Mailbox blasting processing method, device and equipment and storage medium

Abstract

The invention relates to the technical field of internet security, and discloses a mailbox blasting processing method, device and equipment and a storage medium, and the method comprises the steps: determining attack address information of an event initiator of a mailbox blasting failure event when the mailbox blasting failure event is detected; determining an attack address type according to the attack address information; obtaining a preset banning strategy corresponding to the attack address type; and processing the mailbox blasting failure event according to a preset banning strategy. Compared with the prior art in which a user needs to monitor the account login condition in a mailbox in real time, judge a mailbox blasting event and process the mailbox blasting event through a preset blasting processing strategy, the method provided by the invention needs to determine the event type of the mailbox blasting event and the attack address type; and then the preset banning strategy is determined according to the event type of the mailbox blasting event and the attack address type, and finally the mailbox blasting event is processed based on the preset banning strategy, so that the processing efficiency of the mailbox blasting event is improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security technology, and in particular to a mailbox blasting processing method, device, equipment and storage medium. Background Art

[0002] Mailbox blasting events are events in which attackers try a large number of email account passwords in order to obtain the real email account password. Once the attacker obtains the correct email account password, all emails in the email account can be stolen. In the prior art, users are required to monitor the account login status in the mailbox in real time and determine the mailbox blasting events based on manual experience. After that, the mailbox blasting events are processed by pre-set blasting processing strategies or manual experience, resulting in low efficiency in processing mailbox blasting events.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a mailbox blasting processing method, device, equipment and storage medium, aiming to solve the technical problem of how to improve the processing efficiency of mailbox blasting events.

[0005] To achieve the above object, the present invention provides a mailbox blasting processing method, which comprises the following steps:

[0006] When a mailbox blasting failure event is detected, determining the attack address information of the event initiator of the mailbox blasting failure event;

[0007] Determine the attack address type according to the attack address information;

[0008] Obtaining a preset blocking policy corresponding to the attack address type;

[0009] The mailbox blasting failure event is processed according to the preset blocking strategy.

[0010] Optionally, before the step of determining the attack address information of the event initiator of the mailbox blasting failure event when the mailbox blasting failure event is detected, the method further includes:

[0011] Obtain information about email blasting behavior within a preset period of time;

[0012] Determine mailbox blasting verification information according to the mailbox blasting behavior information;

[0013] When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

[0014] Optionally, the step of determining the mailbox blasting verification information according to the mailbox blasting behavior information includes:

[0015] Determine the number of mailbox blasting times according to the mailbox blasting behavior information;

[0016] When the mailbox blasting times are greater than the preset blasting times, a mailbox blasting event is generated according to the mailbox blasting behavior information;

[0017] The mailbox blasting event is analyzed to obtain mailbox blasting verification information.

[0018] Optionally, after the step of determining the mailbox blasting verification information according to the mailbox blasting behavior information, the method further includes:

[0019] When the mailbox blasting verification information does not meet the preset blasting failure condition, determining the attacked mailbox account according to the mailbox blasting verification information;

[0020] The attacked email account is blocked.

[0021] Optionally, the step of blocking the attacked email account includes:

[0022] Determine the login terminal corresponding to the attacked email account;

[0023] Determining a security linkage device according to the login terminal;

[0024] The attacked email account is blocked through the security linkage device.

[0025] Optionally, after the step of blocking the attacked email account by the security linkage device, the method further includes:

[0026] Obtaining the mailbox management terminal corresponding to the attacked mailbox account;

[0027] Generate mailbox warning information according to the mailbox blasting behavior information;

[0028] The mailbox warning information is sent to the mailbox management terminal, so that the mailbox management terminal issues a warning prompt based on the mailbox warning information.

[0029] Optionally, the step of determining the attack address information of the event initiator of the mailbox blasting failure event includes:

[0030] Obtain the mailbox password information corresponding to the mailbox blasting failure event;

[0031] Determine the password information corresponding to the mailbox password information;

[0032] The attack address information of the event initiator of the mailbox blasting failure event is determined according to the password information.

[0033] Optionally, the step of determining the attack address information of the event initiator of the mailbox blasting failure event according to the password information includes:

[0034] Extracting password keywords from the password information;

[0035] Determining the password level according to the password keyword;

[0036] When the password level is the first level, the attack address information of the event initiator of the mailbox blasting failure event is determined according to the password level.

[0037] Optionally, after the step of determining the password level according to the password keyword, the method further includes:

[0038] When the password level is the second level, determining the password modification strategy according to the password level;

[0039] The mailbox password information is adjusted according to the password modification policy.

[0040] Optionally, the step of determining the attack address type according to the attack address information includes:

[0041] extracting data communication information from the attack address information;

[0042] Analyzing the data communication information to obtain address area information;

[0043] The attack address type is determined according to the address area information.

[0044] Optionally, after the step of processing the mailbox blasting failure event according to the preset blocking strategy, the method further includes:

[0045] Generate a mailbox blasting log according to the mailbox blasting failure event and the preset blocking strategy;

[0046] The mailbox blasting log is added to the preset mailbox blasting library for storage.

[0047] Optionally, the step of adding the mailbox blasting log to a preset mailbox blasting library for storage includes:

[0048] Get the blasting log type corresponding to the mailbox blasting log;

[0049] Determine a mailbox blasting sub-library from a preset mailbox blasting library according to the blasting log type;

[0050] The mailbox blasting log is added to the mailbox blasting sub-library for storage.

[0051] In addition, to achieve the above-mentioned purpose, the present invention also proposes a mailbox blasting treatment device, the mailbox blasting treatment device comprising:

[0052] A determination module, used to determine the attack address information of the event initiator of the mailbox blasting failure event when a mailbox blasting failure event is detected;

[0053] The determination module is further used to determine the attack address type according to the attack address information;

[0054] An acquisition module, used to acquire a preset blocking policy corresponding to the attack address type;

[0055] The processing module is used to process the mailbox blasting failure event according to the preset blocking strategy.

[0056] Optionally, the mailbox blasting processing device further includes a determination module;

[0057] The determination module is used to obtain mailbox blasting behavior information within a preset period of time;

[0058] The determination module is further used to determine the mailbox blasting verification information according to the mailbox blasting behavior information;

[0059] The determination module is further configured to determine that a mailbox blasting failure event is detected when the mailbox blasting verification information meets a preset blasting failure condition.

[0060] Optionally, the determination module is further used to obtain the mailbox password information corresponding to the mailbox blasting failure event;

[0061] The determination module is further used to determine the password information corresponding to the mailbox password information;

[0062] The determination module is further configured to determine the attack address information of the event initiator of the mailbox blasting failure event according to the password information.

[0063] Optionally, the determination module is further used to extract password keywords from the password information;

[0064] The determination module is further used to determine the password level according to the password keyword;

[0065] The determination module is further configured to determine, when the password level is the first level, the attack address information of the event initiator of the mailbox blasting failure event according to the password level.

[0066] Optionally, the determination module is further configured to determine a password modification policy according to the password level when the password level is the second level;

[0067] The determination module is further used to adjust the mailbox password information according to the password modification policy.

[0068] Optionally, the determination module is further used to extract data communication information from the attack address information;

[0069] The determination module is further used to analyze the data communication information to obtain address area information;

[0070] The determination module is further used to determine the attack address type according to the address area information.

[0071] In addition, to achieve the above-mentioned purpose, the present invention also proposes a mailbox blasting processing device, which includes: a memory, a processor, and a mailbox blasting processing program stored on the memory and executable on the processor, and the mailbox blasting processing program is configured to implement the steps of the mailbox blasting processing method described above.

[0072] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a mailbox blasting processing program is stored, and when the mailbox blasting processing program is executed by a processor, the steps of the mailbox blasting processing method described above are implemented.

[0073] When the present invention detects a mailbox blasting failure event, it first determines the attack address information of the event initiator of the mailbox blasting failure event, then determines the attack address type according to the attack address information, and obtains the preset blocking policy corresponding to the attack address type, and then processes the mailbox blasting failure event according to the preset blocking policy. Compared with the prior art, which requires users to monitor the account login status in the mailbox in real time, determine the mailbox blasting event, and process the mailbox blasting event through a preset blasting processing policy, the present invention needs to determine the event type and attack address type of the mailbox blasting event, and then determine the preset blocking policy according to the event type and attack address type of the mailbox blasting event, and finally process the mailbox blasting event based on the preset blocking policy, thereby improving the processing efficiency of the mailbox blasting event, and then improving the overall security capabilities and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 It is a structural schematic diagram of a mailbox blasting processing device in a hardware operating environment involved in an embodiment of the present invention;

[0075] Figure 2 It is a flowchart of the first embodiment of the mailbox blasting processing method of the present invention;

[0076] Figure 3 It is a flow chart of the second embodiment of the mailbox blasting processing method of the present invention;

[0077] Figure 4 It is a flowchart of the third embodiment of the mailbox blasting processing method of the present invention;

[0078] Figure 5 This is a structural block diagram of the first embodiment of the mailbox blasting processing device of the present invention.

[0079] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0080] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0081] Reference Figure 1 , Figure 1 The schematic diagram of the structure of the mailbox blasting processing device in the hardware operating environment involved in the embodiment of the present invention.

[0082] like Figure 1 As shown, the mailbox blasting processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireles s-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volat ile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0083] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation of the mailbox blasting processing equipment, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0084] like Figure 1As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a mailbox blasting processing program.

[0085] exist Figure 1 In the mailbox blasting processing device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the mailbox blasting processing device of the present invention can be set in the mailbox blasting processing device, and the mailbox blasting processing device calls the mailbox blasting processing program stored in the memory 1005 through the processor 1001, and executes the mailbox blasting processing method provided by the embodiment of the present invention.

[0086] The embodiment of the present invention provides a mailbox blasting processing method, referring to Figure 2 , Figure 2 It is a flowchart of the first embodiment of the mailbox blasting processing method of the present invention.

[0087] In this embodiment, the mailbox blasting processing method includes the following steps:

[0088] Step S10: when a mailbox blasting failure event is detected, determining the attack address information of the event initiator of the mailbox blasting failure event.

[0089] It is easy to understand that the execution subject of this embodiment can be a mailbox blasting processing device with functions such as data processing, network communication and program running, or other computer devices with similar functions, and this embodiment is not limited.

[0090] It is understandable that the mailbox blasting failure event is an event in which the attacker continuously tries a large number of mailbox account passwords but fails to obtain the correct mailbox account password. The mailbox blasting event includes the mailbox blasting failure event and the mailbox blasting success event. The attack website information can be the attack address information of the event initiator against the mailbox account.

[0091] Furthermore, in order to accurately distinguish mailbox blasting failure events, when a mailbox blasting failure event is detected, before the step of determining the attack address information of the event initiator of the mailbox blasting failure event, it is also necessary to obtain the mailbox blasting behavior information within a preset time period, and then determine the mailbox blasting verification information based on the mailbox blasting behavior information. When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

[0092] It should be noted that the preset time period can be a user-defined setting, which can be 30 minutes, or 50 seconds, etc. The mailbox blasting behavior information can be the mailbox account attacked within the preset time period and the account password corresponding to the mailbox account, and the matching information between the mailbox account and the account password. The matching information can be a successful match or a failed match. The mailbox blasting verification information includes mailbox blasting verification success information, mailbox blasting verification failure, and the number of verification failures. The preset blasting failure condition is that the number of verification failures is greater than the preset matching number, and the verification information is all mailbox blasting verification failures. The preset matching number can be a user-defined setting, such as 3 or 5.

[0093] Assuming that there may be an email account A in the email blasting behavior information, it is necessary to obtain the account and password information corresponding to the email account A. If the account and password information are A1, A2, A3, A4 and A5 respectively, then match the email account A with the account and password information A1, A2, A3, A4 and A5 respectively to obtain the email blasting verification information between the email account A and the account and password A1, the email blasting verification information between the email account A and the account and password A2, the email blasting verification information between the email account A and the account and password A3, the email blasting verification information between the email account A and the account and password A4, and the email blasting verification information between the email account A and the account and password A5. If the email blasting verification information is all failed, the number of verification failures is 5, and the number of verification failures is greater than the preset matching number of 3 times, it is determined that the email blasting failure event is detected. If the account and password A1, A2, A3 and A4 are all failed, the account and password A5 is successfully verified, and the number of verification failures is greater than the preset matching number of 3 times, it is determined that the email blasting success event is detected, etc.

[0094] Furthermore, in order to accurately obtain mailbox blasting verification information, the processing method for determining the mailbox blasting verification information according to the mailbox blasting behavior information can be to determine the number of mailbox blasting according to the mailbox blasting behavior information, and when the number of mailbox blasting is greater than the preset number of blasting, generate a mailbox blasting event according to the mailbox blasting behavior information, and then analyze the mailbox blasting event to obtain the mailbox blasting verification information.

[0095] It should also be noted that the way to perceive mailbox blasting events can also be to discover blasting behavior through traffic detection equipment, or to discover blasting behavior through log detection equipment, or to discover blasting behavior by manually checking the device mail server account login log, etc.

[0096] In a specific implementation, when the mailbox blasting verification information does not meet the preset blasting failure condition, the attacked mailbox account is determined according to the mailbox blasting verification information, and then the attacked mailbox account is banned.

[0097] It should also be understood that when the mailbox blasting verification information does not meet the preset blasting failure condition, the mailbox blasting event is determined to be a mailbox blasting success event, etc. The attacked mailbox account is the mailbox account attacked by the event initiator, etc.

[0098] In this embodiment, the step of banning the attacked email account can also be to determine the login terminal corresponding to the attacked email account, then determine the security linkage device based on the login terminal, and ban the attacked email account through the security linkage device, and obtain the email management terminal corresponding to the attacked email account, generate email warning information based on the email blasting behavior information, and finally send the email warning information to the email management terminal, so that the email management terminal can issue a warning prompt based on the email warning information.

[0099] It should also be noted that the login terminal is the terminal logged in by the current email account, and the security linkage device is the security device existing on the terminal logged in by the current email account, and the security device can be a mail server, etc.

[0100] In a specific implementation, when the mailbox blasting event is a mailbox blasting success event, the mail server can be linked to deactivate the mailbox account, and notify the person in charge of the mailbox account to change the password of the mailbox account, etc. When the mailbox blasting event is a mailbox blasting failure event, the mailbox password information corresponding to the mailbox blasting failure event is obtained, and then the password information corresponding to the mailbox password information is determined, and the attack address information of the initiator of the mailbox blasting failure event is determined according to the password information.

[0101] Furthermore, in order to speed up the processing efficiency of the mailbox blasting event, the processing method of determining the attack address information of the event initiator of the mailbox blasting failure event according to the password information can be to extract the password keyword from the password information, determine the password level according to the password keyword, and when the password level is the first level, determine the attack address information of the event initiator of the mailbox blasting failure event according to the password level. When the password level is the second level, determine the password modification policy according to the password level, and adjust the mailbox password information according to the password modification policy.

[0102] It should also be understood that the password information is the password information bound to the password set by the user in advance, and the password information can be customized by the user, and can be a name question, or an age question, etc. The password level includes the first level and the second level, the first level is the strong password level, the second level is the weak password level, etc.

[0103] In a specific implementation, password keywords can be extracted from the password information, and then the corresponding password levels are matched in a preset level mapping relationship table according to the password keywords. There are multiple password keywords and multiple password levels in the preset level mapping relationship table, and there is a one-to-one correspondence between the password keywords and the password levels.

[0104] In this embodiment, if there is a weak password at the password level, the mailbox holder needs to be notified to modify the highly complex password. If there is no weak password at the password level, the attack address information of the initiator of the mailbox blasting failure event is determined.

[0105] Step S20: Determine the attack address type according to the attack address information.

[0106] Furthermore, in order to accurately determine the attack address type, a processing method for determining the attack address type based on the attack address information can be to extract data communication information from the attack address information, analyze the data communication information, obtain address area information, and determine the attack address type based on the address area information.

[0107] It should be noted that the attack address type can be a local area network type or a wide area network type, etc. The data communication information is the communication information generated by the event initiator when attacking the mailbox account, and the address area information can be determined based on the communication information, and the address area information includes local area information and wide area information, etc.

[0108] In a specific implementation, the corresponding attack address type can be matched in a preset type mapping relationship table according to the address area information. The preset type mapping relationship table contains multiple address area information and multiple attack address types, and there is a one-to-one correspondence between the address area information and the attack address type.

[0109] Step S30: Obtain a preset blocking policy corresponding to the attack address type.

[0110] It should be noted that the preset anti-attack strategy can be customized by the user, for example, linking firewalls and other devices to block to prevent further attacks; or notifying relevant technical personnel to verify the attacking IP with superiors to see whether the host has been compromised.

[0111] In this embodiment, if the attack address type is a WAN type, the firewall and other devices will be linked to block it to prevent further attacks; if the attack address type is a LAN type, the relevant technical personnel must be notified to verify the attack IP with the superior to see whether the host has been compromised.

[0112] Step S40: Processing the mailbox blasting failure event according to the preset blocking strategy.

[0113] It should be noted that when the preset anti-attack strategy is the external network anti-attack strategy, that is, the preset anti-attack strategy corresponding to the wide area network type, the firewall and other devices can be linked to block to prevent further attacks; when the preset anti-attack strategy is the internal network anti-attack strategy, that is, the preset anti-attack strategy corresponding to the local area network type, the relevant technical personnel will be notified to verify the attacking IP with superiors to see whether the host has been compromised.

[0114] In a specific implementation, a mailbox blasting log may be generated according to a mailbox blasting failure event and a preset blocking policy, and the mailbox blasting log may be added to a preset mailbox blasting library for storage.

[0115] It should also be understood that there are multiple mailbox blasting sub-libraries in the preset mailbox blasting library, and the mailbox blasting sub-libraries can be used to classify mailbox blasting logs to facilitate users to quickly find corresponding mailbox blasting logs, etc.

[0116] It should also be noted that the processing method for adding the mailbox blasting log to the preset mailbox blasting library for storage can be to obtain the blasting log type corresponding to the mailbox blasting log, which can be a blasting failure log type or a blasting success log type. Then, according to the blasting log type, the mailbox blasting sub-library is determined from the preset mailbox blasting library, and the mailbox blasting log is added to the mailbox blasting sub-library for storage, etc.

[0117] In this embodiment, when a mailbox blasting failure event is detected, the attack address information of the event initiator of the mailbox blasting failure event is first determined, and then the attack address type is determined based on the attack address information, and the preset blocking policy corresponding to the attack address type is obtained, and then the mailbox blasting failure event is processed according to the preset blocking policy. Compared with the prior art, which requires users to monitor the account login status in the mailbox in real time, determine the mailbox blasting event, and process the mailbox blasting event through a pre-set blasting processing policy, in this embodiment, it is necessary to determine the event type and attack address type of the mailbox blasting event, and then determine the preset blocking policy based on the event type and attack address type of the mailbox blasting event, and finally process the mailbox blasting event based on the preset blocking policy, thereby improving the processing efficiency of the mailbox blasting event, and then improving the overall security capabilities.

[0118] refer to Figure 3 , Figure 3 It is a flowchart of the second embodiment of the mailbox blasting processing method of the present invention.

[0119] Based on the first embodiment above, in this embodiment, before step S10, the following steps are further included:

[0120] Step S001: Obtain mailbox blasting behavior information within a preset time period.

[0121] It should be noted that the preset time period can be user-defined, and can be 30 minutes, 50 seconds, etc. The mailbox blasting behavior information can be the mailbox account attacked within the preset time period, the account password corresponding to the mailbox account, and the matching information between the mailbox account and the account password, and the matching information can be a successful match or a failed match.

[0122] Step S002: Determine mailbox blasting verification information according to the mailbox blasting behavior information.

[0123] It should also be understood that the mailbox blasting verification information includes mailbox blasting verification success information, mailbox blasting verification failure and the number of verification failures, etc.

[0124] Assuming that the email account B may be included in the email blasting behavior information, it is necessary to obtain the account and password information corresponding to the email account B. If the account and password information are B1, B2, B3, B4 and B5 respectively, then match the email account B with the account and password information B1, B2, B3, B4 and B5 respectively to obtain the email blasting verification information between the email account B and the account and password B1, the email blasting verification information between the email account B and the account and password B2, the email blasting verification information between the email account B and the account and password B3, the email blasting verification information between the email account B and the account and password B4, the email blasting verification information between the email account B and the account and password B5, etc.

[0125] Furthermore, in order to accurately obtain mailbox blasting verification information, the processing method for determining the mailbox blasting verification information according to the mailbox blasting behavior information can be to determine the number of mailbox blasting according to the mailbox blasting behavior information, and when the number of mailbox blasting is greater than the preset number of blasting, generate a mailbox blasting event according to the mailbox blasting behavior information, and then analyze the mailbox blasting event to obtain the mailbox blasting verification information.

[0126] It should also be noted that the number of mailbox blasting is the number of attacks launched by the event initiator against the mailbox account. The preset number of blasting can be customized by the user, such as 10 times or 5 times. Mailbox blasting events include mailbox blasting failure events and mailbox blasting success events. In the specific implementation, the mailbox blasting event can be analyzed to obtain the mailbox blasting verification information, so as to determine whether the mailbox blasting event is a mailbox blasting failure event or a mailbox blasting success event.

[0127] Step S003: When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

[0128] In a specific implementation, when the email blasting verification information does not meet the preset blasting failure condition, the attacked email account is determined based on the email blasting verification information, and then the attacked email account is blocked. The preset blasting failure condition is that the number of verification failures is greater than the preset number of matches, and the verification information is all email blasting verification failures. The preset number of matches can be user-defined, such as 3 or 5.

[0129] It should also be understood that when the mailbox blasting verification information does not meet the preset blasting failure condition, the mailbox blasting event is determined to be a mailbox blasting success event, etc. The attacked mailbox account is the mailbox account attacked by the event initiator, etc.

[0130] In this embodiment, the step of banning the attacked email account can also be to determine the login terminal corresponding to the attacked email account, then determine the security linkage device based on the login terminal, and ban the attacked email account through the security linkage device, and obtain the email management terminal corresponding to the attacked email account, generate email warning information based on the email blasting behavior information, and finally send the email warning information to the email management terminal, so that the email management terminal can issue a warning prompt based on the email warning information.

[0131] It should be understood that the blasting behavior can be discovered through traffic detection equipment, or through log detection equipment, or by manually checking the device mail server account login log, etc., and then the blasting behavior is analyzed to determine whether a mailbox blasting failure event has been detected.

[0132] In this embodiment, first, the mailbox blasting behavior information within a preset time period is obtained, and then the mailbox blasting verification information is determined based on the mailbox blasting behavior information. When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected. Compared with the prior art in which the mailbox blasting failure event is determined only based on manual experience, the mailbox blasting failure event can be determined based on the mailbox blasting behavior in this embodiment, thereby improving the detection accuracy of the mailbox blasting failure event, and further improving the processing efficiency of the mailbox blasting failure event.

[0133] refer to Figure 4 , Figure 4 It is a flowchart of the third embodiment of the mailbox blasting processing method of the present invention.

[0134] Based on the above first embodiment, in this embodiment, step S10 includes:

[0135] Step S101: when a mailbox blasting failure event is detected, obtaining mailbox password information corresponding to the mailbox blasting failure event.

[0136] It should be noted that the email password information is the correct password information corresponding to the email account attacked by the initiator of the email blasting incident.

[0137] Step S102: Determine the password information corresponding to the mailbox password information.

[0138] It should also be understood that the password information is the password information bound to the password set by the user in advance, and the password information can be customized by the user, and can be a name question, or an age question, etc. The password level includes the first level and the second level, the first level is the strong password level, the second level is the weak password level, etc.

[0139] Step S103: Determine the attack address information of the event initiator of the mailbox blasting failure event according to the password information.

[0140] Furthermore, in order to speed up the processing efficiency of the mailbox blasting event, the processing method of determining the attack address information of the event initiator of the mailbox blasting failure event according to the password information can be to extract the password keyword from the password information, determine the password level according to the password keyword, and when the password level is the first level, determine the attack address information of the event initiator of the mailbox blasting failure event according to the password level. When the password level is the second level, determine the password modification policy according to the password level, and adjust the mailbox password information according to the password modification policy.

[0141] In a specific implementation, password keywords can be extracted from the password information, and then the corresponding password levels are matched in a preset level mapping relationship table according to the password keywords. There are multiple password keywords and multiple password levels in the preset level mapping relationship table, and there is a one-to-one correspondence between the password keywords and the password levels.

[0142] It should also be noted that if the password level is weak, the mailbox holder needs to be notified to change the password with high complexity. If the password level is strong, the attack address information of the initiator of the mailbox blasting failure event is determined.

[0143] In this embodiment, when a mailbox blasting failure event is detected, the mailbox password information corresponding to the mailbox blasting failure event is obtained, and then the password information corresponding to the mailbox password information is determined, and then the attack address information of the event initiator of the mailbox blasting failure event is determined based on the password information. Compared with the prior art, when a mailbox blasting failure event is detected, the mailbox blasting failure event is not processed. In this embodiment, when a mailbox blasting failure event is detected, the attack address information is searched based on the password information corresponding to the mailbox password information, thereby speeding up the processing efficiency of the mailbox blasting failure event and improving the overall security capabilities.

[0144] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the mailbox blasting processing device of the present invention.

[0145] like Figure 5 As shown, the mailbox blasting processing device proposed in the embodiment of the present invention includes:

[0146] The determination module 5001 is used to determine the attack address information of the event initiator of the mailbox blasting failure event when a mailbox blasting failure event is detected.

[0147] It is understandable that the mailbox blasting failure event is an event in which the attacker continuously tries a large number of mailbox account passwords but fails to obtain the correct mailbox account password. The mailbox blasting event includes the mailbox blasting failure event and the mailbox blasting success event. The attack website information can be the attack address information of the event initiator against the mailbox account.

[0148] Furthermore, in order to accurately distinguish mailbox blasting failure events, when a mailbox blasting failure event is detected, before the step of determining the attack address information of the event initiator of the mailbox blasting failure event, it is also necessary to obtain the mailbox blasting behavior information within a preset time period, and then determine the mailbox blasting verification information based on the mailbox blasting behavior information. When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

[0149] It should be noted that the preset time period can be a user-defined setting, which can be 30 minutes, or 50 seconds, etc. The mailbox blasting behavior information can be the mailbox account attacked within the preset time period and the account password corresponding to the mailbox account, and the matching information between the mailbox account and the account password. The matching information can be a successful match or a failed match. The mailbox blasting verification information includes mailbox blasting verification success information, mailbox blasting verification failure, and the number of verification failures. The preset blasting failure condition is that the number of verification failures is greater than the preset matching number, and the verification information is all mailbox blasting verification failures. The preset matching number can be a user-defined setting, such as 3 or 5.

[0150] Assuming that there may be an email account A in the email blasting behavior information, it is necessary to obtain the account and password information corresponding to the email account A. If the account and password information are A1, A2, A3, A4 and A5 respectively, then match the email account A with the account and password information A1, A2, A3, A4 and A5 respectively to obtain the email blasting verification information between the email account A and the account and password A1, the email blasting verification information between the email account A and the account and password A2, the email blasting verification information between the email account A and the account and password A3, the email blasting verification information between the email account A and the account and password A4, and the email blasting verification information between the email account A and the account and password A5. If the email blasting verification information is all failed, the number of verification failures is 5, and the number of verification failures is greater than the preset matching number of 3 times, it is determined that the email blasting failure event is detected. If the account and password A1, A2, A3 and A4 are all failed, the account and password A5 is successfully verified, and the number of verification failures is greater than the preset matching number of 3 times, it is determined that the email blasting success event is detected, etc.

[0151] Furthermore, in order to accurately obtain mailbox blasting verification information, the processing method for determining the mailbox blasting verification information according to the mailbox blasting behavior information can be to determine the number of mailbox blasting according to the mailbox blasting behavior information, and when the number of mailbox blasting is greater than the preset number of blasting, generate a mailbox blasting event according to the mailbox blasting behavior information, and then analyze the mailbox blasting event to obtain the mailbox blasting verification information.

[0152] It should also be noted that the way to perceive mailbox blasting events can also be to discover blasting behavior through traffic detection equipment, or to discover blasting behavior through log detection equipment, or to discover blasting behavior by manually checking the device mail server account login log, etc.

[0153] In a specific implementation, when the mailbox blasting verification information does not meet the preset blasting failure condition, the attacked mailbox account is determined according to the mailbox blasting verification information, and then the attacked mailbox account is banned.

[0154] It should also be understood that when the mailbox blasting verification information does not meet the preset blasting failure condition, the mailbox blasting event is determined to be a mailbox blasting success event, etc. The attacked mailbox account is the mailbox account attacked by the event initiator, etc.

[0155] In this embodiment, the step of banning the attacked email account can also be to determine the login terminal corresponding to the attacked email account, then determine the security linkage device based on the login terminal, and ban the attacked email account through the security linkage device, and obtain the email management terminal corresponding to the attacked email account, generate email warning information based on the email blasting behavior information, and finally send the email warning information to the email management terminal, so that the email management terminal can issue a warning prompt based on the email warning information.

[0156] It should also be noted that the login terminal is the terminal logged in by the current email account, and the security linkage device is the security device existing on the terminal logged in by the current email account, and the security device can be a mail server, etc.

[0157] In a specific implementation, when the mailbox blasting event is a mailbox blasting success event, the mail server can be linked to deactivate the mailbox account, and notify the person in charge of the mailbox account to change the password of the mailbox account, etc. When the mailbox blasting event is a mailbox blasting failure event, the mailbox password information corresponding to the mailbox blasting failure event is obtained, and then the password information corresponding to the mailbox password information is determined, and the attack address information of the initiator of the mailbox blasting failure event is determined according to the password information.

[0158] Furthermore, in order to speed up the processing efficiency of the mailbox blasting event, the processing method of determining the attack address information of the event initiator of the mailbox blasting failure event according to the password information can be to extract the password keyword from the password information, determine the password level according to the password keyword, and when the password level is the first level, determine the attack address information of the event initiator of the mailbox blasting failure event according to the password level. When the password level is the second level, determine the password modification policy according to the password level, and adjust the mailbox password information according to the password modification policy.

[0159] It should also be understood that the password information is the password information bound to the password set by the user in advance, and the password information can be customized by the user, and can be a name question, or an age question, etc. The password level includes the first level and the second level, the first level is the strong password level, the second level is the weak password level, etc.

[0160] In a specific implementation, password keywords can be extracted from the password information, and then the corresponding password levels are matched in a preset level mapping relationship table according to the password keywords. There are multiple password keywords and multiple password levels in the preset level mapping relationship table, and there is a one-to-one correspondence between the password keywords and the password levels.

[0161] In this embodiment, if there is a weak password at the password level, the mailbox holder needs to be notified to modify the highly complex password. If there is no weak password at the password level, the attack address information of the initiator of the mailbox blasting failure event is determined.

[0162] The determination module 5001 is further configured to determine the attack address type according to the attack address information.

[0163] Furthermore, in order to accurately determine the attack address type, a processing method for determining the attack address type based on the attack address information can be to extract data communication information from the attack address information, analyze the data communication information, obtain address area information, and determine the attack address type based on the address area information.

[0164] It should be noted that the attack address type can be a local area network type or a wide area network type, etc. The data communication information is the communication information generated by the event initiator when attacking the mailbox account, and the address area information can be determined based on the communication information, and the address area information includes local area information and wide area information, etc.

[0165] In a specific implementation, the corresponding attack address type can be matched in a preset type mapping relationship table according to the address area information. The preset type mapping relationship table contains multiple address area information and multiple attack address types, and there is a one-to-one correspondence between the address area information and the attack address type.

[0166] The acquisition module 5002 is used to acquire the preset blocking policy corresponding to the attack address type.

[0167] It should be noted that the preset anti-attack strategy can be customized by the user, for example, linking firewalls and other devices to block to prevent further attacks; or notifying relevant technical personnel to verify the attacking IP with superiors to see whether the host has been compromised.

[0168] In this embodiment, if the attack address type is a WAN type, the firewall and other devices will be linked to block it to prevent further attacks; if the attack address type is a LAN type, the relevant technical personnel must be notified to verify the attack IP with the superior to see whether the host has been compromised.

[0169] The processing module 5003 is used to process the mailbox blasting failure event according to the preset blocking strategy.

[0170] It should be noted that when the preset anti-attack strategy is the external network anti-attack strategy, that is, the preset anti-attack strategy corresponding to the wide area network type, the firewall and other devices can be linked to block to prevent further attacks; when the preset anti-attack strategy is the internal network anti-attack strategy, that is, the preset anti-attack strategy corresponding to the local area network type, the relevant technical personnel will be notified to verify the attacking IP with superiors to see whether the host has been compromised.

[0171] In a specific implementation, a mailbox blasting log may be generated according to a mailbox blasting failure event and a preset blocking policy, and the mailbox blasting log may be added to a preset mailbox blasting library for storage.

[0172] It should also be understood that there are multiple mailbox blasting sub-libraries in the preset mailbox blasting library, and the mailbox blasting sub-libraries can be used to classify mailbox blasting logs to facilitate users to quickly find corresponding mailbox blasting logs, etc.

[0173] It should also be noted that the processing method for adding the mailbox blasting log to the preset mailbox blasting library for storage can be to obtain the blasting log type corresponding to the mailbox blasting log, which can be a blasting failure log type or a blasting success log type. Then, according to the blasting log type, the mailbox blasting sub-library is determined from the preset mailbox blasting library, and the mailbox blasting log is added to the mailbox blasting sub-library for storage, etc.

[0174] In this embodiment, when a mailbox blasting failure event is detected, the attack address information of the event initiator of the mailbox blasting failure event is first determined, and then the attack address type is determined based on the attack address information, and the preset blocking policy corresponding to the attack address type is obtained, and then the mailbox blasting failure event is processed according to the preset blocking policy. Compared with the prior art, which requires users to monitor the account login status in the mailbox in real time, determine the mailbox blasting event, and process the mailbox blasting event through a pre-set blasting processing policy, in this embodiment, it is necessary to determine the event type and attack address type of the mailbox blasting event, and then determine the preset blocking policy based on the event type and attack address type of the mailbox blasting event, and finally process the mailbox blasting event based on the preset blocking policy, thereby improving the processing efficiency of the mailbox blasting event, and then improving the overall security capabilities.

[0175] Furthermore, the mailbox blasting processing device also includes a determination module;

[0176] The determination module is used to obtain mailbox blasting behavior information within a preset period of time;

[0177] The determination module is further used to determine the mailbox blasting verification information according to the mailbox blasting behavior information;

[0178] The determination module is further configured to determine that a mailbox blasting failure event is detected when the mailbox blasting verification information meets a preset blasting failure condition.

[0179] Furthermore, the determination module 5001 is also used to obtain the mailbox password information corresponding to the mailbox blasting failure event;

[0180] The determination module 5001 is further used to determine the password information corresponding to the mailbox password information;

[0181] The determination module 5001 is further configured to determine the attack address information of the event initiator of the mailbox blasting failure event according to the password information.

[0182] Furthermore, the determination module 5001 is also used to extract password keywords from the password information;

[0183] The determination module 5001 is further used to determine the password level according to the password keyword;

[0184] The determination module 5001 is further configured to determine the attack address information of the event initiator of the mailbox blasting failure event according to the password level when the password level is the first level.

[0185] Furthermore, the determination module 5001 is further configured to determine a password modification strategy according to the password level when the password level is the second level;

[0186] The determination module 5001 is further configured to adjust the mailbox password information according to the password modification policy.

[0187] Furthermore, the determination module 5001 is also used to extract data communication information from the attack address information;

[0188] The determination module 5001 is further used to analyze the data communication information to obtain address area information;

[0189] The determination module 5001 is further configured to determine the attack address type according to the address region information.

[0190] Other embodiments or specific implementations of the mailbox blasting treatment device of the present invention can refer to the above-mentioned method embodiments, which will not be described in detail here.

[0191] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0192] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory / random access memory, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0194] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0195] The present invention discloses A1, a mailbox blasting processing method, the mailbox blasting processing method comprises the following steps:

[0196] When a mailbox blasting failure event is detected, determining the attack address information of the event initiator of the mailbox blasting failure event;

[0197] Determine the attack address type according to the attack address information;

[0198] Obtaining a preset blocking policy corresponding to the attack address type;

[0199] The mailbox blasting failure event is processed according to the preset blocking strategy.

[0200] A2. The method as described in A1, before the step of determining the attack address information of the event initiator of the mailbox blasting failure event when the mailbox blasting failure event is detected, further comprising:

[0201] Obtain information about email blasting behavior within a preset period of time;

[0202] Determine mailbox blasting verification information according to the mailbox blasting behavior information;

[0203] When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

[0204] A3. As described in A2, the step of determining the mailbox blasting verification information according to the mailbox blasting behavior information comprises:

[0205] Determine the number of mailbox blasting times according to the mailbox blasting behavior information;

[0206] When the mailbox blasting times are greater than the preset blasting times, a mailbox blasting event is generated according to the mailbox blasting behavior information;

[0207] The mailbox blasting event is analyzed to obtain mailbox blasting verification information.

[0208] A4. The method as described in A2, after the step of determining the mailbox blasting verification information according to the mailbox blasting behavior information, further comprising:

[0209] When the mailbox blasting verification information does not meet the preset blasting failure condition, determining the attacked mailbox account according to the mailbox blasting verification information;

[0210] The attacked email account is blocked.

[0211] A5. As described in A4, the step of blocking the attacked email account comprises:

[0212] Determine the login terminal corresponding to the attacked email account;

[0213] Determining a security linkage device according to the login terminal;

[0214] The attacked email account is blocked through the security linkage device.

[0215] A6. The method as described in A5, after the step of blocking the attacked email account by the security linkage device, further comprising:

[0216] Obtaining the mailbox management terminal corresponding to the attacked mailbox account;

[0217] Generate mailbox warning information according to the mailbox blasting behavior information;

[0218] The mailbox warning information is sent to the mailbox management terminal, so that the mailbox management terminal issues a warning prompt based on the mailbox warning information.

[0219] A7. The method as described in any one of A1 to A6, wherein the step of determining the attack address information of the event initiator of the mailbox blasting failure event comprises:

[0220] Obtain the mailbox password information corresponding to the mailbox blasting failure event;

[0221] Determine the password information corresponding to the mailbox password information;

[0222] The attack address information of the event initiator of the mailbox blasting failure event is determined according to the password information.

[0223] A8. The method as described in A7, wherein the step of determining the attack address information of the initiator of the mailbox blasting failure event according to the password information comprises:

[0224] Extracting password keywords from the password information;

[0225] Determining the password level according to the password keyword;

[0226] When the password level is the first level, the attack address information of the event initiator of the mailbox blasting failure event is determined according to the password level.

[0227] A9. The method as described in A8, after the step of determining the password level according to the password keyword, further comprising:

[0228] When the password level is the second level, determining the password modification strategy according to the password level;

[0229] The mailbox password information is adjusted according to the password modification policy.

[0230] A10. The method as described in any one of A1 to A6, wherein the step of determining the attack address type according to the attack address information comprises:

[0231] extracting data communication information from the attack address information;

[0232] Analyzing the data communication information to obtain address area information;

[0233] The attack address type is determined according to the address area information.

[0234] A11. The method as described in any one of A1 to A6, after the step of processing the mailbox blasting failure event according to the preset blocking strategy, further comprising:

[0235] Generate a mailbox blasting log according to the mailbox blasting failure event and the preset blocking strategy;

[0236] The mailbox blasting log is added to the preset mailbox blasting library for storage.

[0237] A12. As described in A11, the step of adding the mailbox blasting log to a preset mailbox blasting library for storage comprises:

[0238] Get the blasting log type corresponding to the mailbox blasting log;

[0239] Determine a mailbox blasting sub-library from a preset mailbox blasting library according to the blasting log type;

[0240] The mailbox blasting log is added to the mailbox blasting sub-library for storage.

[0241] The present invention also discloses B13, a mailbox blasting treatment device, the mailbox blasting treatment device comprising:

[0242] A determination module, used to determine the attack address information of the event initiator of the mailbox blasting failure event when a mailbox blasting failure event is detected;

[0243] The determination module is further used to determine the attack address type according to the attack address information;

[0244] An acquisition module, used to acquire a preset blocking policy corresponding to the attack address type;

[0245] The processing module is used to process the mailbox blasting failure event according to the preset blocking strategy.

[0246] B14. The device as described in B13, wherein the mailbox blasting processing device further includes a determination module;

[0247] The determination module is used to obtain mailbox blasting behavior information within a preset period of time;

[0248] The determination module is further used to determine the mailbox blasting verification information according to the mailbox blasting behavior information;

[0249] The determination module is further configured to determine that a mailbox blasting failure event is detected when the mailbox blasting verification information meets a preset blasting failure condition.

[0250] B15. In the device as described in B13, the determination module is further used to obtain the mailbox password information corresponding to the mailbox blasting failure event;

[0251] The determination module is further used to determine the password information corresponding to the mailbox password information;

[0252] The determination module is further configured to determine the attack address information of the event initiator of the mailbox blasting failure event according to the password information.

[0253] B16. The device as described in B15, wherein the determining module is further used to extract password keywords from the password information;

[0254] The determination module is further used to determine the password level according to the password keyword;

[0255] The determination module is further configured to determine, when the password level is the first level, the attack address information of the event initiator of the mailbox blasting failure event according to the password level.

[0256] B17. The device as described in B16, wherein the determining module is further used to determine the password modification strategy according to the password level when the password level is the second level;

[0257] The determination module is further used to adjust the mailbox password information according to the password modification policy.

[0258] B18. The device as described in any one of B13-B15, wherein the determination module is further used to extract data communication information from the attack address information;

[0259] The determination module is further used to analyze the data communication information to obtain address area information;

[0260] The determination module is further used to determine the attack address type according to the address area information.

Claims

1. A mailbox blasting processing method, characterized in that: The mailbox blasting processing method comprises the following steps: When a mailbox blasting failure event is detected, determining the attack address information of the event initiator of the mailbox blasting failure event; Determine the attack address type according to the attack address information; Obtaining a preset blocking policy corresponding to the attack address type; The mailbox blasting failure event is processed according to the preset blocking strategy.

2. The method according to claim 1, characterized in that Before the step of determining the attack address information of the event initiator of the mailbox blasting failure event when the mailbox blasting failure event is detected, the method further includes: Obtain information about email blasting behavior within a preset period of time; Determine mailbox blasting verification information according to the mailbox blasting behavior information; When the mailbox blasting verification information meets the preset blasting failure condition, it is determined that a mailbox blasting failure event is detected.

3. The method according to claim 2, characterized in that The step of determining the mailbox blasting verification information according to the mailbox blasting behavior information includes: Determine the number of mailbox blasting times according to the mailbox blasting behavior information; When the mailbox blasting times are greater than the preset blasting times, a mailbox blasting event is generated according to the mailbox blasting behavior information; The mailbox blasting event is analyzed to obtain mailbox blasting verification information.

4. The method according to claim 2, characterized in that After the step of determining the mailbox blasting verification information according to the mailbox blasting behavior information, the method further includes: When the mailbox blasting verification information does not meet the preset blasting failure condition, determining the attacked mailbox account according to the mailbox blasting verification information; The attacked email account is blocked.

5. The method according to claim 4, characterized in that The step of blocking the attacked email account includes: Determine the login terminal corresponding to the attacked email account; Determining a security linkage device according to the login terminal; The attacked email account is blocked through the security linkage device.

6. The method according to claim 5, characterized in that After the step of blocking the attacked email account by the security linkage device, the method further includes: Obtaining the mailbox management terminal corresponding to the attacked mailbox account; Generate mailbox warning information according to the mailbox blasting behavior information; The mailbox warning information is sent to the mailbox management terminal, so that the mailbox management terminal issues a warning prompt based on the mailbox warning information.

7. The method according to any one of claims 1 to 6, characterized in that: The step of determining the attack address information of the event initiator of the mailbox blasting failure event includes: Obtain the mailbox password information corresponding to the mailbox blasting failure event; Determine the password information corresponding to the mailbox password information; The attack address information of the event initiator of the mailbox blasting failure event is determined according to the password information.

8. A mailbox blasting treatment device, characterized in that: The mailbox blasting treatment device comprises: A determination module, used to determine the attack address information of the event initiator of the mailbox blasting failure event when a mailbox blasting failure event is detected; The determination module is further used to determine the attack address type according to the attack address information; An acquisition module, used to acquire a preset blocking policy corresponding to the attack address type; The processing module is used to process the mailbox blasting failure event according to the preset blocking strategy.

9. A mailbox blasting treatment device, characterized in that: The mailbox blasting processing device includes: a memory, a processor, and a mailbox blasting processing program stored in the memory and executable on the processor, wherein the mailbox blasting processing program is configured with steps for implementing the mailbox blasting processing method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a mailbox blasting processing program, and when the mailbox blasting processing program is executed by the processor, the steps of the mailbox blasting processing method according to any one of claims 1 to 7 are implemented.

Images