there is no update, it will not be loaded repeatedly.

[0151] Step S608: The front-end API matches the email attachment with a stored feature set of one or more viruses.

[0152] Wherein, the virus signatures included in the one or more virus signature sets are determined based on historical email attachments;

[0153] Step S609: the front-end API updates the task management information according to the result of matching the email attachment with the feature set of one or more viruses stored in the local disk.

[0154] Step S610: The front-end API updates the detection result in the database as illegal based on the matching result, when a virus feature is matched, otherwise the detection result is updated as legal.

[0155] Step S611: The front-end API determines whether the email attachment needs to be sent to the cloud sandbox for secondary detection based on the matching result.

[0156] When it is determined that the email attachment matches the virus signature, the process ends.

[0157] When it is determined that the email attachment does not match any virus signature, proceed to the next step.

[0158] Step 612: The front-end API sends a resource application request to the cloud sandbox to obtain available cloud sandbox resources.

[0159] Step 613: The front-end API submits the detection request and the corresponding email attachment to the cloud sandbox.

[0160] Step 614: The front-end API updates the task status in the task management information in the database to cloud sandbox detection.

[0161] Furthermore, the front-end API detects the security of the email attachment and indicates that the attachment is legitimate, such as Figure 7 As shown, the email security detection method may further include the following steps:

[0162] Step S701: the background service module periodically obtains task information of security detection tasks whose task status is cloud sandbox detection from the database.

[0163] Step S702: the background service module sends a security analysis result acquisition request to the cloud sandbox according to the information indicating the detection in the attachment information, and obtains the security analysis result for the email attachment from the cloud sandbox.

[0164] Step S703: the background service module updates the task management information according to the security analysis result of the email attachment; if the security analysis result indicates that the attachment is illegal, the next step is executed; if the security analysis result indicates that the attachment is legal, the current process is directly terminated.

[0165] Step S704: The background service module extracts corresponding virus features based on the security analysis result of the email attachment and merges them with the current feature set of one or more viruses into a new virus feature set.

[0166] In addition, the background service also cleans up files stored on the local disk according to the preset cleanup strategy.

[0167] Reference below Figure 8, which shows a schematic diagram of the structure of a computer system 800 including a front-end service interface and a back-end service module suitable for implementing an embodiment of the present invention. Figure 8 The device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0168] like Figure 8 As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0169] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0170] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processing unit (CPU) 801, the above-mentioned functions defined in the system of the present invention are executed.

[0171] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0172] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0173] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a query module, a security detection module and a management module. The names of these modules do not constitute a limitation on the modules themselves in some cases, for example, the query module may also be described as "a module that returns security detection results to the email security gateway".

[0174] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: receiving an email attachment sent by an email security gateway, matching the email attachment with a feature set of one or more viruses stored, wherein the virus features included in the feature set of one or more viruses are determined based on historical email attachments; determining the security detection result of the email attachment according to the matching result, and returning the security detection result to the email security gateway in response to the result acquisition request of the email security gateway, so that the email security gateway processes the email attachment according to the security detection result; in the case where the security detection result of the email attachment indicates that the attachment is legal, sending the email attachment to the cloud sandbox so that the cloud sandbox performs security analysis on the email attachment; obtaining the security analysis result for the email attachment from the cloud sandbox, and in the case where the security analysis result indicates that the attachment is illegal, updating the feature set based on the email attachment or the security analysis result.

[0175] According to the technical solution of the embodiment of the present invention, by matching the email attachment sent by the email security gateway with the feature set of one or more stored viruses, the email attachment is subjected to security detection to obtain the security detection result. Compared with the cloud sandbox detecting the security of the email attachment by running the email attachment, the detection efficiency of this feature set matching method is higher, so that the email security gateway can timely intercept or release the email attachment according to the security detection result. In addition, in the case where the security detection result of the email attachment indicates that the attachment is legal, further security analysis is performed through the cloud sandbox. After the cloud sandbox security analysis structure indicates that the attachment is illegal, a new feature set is determined, and the feature set of the virus is expanded. Subsequently, the virus can be quickly matched based on the feature set, which ensures the efficiency of the email attachment security detection, and can effectively improve the accuracy of the email attachment security detection and improve the security of the email.

[0176] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting email security, characterized in that: The email security detection method is implemented by cooperating with the front-end service interface and the back-end service module, including: Receiving a query request for a specific file hash value sent by the email security gateway through the front-end service interface, and returning a detection result of a specific email attachment corresponding to the file hash value, so that the email security gateway processes the email attachment or the corresponding email according to the detection result; Receiving, through the front-end service interface, an email attachment detection request and a corresponding email attachment sent by the email security gateway, and matching the email attachment with a stored feature set of one or more viruses, wherein the feature set of one or more viruses includes virus features determined based on historical email attachments; In the case where the virus feature matching result of the email attachment indicates that the attachment is legitimate, the email attachment is sent to the cloud sandbox through the front-end service interface, so that the cloud sandbox performs a security analysis on the email attachment; Obtaining a security analysis result for the email attachment from the cloud sandbox through a background service module, and updating the feature set of the one or more viruses based on the email attachment or the security analysis result when the security analysis result indicates that the attachment is illegal, wherein the background service module is implemented by a background server for email security detection; The feature set updated by the background service module is loaded through the front-end service interface, and the front-end service interface is implemented through the email security detection front-end.

2. The email security detection method according to claim 1, characterized in that: Also includes: Accepting a query request for a file hash value of an email attachment from the email security gateway through the front-end service interface, and returning a detection result of the corresponding email attachment; When there is no detection record, receive the email attachment file and email attachment detection request sent by the email security gateway.

3. The email security detection method according to claim 1, characterized in that: Also includes: If the cloud sandbox detects that the email attachment is a malicious file, the background service module reads the virus features from the security analysis results of the email attachment obtained from the cloud sandbox, and merges the virus features and the file hash value of the email attachment with the feature set of one or more current viruses into a new virus feature set.

4. The email security detection method according to claim 1, characterized in that: Also includes: The email attachment received from the email security gateway is stored in a local disk through the front-end service interface; The sending of the email attachment to the cloud sandbox includes: The email attachment indicating legitimacy stored in the local disk is sent to the cloud sandbox.

5. The email security detection method according to claim 1, characterized in that: Also includes: Send a resource acquisition request to the operating platform equipped with the cloud sandbox through the front-end service interface, and receive available resources for the cloud sandbox fed back by the operating platform; The step of sending the email attachment to the cloud sandbox is performed based on available resources for the cloud sandbox.

6. The email security detection method according to any one of claims 1 to 5, characterized in that: After receiving the email attachment sent by the email security gateway, the method further includes: Generate a security detection task for the email attachment through the front-end service interface, determine initial information and task management information for the security detection task based on the email attachment, and store the initial information, task status and task management information in a database; The task management information is updated according to a result of matching the email attachment with a stored feature set of one or more viruses or a security analysis result of the cloud sandbox on the email attachment.

7. The email security detection method according to claim 1, characterized in that: Also includes: Obtaining attachment information of the safety detection task in the task status indication detection from the database at regular intervals through the background service module; The background service module obtains a security analysis result for the email attachment from the cloud sandbox according to the attachment information.

8. A mail security detection device, characterized in that: include: Query module, security detection module and management module, among which, The query module and the security detection module are set in the front-end service interface, the management module is a background service module, the front-end service interface is implemented by the email security detection front-end, and the background service module is implemented by the email security detection back-end server; The security detection module is used to receive an email attachment sent by an email security gateway, match the email attachment with a stored feature set of one or more viruses, wherein the virus features included in the feature set of one or more viruses are determined based on historical email attachments; determine a security detection result of the email attachment based on the matching result; and when the security detection result of the email attachment indicates that the attachment is legal, send the email attachment to a cloud sandbox so that the cloud sandbox performs a security analysis on the email attachment; The query module is used to return the security detection result to the email security gateway in response to the result acquisition request of the email security gateway, so that the email security gateway processes the email attachment according to the security detection result; The management module is used to obtain a security analysis result for the email attachment from the cloud sandbox, and when the security analysis result indicates that the attachment is illegal, determine and store a new feature set based on the email attachment or the security analysis result; The security detection module is further used to load the feature set updated by the management module, and match the email attachment with the feature set of one or more stored viruses; The management module is further used to obtain a security analysis result update feature set based on the email attachment from the cloud sandbox.

9. A mail security detection system, characterized in that: include: Cloud sandbox and the email security detection device as described in claim 8.

10. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

11. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images