Phishing mail drilling method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a phishing mail drilling method and system, electronic equipment and a storage medium. The method comprises the following steps: acquiring a phishing mail drill client downloaded from a cloud, and importing the client into an intranet electronic device for operation; obtaining phishing mail configuration information generated by performing phishing mail configuration by the cloud according to the drill information, and running the phishing mail configuration information at the client to obtain a user information analysis template; when phishing mail drilling is carried out, receiving a phishing mail sent by the cloud according to the drilling information; in response to the operation of the user in the phishing mail, collecting user information in the intranet through the client; and carrying out statistical analysis on the user information by adopting the user information analysis template in the intranet through the client to obtain a phishing mail drilling result. By operating the phishing mail drilling client in the intranet to collect and analyze the user data, the user data in the drilling can be prevented from being leaked to the extranet, and the safety of the user data is ensured while the operation cost is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a phishing email rehearsal method, a rehearsal system, an electronic device and a storage medium. Background Art

[0002] In network security, there are already a variety of protective measures that make network boundaries increasingly difficult to breach. For example, security facilities such as the deployment of firewalls, Web Application Firewall (WAF), anti-distributed denial of service (DDoS), and the use of secure access facilities such as zero trust. Although the implementation of these protective measures has improved enterprise security construction, there are still some weaknesses that cannot be ignored. For example, network security issues caused by human factors.

[0003] Employees' security awareness has become the biggest hidden danger to corporate network security. The frequent occurrence of unauthorized access, weak passwords and other issues poses a great risk to corporate security. In response to these problems, "phishing emails" have become a common means of attack. In order to improve employees' awareness and response capabilities to security issues, conducting internal phishing email drills is an effective way.

[0004] In the existing phishing email drills, if an enterprise purchases a complete set of phishing email drills to ensure data security, it will require very high server costs and professional operation and maintenance costs. In order to reduce costs, enterprises are more inclined to purchase several drill services. However, in the drill service, data collection and analysis are required through the enterprise's extranet to implement phishing email drills, resulting in the risk of corporate data leakage. Although some technologies use encrypted communication or desensitization processing to ensure corporate data security. However, corporate data must be transmitted back to the phishing email drill platform on the extranet, and data leakage cannot be completely avoided. Summary of the invention

[0005] The present invention provides a phishing email rehearsal method, a rehearsal system, an electronic device and a storage medium, so as to reduce the operation cost and ensure the security of user data in the phishing email rehearsal.

[0006] According to one aspect of the present invention, a phishing email rehearsal method is provided, the method being executed by an intranet electronic device, comprising:

[0007] Obtaining a phishing email drill client downloaded from the cloud, and importing the client into an intranet electronic device for execution;

[0008] Obtaining phishing email configuration information generated by configuring phishing emails in the cloud according to the drill information, and running the phishing email configuration information on the client to obtain a user information analysis template;

[0009] When conducting a phishing email drill, receiving a phishing email sent by the cloud according to the drill information; and in response to the user's operation in the phishing email, collecting user information in the intranet through the client;

[0010] The client uses the user information analysis template in the intranet to perform statistical analysis on the user information to obtain the phishing email drill result.

[0011] Optionally, obtaining a phishing email drill client downloaded from the cloud, and importing the client into an intranet electronic device for execution, includes:

[0012] The phishing email rehearsal client is downloaded from the cloud through a one-way transmission method, and the client is imported into an intranet electronic device for operation.

[0013] Optionally, downloading the phishing email drill client in the cloud through a one-way transmission method, and importing the client into an intranet electronic device for execution, includes:

[0014] A phishing email drill client that supports the operation of an intranet electronic device's operating system is downloaded from the cloud through a one-way transmission method, and the client is imported into the intranet electronic device for operation.

[0015] Optionally, obtaining phishing email configuration information generated by configuring phishing emails according to the drill information in the cloud, and running the phishing email configuration information on the client to obtain a user information analysis template includes:

[0016] The phishing email configuration information generated by configuring the phishing email according to the drill information is obtained in the cloud through a one-way transmission method, and the phishing email configuration information is run on the client to obtain a user information analysis template.

[0017] Optionally, the one-way transmission method includes: a disc transmission method, a USB disk transmission method, a transmission method of connecting to the Internet to receive data and then disconnecting from the Internet, and a one-way optical fiber network card transmission method.

[0018] Optionally, in response to the user's operation in the phishing email, collecting user information in the intranet through the client includes:

[0019] Before obtaining the phishing email configuration information generated by the cloud according to the drill information and executing the phishing email configuration information on the client to obtain the user information analysis template, reading the IP address of the intranet electronic device, and transmitting the IP address to the cloud in an offline manner, so that the cloud updates the data collection address in the phishing email configuration information;

[0020] In response to the user's operation in the phishing email, when the data collection address in the phishing email configuration information is the IP address of the intranet electronic device, the user information is collected in the intranet through the client.

[0021] According to another aspect of the present invention, a phishing email drill method is provided, the method being executed by a cloud, and the method comprising:

[0022] Obtaining a phishing email drill requirement transmitted by a user through a non-intranet electronic device, and obtaining drill information through the non-intranet electronic device according to the phishing email drill requirement;

[0023] Generate phishing emails according to the drill information configuration and determine the corresponding phishing email configuration information;

[0024] Generate a phishing email rehearsal client and provide a client download interface so that the intranet electronic device can obtain the client;

[0025] Providing the phishing email configuration information acquisition interface so that the intranet electronic device can obtain the phishing email configuration information and run it in the client;

[0026] When conducting a phishing email drill, the phishing email is sent to the email address in the drill information, so that the intranet electronic device collects user information in the intranet through the client and analyzes it to obtain the phishing email drill result.

[0027] According to another aspect of the present invention, a phishing email drill system is provided, the system comprising cloud and intranet electronic devices; wherein:

[0028] The cloud is used to obtain the phishing email drill requirements transmitted by the user through the non-intranet electronic device, and obtain the drill information through the non-intranet electronic device according to the phishing email drill requirements; generate a phishing email according to the drill information configuration, and determine the corresponding phishing email configuration information; generate a phishing email drill client, and provide a client download interface;

[0029] The intranet electronic device is used to obtain the phishing email drill client downloaded from the cloud, and import the client into the intranet electronic device for execution;

[0030] The cloud is used to provide an interface for obtaining the phishing email configuration information;

[0031] The intranet electronic device is used to obtain phishing email configuration information generated by configuring phishing emails according to the drill information in the cloud, and to execute the phishing email configuration information on the client to obtain a user information analysis template;

[0032] The cloud is used to send the phishing email to the email address in the drill information when conducting a phishing email drill;

[0033] The intranet electronic device is used to receive a phishing email sent by the cloud based on the drill information when conducting a phishing email drill; and in response to the user's operation in the phishing email, collect user information in the intranet through the client; and perform statistical analysis on the user information using the user information analysis template in the intranet through the client to obtain the phishing email drill result.

[0034] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0035] at least one processor; and

[0036] a memory communicatively connected to the at least one processor; wherein,

[0037] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the phishing email rehearsal method described in any embodiment of the present invention.

[0038] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the phishing email rehearsal method described in any embodiment of the present invention when executed.

[0039] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the phishing email rehearsal method according to any embodiment of the present invention is implemented.

[0040] The technical solution of the embodiment of the present invention is as follows: obtaining a phishing email drill client downloaded from the cloud, and importing the client into an intranet electronic device for execution; obtaining phishing email configuration information generated by configuring the phishing email on the cloud according to the drill information, and executing the phishing email configuration information on the client to obtain a user information analysis template; receiving a phishing email sent by the cloud according to the drill information when conducting a phishing email drill; and collecting user information in the intranet through the client in response to the user's operation in the phishing email; and obtaining a phishing email drill result by using the user information analysis template to perform statistical analysis on the user information in the intranet through the client, thereby solving the problem of data leakage risk in phishing email drills. By running the phishing email drill client in the intranet, the client collects and analyzes user data in the intranet, thereby ensuring that user data will not be leaked to the external network during the phishing email drill, thereby reducing operating costs while ensuring user data security.

[0041] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 is a flow chart of a phishing email drill method provided according to Embodiment 1 of the present invention;

[0044] Figure 2 is a flow chart of a phishing email drill method provided according to Embodiment 2 of the present invention;

[0045] Figure 3 is a structural diagram of a phishing email drill system provided according to Embodiment 3 of the present invention;

[0046] Figure 4 is a schematic diagram of the structure of a phishing email training device provided according to Embodiment 4 of the present invention;

[0047] Figure 5 It is a structural schematic diagram of a phishing email training device provided according to Embodiment 5 of the present invention;

[0048] Figure 6 It is a structural schematic diagram of an electronic device for implementing the phishing email rehearsal method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] Embodiment 1

[0052] Figure 1 This is a flow chart of a phishing email drill method provided according to the first embodiment of the present invention. This embodiment can be applied to the situation where an enterprise conducts phishing email drills on employees to ensure network security, so that employees can personally experience network security attacks and ensure data security during the drills. The method can be executed by a phishing email drill device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Specifically, the electronic device can be set in the enterprise intranet.

[0053] like Figure 1 As shown, the method is performed by an intranet electronic device, and the method includes:

[0054] Step 110: Obtain the phishing email practice client downloaded from the cloud, and import the client into an intranet electronic device for execution.

[0055] Among them, the cloud can be a server that provides phishing email drill services. The cloud can provide a phishing email drill client that can be downloaded. The phishing email drill client can be run in an intranet electronic device. In order to ensure the simplicity of the operation of the phishing email drill client, the phishing email drill client can be set as an installation-free package. Specifically, the phishing email drill client supports the operation of the intranet electronic device operating system. For example, the client's Java program can be adapted to a program language that supports direct operation of the Windows system, so that the client can be directly run without installation.

[0056] In order to ensure the data security and leakage prevention before and after the client runs in the intranet electronic device, in an optional implementation of the embodiment of the present invention, a phishing email drill client downloaded from the cloud is obtained, and the client is imported into the intranet electronic device for operation, including: downloading the phishing email drill client in the cloud through a one-way transmission method, and importing the client into the intranet electronic device for operation.

[0057] Among them, the one-way transmission mode can be understood as a transmission mode that only allows external network data to be transmitted to the internal network electronic device, but does not allow the internal network data to be transmitted to the external network. Exemplarily, the one-way transmission mode can be a manual ferry transmission mode. In an optional implementation of an embodiment of the present invention, the one-way transmission mode includes: a disc transmission mode, a USB flash drive transmission mode, a transmission mode that connects to the Internet to receive data and then disconnects the Internet connection, and a one-way optical fiber network card transmission mode.

[0058] Downloading the client through a one-way transmission method and running it in an intranet electronic device can ensure that the intranet data will not be leaked to the external network, ensuring the data security in the phishing email drill. Specifically, in an optional implementation of the embodiment of the present invention, downloading the phishing email drill client in the cloud through a one-way transmission method, and importing the client into the intranet electronic device for operation, includes: downloading the phishing email drill client that supports the operation of the intranet electronic device operating system in the cloud through a one-way transmission method, and importing the client into the intranet electronic device for operation.

[0059] When conducting phishing email drills in an enterprise, you can choose a computer with ordinary configuration and no confidential data, such as a laptop or desktop computer running Windows system.

[0060] Step 120: Obtain phishing email configuration information generated by configuring phishing emails based on the drill information in the cloud, and run the phishing email configuration information on the client to obtain a user information analysis template.

[0061] The drill information may be information determined by the enterprise based on the drill theme. For example, the drill information may include, but is not limited to, drill theme, drill objectives, drill time nodes, and target users and groups during the drill. The enterprise may inform the cloud of the drill information offline or through an external network that does not involve confidential data to avoid leakage of enterprise intranet data.

[0062] The phishing email configuration information may be information generated by the cloud when performing phishing email drill task configuration. The phishing email drill task configuration may include but is not limited to: setting the drill task name, start time, selecting the phishing web page to be used, email template, email service policy, and target users and groups.

[0063] In an embodiment of the present invention, in order to improve the authenticity of emails in phishing email drills, when configuring phishing web pages, phishing simulation web pages can be implemented for target users, and third-party website pages can be added and directly cloned in the cloud. When configuring email templates, email content based on social engineering attacks can be sent to target users, and direct import and use of emails are supported in the cloud. When configuring email services, the email service information and sending user data of the email sender can be configured. When configuring target users and groups, the cloud can support the entry of target user data and group data, and support batch import of user information. Among them, the target users and groups include email addresses and user resource groups, which are basic information and will not cause leakage of intranet data. On the basis of the above configuration, the report template content can also be customized for report export after the drill.

[0064] In an embodiment of the present invention, in order to display the information in the phishing email drill in the client of the intranet, the phishing email configuration information generated by the cloud according to the drill information can be obtained and run on the client. In an embodiment of the present invention, in order to protect user data, user information is collected in the intranet, and analyzed to generate the phishing email drill results. Therefore, when the phishing email configuration information is run on the client, in addition to the above-mentioned information display function, it is also necessary to generate a user information analysis template according to the configuration content of the report template in the phishing email configuration information.

[0065] In order to ensure data security when obtaining phishing email configuration information and running it on the intranet client, in an optional implementation of the embodiment of the present invention, the phishing email configuration information generated by the cloud according to the drill information is obtained, and the phishing email configuration information is run on the client to obtain a user information analysis template, including: obtaining the phishing email configuration information generated by the cloud according to the drill information through a one-way transmission method, and running the phishing email configuration information on the client to obtain a user information analysis template.

[0066] Step 130: When conducting a phishing email drill, receive a phishing email sent by the cloud based on the drill information; and in response to the user's operation in the phishing email, collect user information in the intranet through the client.

[0067] Among them, the cloud can configure the phishing email drill task according to the drill information to generate a phishing email. At the beginning of the drill, the cloud can send phishing emails to target users and groups in the intranet electronic devices. Users can perform operations in the phishing email, such as opening the phishing email, clicking on the link in the phishing email to submit data, etc. The client can collect user information of successful phishing when the user operates the phishing email. User information includes but is not limited to: IP address, operating system information, user account password, and user login data and other log records.

[0068] In order to collect user information through the client in the intranet, the IP address of the intranet electronic device can be recorded. Specifically, in an optional implementation of the embodiment of the present invention, in response to the user's operation in the phishing email, the user information is collected in the intranet through the client, including: before obtaining the phishing email configuration information generated by the cloud according to the drill information and running the phishing email configuration information on the client to obtain the user information analysis template, the IP address of the intranet electronic device is read to transmit the IP address to the cloud in an offline manner, so that the cloud updates the data collection address in the phishing email configuration information; in response to the user's operation in the phishing email, when the data collection address in the phishing email configuration information is the IP address of the intranet electronic device, the user information is collected in the intranet through the client.

[0069] Among them, the IP address of the intranet electronic device is transmitted to the cloud offline, which can ensure that the intranet data will not be leaked. The cloud updates the data collection address in the phishing email configuration information to the IP address of the intranet electronic device, and can collect user information through the client in the IP address, avoiding the situation where the cloud defaults to data collection being performed by the cloud and data collection is performed through the external network; ensuring data security and avoiding user data leakage.

[0070] Step 140: Perform statistical analysis on user information using a user information analysis template in the intranet through the client to obtain phishing email drill results.

[0071] The client running in the intranet can use the user information analysis template to summarize and analyze the collected user information to generate phishing email drill results. The phishing email drill results can be displayed on electronic devices, which can help companies understand the weaknesses of employees in phishing emails. Through the phishing email drill results, employees' safety awareness can be improved, and they can know what to pay extra attention to when opening emails to avoid email phishing incidents.

[0072] The technical solution of this embodiment is to obtain a phishing email drill client downloaded from the cloud, and import the client into an intranet electronic device for execution; obtain phishing email configuration information generated by configuring the phishing email on the cloud according to the drill information, and execute the phishing email configuration information on the client to obtain a user information analysis template; when conducting a phishing email drill, receive a phishing email sent by the cloud according to the drill information; and in response to the user's operation in the phishing email, collect user information in the intranet through the client; perform statistical analysis on the user information by using the user information analysis template in the intranet through the client to obtain the phishing email drill result, thereby solving the problem of data leakage risk in the phishing email drill, and by running the phishing email drill client in the intranet, the client performs user data collection and analysis in the intranet, thereby ensuring that user data will not be leaked to the external network during the phishing email drill, thereby reducing operating costs while ensuring user data security.

[0073] It should be noted that in the phishing email drill, the collection of user information is carried out in the enterprise intranet, and the phishing email drill is based on the needs of the enterprise and is conducted with the knowledge and authorization of the enterprise. Therefore, the data acquisition operation in the phishing email drill is reasonable and legal. The collection of user information is only for the purpose of improving the enterprise's awareness of phishing emails and the safety awareness of enterprise employees, which complies with the provisions of relevant laws and regulations and does not violate public order and good customs.

[0074] Embodiment 2

[0075] Figure 2 This is a flow chart of a phishing email drill method provided according to the second embodiment of the present invention. This embodiment can be applied to the situation where an enterprise conducts phishing email drills on employees to ensure network security, so that employees can experience network security attacks in person and ensure data security during the drill. The method can be executed by a phishing email drill device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device such as a cloud server. Specifically, the electronic device can be set in an external network.

[0076] like Figure 2 As shown, the method is executed by a cloud of an external network, and the method includes:

[0077] Step 210: Obtain a phishing email drill requirement transmitted by a user through a non-intranet electronic device, and obtain drill information through the non-intranet electronic device according to the phishing email drill requirement.

[0078] In order to ensure the security of enterprise intranet data, phishing email drill requirements and drill information can be transmitted through non-intranet electronic devices. Non-intranet electronic devices do not involve confidential data.

[0079] Step 220: Generate a phishing email according to the drill information configuration, and determine the corresponding phishing email configuration information.

[0080] Step 230: Generate a phishing email practice client and provide a client download interface so that an intranet electronic device can obtain the client.

[0081] The phishing email practice client can be run in the intranet electronic device without installation. In an optional implementation of the embodiment of the present invention, generating the phishing email practice client includes: generating a phishing email practice client that supports the operation of the intranet electronic device operating system.

[0082] When obtaining the client, the intranet electronic device may download and run the client through the client download interface in a one-way transmission mode to ensure the security of the intranet data.

[0083] Step 240: Provide a phishing email configuration information acquisition interface so that the intranet electronic device can obtain the phishing email configuration information and run it in the client.

[0084] Among them, the client running the phishing email configuration information can realize the display of information in the phishing email drill, and generate a user information analysis template to analyze the collected user information. When the intranet electronic device obtains the phishing email configuration information, it can obtain the information through the phishing email configuration information acquisition interface in a one-way transmission mode to ensure the security of the intranet data.

[0085] Step 250: When conducting a phishing email drill, a phishing email is sent to the email address in the drill information, so that the intranet electronic device collects user information in the intranet through the client and analyzes it to obtain the phishing email drill result.

[0086] In an optional implementation of the embodiment of the present invention, the method further includes: obtaining the IP address of the intranet electronic device, and setting the data collection address in the phishing email configuration information to the IP address of the intranet electronic device. By updating the data collection address to the IP address of the intranet electronic device, user information collection can be implemented through the client in the intranet electronic device.

[0087] The technical solution of the embodiment of the present invention obtains the phishing email drill demand transmitted by the user through a non-intranet electronic device, and obtains the drill information through the non-intranet electronic device according to the phishing email drill demand; generates a phishing email according to the drill information configuration, and determines the corresponding phishing email configuration information; generates a phishing email drill client, and provides a client download interface so that the intranet electronic device obtains the client; provides a phishing email configuration information acquisition interface so that the intranet electronic device obtains the phishing email configuration information and runs it in the client; when performing a phishing email drill, sends a phishing email to the email address in the drill information, so that the intranet electronic device collects user information in the intranet through the client and analyzes it to obtain the phishing email drill result, thereby solving the problem of data leakage risk in the phishing email drill. By generating a phishing email drill client and providing a download interface, the intranet device can download the client through a one-way transmission method to collect and analyze user data in the intranet, thereby ensuring that user data will not be leaked to the external network during the phishing email drill, thereby reducing operating costs while ensuring user data security.

[0088] Embodiment 3

[0089] Figure 3 Schematic diagram of a phishing email training system provided according to Embodiment 3 of the present invention. Figure 3 As shown, the system includes cloud and intranet electronic devices. Among them:

[0090] The cloud is used to obtain the phishing email drill requirements transmitted by the user through non-intranet electronic devices, and obtain the drill information through non-intranet electronic devices according to the phishing email drill requirements; generate phishing emails according to the drill information configuration, and determine the corresponding phishing email configuration information; generate a phishing email drill client, and provide a client download interface;

[0091] An intranet electronic device is used to obtain a phishing email drill client downloaded from the cloud and import the client into the intranet electronic device for operation;

[0092] The cloud is used to provide an interface for obtaining phishing email configuration information;

[0093] The intranet electronic device is used to obtain the phishing email configuration information generated by the cloud according to the drill information, and to run the phishing email configuration information on the client to obtain a user information analysis template;

[0094] The cloud is used to send phishing emails to the email addresses in the drill information when conducting a phishing email drill;

[0095] An intranet electronic device is used to receive phishing emails sent by the cloud based on drill information when conducting a phishing email drill; and in response to the user's operation in the phishing email, collect user information in the intranet through the client; and perform statistical analysis on the user information using a user information analysis template in the intranet through the client to obtain the phishing email drill result.

[0096] Optionally, an intranet electronic device is specifically used to download a phishing email drill client from the cloud via a one-way transmission method, and import the client into the intranet electronic device for operation.

[0097] Optionally, the intranet electronic device is specifically used to download a phishing email rehearsal client that supports the operation of the intranet electronic device's operating system in the cloud through a one-way transmission method, and import the client into the intranet electronic device for operation.

[0098] Optionally, an intranet electronic device is specifically used to obtain phishing email configuration information generated by configuring phishing emails based on drill information in the cloud through a one-way transmission method, and run the phishing email configuration information on the client to obtain a user information analysis template.

[0099] Optional one-way transmission methods include: disc transmission method, USB disk transmission method, transmission method of connecting to the Internet to receive data and then disconnecting from the Internet, and one-way optical fiber network card transmission method.

[0100] Optionally, the intranet electronic device is specifically used to read the IP address of the intranet electronic device before obtaining the phishing email configuration information generated by the cloud according to the drill information and executing the phishing email configuration information on the client to obtain the user information analysis template;

[0101] The cloud is specifically used to obtain the IP address of the electronic device on the intranet and update the data collection address in the phishing email configuration information to the IP address of the electronic device on the intranet;

[0102] The intranet electronic device is specifically used to respond to the user's operation in the phishing email, and when the data collection address in the phishing email configuration information is the IP address of the intranet electronic device, collect user information in the intranet through the client.

[0103] like Figure 3 As shown, the technical solution of the embodiment of the present invention, through the interactive setting between the cloud and the intranet electronic device, the data collection and analysis performed in the external network by the prior art is deployed in the intranet for execution, without communicating with the outside, to avoid the possibility of leakage of user information. By running the client in the intranet electronic device, the problem of high drill cost and difficult maintenance when the enterprise purchases the entire phishing email drill platform can be avoided; at the same time, the security of the intranet data can be guaranteed.

[0104] Embodiment 4

[0105] Figure 4 1 is a schematic diagram of a phishing email training device according to Embodiment 4 of the present invention. The device is executed by an intranet electronic device. Figure 4 As shown, the device includes: a client import and run module 410, a user information analysis template generation module 420, a user information collection module 430 and a phishing email drill result determination module 440. Among them:

[0106] The client import and run module 410 is used to obtain the phishing email drill client downloaded from the cloud, and import the client into the intranet electronic device for operation;

[0107] The user information analysis template generation module 420 is used to obtain phishing email configuration information generated by the cloud according to the drill information, and execute the phishing email configuration information on the client to obtain a user information analysis template;

[0108] The user information collection module 430 is used to receive the phishing email sent by the cloud according to the drill information when the phishing email drill is performed; and in response to the user's operation in the phishing email, collect the user information in the intranet through the client;

[0109] The phishing email drill result determination module 440 is used to perform statistical analysis on user information using a user information analysis template in the intranet through the client to obtain the phishing email drill result.

[0110] Optionally, the client imports the running module 410, including:

[0111] The client import operation unit is used to download the phishing email drill client in the cloud through a one-way transmission method, and import the client into the intranet electronic device for operation.

[0112] Optionally, the client imports the running unit, including:

[0113] The client import and run sub-unit is used to download a phishing email drill client that supports the operation of the intranet electronic device operating system in the cloud through a one-way transmission method, and import the client into the intranet electronic device for operation.

[0114] Optionally, the user information analysis template generation module 420 includes:

[0115] The user information analysis template generation unit is used to obtain the phishing email configuration information generated by the cloud according to the drill information through a one-way transmission method, and run the phishing email configuration information on the client to obtain the user information analysis template.

[0116] Optional one-way transmission methods include: disc transmission method, USB disk transmission method, transmission method of connecting to the Internet to receive data and then disconnecting from the Internet, and one-way optical fiber network card transmission method.

[0117] Optionally, the user information collection module 430 includes:

[0118] The IP address unit is used to read the IP address of the electronic device in the intranet before obtaining the phishing email configuration information generated by the cloud according to the drill information and running the phishing email configuration information on the client to obtain the user information analysis template, so as to transmit the IP address to the cloud in an offline manner, so that the cloud updates the data collection address in the phishing email configuration information;

[0119] The user information collection unit is used to respond to the user's operation in the phishing email, and when the data collection address in the phishing email configuration information is the IP address of the intranet electronic device, collect user information in the intranet through the client.

[0120] The phishing email rehearsal device provided in the embodiment of the present invention can execute the phishing email rehearsal method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0121] Embodiment 5

[0122] Figure 5 1 is a schematic diagram of a phishing email training device according to Embodiment 5 of the present invention. The device is executed by an intranet electronic device. Figure 5 As shown, the device includes: a drill information acquisition module 510, a phishing email generation module 520, a client download interface providing module 530, a phishing email configuration information acquisition interface providing module 540, and a phishing email sending module 550. Among them:

[0123] The drill information acquisition module 510 is used to obtain the phishing email drill requirements transmitted by the user through the non-intranet electronic device, and obtain the drill information through the non-intranet electronic device according to the phishing email drill requirements;

[0124] A phishing email generation module 520, configured to generate a phishing email according to the drill information configuration and determine corresponding phishing email configuration information;

[0125] The client download interface providing module 530 is used to generate a phishing email drill client and provide a client download interface so that the intranet electronic device can obtain the client;

[0126] A phishing email configuration information acquisition interface providing module 540 is used to provide a phishing email configuration information acquisition interface so that the intranet electronic device can obtain the phishing email configuration information and run it in the client;

[0127] The phishing email sending module 550 is used to send a phishing email to the email address in the drill information when conducting a phishing email drill, so that the intranet electronic device collects user information in the intranet through the client and analyzes it to obtain the phishing email drill result.

[0128] Optionally, the phishing email generation module 520 includes:

[0129] A phishing email generation unit is used to generate a phishing email drill client that supports the operation of an intranet electronic device operating system.

[0130] Optionally, the device further includes:

[0131] The data collection address update module is used to obtain the IP address of the intranet electronic device and set the data collection address in the phishing email configuration information as the IP address of the intranet electronic device.

[0132] The phishing email rehearsal device provided in the embodiment of the present invention can execute the phishing email rehearsal method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0133] In the technical solutions of the embodiments of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0134] Embodiment 6

[0135] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0136] like Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0137] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0138] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the phishing email rehearsal method.

[0139] In some embodiments, the phishing email rehearsal method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the phishing email rehearsal method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the phishing email rehearsal method in any other appropriate manner (e.g., by means of firmware).

[0140] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0141] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0142] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0143] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0144] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0145] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0146] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0147] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A phishing email drill method, characterized in that: The method is performed by an intranet electronic device, and the method includes: Obtaining a phishing email drill client downloaded from the cloud, and importing the client into an intranet electronic device for execution; Obtaining phishing email configuration information generated by configuring phishing emails in the cloud according to the drill information, and running the phishing email configuration information on the client to obtain a user information analysis template; When conducting a phishing email drill, receiving a phishing email sent by the cloud according to the drill information; and in response to the user's operation in the phishing email, collecting user information in the intranet through the client; The client uses the user information analysis template in the intranet to perform statistical analysis on the user information to obtain the phishing email drill result.

2. The method according to claim 1, characterized in that Obtain the phishing email drill client downloaded from the cloud, and import the client into the intranet electronic device for execution, including: The phishing email rehearsal client is downloaded from the cloud through a one-way transmission method, and the client is imported into an intranet electronic device for operation.

3. The method according to claim 2, characterized in that Download the phishing email drill client in the cloud through a one-way transmission method, and import the client into the intranet electronic device for operation, including: A phishing email drill client that supports the operation of an intranet electronic device's operating system is downloaded from the cloud through a one-way transmission method, and the client is imported into the intranet electronic device for operation.

4. The method according to claim 1, characterized in that: Obtaining phishing email configuration information generated by configuring phishing emails in the cloud according to the drill information, and running the phishing email configuration information on the client to obtain a user information analysis template, including: The phishing email configuration information generated by configuring the phishing email according to the drill information is obtained in the cloud through a one-way transmission method, and the phishing email configuration information is run on the client to obtain a user information analysis template.

5. The method according to any one of claims 2 to 4, characterized in that: The one-way transmission method includes: a disc transmission method, a USB disk transmission method, a transmission method of connecting to the Internet to receive data and then disconnecting from the Internet, and a one-way optical fiber network card transmission method.

6. The method according to claim 1, characterized in that In response to the user's operation in the phishing email, collecting user information in the intranet through the client includes: Before obtaining the phishing email configuration information generated by the cloud according to the drill information and executing the phishing email configuration information on the client to obtain the user information analysis template, reading the IP address of the intranet electronic device, and transmitting the IP address to the cloud in an offline manner, so that the cloud updates the data collection address in the phishing email configuration information; In response to the user's operation in the phishing email, when the data collection address in the phishing email configuration information is the IP address of the intranet electronic device, the user information is collected in the intranet through the client.

7. A phishing email drill method, characterized in that: The method is executed by the cloud, and the method includes: Obtaining a phishing email drill requirement transmitted by a user through a non-intranet electronic device, and obtaining drill information through the non-intranet electronic device according to the phishing email drill requirement; Generate phishing emails according to the drill information configuration and determine the corresponding phishing email configuration information; Generate a phishing email rehearsal client and provide a client download interface so that the intranet electronic device can obtain the client; Providing the phishing email configuration information acquisition interface so that the intranet electronic device can obtain the phishing email configuration information and run it in the client; When conducting a phishing email drill, the phishing email is sent to the email address in the drill information, so that the intranet electronic device collects user information in the intranet through the client and analyzes it to obtain the phishing email drill result.

8. A phishing email training system, characterized in that: The system includes cloud and intranet electronic devices; wherein: The cloud is used to obtain the phishing email drill requirements transmitted by the user through the non-intranet electronic device, and obtain the drill information through the non-intranet electronic device according to the phishing email drill requirements; generate a phishing email according to the drill information configuration, and determine the corresponding phishing email configuration information; generate a phishing email drill client, and provide a client download interface; The intranet electronic device is used to obtain the phishing email drill client downloaded from the cloud, and import the client into the intranet electronic device for execution; The cloud is used to provide an interface for obtaining the phishing email configuration information; The intranet electronic device is used to obtain phishing email configuration information generated by configuring phishing emails according to the drill information in the cloud, and to execute the phishing email configuration information on the client to obtain a user information analysis template; The cloud is used to send the phishing email to the email address in the drill information when conducting a phishing email drill; The intranet electronic device is used to receive a phishing email sent by the cloud based on the drill information when conducting a phishing email drill; and in response to the user's operation in the phishing email, collect user information in the intranet through the client; and perform statistical analysis on the user information using the user information analysis template in the intranet through the client to obtain the phishing email drill result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the phishing email rehearsal method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the phishing email rehearsal method according to any one of claims 1 to 7 when executed.

Images