A method, system, electronic device, and storage medium for detecting email worms.

Abstract

This invention discloses a method, system, storage medium, and electronic device for detecting email worms. The method involves calculating the similarity between the title and attachments of known emails infected with an email worm and each email from a user's host within a time window T obtained from a mail server. This calculation determines the email attributes of each email and identifies whether the user's host is infected with an email worm based on the number of emails with the attribute of a potential worm. This method, based on the characteristics of email worms, considers the similarity between known emails and emails on the mail server from the perspectives of email title and attachment similarity. It determines the email similarity based on these two similarities to identify whether the user's host is infected with an email worm, significantly improving the efficiency and accuracy of email worm detection and effectively ensuring system security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and more particularly, to a method and system for detecting a mail worm, an electronic device and a storage medium. BACKGROUND

[0002] A mail worm belongs to the family of topological worms. A mail worm is a malicious worm that spreads through an email service. Since most people do not want to be infected by a worm, a mail worm needs to rely on a mail title to attract the attention of a user, and then uses social engineering techniques to trick the user into clicking on a malicious mail attachment. When the mail user opens the attachment in the mail, the host of the user is infected by the worm. Once infected by the mail worm, the worm looks for mail addresses on the infected host, and then sends a copy of the worm on the infected host to these addresses.

[0003] In order to improve the efficiency of worm infection, most mail worms will continuously send malicious mail worm codes to known mail addresses, thereby causing serious network congestion while infecting the host.

[0004] Therefore, in order to avoid the network from being seriously congested by the host infected by the mail worm, there is an urgent need for an effective method for detecting a mail worm. SUMMARY

[0005] In order to solve the technical problem of the network being seriously congested by the mail worm sending malicious mail worm codes to known mail addresses of the host after the host is infected by the mail worm in the prior art, the present application provides a method and system for detecting a mail worm, an electronic device and a storage medium, which can accurately detect the mail worm by comparing the received mail with the mail infected by the mail worm, thereby protecting the system security.

[0006] According to an aspect of the present application, there is provided a method for detecting a mail worm, the method comprising:

[0007] obtaining mail information of N mails of a user host in a time window T from a mail server, wherein the mail information comprises mail title information and mail attachment information;

[0008] calculating a mail title similarity between each mail in the time window T and a known mail based on a set mail title similarity function according to the mail title information of the known mail and each mail in the time window T, wherein the known mail is a mail that has been determined to be infected by the mail worm;

[0009] calculating a mail attachment similarity between each mail in the time window T and the known mail based on a set mail attachment similarity function according to the mail attachment information of the known mail and each mail in the time window T.

[0010] a mail similarity between each mail in the time window T and the known mail is calculated according to the mail title similarity and the mail attachment similarity between each mail in the time window T and the known mail based on a set mail similarity function;

[0011] a mail attribute of each mail in the time window T is determined according to the mail similarity threshold and the mail similarity between each mail in the time window T and the known mail, wherein the mail attribute includes normal mail and potential worm mail;

[0012] a mail worm detection result of the user host is determined according to the mail attributes of the N mails in the time window T based on a set mail worm detection function.

[0013] According to another aspect of the present application, a system for detecting mail worm is provided, which comprises:

[0014] a mail acquisition module, configured to acquire mail information of N mails of a user host in a time window T from a mail server, wherein the mail information includes mail title information and mail attachment information;

[0015] a first calculation module, configured to calculate a mail title similarity between each mail in the time window T and a known mail according to the mail title information of the known mail and each mail in the time window T based on a set mail title similarity function, wherein the known mail is a mail that has been determined to be infected by a mail worm;

[0016] a second calculation module, configured to calculate a mail attachment similarity between each mail in the time window T and the known mail according to the mail attachment information of the known mail and each mail in the time window T based on a set mail attachment similarity function;

[0017] a third calculation module, configured to calculate a mail similarity between each mail in the time window T and the known mail according to the mail title similarity and the mail attachment similarity between each mail in the time window T and the known mail based on a set mail similarity function;

[0018] a mail attribute module, configured to determine a mail attribute of each mail in the time window T according to the mail similarity threshold and the mail similarity between each mail in the time window T and the known mail, wherein the mail attribute includes normal mail and potential worm mail;

[0019] a result output module, configured to determine a mail worm detection result of the user host according to the mail attributes of the N mails in the time window T based on a set mail worm detection function.

[0020] According to another aspect of the present application, an electronic device is provided, characterized in that the electronic device comprises a memory and a processor coupled with the memory; the memory stores program instructions, and the program instructions, when executed by the processor, cause the electronic device to perform the method according to any one of the preceding method aspects.

[0021] According to another aspect of the present application, a computer readable storage medium is provided, characterized in that the computer readable storage medium comprises a computer program, and the computer program, when executed on an electronic device, causes the electronic device to perform the method according to any one of the preceding method aspects.

[0022] The method and system for detecting mail worm according to the present application, wherein the method calculates the similarity of mail header and the similarity of mail attachment between the known mail infected by mail worm and each mail in time window T, and then calculates the similarity between the known mail and each mail in time window T, determines the mail attribute of each mail, and finally determines whether the user host breaks out mail worm according to the mail attribute of the number of potential worm mails. The method considers the similarity between the known mail and the mail in mail server from two aspects of mail header and mail attachment according to the characteristics of mail worm, determines the mail similarity according to the similarity of mail header and the similarity of mail attachment, and judges whether the user host breaks out mail worm, which greatly improves the efficiency and accuracy of detecting mail worm, and effectively ensures the security of the system.

[0023] The technical solutions of the present application will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0024] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which like reference characters refer to like parts throughout the figures. The drawings provided in the present application are used to provide further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the present application together with the embodiments of the present application, and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally indicate the same parts or steps throughout the figures.

[0025] Figure 1 A flowchart of the method for detecting mail worm according to the preferred embodiment of the present application;

[0026] Figure 2 A structural diagram of the system for detecting mail worm according to the preferred embodiment of the present application; and

[0027] Figure 3 A structural diagram of the electronic device according to the preferred embodiment of the present application. DETAILED DESCRIPTION

[0028] The exemplary embodiments of the present application will now be described with reference to the accompanying drawings. The present application can, however, be carried out in many different ways, and is not limited to the embodiments described herein, which are provided for the purpose of thorough and complete disclosure of the present application and to provide those skilled in the art with a full and enabling disclosure of the scope of the present application. The terminology used in the description presented herein is not intended to be limiting. Rather, any specific terminology used should be taken to have a meaning that is consistent with its general usage in the relevant art. Descriptions of exemplary embodiments in terms of functional descriptions or structural descriptions are not intended to be limiting. Rather, it is intended to include all equivalents, modifications, and variations that fall within the scope of the present application.

[0029] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0030] Exemplary method

[0031] Figure 1 A flowchart of a method for detecting a mail worm according to a preferred embodiment of the present application is shown. As shown in FIG. 1, the method for detecting a mail worm according to the preferred embodiment of the present application starts from step 101. Figure 1 As shown in FIG. 1, the method for detecting a mail worm according to the preferred embodiment of the present application starts from step 101.

[0032] In step 101, mail information of N mails of a user host (or user, user equipment, user terminal, etc.) in a time window T is obtained from a mail server, wherein the mail information includes mail title information and mail attachment information.

[0033] In the preferred embodiment, in order to obtain the mail more conveniently, the mail information of the user can be obtained from the mail server by setting the time window T and using a proxy program. Since the user host is infected with the mail worm, it is usually caused by the user being attracted by the mail title and then clicking the malicious mail attachment, and after being infected with the mail worm, the worm will search for mail addresses on the infected host and then send the worm copy on the infected host to these addresses. Therefore, when obtaining the mail information of the user from the mail server, it is not limited to the received mail, but also includes the sent mail, the mail in the mailbox, the mail in the trash, etc. For the obtained mail, when extracting the mail information, the main mail title information and attachment information are extracted.

[0034] Preferably, the obtaining of the mail information of N mails of the user host in the time window T from the mail server further includes:

[0035] Selecting any one of the plurality of mail samples determined to be infected with the mail worm from the established mail sample library as the known mail.

[0036] In the preferred embodiment, in order to better detect the mail worm on the user host, the application establishes a sample library of the mail infected by the mail worm based on the detected mail worm. By using the method for detecting the mail worm, the accuracy of detecting the mail worm on the user host can be further improved by calculating the similarity between each mail in the mail sample library as the known mail and the user's mail obtained from the mail server.

[0037] In step 102, based on the set mail subject similarity function, the mail subject similarity between each mail in the time window T and the known mail is calculated according to the mail subject information of the known mail and each mail in the time window T, wherein the known mail is the mail that has been determined to be infected by the mail worm.

[0038] In step 103, based on the set mail attachment similarity function, the mail attachment similarity between each mail in the time window T and the known mail is calculated according to the mail attachment information of the known mail and each mail in the time window T.

[0039] Preferably, the mail attachment similarity between each mail in the time window T and the known mail is calculated according to the mail attachment information of the known mail and each mail in the time window T based on the set mail attachment similarity function, wherein the expression of the mail attachment similarity function is:

[0040]

[0041] wherein 1≤n≤N, attachment_k is the mail attachment string of the known mail, attachment_Tn is the mail attachment string of the nth mail in the time window T, Similarity(attachment_k, attachment_Tn) is the mail attachment similarity of the known mail and the nth mail in the time window T, conbinary(attachment_k, attachment_Tn) is the difference between the sum of the string lengths of attachment_k and attachment_Tn and the sum of the lengths of all common substrings of attachment_k and attachment_Tn. attachment_k and attachment_Tn can have any number of common substrings, or attachment_k and attachment_Tn have at least one common substring. The lengths of all common substrings of attachment_k and attachment_Tn are summed to determine the sum of the lengths of all common substrings of attachment_k and attachment_Tn. For example, let the mail attachment of the known mail "ABC" and the mail attachment of the obtained mail "BCD" be attachment_k and attachment_Tn, respectively, then the overlapping substring in the two strings should be "BC", and the value of conbinary(attachment_k, attachment_Tn) should be the sum of the string lengths of "ABC" and "BCD" minus the length of the corresponding string of the repeated "BC". c and d are the set adjustment weights, which are set according to experience. For example, c>0, d>0, c+d=1. |attachment_k| is the character length of the string attachment_k, |attachment_Tn| is the character length of the string attachment_Tn, and ||attachment_k-attachment_Tn|| is the absolute value of the difference between |attachment_k| and |attachment_Tn| k ||attachment_Tn|| is the absolute value of the difference between |attachment_k| and |attachment_Tn|

[0042] The present application considers both the length of the email attachment and the length of the common substring when calculating the similarity of the email attachment. First, the length of the email attachment provides a preliminary basis for judgment, which can help us quickly identify those emails with similar size attachments. This similarity may mean that these emails contain the same type of file or have similar data content. By filtering emails with similar attachment lengths, we can more accurately locate those potentially relevant emails, thereby improving the efficiency of subsequent processing. Second, the common substring provides a more in-depth similarity measurement method. By calculating the common substring, we can directly find the common part between two emails. This direct similarity measurement method is not only easy to understand and interpret, but also can quickly calculate the result, suitable for processing a large number of emails and real-time detection of similar emails. Therefore, when calculating the similarity of the email attachment, combining the length of the email attachment and the common substring, we can get a more comprehensive and accurate similarity evaluation result of the email. This method not only considers the type and size of the email attachment, but also deeply analyzes the similarity of the email content, thereby improving the accuracy and reliability of email processing.

[0043] In practice, relying solely on the similarity of the email title or attachment to detect email worms may result in a high false positive rate, as some normal emails may also have similar titles or attachments. Moreover, usually, email worms will use similar titles and attachments to attract users to click, and the present application can greatly improve the accuracy of detection by simultaneously analyzing the similarity of the email title and attachment, using the dual detection mechanism of email title similarity and email attachment similarity, thereby more accurately identifying potential email worms, reducing false positives, improving detection reliability and taking appropriate measures to prevent further spread.

[0044] In step 104, based on the set email similarity function, the email similarity of each email in the time window T and the known email is calculated according to the email title similarity and the email attachment similarity of each email in the time window T and the known email.

[0045] Preferably, the email similarity function is set based on the email title similarity and the email attachment similarity of each email in the time window T and the known email, wherein the expression of the email similarity function is:

[0046] Similarity(email_k,email_Tn)

[0047] =e*Similarity(title_k,title_Tn)+f*Similarity(attachment_k,attachment_Tn)

[0048] In the formula, Similarity(email_k, email_Tn) is the email similarity between the known email and the nth email in the time window T;

[0049] Similarity(title_k, title_Tn) represents the similarity between the titles of the known emails and the nth email in the time window T, respectively.

[0050] Similarity(attachment_k, attachment_Tn) represents the similarity between the known email and the nth email in the time window T, respectively. e and f are the adjustment weights that can be set based on experience. For example, e>0, f>0, e+f=1.

[0051] In step 105, the email attributes of each email in the time window T are determined based on the set email similarity threshold and the email similarity between each email in the time window T and the known emails. The email attributes include normal emails and potential worm emails.

[0052] Preferably, determining the email attributes of each email in the time window T based on the set email similarity threshold and the email similarity between each email in the time window T and the known emails includes:

[0053] When Similarity(email_k, email_Tn) is not less than the email similarity threshold, the email attribute of the nth email in time window T is determined to be a potential worm email. A potential worm email can be considered as an email with a high probability of containing a worm, an email with a probability greater than the probability threshold, an email containing a worm, an email that may contain a worm, or an email infected by a worm, etc. Here, Similarity(email_k, email_Tn) is the email similarity between the known email and the nth email in time window T, and the email similarity threshold is a positive number less than 1.

[0054] When Similarity(email_k, email_Tn) is less than the email similarity threshold, the email attribute of the nth email in the time window T is determined to be a normal email.

[0055] In step 106, based on the configured email worm detection function, the email worm detection result of the user's host is determined according to the email attributes of N emails in the time window T.

[0056] Preferably, the mail worm detection function based on the setting determines the mail worm detection result of the user host according to the mail attributes of the N mails in the time window T, comprising:

[0057] counting the mails with the mail attribute of potential worm mails in the N mails in the time window T to obtain the number of potential worm mails count(T);

[0058] determining the mail worm detection result according to the mail worm detection function based on the setting and the number of potential worm mails count(T), wherein the expression of the mail worm detection function is:

[0059] final userhost = count(T) / N

[0060] wherein final userhost is the mail worm detection value of the user host,

[0061] when final userhost is greater than the detection threshold of the time window T, it is determined that the mail worm detection result of the user host is that the user host has broken out a mail worm, otherwise, it is determined that the mail worm detection result of the user host is that the user host is working normally or the user host has not broken out a mail worm.

[0062] According to an embodiment, further comprising determining the detection threshold of the time window T. For example, the detection threshold of the time window T is determined at or before the start of the time window T.

[0063] Determining the detection threshold of the time window T comprises:

[0064] obtaining the detection threshold of each historical time window in the Ntw continuous historical time windows before the time window T;

[0065] obtaining the historical detection data of each historical time window in the Ntw continuous historical time windows before the time window T, wherein the historical detection data comprises a plurality of historical detection data items, each historical detection data item comprising: a detection serial number, a detection time, an identifier of the user host, a number of detected mails and a number of potential worm mails; and

[0066] determining the detection threshold of the time window T based on the detection threshold and the historical detection data of each historical time window in the Ntw continuous historical time windows before the time window T.

[0067] According to one embodiment, Ntw consecutive historical time windows are included before the time window T. Preferably, each time window has the same or different time length. In addition, among the Ntw consecutive historical time windows before the time window T, the first historical time window is the farthest in time from the time window T, and the Ntwth historical time window is adjacent in time to the time window T. For example, 10 consecutive time windows are included before the time window T, i.e., a total of 11 time windows. Since the time window T is the current time window, the remaining 10 consecutive time windows can be referred to as historical time windows in addition to the time window T. The 11 time windows are in chronological order: the first historical time window, the second historical time window, the third historical time window,..., the ninth historical time window, the tenth historical time window, and the time window T.

[0068] Preferably, each historical time window has historical detection data, wherein the historical detection data includes a plurality of historical detection data items, and each historical detection data item includes: a detection serial number, a detection time, an identifier of a user host, a number of detected emails, and a number of potential worm emails. The detection serial number can be a serial number for indicating the order of performing email worm detection in a time window or a historical time window. The detection time can be a detection start time, a detection end time, or a time of requesting detection of performing email worm detection. The identifier of the user host is used to uniquely identify the user host. The number of detected emails is used to indicate the total number of emails detected when the user host performs email worm detection. The number of potential worm emails is used to indicate the number of emails with the mail attribute of potential worm emails of the user host. Based on the detection time, the historical time window to which the historical detection data item belongs can be determined. For example, the historical time window to which the historical detection data item belongs can be determined by the time window in which the detection time of the historical detection data item is located.

[0069] In the first embodiment, the detection threshold of the time window T is determined based on the detection threshold and the historical detection data of each historical time window in the Ntw consecutive historical time windows before the time window T, including:

[0070] determining the initial threshold of the time window T based on the detection threshold of each historical time window in the Ntw consecutive historical time windows before the time window T;

[0071] determining the detection coefficient of each historical time window in the Ntw consecutive historical time windows based on the historical detection data and the detection threshold of each historical time window in the Ntw consecutive historical time windows before the time window T;

[0072] determining a threshold adjustment value of each of the Ntw continuous historical time windows based on the detection coefficient and the detection threshold of each of the Ntw continuous historical time windows before the time window T; and

[0073] determining the detection threshold of the time window T based on the threshold adjustment value of each of the Ntw continuous historical time windows before the time window T and the initial threshold of the time window T.

[0074] In one embodiment, determining the initial threshold of the time window T based on the detection threshold of each of the Ntw continuous historical time windows before the time window T comprises:

[0075] determining the initial threshold of the time window T based on the following formula:

[0076]

[0077] wherein preTH T is the initial threshold of the time window T, Ntw is the number of continuous historical time windows before the time window T, TH j is the detection threshold of the jth historical time window of the Ntw continuous historical time windows before the time window T, j, nt and Ntw are natural numbers, nt is a set parameter and 2 < nt, wherein the Ntwth historical time window of the Ntw continuous historical time windows before the time window T is adjacent to the time window T in time, is the floor function, and a, b and g are adjustment factors, 0 < a < b < g < 1 and a + b + g = 1.

[0078] In one embodiment, determining the detection coefficient of each of the Ntw continuous historical time windows based on the historical detection data and the detection threshold of each of the Ntw continuous historical time windows before the time window T comprises:

[0079] determining the number of historical detection data items in each of the historical time windows based on the historical detection data of each of the Ntw continuous historical time windows before the time window T;

[0080] determining a mail worm detection value of each of the historical detection data items based on the number of detected mails and the number of potential worm mails in each of the historical detection data items; and

[0081] Based on the number of historical detection data items in each historical time window, the detection threshold value, and the mail worm detection value of each historical detection data item in each historical time window, a detection coefficient of each historical time window in the Ntw consecutive historical time windows before the time window T is determined.

[0082] In one embodiment, based on the number of historical detection data items in each historical time window, the detection threshold value, and the mail worm detection value of each historical detection data item in each historical time window, a detection coefficient of each historical time window in the Ntw consecutive historical time windows before the time window T is determined, including:

[0083] The detection coefficient of each historical time window in the Ntw consecutive historical time windows before the time window T is determined based on the following formula:

[0084]

[0085] Wherein,

[0086] Wherein, θ j is the detection coefficient of the jth historical time window in the Ntw consecutive historical time windows before the time window T, Ndata j is the number of historical detection data items in the jth historical time window in the Ntw consecutive historical time windows before the time window T; Ndata max is the maximum value of the number of historical detection data items in the Ntw consecutive historical time windows before the time window T; Ndata med is the median of the number of historical detection data items in the Ntw consecutive historical time windows before the time window T;

[0087] j, q, fN j and Ntw are natural numbers, Ntw is the number of consecutive historical time windows before the time window T; fN j is the number of historical detection data items in the jth historical time window in the Ntw consecutive historical time windows before the time window T; v is an intermediate parameter;

[0088] final j,q is the mail worm detection value of the qth historical detection data item in the jth historical time window in the Ntw consecutive historical time windows before the time window T; TH j is the detection threshold value of the jth historical time window in the Ntw consecutive historical time windows before the time window T; ε and μ are adjustment factors, 0 < ε < 1, 0 < μ < 1, ε + μ = 1.

[0089] In one embodiment, the threshold adjustment value of each of the Ntw consecutive historical time windows before the time window T is determined based on the detection coefficient and the detection threshold of each of the Ntw consecutive historical time windows before the time window T, comprising:

[0090] The threshold adjustment value of each of the Ntw consecutive historical time windows before the time window T is calculated based on the following formula:

[0091] Value j = θ j × TH j

[0092] wherein Value j is the threshold adjustment value of the jth historical time window of the Ntw consecutive historical time windows before the time window T, θ j is the detection coefficient of the jth historical time window of the Ntw consecutive historical time windows before the time window T, TH j is the detection threshold of the jth historical time window of the Ntw consecutive historical time windows before the time window T.

[0093] In one embodiment, the detection threshold of the time window T is determined based on the threshold adjustment value of each of the Ntw consecutive historical time windows before the time window T and the initial threshold of the time window T, comprising:

[0094] TH T = preTH T + aTH T

[0095]

[0096] wherein TH T is the detection threshold of the time window T, preTH T is the initial threshold of the time window T; aTH T is the threshold adjustment value of the time window T; Value j is the threshold adjustment value of the jth historical time window of the Ntw consecutive historical time windows before the time window T, j, nt and Ntw are natural numbers, Ntw is the number of consecutive historical time windows before the time window T, nt is a set parameter and 2 < nt, the Ntwth historical time window of the Ntw consecutive historical time windows before the time window T is adjacent to the time window T, is the floor function, a, β and γ are adjustment factors, 0 < a < β < γ < 1 and a + β + γ = 1.

[0097] According to another embodiment, in order to capture finaluserhost Small or gradual changes in the sequence are detected by calculating the deviation of each observation from the expected value and accumulating these deviations to detect trends or anomalies in the data sequence. When the cumulative sum exceeds a pre-set threshold, a significant change is considered to have occurred and appropriate action is taken. userhost Small or gradual changes in the sequence are detected by calculating the deviation of each observation from the expected value and accumulating these deviations to detect trends or anomalies in the data sequence. When the cumulative sum exceeds a pre-set threshold, a significant change is considered to have occurred and appropriate action is taken.

[0098] Preferably, the mail worm detection result of the user host is determined based on the mail attributes of the N mails in the time window T, including:

[0099] a. Determine the expected value: The expected value (μ) is the average of the historical data.

[0100] b. Initialize the cumulative sum: The cumulative sum St is initialized to 0 at the beginning.

[0101] c. Calculate the deviation and update the cumulative sum:

[0102] For each new observation finalt, calculate its deviation from the expected value (finalt - μ).

[0103] Add the deviation to the cumulative sum at the previous time point and apply the non-negative constraint (i.e. if the cumulative sum becomes negative, reset it to 0).

[0104] St = max(0, St-1 + (finalt - μ))

[0105] Note: In some cases, to adjust the sensitivity of the algorithm, an additional deviation weight factor (k) can be introduced, then the formula becomes: St = max(0, St-1 + (finalt - μ - k))

[0106] d. Set the threshold:

[0107] According to the requirements and data characteristics, set a threshold (h) to determine when the cumulative sum exceeds the threshold.

[0108] e. Event triggering:

[0109] When the cumulative sum St exceeds the set threshold (h), a worm is considered to have occurred, indicating that a significant change or anomaly has occurred in the data sequence.

[0110] f. Reset the cumulative sum (optional):

[0111] In some cases, after detecting a change, it may be chosen to reset the cumulative sum to the initial value (such as 0) so that the algorithm can continue to detect subsequent changes.

[0112] The method for detecting mail worm according to the preferred embodiment of the present application calculates the similarity of mail header and the similarity of mail attachment of each mail in the time window T from the known mail infected by the mail worm, thereby calculating the similarity of each mail in the time window T from the known mail, determining the mail attribute of each mail, and finally determining whether the user host breaks out the mail worm according to the mail attribute of the mail number of the potential worm mail. The method considers the similarity of the known mail and the mail in the mail server from the two aspects of the mail header and the mail attachment according to the characteristics of the mail worm, determines the mail similarity according to the similarity of the mail header and the similarity of the mail attachment, and judges whether the user host breaks out the mail worm, thereby greatly improving the efficiency and accuracy of detecting the mail worm and effectively ensuring the safety of the system.

[0113] Exemplary system

[0114] Figure 2 The structure diagram of the system for detecting mail worm according to the preferred embodiment of the present application. As shown in Figure 2 the system 200 for detecting mail worm according to the preferred embodiment of the present application comprises:

[0115] a mail acquisition module 201, configured to acquire the mail information of N mails of a user in a time window T from a mail server, wherein the mail information comprises mail header information and mail attachment information;

[0116] a first calculation module 202, configured to calculate the similarity of the mail header of each mail in the time window T from the known mail according to the mail header information of each mail in the time window T and the known mail based on the set mail header similarity function, wherein the known mail is the mail infected by the mail worm;

[0117] a second calculation module 203, configured to calculate the similarity of the mail attachment of each mail in the time window T from the known mail according to the mail attachment information of each mail in the time window T and the known mail based on the set mail attachment similarity function;

[0118] a third calculation module 204, configured to calculate the similarity of each mail in the time window T from the known mail according to the similarity of the mail header and the similarity of the mail attachment of each mail in the time window T from the known mail based on the set mail similarity function;

[0119] a mail attribute module 205, configured to determine the mail attribute of each mail in the time window T according to the set mail similarity threshold and the similarity of each mail in the time window T from the known mail, wherein the mail attribute comprises normal mail and potential worm mail;

[0120] a result output module 206 configured to determine a mail worm detection result of the user host according to the mail attributes of the N mails in the time window T based on the set mail worm detection function.

[0121] Preferably, the second calculation module 203 is configured to calculate a mail attachment similarity between each mail in the time window T and the known mail according to the mail attachment information of the known mail and each mail in the time window T based on a set mail attachment similarity function, wherein the expression of the mail attachment similarity function is:

[0122]

[0123] wherein 1≤n≤N, attachment_k is the mail attachment string of the known mail, attachment_Tn is the mail attachment string of the nth mail in the time window T, Similarity(attachment_k, attachment_Tn) is the mail attachment similarity between the known mail and the nth mail in the time window T, conbinary(attachment_k, attachment_Tn) is the difference between the sum of the string length of attachment_k and the string length of attachment_Tn and the sum of the length of all common substrings of attachment_k and attachment_Tn. attachment_k and attachment_Tn can have any number of common substrings, or attachment_k and attachment_Tn have at least one common substring. The sum of the length of all common substrings of attachment_k and attachment_Tn is determined by summing the length of all common substrings of attachment_k and attachment_Tn, and c and d are set adjustment weights which can be set according to experience.

[0124] Preferably, the third calculation module 204 is configured to calculate a mail similarity between each mail in the time window T and the known mail according to the mail title similarity and the mail attachment similarity between each mail in the time window T and the known mail based on a set mail similarity function, wherein the expression of the mail similarity function is:

[0125] Similarity(email_k, email_Tn)

[0126] = e * Similarity(title_k, title_Tn) + f * Similarity(attachment_k, attachment_Tn)

[0127] where Similarity(email_k, email_Tn), Similarity(title_k, title_Tn) and Similarity(attachment_k, attachment_Tn) are the email similarity, the title similarity and the attachment similarity between the known email and the nth email in the time window T, respectively, and e and f are the adjusting weights set according to experience.

[0128] Preferably, the email attribute module 205 determines the email attribute of each email in the time window T according to the email similarity between each email in the time window T and the known email and the set email similarity threshold, comprising:

[0129] when Similarity(email_k, email_Tn) is not less than the email similarity threshold, determining the email attribute of the nth email in the time window T as potential worm email, where Similarity(email_k, email_Tn) is the email similarity between the known email and the nth email in the time window T;

[0130] when Similarity(email_k, email_Tn) is less than the email similarity threshold, determining the email attribute of the nth email in the time window T as normal email.

[0131] Preferably, the result output module 206 determines the email worm detection result of the user host according to the email attributes of the N emails in the time window T based on the set email worm detection function, comprising:

[0132] counting the emails with the email attribute of potential worm email in the N emails in the time window T to obtain the number of potential worm emails count(T);

[0133] determining the email worm detection result according to the set email worm detection function and the number of potential worm emails count(T), where the expression of the email worm detection function is:

[0134] final=count(T) / N

[0135] when final is greater than the set detection threshold, determining that the user host breaks out email worm, otherwise, considering that the user host works normally.

[0136] Alternatively, the email worm detection result of the user host is determined according to the email attributes of the N emails in the time window T based on the set email worm detection function, comprising:

[0137] count(T) is obtained by counting the number of emails with the mail attribute of potential worm emails in the N emails in the time window T;

[0138] A mail worm detection value is determined according to the set mail worm detection function and the number count(T) of the potential worm emails, wherein the expression of the mail worm detection function is:

[0139] finalfinal uerhost = count(T) / N

[0140] Wherein, final uerhost is the mail worm detection value of the user host,

[0141] When final uerhost is greater than the detection threshold value of the time window T, it is determined that the mail worm detection result of the user host is that the user host has broken out a mail worm, otherwise, it is determined that the mail worm detection result of the user host is that the user host is working normally or the user host has not broken out a mail worm.

[0142] The system for detecting a mail worm according to the preferred embodiment of the present application calculates the similarity of the mail title and the mail attachment of each of the known mails infected by the mail worm and each of the mails in the time window T obtained from the mail server, thereby calculating the similarity of each of the known mails and each of the mails in the time window T, determining the mail attribute of each of the mails, and finally determining whether the user host has broken out a mail worm according to the number of the mails with the mail attribute of potential worm emails, which is the same as the steps of the method for detecting a mail worm according to the present application and achieves the same technical effects, which will not be described here.

[0143] Exemplary electronic device

[0144] Figure 3 A structure diagram of an electronic device according to the preferred embodiment of the present application. The electronic device can be either one or both of the first device and the second device, or a single device independent of them, which can communicate with the first device and the second device to receive the collected input signals therefrom. Figure 3 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. As shown in Figure 3 The electronic device includes one or more processors 301 and a memory 302.

[0145] The processor 301 can be a central processing unit (CPU) or other form of processing unit having data processing and / or instruction execution capabilities, and can control other components in the electronic device to perform desired functions.

[0146] The memory 302 can include one or more computer program products that can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory, for example, can include random access memory (RAM), cache memory, and / or the like. The non-volatile memory, for example, can include read-only memory (ROM), hard disk drives, solid-state drives, and / or the like. The computer-readable storage media can store one or more computer program instructions executable by the processor 301 to implement the enterprise energy-consuming space-based energy anomaly diagnosis method and / or other desired functions of the various embodiments disclosed above. In one example, the electronic device can further include an input device 303 and an output device 304, which are interconnected through a bus system and / or other forms of connection mechanisms (not shown).

[0147] In addition, the input device 303 can include, for example, a keyboard, a mouse, and / or the like.

[0148] The output device 304 can output various information to the outside. The output device 304 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and / or the like.

[0149] Of course, in order to simplify, Figure 3 Only some of the components of the electronic device related to the present disclosure are shown in FIG. 3, and components such as a bus, an input / output interface, and / or the like are omitted. In addition, the electronic device can further include any other appropriate components according to a specific application.

[0150] Exemplary computer program product and computer readable storage medium

[0151] In addition to the above-described method and device, embodiments of the present disclosure can be a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform steps of the method of detecting a mail worm according to various embodiments of the present disclosure described in the above "Exemplary Method" section of the specification.

[0152] The computer program product can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, C++, and / or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote cloud device or server.

[0153] Furthermore, an embodiment of the present disclosure can also be a computer readable storage medium having stored thereon a computer program instructing, which, when executed by a processor, causes the processor to perform the steps of the method for detecting a mail worm according to various embodiments of the present disclosure described in the above "Exemplary Method" section of the specification.

[0154] The computer readable storage medium can take the form of one or more combinations of any type of computer readable medium. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0155] The above describes the basic principles of the present disclosure in conjunction with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present disclosure are only examples and are not limiting, and these advantages, benefits, effects and the like cannot be considered as necessary for each embodiment of the present disclosure. In addition, the above specific details are only for the purpose of example and for the purpose of understanding, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.

[0156] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between each embodiment can be mutually referred to. For system embodiments, since they basically correspond to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0157] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply that the connections, arrangements, configurations must be as shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have", and the like are open-ended words, mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0158] The methods and apparatus of the present disclosure can be implemented in a number of ways. For example, the methods and apparatus of the present disclosure can be implemented using software, hardware, firmware, or any combination of these methods. The order of any steps described above is merely exemplary and the steps of the methods of the present disclosure need not be performed in the order described above unless otherwise specified. Furthermore, in some embodiments, the present disclosure can also be implemented as a program for running on a computer or a processor to implement the methods according to the present disclosure. Thus, the present disclosure also covers a record medium storing the program for implementing the methods according to the present disclosure.

[0159] It is also important to note that the present disclosure can be implemented in methods and apparatuses containing, together or separately, some or all of the features, elements, components, or implementations described above. It is contemplated that the present disclosure can be implemented in any combination of hardware and / or software and that the means or components of the present disclosure can be implemented in hardware and / or software to achieve these ends. It is further contemplated that the present disclosure can be implemented both as a stand-alone device or as part of another device or apparatus.

[0160] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although the above discussion has focused on various example aspects and embodiments, those skilled in the art will recognize certain variations, modifications, changes, additions, and sub-combinations thereof.

Claims

1. A method of detecting a mail worm, characterized by, The method comprises: Obtaining mail information of N mails of a user host in a time window T from a mail server, wherein the mail information comprises mail title information and mail attachment information; Based on a set mail title similarity function, calculating a mail title similarity of each mail in the time window T and a known mail according to the mail title information of the known mail and each mail in the time window T, wherein the known mail is a mail that has been determined to be infected by a mail worm; Based on a set mail attachment similarity function, calculating a mail attachment similarity of each mail in the time window T and the known mail according to the mail attachment information of the known mail and each mail in the time window T; Based on a set mail similarity function, calculating a mail similarity of each mail in the time window T and the known mail according to the mail title similarity and the mail attachment similarity of each mail in the time window T and the known mail; Based on a set mail similarity threshold and the mail similarity of each mail in the time window T and the known mail, determining a mail attribute of each mail in the time window T, wherein the mail attribute comprises a normal mail and a potential worm mail; Based on a set mail worm detection function, determining a mail worm detection result of the user host according to the mail attribute of the N mails in the time window T; Based on a set mail attachment similarity function, calculating a mail attachment similarity of each mail in the time window T and the known mail according to the mail attachment information of the known mail and each mail in the time window T, wherein an expression of the mail attachment similarity function is: In the formula, 1≤n≤N, attachment_k and attachment_Tn are respectively a mail attachment string of the known mail and the nth mail in the time window T, Similarity(attachment_k, attachment_Tn) is a mail attachment similarity of the known mail and the nth mail in the time window T, conbinary(attachment_k, attachment_Tn) is the sum of the string length of attachment_k and the string length of attachment_Tn, minus the difference of the sum of the length of all common substrings of attachment_k and attachment_Tn, c and d are set adjustment weights, c > 0, d > 0, d + c = 1, |attachment_k| is the length of attachment_k string, |attachment_Tn| is the length of attachment_Tn string, ||attachment k |-|attachment_Tn|| is the absolute value of the difference of |attachment_k| and |attachment_Tn|; Based on a set mail similarity function, calculating a mail similarity of each mail in the time window T and the known mail according to the mail title similarity and the mail attachment similarity of each mail in the time window T and the known mail, wherein an expression of the mail similarity function is: Similarity(email_k, email_Tn) = e*Similarity(title_k, title_Tn) + f*Similarity(attachment_k, attachment_Tn) In the formula, Similarity(email_k, email_Tn) is a mail similarity of the known mail and the nth mail in the time window T; Similarity(title_k, title_Tn) is a mail title similarity of the known mail and the nth mail in the time window T, respectively; and Similarity(attachment_k, attachment_Tn) is the mail attachment similarity of the known mail and the nth mail in the time window T, e and f are the set adjustment weights, e>0, f>0, e+f=1; The mail worm detection function based on the settings is used to determine the mail worm detection result of the user host according to the mail attributes of the N mails in the time window T, and includes: Counting the mails with the mail attribute of potential worm mails in the N mails in the time window T to obtain the number of potential worm mails count(T); Determining the mail worm detection value according to the mail worm detection function based on the settings and the number of potential worm mails count(T), wherein the expression of the mail worm detection function is: final uerhost = count(T) / N wherein final userhost is the mail worm detection value for the user host, When final userhost When the detection threshold is greater than the time window T, the mail worm detection result of the user host is determined as the user host breaking out the mail worm, otherwise, the mail worm detection result of the user host is determined as the user host working normally or the user host not breaking out the mail worm.

2. The method of claim 1, wherein, Determining the mail attribute of each mail in the time window T according to the mail similarity of each mail in the time window T and the known mail, and the mail similarity threshold value, includes: When Similarity(email_k, email_Tn) is greater than or equal to the mail similarity threshold value, determining that the mail attribute of the nth mail in the time window T is a potential worm mail, wherein Similarity(email_k, email_Tn) is the mail similarity of the known mail and the nth mail in the time window T; When Similarity(email_k, email_Tn) is less than the mail similarity threshold value, determining that the mail attribute of the nth mail in the time window T is a normal mail.

3. The method of claim 1, wherein, Before the mail information of the N mails of the user host in the time window T is obtained from the mail server, the method further includes: Selecting any one of the plurality of mail samples that have been determined to be infected by the mail worm from the established mail sample library as the known mail.

4. A system for detecting a mail worm, characterized by The system includes: A mail obtaining module, configured to obtain mail information of N mails of a user host in a time window T from a mail server, wherein the mail information includes mail title information and mail attachment information; A first calculating module, configured to calculate mail title similarity of each mail in the time window T and a known mail according to mail title information of each mail in the time window T and the known mail based on a set mail title similarity function, wherein the known mail is a mail that has been determined to be infected by a mail worm; A second calculating module, configured to calculate mail attachment similarity of each mail in the time window T and the known mail according to mail attachment information of each mail in the time window T and the known mail based on a set mail attachment similarity function; A third calculating module, configured to calculate mail similarity of each mail in the time window T and the known mail according to mail title similarity and mail attachment similarity of each mail in the time window T and the known mail based on a set mail similarity function; a mail attribute module, configured to determine a mail attribute of each mail in the time window T according to a set mail similarity threshold and a mail similarity between each mail in the time window T and the known mail, wherein the mail attribute comprises a normal mail and a potential worm mail; a result output module, configured to determine a mail worm detection result of the user host according to the mail attribute of N mails in the time window T based on a set mail worm detection function; wherein the mail attachment similarity function is configured to calculate a mail attachment similarity between each mail in the time window T and the known mail according to mail attachment information of the known mail and each mail in the time window T, and an expression of the mail attachment similarity function is: wherein 1≤n≤N, attachment_k and attachment_Tn are respectively a mail attachment string of the known mail and the nth mail in the time window T, Similarity(attachment_k, attachment_Tn) is a mail attachment similarity between the known mail and the nth mail in the time window T, conbinary(attachment_k, attachment_Tn) is the sum of the string length of attachment_k and the string length of attachment_Tn, minus the difference of the sum of the length of all common substrings of attachment_k and attachment_Tn, c and d are set adjustment weights, c > 0, d > 0, d + c = 1, |attachment_k| is the length of attachment_k string, |attachment_Tn| is the length of attachment_Tn string, ||attachment k |-|attachment_Tn|| is the absolute value of the difference of |attachment_k| and |attachment_Tn|; wherein the mail similarity function is configured to calculate a mail similarity between each mail in the time window T and the known mail according to a mail title similarity and a mail attachment similarity between each mail in the time window T and the known mail, and an expression of the mail similarity function is: Similarity(email_k, email_Tn) = e*Similarity(title_k, title_Tn) + f*Similarity(attachment_k, attachment_Tn) wherein Similarity(email_k, email_Tn) is a mail similarity between the known mail and the nth mail in the time window T, Similarity(title_k, title_Tn) is a mail title similarity between the known mail and the nth mail in the time window T, Similarity(attachment_k, attachment_Tn) is a mail attachment similarity between the known mail and the nth mail in the time window T, e and f are set adjustment weights, e>0, f>0, and e+f=1; wherein the mail worm detection function is configured to determine a mail worm detection result of the user host according to the mail attribute of N mails in the time window T, and the mail worm detection function comprises: counting mails with the mail attribute of potential worm mails in the N mails in the time window T to obtain a number of potential worm mails count(T); determining a mail worm detection value according to the set mail worm detection function and the number of potential worm mails count(T), and an expression of the mail worm detection function is: final uerhost = count(T) / N wherein final userhost is the mail worm detection value for the user host, When final userhost When the detection threshold is greater than the time window T, it is determined that the mail worm detection result of the user host is that the user host has broken out a mail worm, otherwise, it is determined that the mail worm detection result of the user host is that the user host is working normally or the user host has not broken out a mail worm.

5. An electronic device, comprising: The electronic device comprises a memory and a processor, which are coupled; the memory stores program instructions, and the program instructions are executed by the processor to enable the electronic device to perform the method in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer program is executed on the electronic device to enable the electronic device to perform the method in any one of claims 1 to 3.

Images