Mail handling method, device and equipment based on Trojan virus and storage medium

Abstract

The invention relates to the technical field of internet security, and discloses a Trojan virus-based mail disposal method, device and equipment and a storage medium, and the method comprises the steps: determining target account information for receiving a Trojan virus mail when the Trojan virus mail is not intercepted; acquiring virus feature information of the Trojan virus mail according to the target account information; determining a security linkage device according to the virus feature information; and carrying out linkage processing on the Trojan virus mail through the safety linkage equipment. Compared with the prior art in which a Trojan virus mail needs to be detected manually and then is handled manually, the method has the advantages that when the Trojan virus mail is detected, the safety linkage equipment is determined according to the virus characteristic information corresponding to the Trojan virus mail, and then the Trojan virus mail is handled in a linkage manner through the safety linkage equipment; therefore, the processing efficiency of the Trojan virus mail is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a mail processing method, device, equipment and storage medium based on Trojan virus. Background Art

[0002] A Trojan virus is a disguised latent network virus that is sent through an email attachment and bundled in other programs. Once the Trojan virus breaks out, it can set a backdoor and regularly send the user's privacy to the address specified by the Trojan program. It can also arbitrarily control the computer and perform illegal operations such as file deletion, copying, and password change. In the prior art, it is necessary to manually check whether the email contains a Trojan virus email at regular intervals. When a Trojan virus email is detected, it needs to be manually cleared, resulting in low efficiency in handling Trojan virus emails.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a method, device, equipment and storage medium for handling mails based on Trojan virus, aiming to solve the technical problem of how to improve the efficiency of handling Trojan virus mails.

[0005] To achieve the above object, the present invention provides a method for handling mails based on Trojan virus, and the method for handling mails based on Trojan virus comprises the following steps:

[0006] When the Trojan virus email is not intercepted, determining target account information for receiving the Trojan virus email;

[0007] Obtain virus feature information of the Trojan virus email according to the target account information;

[0008] Determine a security linkage device according to the virus feature information;

[0009] The Trojan virus email is handled in a linked manner through the security linkage device.

[0010] Optionally, before the step of determining the target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted, the method further includes:

[0011] Obtain email alert information through security detection equipment;

[0012] Determine the Trojan virus event based on the email warning information;

[0013] Analyze the Trojan virus event to obtain Trojan virus infection information;

[0014] The Trojan virus email is determined according to the Trojan virus infection information.

[0015] Optionally, after the step of determining the Trojan virus email according to the Trojan virus infection information, the method further includes:

[0016] The Trojan virus email is intercepted by an email gateway device to obtain email interception information;

[0017] Determining whether the email interception information meets a preset interception condition;

[0018] When the email interception information does not satisfy the preset interception condition, it is determined that the Trojan virus email is not intercepted.

[0019] Optionally, after the step of determining whether the email interception information meets a preset interception condition, the step further includes:

[0020] When the mail interception information meets the preset interception condition, generating interception alarm information according to the mail interception information;

[0021] The interception alarm information is sent to the corresponding target management terminal.

[0022] Optionally, before the step of determining the target account information for receiving the Trojan virus email, the step further includes:

[0023] Obtaining email handling information of the Trojan virus email;

[0024] Determining whether the mail handling information meets the preset mail receiving conditions;

[0025] When the email handling information meets the preset email receiving condition, the step of determining the target account information for receiving the Trojan virus email is performed.

[0026] Optionally, after the step of determining whether the email disposal information meets a preset email receiving condition, the step further includes:

[0027] When the mail handling information does not meet the preset mail receiving condition, determining the delivery account information of the Trojan virus mail;

[0028] The delivery account information is added to an email blacklist, so that an email interception device intercepts emails sent by the delivery account information according to the email blacklist.

[0029] Optionally, the step of obtaining virus feature information of the Trojan virus email according to the target account information includes:

[0030] Extract virus sample information from the Trojan virus email according to the target account information;

[0031] The virus sample information is analyzed to obtain virus feature information of the Trojan virus email.

[0032] Optionally, the step of analyzing the virus sample information to obtain virus feature information of the Trojan virus email includes:

[0033] Obtaining login terminal information corresponding to the target account information;

[0034] Determine the security detection device according to the login terminal information;

[0035] The virus sample information is analyzed by the security detection device to obtain virus feature information of the Trojan virus email.

[0036] Optionally, the step of determining a security linkage device according to the virus feature information includes:

[0037] Analyze the virus feature information to obtain Trojan virus information;

[0038] Determine the security linkage device according to the Trojan virus information.

[0039] Optionally, the step of determining a security linkage device according to the Trojan virus information includes:

[0040] Determine whether the Trojan virus information meets the preset virus condition;

[0041] When the Trojan virus information meets the preset virus condition, determining the Trojan virus level according to the Trojan virus information;

[0042] The security linkage device is determined according to the Trojan virus level.

[0043] Optionally, the step of performing linkage processing on the Trojan virus email through the security linkage device includes:

[0044] Determine the domain name information and address information corresponding to the Trojan virus email;

[0045] Determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device;

[0046] Based on the preset virus blocking strategy, the Trojan virus email is linked and handled through the security linkage device.

[0047] Optionally, after the step of performing linkage processing on the Trojan virus email through the security linkage device based on the preset virus blocking strategy, the method further includes:

[0048] Generate a Trojan virus log according to the linkage disposal result of the Trojan virus email;

[0049] Determine the terminal host compromise information according to the Trojan virus log;

[0050] Determine a preset host handling strategy according to the terminal host loss information;

[0051] The terminal host is isolated and disposed according to the preset host disposal strategy.

[0052] In addition, to achieve the above-mentioned purpose, the present invention also proposes a mail processing device based on a Trojan virus, and the mail processing device based on a Trojan virus comprises:

[0053] A determination module, used for determining target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted;

[0054] An acquisition module, used to acquire virus feature information of the Trojan virus email according to the target account information;

[0055] The determination module is further used to determine a security linkage device according to the virus feature information;

[0056] The processing module is used to perform linkage processing on the Trojan virus email through the security linkage device.

[0057] Optionally, the Trojan virus-based mail processing device further includes a determination module;

[0058] The determination module is used to obtain the mail handling information of the Trojan virus mail;

[0059] The determination module is further used to determine whether the mail handling information meets the preset mail receiving condition;

[0060] The determination module is further configured to, when the email handling information satisfies the preset email receiving condition, execute the operation of determining the target account information for receiving the Trojan virus email.

[0061] Optionally, the acquisition module is further used to extract virus sample information from the Trojan virus email according to the target account information;

[0062] The acquisition module is also used to analyze the virus sample information to obtain virus feature information of the Trojan virus email.

[0063] Optionally, the determination module is further used to analyze the virus feature information to obtain Trojan virus information;

[0064] The determination module is also used to determine the security linkage device according to the Trojan virus information.

[0065] Optionally, the processing module is further used to determine the domain name information and address information corresponding to the Trojan virus email;

[0066] The processing module is further used to determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device;

[0067] The processing module is also used to perform linkage processing on the Trojan virus email through the security linkage device based on the preset virus blocking strategy.

[0068] Optionally, the processing module is further used to generate a Trojan virus log according to the linkage processing result of the Trojan virus email;

[0069] The processing module is further used to determine the terminal host loss information according to the Trojan virus log;

[0070] The handling module is further used to determine a preset host handling strategy according to the terminal host loss information;

[0071] The processing module is also used to isolate the terminal host according to the preset host processing strategy.

[0072] In addition, to achieve the above-mentioned purpose, the present invention also proposes a Trojan virus-based email processing device, which includes: a memory, a processor, and a Trojan virus-based email processing program stored on the memory and executable on the processor, wherein the Trojan virus-based email processing program is configured to implement the steps of the Trojan virus-based email processing method as described above.

[0073] In addition, to achieve the above purpose, the present invention also proposes a storage medium, on which a Trojan virus-based email processing program is stored. When the Trojan virus-based email processing program is executed by a processor, the steps of the Trojan virus-based email processing method described above are implemented.

[0074] When the Trojan virus mail is not intercepted, the present invention first determines the target account information for receiving the Trojan virus mail, then obtains the virus feature information of the Trojan virus mail according to the target account information, and determines the security linkage device according to the virus feature information, and then performs linkage treatment on the Trojan virus mail through the security linkage device. Compared with the prior art, which requires manual detection of Trojan virus mails and then manual treatment of Trojan virus mails, the present invention determines the security linkage device according to the virus feature information corresponding to the Trojan virus mail when the Trojan virus mail is detected, and then performs linkage treatment on the Trojan virus mail through the security linkage device, thereby improving the treatment efficiency of the Trojan virus mail, and further improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 It is a structural schematic diagram of a mail processing device based on a Trojan virus in a hardware operating environment involved in an embodiment of the present invention;

[0076] Figure 2 It is a flow chart of the first embodiment of the method for handling mails based on Trojan virus of the present invention;

[0077] Figure 3 It is a flow chart of a second embodiment of the method for handling mails based on Trojan virus of the present invention;

[0078] Figure 4 It is a flow chart of a third embodiment of the method for handling mails based on Trojan virus of the present invention;

[0079] Figure 5 It is a structural block diagram of the first embodiment of the mail processing device based on Trojan virus of the present invention.

[0080] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0081] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0082] Reference Figure 1 , Figure 1 The schematic diagram of the structure of the mail processing device based on Trojan virus in the hardware operating environment involved in the embodiment of the present invention.

[0083] like Figure 1As shown, the mail handling device based on Trojan virus may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0084] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the mail handling device based on the Trojan virus, and may include more or less components than those shown in the figure, or combine certain components, or arrange the components differently.

[0085] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a mail processing program based on a Trojan virus.

[0086] exist Figure 1 In the Trojan virus-based email processing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the Trojan virus-based email processing device of the present invention can be set in the Trojan virus-based email processing device, and the Trojan virus-based email processing device calls the Trojan virus-based email processing program stored in the memory 1005 through the processor 1001, and executes the Trojan virus-based email processing method provided by the embodiment of the present invention.

[0087] The embodiment of the present invention provides a method for handling mails based on Trojan virus. Figure 2 , Figure 2 It is a flowchart of the first embodiment of the method for handling mails based on Trojan virus of the present invention.

[0088] In this embodiment, the Trojan virus-based email processing method includes the following steps:

[0089] Step S10: When the Trojan virus email is not intercepted, determine the target account information for receiving the Trojan virus email.

[0090] It is easy to understand that the execution subject of this embodiment can be a Trojan virus-based mail processing device with functions such as data processing, network communication and program running, or it can be other computer devices with similar functions, and this embodiment is not limited.

[0091] It is understandable that a Trojan virus email is an email that carries a Trojan virus. Once the Trojan virus email is opened by a user, the terminal will be invaded by the Trojan virus, which can then control the computer at will and perform illegal operations such as file deletion, copying, and password changing.

[0092] It should be noted that the target account information of the Trojan virus email is the email account information that receives the Trojan virus email.

[0093] Furthermore, in order to accurately identify Trojan virus emails, when Trojan virus emails are not intercepted, before the step of determining the target account information that receives the Trojan virus emails, it is necessary to obtain email warning information through a security detection device, and then determine the Trojan virus event based on the email warning information, and then analyze the Trojan virus event to obtain the Trojan virus infection information, and determine the Trojan virus email based on the Trojan virus infection information.

[0094] It should also be understood that the email warning information is the virus warning information generated by the security device, wherein the virus warning information includes the discovery of the delivery of Trojan virus events or the discovery of the delivery of other viruses.

[0095] In the specific implementation, when a Trojan virus delivery event is discovered, it is necessary to analyze the Trojan virus event and obtain the Trojan virus infection information. The Trojan virus infection information includes the specific delivery method of the Trojan virus, such as link delivery or email delivery, etc., and then the Trojan virus email or Trojan virus link can be determined based on the Trojan virus infection information.

[0096] In this embodiment, through the alarm generated by the security device, the security device can perform advanced threat detection and malicious analysis on Trojan virus mails and discover the Trojan mail event of delivery virus. It is necessary to send the Trojan virus event to the mail gateway, and the mail gateway can intercept the Trojan virus mail, obtain the mail interception information, and determine whether the mail interception information meets the preset interception condition. When the mail interception information does not meet the preset interception condition, it is determined that the Trojan virus mail is not intercepted; when the mail interception information meets the preset interception condition, an interception alarm information is generated according to the mail interception information, and the interception alarm information is sent to the corresponding target management terminal.

[0097] It should be understood that the preset interception condition is that the Trojan virus email is intercepted, and the email interception information includes email interception information and email non-interception information, etc. The target management terminal can be a terminal managed by the person in charge of the Trojan virus, or an associated terminal corresponding to the target account information.

[0098] In the specific implementation, when the Trojan virus email is not intercepted by the email gateway, the email disposal information of the Trojan virus email is still needed to determine whether the email disposal information meets the preset email receiving conditions. When the email disposal information does not meet the preset email receiving conditions, the delivery account information of the Trojan virus email is determined, and the delivery account information is added to the email blacklist, so that the email interception device intercepts the email sent by the delivery account information according to the email blacklist; when the email disposal information meets the preset email receiving conditions, the target account information for receiving the Trojan virus email is determined.

[0099] It should also be noted that the email processing information may be the status information of the current Trojan virus email, such as the email receiving status or the email not receiving status, etc. The preset email receiving condition is that the user has received the Trojan virus email, etc.

[0100] In this embodiment, through the alarm generated by the security device, the event of delivering a virus and Trojan horse email is discovered. First, it is determined whether the email gateway has intercepted it. If the email gateway has intercepted it, no processing is required. Otherwise, the relevant email account is determined according to the alarm, and then the relevant virus and Trojan horse email is determined according to the alarm information, and it is determined whether the user accepts the email. If not, it is confirmed that the user is not harmed and the user is notified that it cannot be opened. If it has been accepted, it is asked whether it has been opened. If not, the user is notified that it cannot be opened. If it has been opened, the host processing flow is entered. The host processing flow includes isolating the host and notifying the technician to perform on-machine processing, deleting emails, clearing Trojans, and business recovery.

[0101] Step S20: Obtain virus feature information of the Trojan virus email according to the target account information.

[0102] Furthermore, in order to accurately obtain virus feature information, the processing method for obtaining the virus feature information of the Trojan virus email according to the target account information can be to extract virus sample information from the Trojan virus email according to the target account information, and then analyze the virus sample information to obtain the virus feature information of the Trojan virus email.

[0103] It should also be understood that the virus sample information may be part of the Trojan virus information in the Trojan virus email, and the virus feature information may be information associated with the Trojan virus, such as Trojan virus toxicity information, related domain names or Internet Protocol (IP) addresses, etc.

[0104] In a specific implementation, the step of analyzing the virus sample information and obtaining the virus feature information of the Trojan virus email can be to obtain the login terminal information corresponding to the target account information, then determine the security detection device based on the login terminal information, and analyze the virus sample information through the security detection device to obtain the virus feature information of the Trojan virus email.

[0105] It should be noted that the login terminal information is the terminal device currently logged in when receiving the Trojan virus email, and the security detection device is the security device existing in the currently logged in terminal device, such as an intrusion detection system or a sandbox device.

[0106] In this embodiment, the virus sample information can be obtained through the intrusion detection system, and then the sandbox is linked to analyze the virus sample information to obtain virus feature information, wherein the virus feature information includes Trojan virus information, related domain names or IP addresses, etc.

[0107] Step S30: Determine a security linkage device according to the virus feature information.

[0108] Furthermore, in order to improve the processing efficiency of Trojan virus emails, the processing method of the security linkage device determined according to the virus feature information can be to analyze the virus feature information, obtain Trojan virus information, and judge whether the Trojan virus information meets the preset virus conditions. When the Trojan virus information meets the preset virus conditions, the Trojan virus level is determined according to the Trojan virus information, and then the security linkage device is determined according to the Trojan virus level.

[0109] It should also be understood that the preset virus condition is that the Trojan virus email is a poisonous email, the Trojan virus information includes Trojan virus poisonous information and Trojan virus non-toxic information, etc., and the security linkage device can be a security device such as a firewall, etc.

[0110] In a specific implementation, if the Trojan virus email is non-toxic, the process ends; if the Trojan virus email is toxic, the security linkage device can be a firewall, etc.

[0111] Step S40: performing linkage processing on the Trojan virus email through the security linkage device.

[0112] Furthermore, in order to improve the efficiency of handling Trojan virus emails, the method for handling Trojan virus emails through linkage through security linkage equipment can be to determine the domain name information and address information corresponding to the Trojan virus emails, and then determine the preset virus blocking strategy based on the domain name information, address information and the security linkage equipment, and based on the preset virus blocking strategy, the Trojan virus emails are linked and handled through the security linkage equipment.

[0113] It should also be noted that the preset virus blocking strategy can be customized for the user, such as linking the firewall to block related domain names and IPs.

[0114] In this embodiment, Trojan virus emails are linked and handled through the security linkage device based on the preset virus blocking strategy, and a Trojan virus log is generated according to the linkage handling result of the Trojan virus email, the terminal host compromise information is determined according to the Trojan virus log, the preset host handling strategy is determined according to the terminal host compromise information, and the terminal host is isolated and handled according to the preset host handling strategy.

[0115] In the specific implementation, the host is analyzed to see if it has been compromised based on the linkage disposal results of Trojan virus emails combined with traffic, alarms, and terminal endpoint detection and response (EDR) logs. The strategy for analyzing the host compromise can be the communication traffic generated in the traffic and the communication domain name or IP in the sandbox analysis results, the terminal EDR generates other abnormal security operation alarms, and the actions are consistent with the sandbox virus analysis results. Then, the preset host disposal strategy is determined based on the analysis of the host compromise results. The preset host disposal strategy can be to isolate the host and notify the technical staff to perform on-site processing, delete emails, clear Trojans, and restore business. Finally, the terminal host is disposed of according to the preset host disposal strategy, and the reasons for the intrusion and the deficiencies in restoring data / business are summarized and reviewed to improve the overall security capabilities based on the existing situation.

[0116] In this embodiment, when the Trojan virus mail is not intercepted, the target account information for receiving the Trojan virus mail is first determined, and then the virus feature information of the Trojan virus mail is obtained according to the target account information, and the security linkage device is determined according to the virus feature information, and then the Trojan virus mail is linked and disposed of by the security linkage device. Compared with the prior art, which requires manual detection of Trojan virus mails and manual disposal of Trojan virus mails, in this embodiment, when the Trojan virus mail is detected, the security linkage device is determined according to the virus feature information corresponding to the Trojan virus mail, and then the Trojan virus mail is linked and disposed of by the security linkage device, thereby improving the disposal efficiency of Trojan virus mails.

[0117] refer to Figure 3 , Figure 3 It is a flow chart of the second embodiment of the method for handling mails based on Trojan virus of the present invention.

[0118] Based on the above first embodiment, in this embodiment, step S10 includes:

[0119] Step S101: when the Trojan virus email is not intercepted, obtaining email handling information of the Trojan virus email.

[0120] It is understandable that a Trojan virus email is an email that carries a Trojan virus. Once the Trojan virus email is opened by a user, the terminal will be invaded by the Trojan virus, which can then control the computer at will and perform illegal operations such as file deletion, copying, and password changing.

[0121] Furthermore, in order to quickly process Trojan virus emails, when the Trojan virus emails are not intercepted, before the step of obtaining the email disposal information of the Trojan virus emails, it is necessary to obtain email warning information through the security detection equipment, and then determine the Trojan virus event based on the email warning information, and then analyze the Trojan virus event to obtain the Trojan virus infection information, and determine the Trojan virus email based on the Trojan virus infection information.

[0122] It should also be understood that the email warning information is the virus warning information generated by the security device, wherein the virus warning information includes the discovery of the delivery of Trojan virus events or the discovery of the delivery of other viruses.

[0123] In the specific implementation, when a Trojan virus delivery event is discovered, it is necessary to analyze the Trojan virus event and obtain the Trojan virus infection information. The Trojan virus infection information includes the specific delivery method of the Trojan virus, such as link delivery or email delivery, etc., and then the Trojan virus email or Trojan virus link can be determined based on the Trojan virus infection information.

[0124] In this embodiment, through the alarm generated by the security device, a Trojan horse mail delivery event is discovered. The Trojan horse virus event needs to be sent to the mail gateway, which can intercept the Trojan horse virus mail, obtain the mail interception information, and determine whether the mail interception information meets the preset interception condition. When the mail interception information does not meet the preset interception condition, it is determined that the Trojan horse virus mail is not intercepted; when the mail interception information meets the preset interception condition, an interception alarm information is generated according to the mail interception information, and the interception alarm information is sent to the corresponding target management terminal.

[0125] It should be understood that the preset interception condition is that the Trojan virus email is intercepted, and the email interception information includes email interception information and email non-interception information, etc. The target management terminal can be a terminal managed by the person in charge of the Trojan virus, or an associated terminal corresponding to the target account information.

[0126] In a specific implementation, when the Trojan virus email is not intercepted by the email gateway, the email disposal information of the Trojan virus email is also needed. The email disposal information can be the status information of the current Trojan virus email, such as the email receiving status or the email not receiving status.

[0127] Step S102: Determine whether the mail handling information satisfies a preset mail receiving condition.

[0128] It should also be noted that the preset email receiving condition is that the user has received a Trojan virus email, etc.

[0129] Step S103: When the email handling information meets the preset email receiving condition, determine the target account information for receiving the Trojan virus email.

[0130] It should be noted that the target account information of the Trojan virus email is the email account information that receives the Trojan virus email.

[0131] In this embodiment, when the email handling information does not meet the preset email receiving conditions, the delivery account information of the Trojan virus email is determined, and the delivery account information is added to the email blacklist, so that the email interception device intercepts the emails sent by the delivery account information according to the email blacklist; when the email handling information meets the preset email receiving conditions, the target account information for receiving the Trojan virus email is determined.

[0132] In the specific implementation, through the alarm generated by the security device, the event of delivering virus and Trojan mail is discovered. First, it is determined whether the mail gateway has intercepted it. If the mail gateway has intercepted it, no processing is required. Otherwise, the relevant mailbox account is determined according to the alarm, and then the relevant virus and Trojan mail is determined according to the alarm information, and it is determined whether the user accepts the mail. If not, it is confirmed that the user is not harmed and the user is notified that it cannot be opened, etc. If it has been accepted, it is asked whether it has been opened. If not, the user is notified that it cannot be opened. If it has been opened, the host processing process is entered. The host processing process includes isolating the host and notifying the technician to process it on the computer, deleting the mail, clearing the Trojan, and restoring the business.

[0133] In this embodiment, when the Trojan virus email is not intercepted, the email disposal information of the Trojan virus email is first obtained to determine whether the email disposal information meets the preset email receiving conditions. When the email disposal information meets the preset email receiving conditions, the target account information for receiving the Trojan virus email is determined. Compared with the prior art, the Trojan virus email is not processed. In this embodiment, when the Trojan virus email is not intercepted and the Trojan virus email is received, the target account information of the Trojan virus email is determined, thereby achieving accurate acquisition of the account information of the Trojan virus email, thereby accelerating the disposal efficiency of the Trojan virus email.

[0134] refer to Figure 4 , Figure 4 It is a flowchart of the third embodiment of the method for handling mails based on Trojan virus of the present invention.

[0135] Based on the first embodiment above, in this embodiment, after step S40, the following steps are further included:

[0136] Step S401: Determine the domain name information and address information corresponding to the Trojan virus email.

[0137] In this embodiment, the virus sample information can be obtained through the intrusion detection system, and then the sandbox is linked to analyze the virus sample information to obtain virus feature information, wherein the virus feature information includes Trojan virus information, related domain names or IP addresses, etc.

[0138] Step S402: determining a preset virus blocking strategy according to the domain name information, the address information and the security linkage device.

[0139] It should also be noted that the preset virus blocking strategy can be customized for the user, such as linking the firewall to block related domain names and IPs.

[0140] Step S403: Based on the preset virus blocking policy, the Trojan virus email is subjected to linkage treatment through the security linkage device.

[0141] It should be noted that based on the preset virus blocking strategy, Trojan virus emails are linked and handled through the security linkage device, and a Trojan virus log is generated according to the linkage handling results of the Trojan virus emails, the terminal host compromise information is determined based on the Trojan virus log, the preset host disposal strategy is determined based on the terminal host compromise information, and the terminal host is isolated and handled according to the preset host disposal strategy.

[0142] In the specific implementation, the host is analyzed to see if it has been compromised based on the linkage disposal results of Trojan virus emails combined with traffic, alarms, and terminal EDR logs. The strategy for analyzing host compromise can be the communication traffic generated in the traffic and the communication domain name or IP in the sandbox analysis results, the terminal EDR generates other abnormal security operation alarms, and the actions are consistent with the sandbox virus analysis results. Then, the preset host disposal strategy is determined based on the analysis of the host compromise results. The preset host disposal strategy can be to isolate the host and notify the technical staff to perform on-machine processing, delete emails, clear Trojans, and restore business. Finally, the terminal host is disposed of according to the preset host disposal strategy, and the reasons for the intrusion and the deficiencies in restoring data / business are summarized and reviewed to improve the overall security capabilities based on the existing situation.

[0143] In this embodiment, the domain name information and address information corresponding to the Trojan virus email are first determined, and then the preset virus blocking strategy is determined according to the domain name information, address information and the security linkage device. Finally, based on the preset virus blocking strategy, the Trojan virus email is linked to the security linkage device. Compared with the prior art that can only manually process Trojan virus emails, in this implementation, the Trojan virus email can be linked to the preset virus blocking strategy and the security linkage device, thereby improving the processing efficiency of Trojan virus emails and further enhancing the overall security capabilities.

[0144] Reference Figure 5 , Figure 5 It is a structural block diagram of the first embodiment of the mail processing device based on Trojan virus of the present invention.

[0145] like Figure 5 As shown, the mail processing device based on Trojan virus proposed in the embodiment of the present invention includes:

[0146] The determination module 5001 is used to determine the target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted.

[0147] It is understandable that a Trojan virus email is an email that carries a Trojan virus. Once the Trojan virus email is opened by a user, the terminal will be invaded by the Trojan virus, which can then control the computer at will and perform illegal operations such as file deletion, copying, and password changing.

[0148] It should be noted that the target account information of the Trojan virus email is the email account information that receives the Trojan virus email.

[0149] Furthermore, in order to accurately identify Trojan virus emails, when Trojan virus emails are not intercepted, before the step of determining the target account information that receives the Trojan virus emails, it is necessary to obtain email warning information through a security detection device, and then determine the Trojan virus event based on the email warning information, and then analyze the Trojan virus event to obtain the Trojan virus infection information, and determine the Trojan virus email based on the Trojan virus infection information.

[0150] It should also be understood that the email warning information is the virus warning information generated by the security device, wherein the virus warning information includes the discovery of the delivery of Trojan virus events or the discovery of the delivery of other viruses.

[0151] In the specific implementation, when a Trojan virus delivery event is discovered, it is necessary to analyze the Trojan virus event and obtain the Trojan virus infection information. The Trojan virus infection information includes the specific delivery method of the Trojan virus, such as link delivery or email delivery, etc., and then the Trojan virus email or Trojan virus link can be determined based on the Trojan virus infection information.

[0152] In this embodiment, through the alarm generated by the security device, a Trojan horse mail delivery event is discovered. The Trojan horse virus event needs to be sent to the mail gateway, which can intercept the Trojan horse virus mail, obtain the mail interception information, and determine whether the mail interception information meets the preset interception condition. When the mail interception information does not meet the preset interception condition, it is determined that the Trojan horse virus mail is not intercepted; when the mail interception information meets the preset interception condition, an interception alarm information is generated according to the mail interception information, and the interception alarm information is sent to the corresponding target management terminal.

[0153] It should be understood that the preset interception condition is that the Trojan virus email is intercepted, and the email interception information includes email interception information and email non-interception information, etc. The target management terminal can be a terminal managed by the person in charge of the Trojan virus, or an associated terminal corresponding to the target account information.

[0154] In the specific implementation, when the Trojan virus email is not intercepted by the email gateway, the email disposal information of the Trojan virus email is still needed to determine whether the email disposal information meets the preset email receiving conditions. When the email disposal information does not meet the preset email receiving conditions, the delivery account information of the Trojan virus email is determined, and the delivery account information is added to the email blacklist, so that the email interception device intercepts the email sent by the delivery account information according to the email blacklist; when the email disposal information meets the preset email receiving conditions, the target account information for receiving the Trojan virus email is determined.

[0155] It should also be noted that the email processing information may be the status information of the current Trojan virus email, such as the email receiving status or the email not receiving status, etc. The preset email receiving condition is that the user has received the Trojan virus email, etc.

[0156] In this embodiment, through the alarm generated by the security device, the event of delivering a virus and Trojan horse email is discovered. First, it is determined whether the email gateway has intercepted it. If the email gateway has intercepted it, no processing is required. Otherwise, the relevant email account is determined according to the alarm, and then the relevant virus and Trojan horse email is determined according to the alarm information, and it is determined whether the user accepts the email. If not, it is confirmed that the user is not harmed and the user is notified that it cannot be opened. If it has been accepted, it is asked whether it has been opened. If not, the user is notified that it cannot be opened. If it has been opened, the host processing flow is entered. The host processing flow includes isolating the host and notifying the technician to perform on-machine processing, deleting emails, clearing Trojans, and business recovery.

[0157] The acquisition module 5002 is used to acquire the virus feature information of the Trojan virus email according to the target account information.

[0158] Furthermore, in order to accurately obtain virus feature information, the processing method for obtaining the virus feature information of the Trojan virus email according to the target account information can be to extract virus sample information from the Trojan virus email according to the target account information, and then analyze the virus sample information to obtain the virus feature information of the Trojan virus email.

[0159] It should also be understood that the virus sample information may be part of the Trojan virus information in the Trojan virus email, and the virus feature information may be information associated with the Trojan virus, such as Trojan virus toxicity information, related domain names or IP addresses, etc.

[0160] In a specific implementation, the step of analyzing the virus sample information and obtaining the virus feature information of the Trojan virus email can be to obtain the login terminal information corresponding to the target account information, then determine the security detection device based on the login terminal information, and analyze the virus sample information through the security detection device to obtain the virus feature information of the Trojan virus email.

[0161] It should be noted that the login terminal information is the terminal device currently logged in when receiving the Trojan virus email, and the security detection device is the security device existing in the currently logged in terminal device, such as an intrusion detection system or a sandbox device.

[0162] In this embodiment, the virus sample information can be obtained through the intrusion detection system, and then the sandbox is linked to analyze the virus sample information to obtain virus feature information, wherein the virus feature information includes Trojan virus information, related domain names or IP addresses, etc.

[0163] The determination module 5001 is further configured to determine a security linkage device according to the virus feature information.

[0164] Furthermore, in order to improve the processing efficiency of Trojan virus emails, the processing method of the security linkage device determined according to the virus feature information can be to analyze the virus feature information, obtain Trojan virus information, and judge whether the Trojan virus information meets the preset virus conditions. When the Trojan virus information meets the preset virus conditions, the Trojan virus level is determined according to the Trojan virus information, and then the security linkage device is determined according to the Trojan virus level.

[0165] It should also be understood that the preset virus condition is that the Trojan virus email is a poisonous email, the Trojan virus information includes Trojan virus poisonous information and Trojan virus non-toxic information, etc., and the security linkage device can be a security device such as a firewall, etc.

[0166] In a specific implementation, if the Trojan virus email is non-toxic, the process ends; if the Trojan virus email is toxic, the security linkage device can be a firewall, etc.

[0167] The processing module 5003 is used to perform linkage processing on the Trojan virus email through the security linkage device.

[0168] Furthermore, in order to improve the efficiency of handling Trojan virus emails, the method for handling Trojan virus emails through linkage through security linkage equipment can be to determine the domain name information and address information corresponding to the Trojan virus emails, and then determine the preset virus blocking strategy based on the domain name information, address information and the security linkage equipment, and based on the preset virus blocking strategy, the Trojan virus emails are linked and handled through the security linkage equipment.

[0169] It should also be noted that the preset virus blocking strategy can be customized for the user, such as linking the firewall to block related domain names and IPs.

[0170] In this embodiment, Trojan virus emails are linked and handled through the security linkage device based on the preset virus blocking strategy, and a Trojan virus log is generated according to the linkage handling result of the Trojan virus email, the terminal host compromise information is determined according to the Trojan virus log, the preset host handling strategy is determined according to the terminal host compromise information, and the terminal host is isolated and handled according to the preset host handling strategy.

[0171] In the specific implementation, the host is analyzed to see if it has been compromised based on the linkage disposal results of Trojan virus emails combined with traffic, alarms, and terminal EDR logs. The strategy for analyzing host compromise can be the communication traffic generated in the traffic and the communication domain name or IP in the sandbox analysis results, the terminal EDR generates other abnormal security operation alarms, and the actions are consistent with the sandbox virus analysis results. Then, the preset host disposal strategy is determined based on the analysis of the host compromise results. The preset host disposal strategy can be to isolate the host and notify the technical staff to perform on-machine processing, delete emails, clear Trojans, and restore business. Finally, the terminal host is disposed of according to the preset host disposal strategy, and the reasons for the intrusion and the deficiencies in restoring data / business are summarized and reviewed to improve the overall security capabilities based on the existing situation.

[0172] In this embodiment, when the Trojan virus mail is not intercepted, the target account information for receiving the Trojan virus mail is first determined, and then the virus feature information of the Trojan virus mail is obtained according to the target account information, and the security linkage device is determined according to the virus feature information, and then the Trojan virus mail is linked and disposed of by the security linkage device. Compared with the prior art, which requires manual detection of Trojan virus mails and manual disposal of Trojan virus mails, in this embodiment, when the Trojan virus mail is detected, the security linkage device is determined according to the virus feature information corresponding to the Trojan virus mail, and then the Trojan virus mail is linked and disposed of by the security linkage device, thereby improving the disposal efficiency of Trojan virus mails.

[0173] Furthermore, the Trojan virus-based mail processing device further includes a determination module;

[0174] The determination module is used to obtain the mail handling information of the Trojan virus mail;

[0175] The determination module is further used to determine whether the mail handling information meets the preset mail receiving condition;

[0176] The determination module is further configured to, when the email handling information satisfies the preset email receiving condition, execute the operation of determining the target account information for receiving the Trojan virus email.

[0177] Furthermore, the acquisition module 5002 is further used to extract virus sample information from the Trojan virus email according to the target account information;

[0178] The acquisition module 5002 is also used to analyze the virus sample information to obtain virus feature information of the Trojan virus email.

[0179] Furthermore, the determination module 5001 is also used to analyze the virus feature information to obtain Trojan virus information;

[0180] The determination module 5001 is further used to determine a security linkage device according to the Trojan virus information.

[0181] Furthermore, the processing module 5003 is also used to determine the domain name information and address information corresponding to the Trojan virus email;

[0182] The handling module 5003 is further used to determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device;

[0183] The handling module 5003 is also used to perform linkage handling on the Trojan virus email through the security linkage device based on the preset virus blocking strategy.

[0184] Furthermore, the processing module 5003 is also used to generate a Trojan virus log according to the linkage processing result of the Trojan virus email;

[0185] The processing module 5003 is also used to determine the terminal host loss information according to the Trojan virus log;

[0186] The handling module 5003 is further used to determine a preset host handling strategy according to the terminal host loss information;

[0187] The processing module 5003 is further used to isolate the terminal host according to the preset host processing strategy.

[0188] Other embodiments or specific implementations of the mail processing device based on Trojan virus of the present invention can refer to the above-mentioned method embodiments, which will not be described in detail here.

[0189] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0190] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0191] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0192] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0193] The present invention also discloses A1, a mail processing method based on Trojan virus, the mail processing method based on Trojan virus comprises the following steps:

[0194] When the Trojan virus email is not intercepted, determining target account information for receiving the Trojan virus email;

[0195] Obtain virus feature information of the Trojan virus email according to the target account information;

[0196] Determine a security linkage device according to the virus feature information;

[0197] The Trojan virus email is handled in a linked manner through the security linkage device.

[0198] A2. The method as described in A1, wherein before the step of determining the target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted, the method further comprises:

[0199] Obtain email alert information through security detection equipment;

[0200] Determine the Trojan virus event based on the email warning information;

[0201] Analyze the Trojan virus event to obtain Trojan virus infection information;

[0202] The Trojan virus email is determined according to the Trojan virus infection information.

[0203] A3. The method as described in A2, after the step of determining the Trojan virus email according to the Trojan virus infection information, further comprising:

[0204] The Trojan virus email is intercepted by an email gateway device to obtain email interception information;

[0205] Determining whether the email interception information meets a preset interception condition;

[0206] When the email interception information does not satisfy the preset interception condition, it is determined that the Trojan virus email is not intercepted.

[0207] A4. The method as described in A3, after the step of determining whether the mail interception information meets the preset interception condition, further comprising:

[0208] When the mail interception information meets the preset interception condition, generating interception alarm information according to the mail interception information;

[0209] The interception alarm information is sent to the corresponding target management terminal.

[0210] A5. The method as described in A1, before the step of determining the target account information for receiving the Trojan virus email, further comprising:

[0211] Obtaining email handling information of the Trojan virus email;

[0212] Determining whether the mail handling information meets the preset mail receiving conditions;

[0213] When the email handling information meets the preset email receiving condition, the step of determining the target account information for receiving the Trojan virus email is performed.

[0214] A6. The method as described in A5, after the step of determining whether the mail disposal information satisfies the preset mail receiving condition, further comprising:

[0215] When the mail handling information does not meet the preset mail receiving condition, determining the delivery account information of the Trojan virus mail;

[0216] The delivery account information is added to an email blacklist, so that an email interception device intercepts emails sent by the delivery account information according to the email blacklist.

[0217] A7. As described in the method of A1, the step of obtaining virus feature information of the Trojan virus email according to the target account information comprises:

[0218] Extract virus sample information from the Trojan virus email according to the target account information;

[0219] The virus sample information is analyzed to obtain virus feature information of the Trojan virus email.

[0220] A8. As described in A7, the step of analyzing the virus sample information to obtain virus feature information of the Trojan virus email includes:

[0221] Obtaining login terminal information corresponding to the target account information;

[0222] Determine the security detection device according to the login terminal information;

[0223] The virus sample information is analyzed by the security detection device to obtain virus feature information of the Trojan virus email.

[0224] A9. The method as described in any one of A1-A8, wherein the step of determining the security linkage device according to the virus feature information comprises:

[0225] Analyze the virus feature information to obtain Trojan virus information;

[0226] Determine the security linkage device according to the Trojan virus information.

[0227] A10. The method as described in A9, wherein the step of determining the security linkage device according to the Trojan virus information comprises:

[0228] Determine whether the Trojan virus information meets the preset virus condition;

[0229] When the Trojan virus information meets the preset virus condition, determining the Trojan virus level according to the Trojan virus information;

[0230] The security linkage device is determined according to the Trojan virus level.

[0231] A11. The method as described in any one of A1 to A8, wherein the step of performing linkage treatment on the Trojan virus email by the security linkage device comprises:

[0232] Determine the domain name information and address information corresponding to the Trojan virus email;

[0233] Determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device;

[0234] Based on the preset virus blocking strategy, the Trojan virus email is linked and handled through the security linkage device.

[0235] A12. The method of A11, after the step of performing linkage treatment on the Trojan virus email through the security linkage device based on the preset virus blocking strategy, further comprises:

[0236] Generate a Trojan virus log according to the linkage disposal result of the Trojan virus email;

[0237] Determine the terminal host compromise information according to the Trojan virus log;

[0238] Determine a preset host handling strategy according to the terminal host loss information;

[0239] The terminal host is isolated and disposed according to the preset host disposal strategy.

[0240] The present invention also discloses B13, a mail processing device based on a Trojan virus, the mail processing device based on a Trojan virus comprising:

[0241] A determination module, used for determining target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted;

[0242] An acquisition module, used to acquire virus feature information of the Trojan virus email according to the target account information;

[0243] The determination module is further used to determine a security linkage device according to the virus feature information;

[0244] The processing module is used to perform linkage processing on the Trojan virus email through the security linkage device.

[0245] B14. The device as described in B13, wherein the mail processing device based on Trojan virus further includes a determination module;

[0246] The determination module is used to obtain the mail handling information of the Trojan virus mail;

[0247] The determination module is further used to determine whether the mail handling information meets the preset mail receiving condition;

[0248] The determination module is further configured to, when the email handling information satisfies the preset email receiving condition, execute the operation of determining the target account information for receiving the Trojan virus email.

[0249] B15. The device as described in B13, wherein the acquisition module is further used to extract virus sample information from the Trojan virus email according to the target account information;

[0250] The acquisition module is also used to analyze the virus sample information to obtain virus feature information of the Trojan virus email.

[0251] B16. In the device according to any one of B13 to B15, the determining module is further used to analyze the virus feature information to obtain Trojan virus information;

[0252] The determination module is also used to determine the security linkage device according to the Trojan virus information.

[0253] B17. In the device according to any one of B13 to B15, the processing module is further used to determine the domain name information and address information corresponding to the Trojan virus email;

[0254] The processing module is further used to determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device;

[0255] The processing module is also used to perform linkage processing on the Trojan virus email through the security linkage device based on the preset virus blocking strategy.

[0256] B18. The device as described in B17, wherein the processing module is further used to generate a Trojan virus log according to the linkage processing result of the Trojan virus email;

[0257] The processing module is further used to determine the terminal host loss information according to the Trojan virus log;

[0258] The handling module is further used to determine a preset host handling strategy according to the terminal host loss information;

[0259] The processing module is also used to isolate the terminal host according to the preset host processing strategy.

[0260] The present invention also discloses C19, a Trojan virus-based mail processing device, which includes: a memory, a processor, and a Trojan virus-based mail processing program stored in the memory and executable on the processor, wherein the Trojan virus-based mail processing program is configured with steps for implementing the Trojan virus-based mail processing method as described above.

[0261] The present invention also discloses D20, a storage medium, on which a mail processing program based on a Trojan virus is stored. When the mail processing program based on a Trojan virus is executed by a processor, the steps of the mail processing method based on a Trojan virus as described above are implemented.

Claims

1. A method for handling mails based on Trojan virus, characterized in that: The mail handling method based on Trojan virus comprises the following steps: When the Trojan virus email is not intercepted, determining target account information for receiving the Trojan virus email; Acquire virus feature information of the Trojan virus email according to the target account information; Determine a security linkage device according to the virus feature information; The Trojan virus email is handled in a linked manner through the security linkage device.

2. The method according to claim 1, characterized in that Before the step of determining the target account information for receiving the Trojan virus email, the method further includes: Obtaining email handling information of the Trojan virus email; Determining whether the mail handling information meets the preset mail receiving conditions; When the email handling information meets the preset email receiving condition, the step of determining the target account information for receiving the Trojan virus email is performed.

3. The method according to claim 2, characterized in that After the step of determining whether the mail handling information meets the preset mail receiving condition, the method further includes: When the email handling information does not meet the preset email receiving condition, determining the delivery account information of the Trojan virus email; The delivery account information is added to an email blacklist, so that an email interception device intercepts emails sent by the delivery account information according to the email blacklist.

4. The method according to claim 1, characterized in that The step of obtaining virus feature information of the Trojan virus email according to the target account information includes: Extract virus sample information from the Trojan virus email according to the target account information; The virus sample information is analyzed to obtain virus feature information of the Trojan virus email.

5. The method according to any one of claims 1 to 4, characterized in that: The step of determining a security linkage device according to the virus feature information includes: Analyze the virus feature information to obtain Trojan virus information; A security linkage device is determined according to the Trojan virus information.

6. The method according to claim 5, characterized in that The step of determining the security linkage device according to the Trojan virus information includes: Determine whether the Trojan virus information meets the preset virus condition; When the Trojan virus information meets the preset virus condition, determining the Trojan virus level according to the Trojan virus information; The security linkage device is determined according to the Trojan virus level.

7. The method according to any one of claims 1 to 4, characterized in that: The step of performing linkage treatment on the Trojan virus email through the security linkage device includes: Determine the domain name information and address information corresponding to the Trojan virus email; Determine a preset virus blocking strategy according to the domain name information, the address information and the security linkage device; Based on the preset virus blocking strategy, the Trojan virus email is linked and handled through the security linkage device.

8. A mail processing device based on Trojan virus, characterized in that: The mail processing device based on Trojan virus includes: A determination module, used to determine target account information for receiving the Trojan virus email when the Trojan virus email is not intercepted; An acquisition module, used to acquire virus feature information of the Trojan virus email according to the target account information; The determination module is further used to determine a security linkage device according to the virus feature information; The processing module is used to perform linkage processing on the Trojan virus email through the security linkage device.

9. A mail processing device based on Trojan virus, characterized in that: The Trojan virus-based email processing device includes: a memory, a processor, and a Trojan virus-based email processing program stored in the memory and executable on the processor, wherein the Trojan virus-based email processing program is configured with steps for implementing the Trojan virus-based email processing method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a mail processing program based on a Trojan virus, and when the mail processing program based on a Trojan virus is executed by a processor, the steps of the mail processing method based on a Trojan virus as claimed in any one of claims 1 to 7 are implemented.

Images