Malicious mail identification method and device based on scoring mechanism

Abstract

The invention discloses a malicious mail identification method and device based on a scoring mechanism, and the method comprises the steps: obtaining the content of a to-be-identified mail through a flow gateway, and splitting the content of the to-be-identified mail; analyzing the split content based on a preset recognition engine, and recognizing behavior characteristics in the to-be-recognized mail; scoring the identified behavior characteristics based on the constructed mail grading and scoring model, and setting malicious levels of the corresponding behavior characteristics; and performing comprehensive analysis according to the scores of all the behavior characteristics and the malicious level, and outputting an identification result corresponding to the to-be-identified mail. According to the method, the malicious email is identified by utilizing a scoring mechanism method, the problem that the relevance between the email content and the metadata is ignored can be effectively solved through comprehensive feature evaluation and a flexible grading scoring rule, and the accuracy and efficiency of malicious email identification are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security and artificial intelligence technology, and in particular to a malicious email identification method and device based on a scoring mechanism. Background Art

[0002] With the development of Internet technology, email has become an indispensable communication tool in people's daily work and life. However, this has also brought about information security issues such as phishing emails and malicious emails. How to identify and accurately intercept malicious emails is a technical challenge faced by many information security researchers.

[0003] Traditional malicious email identification mainly relies on two methods: rule matching and machine learning. The rule matching method uses a pre-defined set of rules to match the features of the email with the rules to determine the degree of maliciousness. This method can quickly perform preliminary screening of malicious emails, but due to the constant changes in malicious emails, the rule matching method is often difficult to adapt to the features of new malicious emails. The machine learning method identifies malicious emails by training models and has a certain degree of adaptability. This method can automatically learn the patterns and associations of features from data and identify new malicious emails. However, the machine learning algorithm method requires a large amount of labeled data for training, has certain requirements for feature selection and model tuning, and may have high computational complexity when processing real-time emails, which can easily cause delays in email sending and receiving.

[0004] The above two recognition technologies often ignore the correlation between email content and metadata, resulting in limited recognition accuracy and often a large number of false positives.

[0005] Therefore, the prior art needs to be improved. Summary of the invention

[0006] The technical problem to be solved by the present invention is that, in view of the defects of the prior art, the present invention provides a malicious email identification method and device based on a scoring mechanism to solve the problem of low recognition accuracy of the existing malicious email identification method.

[0007] The technical solution adopted by the present invention to solve the technical problem is as follows: In a first aspect, the present invention provides a method for identifying malicious emails based on a scoring mechanism, comprising: Obtaining the content of the email to be identified through the traffic gateway, and splitting the content of the email to be identified; Analyze the split content based on a preset recognition engine to identify the behavioral features in the email to be identified; Score the identified behavior features based on the constructed email grading and scoring model, and set the malicious level of the corresponding behavior features; A comprehensive analysis is performed based on the scores of all behavioral characteristics and the maliciousness level, and an identification result corresponding to the email to be identified is output.

[0008] In one implementation, obtaining the content of the email to be identified through the traffic gateway includes: The content of the email to be identified is obtained through a traffic gateway; the content of the email to be identified includes: an email header, an email body, and attachment information.

[0009] In one implementation, the splitting of the content of the to-be-identified email includes: Split the email header into sender account, sender domain name, sender IP and SPF information; Splitting the email body into picture information, URL link information and text information; The attachment information is split into attachment format information and attachment content information.

[0010] In one implementation, analyzing the split content based on a preset recognition engine to identify the behavioral features in the email to be identified includes: Analyze the domain name of the email header or body of the email to be identified based on the threat intelligence engine to obtain corresponding threat intelligence information; Analyze the email body of the email to be identified based on the machine learning engine to obtain content features corresponding to the email body; The attachment information of the email to be identified is analyzed based on a virus scanning engine to obtain behavior features corresponding to the attachment information.

[0011] In one implementation, the email grading and scoring model constructed is used to score the identified behavior features and set the maliciousness level of the corresponding behavior features, including: Constructing the email grading and scoring model according to preset scoring rules and grading standards, and adjusting and optimizing parameters of the email grading and scoring model; Based on the email grading and scoring model, the identified behavior characteristics are scored according to the preset scoring rules, and the malicious level of the corresponding behavior characteristics is set according to the grading standard.

[0012] In one implementation, the step of scoring the identified behavior features based on the email rating and scoring model according to the preset scoring rules, and setting the malicious level of the corresponding behavior features according to the rating standards, includes: When the sender address of the email to be identified is empty or hidden, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; When the similarity between the sender domain name of the email to be identified and the enterprise domain name is less than the similarity threshold, the current behavior feature is set as a suspicious level, and the corresponding score is increased to a corresponding score; When the sender domain name of the email to be identified is a domain name generated by the DGA algorithm, the current behavior feature is set to a suspicious level, and the corresponding score is increased to a corresponding score; When the verification result of the sender policy framework of the email to be identified is failure, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; When the threat intelligence engine analyzes the content of the email to be identified as malicious, the current behavior feature is set to the malicious level, and the corresponding score is increased to the corresponding score; When the analysis result of the virus scanning engine of the attachment information of the to-be-identified email is a malicious virus, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score.

[0013] In one implementation, the comprehensive analysis is performed based on the scores of all behavioral characteristics and the maliciousness level, and the identification result corresponding to the email to be identified is output, including: Adjusting scores corresponding to maliciously exploited behavior features, multiple suspicious behavior features, and multiple malicious behavior features according to preset weighting rules; Comprehensively analyze the scores of all behavioral characteristics and malicious levels, and determine the final comprehensive evaluation threshold; The result obtained by comprehensive analysis is compared with the threshold of the final comprehensive evaluation to determine and output the identification result of the email to be identified; wherein the identification result is any one of malicious email, suspicious email and normal email.

[0014] In a second aspect, the present invention provides a malicious email identification device based on a scoring mechanism, comprising: The mail acquisition and splitting module is used to acquire the content of the mail to be identified through the traffic gateway and split the content of the mail to be identified; A behavior feature analysis module, used to analyze the split content based on a preset recognition engine to identify the behavior features in the email to be identified; The scoring and grading module is used to score the identified behavior features based on the constructed email grading and scoring model, and set the malicious level of the corresponding behavior features; The comprehensive analysis and output module is used to perform a comprehensive analysis based on the scores of all behavioral characteristics and the malicious level, and output the identification result corresponding to the email to be identified.

[0015] In a third aspect, the present invention provides a terminal, comprising: a processor and a memory, wherein the memory stores a malicious email identification program based on a scoring mechanism, and when the malicious email identification program based on a scoring mechanism is executed by the processor, it is used to implement the operation of the malicious email identification method based on a scoring mechanism as described in the first aspect.

[0016] In a fourth aspect, the present invention further provides a medium, which is a computer-readable storage medium, and which stores a malicious email identification program based on a scoring mechanism. When the malicious email identification program based on a scoring mechanism is executed by a processor, it is used to implement the operation of the malicious email identification method based on a scoring mechanism as described in the first aspect.

[0017] The present invention adopts the above technical solution to achieve the following effects: The present invention obtains the content of the email to be identified through a traffic gateway, and splits the content of the email to be identified; analyzes the split content based on a preset identification engine to identify the behavioral features in the email to be identified; scores the identified behavioral features based on the constructed email grading and scoring model, and sets the malicious level of the corresponding behavioral features; conducts a comprehensive analysis based on the scores and malicious levels of all behavioral features, and outputs the identification result corresponding to the email to be identified. The present invention uses a scoring mechanism method to identify malicious emails. Through comprehensive feature evaluation and flexible grading and scoring rules, it can effectively solve the problem of ignoring the correlation between email content and metadata, and improve the accuracy and efficiency of malicious email identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of the malicious email identification method based on the scoring mechanism in the present invention.

[0020] Figure 2 The present invention is a flowchart of malicious email identification in one implementation method.

[0021] Figure 3 It is a functional principle diagram of a terminal in one implementation of the present invention.

[0022] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0024] Exemplary Methods Traditional malicious email identification mainly relies on two methods: rule matching and machine learning. The rule matching method uses a pre-defined set of rules to match the features of the email with the rules to determine the degree of maliciousness. This method can quickly perform preliminary screening of malicious emails, but due to the constant changes in malicious emails, the rule matching method is often difficult to adapt to the features of new malicious emails. The machine learning method identifies malicious emails by training models and has a certain degree of adaptability. This method can automatically learn the patterns and associations of features from data and identify new malicious emails. However, the machine learning algorithm method requires a large amount of labeled data for training, has certain requirements for feature selection and model tuning, and may have high computational complexity when processing real-time emails, which can easily cause delays in email sending and receiving. The above two identification technologies often ignore the correlation between email content and metadata, resulting in limited recognition accuracy and often a large number of false positives.

[0025] In response to the above technical problems, an embodiment of the present invention provides a method for identifying malicious emails based on a scoring mechanism, which method obtains the content of the email to be identified through a traffic gateway and splits the content of the email to be identified; analyzes the split content based on a preset recognition engine to identify the behavioral features in the email to be identified; scores the identified behavioral features based on the constructed email grading and scoring model, and sets the malicious level of the corresponding behavioral features; conducts a comprehensive analysis based on the scores and malicious levels of all behavioral features, and outputs the identification result corresponding to the email to be identified. The present invention uses a scoring mechanism method to identify malicious emails. Through comprehensive feature evaluation and flexible grading and scoring rules, it can effectively solve the problem of ignoring the correlation between email content and metadata, and improve the accuracy and efficiency of malicious email identification.

[0026] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying malicious emails based on a scoring mechanism, comprising the following steps: Step S100, obtaining the content of the email to be identified through the traffic gateway, and splitting the content of the email to be identified.

[0027] In this embodiment, first, the email header and email body are disassembled to deeply penetrate into each part of the email. Then, the contents of the decomposed parts are subjected to rule matching, malicious intelligence association, machine learning, virus scanning and other methods to identify whether there are any abnormalities; then, the recognition results of each part are graded and scored using a scoring model. Finally, a comprehensive evaluation is performed to determine whether the email is malicious, suspicious or normal based on the set threshold.

[0028] Specifically, in an implementation of this embodiment, step S100 includes the following steps: Step S101, obtaining the content of the email to be identified through a traffic gateway; Step S102, splitting the email header into sender account, sender domain name, sender IP and SPF information; Step S103, splitting the email body into picture information, URL link information and text information; Step S104: split the attachment information into attachment format information and attachment content information.

[0029] like Figure 2 As shown, the solution in this embodiment mainly includes the following steps: decomposing the email content, multi-engine recognition results, grading and scoring the results, weighting the scoring results, and comprehensively evaluating the maliciousness of the email.

[0030] First, the complete email content of the email to be identified is obtained through a traffic gateway (for example, Nignx gateway); wherein the obtained email content includes: email header, email body, attachment information, etc.; it can be understood that in this embodiment, the email content of the email to be identified obtained through the traffic gateway can be batch email content, for example, the email content of multiple emails within a certain time period.

[0031] After obtaining the complete email content of the email to be identified, the email bodies are split; the email header can be split into sender account information, sender domain name, sender IP, received information, SPF (Sender Policy Framework) information, etc.; the email body can be split into image information, URL link information, text information, etc.; and the attachment information can be split into attachment format information, attachment content information, etc.

[0032] In this embodiment, by disassembling the email header and the email body, it is possible to deeply penetrate into each part of the email, so that different recognition engines can be used to analyze the split content, thereby solving the problem of lack of correlation analysis of the results of various parts of the email when using a single rule matching engine or a single machine learning engine.

[0033] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying malicious emails based on a scoring mechanism, comprising the following steps: Step S200: analyzing the split contents based on a preset recognition engine to identify the behavior features in the email to be identified.

[0034] In this embodiment, after the content of the email to be identified is split, each split individual is carefully analyzed by the corresponding content recognition engine, so as to define some behavioral characteristics therein; for example, abnormal sender behavior, abnormal email body behavior, and abnormal attachment information, etc.

[0035] Specifically, in an implementation of this embodiment, step S200 includes the following steps: Step S201, analyzing the domain name of the email header or body of the email to be identified based on the threat intelligence engine to obtain corresponding threat intelligence information; Step S202, analyzing the email body of the email to be identified based on a machine learning engine to obtain content features corresponding to the email body; Step S203: analyzing the attachment information of the email to be identified based on the virus scanning engine to obtain the behavior characteristics corresponding to the attachment information.

[0036] In this embodiment, for the email content obtained by splitting in steps S102~S104, the following content recognition engines are mainly used to analyze the email content, namely: threat intelligence engine (for example, IBM QRadar engine), machine learning engine (for example, OpenCV model, VGGNet model), semantic recognition engine (for example, BERT model, GTP model), virus scanning engine (for example, Symantec engine), rule matching engine (for example, Drools engine), etc.

[0037] As an example of this embodiment, to determine whether there is a malicious virus in the attachment information, a virus scanning engine is required to perform analysis. For example, the attachment information of the email to be identified is analyzed based on the virus scanning engine to obtain behavioral features such as whether the attachment information contains viruses. To determine whether the image in the email body contains a QR code and the specific meaning of the body content, a machine learning engine is required to perform analysis. For example, the email body of the email to be identified is analyzed based on the machine learning engine to obtain content features such as text, images, and URL link information in the email body. To determine whether the sender domain and the URL link information in the body are malicious domain names, a threat intelligence engine is required to perform analysis. For example, the domain name of the email header or body of the email to be identified is analyzed based on the threat intelligence engine to obtain information on whether the domain name in the email header or body is a threat.

[0038] It is understandable that the engine analysis only analyzes a certain part of the email content to determine whether there is a certain behavioral feature. There are many behavioral analysis processes for a sender address alone, such as: whether there is a sender, whether the sender address is disguised, whether there is a display name disguise, whether the reply is impersonated, etc. By analyzing the email content through the above-mentioned content recognition engines, all behavioral features in the email content can be analyzed, which will not be described one by one here.

[0039] Therefore, in this embodiment, multiple methods such as rule matching, malicious intelligence association, machine learning, virus scanning, etc. are used to identify whether there are any abnormalities on the split email content, and correlation analysis of the results of each part of the email is achieved, so as to accurately identify risks.

[0040] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying malicious emails based on a scoring mechanism, comprising the following steps: Step S300, scoring the identified behavior features based on the constructed email grading and scoring model, and setting the maliciousness level of the corresponding behavior features.

[0041] In this embodiment, a scoring mechanism is used to identify malicious emails, and the accuracy and efficiency of malicious email identification are further improved through comprehensive feature evaluation and flexible rating and scoring rules; wherein the scoring mechanism refers to using the email rating and scoring model constructed in this embodiment to score and top-level determine the behavioral features obtained in the above steps S201 to S203.

[0042] Specifically, in an implementation of this embodiment, step S300 includes the following steps: Step S301, constructing the email grading and scoring model according to preset scoring rules and grading standards, and adjusting and optimizing parameters of the email grading and scoring model; Step S302: Based on the email grading and scoring model, the identified behavior characteristics are scored according to the preset scoring rules, and the malicious level of the corresponding behavior characteristics is set according to the grading standard.

[0043] In this embodiment, in the process of constructing the email grading and scoring model, it is necessary to set reasonable grading and scoring rules; Figure 2 As shown, three levels, malicious, suspicious, and warning, can be set for each behavior feature. Each level has a score upper limit, for example, the highest score is 10 points and the lowest score is 0 points. The higher the score of each level, the more malicious the behavior feature.

[0044] After setting reasonable grading and scoring rules and constructing an email grading and scoring model, the parameters of the email grading and scoring model are adjusted and optimized according to the corresponding prior knowledge or the identification record data of historical emails to obtain an optimized email grading and scoring model. The parameter adjustment and optimization of the email grading and scoring model can refer to the optimization process of the machine learning model, which will not be described in detail here.

[0045] After adjusting and optimizing the parameters of the email grading and scoring model, the optimized model can be used to score and set the grade for each behavioral feature.

[0046] Specifically, in an implementation of this embodiment, step S302 includes the following steps: Step S302a, when the sender address of the email to be identified is empty or hidden, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; Step S302b, when the similarity between the sender domain name of the email to be identified and the enterprise domain name is less than a similarity threshold (for example, the similarity threshold is 80%), the current behavior feature is set as a suspicious level, and the corresponding score is increased to a corresponding score; Step S302c: when the sender domain name of the email to be identified is a domain name generated by the DGA algorithm, the current behavior feature is set to a suspicious level, and the corresponding score is increased to a corresponding score; Step S302d, when the verification result of the sender policy framework of the email to be identified is failure, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; Step S302e, when the threat intelligence engine analyzes the body content of the email to be identified as malicious, the current behavior feature is set to the malicious level, and the corresponding score is increased to the corresponding score; Step S302f, when the analysis result of the virus scanning engine of the attachment information of the email to be identified is a malicious virus, the current behavior feature is set as the malicious level, and the corresponding score is increased to the corresponding score.

[0047] As an example in this embodiment, the scoring and level setting of the behavior characteristics of the email content mainly follow the following methods: 1) The sender address of a normal email should be displayed normally. If the sender address is empty or the sender address is deliberately hidden, then this behavior is most likely malicious. The level given for this behavior is malicious, and the score is increased to 10 points.

[0048] 2) Phishing emails usually imitate the domain name of the enterprise. The enterprise must first configure its own email domain name, for example: @pycredit.com; through machine learning algorithms and rule matching, the similarity between the sender's domain name and the enterprise's domain name can be calculated. For example: the letters a and e are similar, and the letters l and i are more similar. If there is a difference between the sender's domain name and the enterprise's email domain name: @pycredlt.com, the level is determined to be malicious, and the score is increased to 8 points. If there is a difference of 2 letters, for example, the e in the above domain name is replaced by a, and i is replaced by l, forming: @pycradlt.com, the level is determined to be suspicious, and the score is increased to 6 points.

[0049] 3) If the sending domain is a domain name generated by the DGA algorithm (a domain name technology that uses random characters and a specific algorithm to generate domain names), the level is determined to be suspicious and the score is increased to 5 points. If the threat intelligence engine indicates that the sending domain name is a malicious domain name, the level is determined to be malicious and the score is increased to 10 points.

[0050] 4) SPF (Sender Policy Framework) verification is also extremely important. When the SPF verification result is Fail, the possibility of maliciousness is very high, and the level is determined to be malicious, and the score is increased to 8 points. If the verification result is Soft Fail or Neutral, there is suspicious behavior, the level is determined to be suspicious, and the score is reduced to 3 points.

[0051] 5) Parse the URL address in the text. If the URL domain name and the parsed IP given by the threat intelligence engine are both malicious, the level is determined to be malicious, and the score is increased to 10 points. If the URL domain name is in the form of an IP, the level is determined to be suspicious, and the score is reduced to 3 points. If the domain name of the displayed link is inconsistent with the domain name of the actual link opened, the level is determined to be malicious, and the score is increased to 10 points. If the URL address uses http instead of https protocol, the level positioning prompt is given, and the score is reduced to 5 points.

[0052] 6) If the attachment is found to contain malicious viruses through the virus scanning engine, and it is a backdoor virus or ransomware virus, the level is determined to be malicious, and the score is increased to 10 points. If it is only a suspicious virus, the level is determined to be suspicious, and the score is increased to 5 points. If the attachment is found to be a malicious file through the threat intelligence engine, the level is determined to be malicious, and the score is increased by 10 points.

[0053] In this embodiment, the above simply describes the specific grading and scoring working principles and rules of the scoring model. The higher the maliciousness, the higher the score value, and vice versa. This scoring model requires us to continuously adjust and optimize according to actual conditions.

[0054] In this embodiment, a scoring mechanism is used to comprehensively evaluate multiple features of emails to improve the accuracy and reliability of malicious email identification, thereby solving the problem of the traditional single-mindedness of directly judging the harmfulness of emails by relying solely on the recognition engine.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a method for identifying malicious emails based on a scoring mechanism, comprising the following steps: Step S400, performing a comprehensive analysis based on the scores of all behavioral characteristics and the maliciousness level, and outputting the identification result corresponding to the email to be identified.

[0056] In this embodiment, after the recognition results of each part are graded and scored using the scoring model, a comprehensive evaluation can be performed based on all the behavior grades and scores, thereby determining whether the email is malicious, suspicious, or normal based on a set threshold.

[0057] Specifically, in an implementation of this embodiment, step S400 includes the following steps: Step S401, adjusting scores corresponding to maliciously exploited behavior features, multiple suspicious behavior features, and multiple malicious behavior features according to a preset weighting rule; Step S402, comprehensively analyzing the scores and malicious levels of all behavioral characteristics, and determining a final comprehensive evaluation threshold; Step S403, comparing the result obtained by comprehensive analysis with the threshold of the final comprehensive evaluation, determining and outputting the identification result of the email to be identified; wherein the identification result is any one of malicious email, suspicious email and normal email.

[0058] In this embodiment, after the recognition results of each part are graded and scored using the scoring model, the next step is to enter the weighting stage, and the scores of certain behaviors are increased by setting weighting rules; for example, senders and attachments are often used by malicious emails, and these places are weighted. Therefore, this embodiment can adapt to different types and variants of malicious emails through flexible scoring rules and feature weighting processing methods, and can improve the accuracy of recognition by continuously adjusting the rules of the scoring model.

[0059] As an example of behavior score weighting in this embodiment, if the attachment information is an executable program such as exe, bat, cmd, etc., the score will be further improved (for example, from 8 points to 10 points); if the sender address contains multiple suspicious or malicious behaviors, the score will be further improved (for example, from 8 points to 10 points), etc.

[0060] In this embodiment, the email grading and scoring model only grades and scores each behavior of the email header, email body, and attachment as malicious, suspicious, or prompt. However, these grading and scoring alone cannot comprehensively determine whether the email to be identified is malicious or suspicious, so a final comprehensive evaluation is still required.

[0061] As an example of a comprehensive score in this embodiment: a certain email identifies 5 behaviors. The rating scores of these 5 behaviors are: malicious 10 points, malicious 10 points, suspicious 5 points, prompt 2 points, and prompt 1 point. Finally, a comprehensive evaluation is required based on the different rating scores of these behaviors. The set threshold is used to determine whether the email is a malicious email. For example, if more than 5 of the 10 behaviors are malicious, and the malicious score reaches the comprehensive evaluation threshold of 20 points, the email is judged to be a malicious email. If there is no maliciousness in any of the 10 behaviors, only 2 are suspicious, and the score is below 3 points, it is considered a normal email.

[0062] Based on the final comprehensive evaluation threshold, it is determined whether the email is malicious, suspicious or normal, and the identification result of the email is output. Malicious emails can be directly blocked, suspicious emails can be attached with warnings to remind users, and normal emails are displayed to users normally.

[0063] This embodiment achieves the following technical effects through the above technical solution: This embodiment obtains the content of the email to be identified through the traffic gateway, and splits the content of the email to be identified; analyzes the split content based on the preset identification engine to identify the behavioral features in the email to be identified; scores the identified behavioral features based on the constructed email grading and scoring model, and sets the malicious level of the corresponding behavioral features; conducts a comprehensive analysis based on the scores and malicious levels of all behavioral features, and outputs the identification result corresponding to the email to be identified. This embodiment uses the scoring mechanism method to identify malicious emails. Through comprehensive feature evaluation and flexible grading and scoring rules, it can effectively solve the problem of ignoring the correlation between email content and metadata, and improve the accuracy and efficiency of malicious email identification.

[0064] Exemplary Devices Based on the above embodiments, the present invention further provides a malicious email identification device based on a scoring mechanism, comprising: The mail acquisition and splitting module is used to acquire the content of the mail to be identified through the traffic gateway and split the content of the mail to be identified; A behavior feature analysis module, used to analyze the split content based on a preset recognition engine to identify the behavior features in the email to be identified; The scoring and grading module is used to score the identified behavior features based on the constructed email grading and scoring model, and set the malicious level of the corresponding behavior features; The comprehensive analysis and output module is used to perform a comprehensive analysis based on the scores of all behavioral characteristics and the malicious level, and output the identification result corresponding to the email to be identified.

[0065] This embodiment achieves the following technical effects through the above technical solution: This embodiment obtains the content of the email to be identified through the traffic gateway, and splits the content of the email to be identified; analyzes the split content based on the preset identification engine to identify the behavioral features in the email to be identified; scores the identified behavioral features based on the constructed email grading and scoring model, and sets the malicious level of the corresponding behavioral features; conducts a comprehensive analysis based on the scores and malicious levels of all behavioral features, and outputs the identification result corresponding to the email to be identified. This embodiment uses the scoring mechanism method to identify malicious emails. Through comprehensive feature evaluation and flexible grading and scoring rules, it can effectively solve the problem of ignoring the correlation between email content and metadata, and improve the accuracy and efficiency of malicious email identification.

[0066] Based on the above embodiment, the present invention further provides a terminal, whose principle block diagram can be as follows: Figure 3 shown.

[0067] The terminal includes: a processor, a memory, an interface, a display screen and a communication module connected through a system bus; wherein the processor of the terminal is used to provide computing and control capabilities; the memory of the terminal includes a storage medium and an internal memory; the storage medium stores an operating system and a computer program; the internal memory provides an environment for the operation of the operating system and the computer program in the storage medium; the interface is used to connect to external devices; the display screen is used to display corresponding information; and the communication module is used to communicate with a cloud server or other devices.

[0068] When the computer program is executed by a processor, it is used to implement the operation of a malicious email identification method based on a scoring mechanism.

[0069] It can be understood by those skilled in the art that Figure 3 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal to which the scheme of the present invention is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0070] In one embodiment, a terminal is provided, which includes: a processor and a memory, wherein the memory stores a malicious email identification program based on a scoring mechanism, and when the malicious email identification program based on the scoring mechanism is executed by the processor, it is used to implement the operation of the malicious email identification method based on the scoring mechanism as described above.

[0071] In one embodiment, a storage medium is provided, wherein the storage medium stores a malicious email identification program based on a scoring mechanism, and when the malicious email identification program based on a scoring mechanism is executed by a processor, it is used to implement the operations of the malicious email identification method based on a scoring mechanism as described above.

[0072] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and volatile memory.

[0073] In summary, the present invention provides a method and device for identifying malicious emails based on a scoring mechanism, including: obtaining the content of the email to be identified through a traffic gateway, and splitting the content of the email to be identified; analyzing the split content based on a preset recognition engine to identify the behavioral features in the email to be identified; scoring the identified behavioral features based on the constructed email grading and scoring model, and setting the malicious level of the corresponding behavioral features; performing a comprehensive analysis based on the scores and malicious levels of all behavioral features, and outputting the identification results corresponding to the email to be identified. The present invention uses a scoring mechanism method to identify malicious emails. Through comprehensive feature evaluation and flexible grading and scoring rules, it can effectively solve the problem of ignoring the correlation between email content and metadata, and improve the accuracy and efficiency of malicious email identification.

[0074] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A method for identifying malicious emails based on a scoring mechanism, characterized in that: include: Obtaining the content of the email to be identified through the traffic gateway, and splitting the content of the email to be identified; Analyze the split content based on a preset recognition engine to identify the behavioral features in the email to be identified; Score the identified behavior features based on the constructed email grading and scoring model, and set the malicious level of the corresponding behavior features; A comprehensive analysis is performed based on the scores of all behavioral characteristics and the maliciousness level, and an identification result corresponding to the email to be identified is output.

2. The method for identifying malicious emails based on a scoring mechanism according to claim 1, characterized in that: The obtaining the content of the email to be identified through the traffic gateway includes: The content of the email to be identified is obtained through a traffic gateway; the content of the email to be identified includes: an email header, an email body, and attachment information.

3. The malicious email identification method based on scoring mechanism according to claim 2 is characterized in that: The step of splitting the content of the email to be identified includes: Split the email header into sender account, sender domain name, sender IP and SPF information; Splitting the email body into picture information, URL link information and text information; The attachment information is split into attachment format information and attachment content information.

4. The method for identifying malicious emails based on a scoring mechanism according to claim 1, characterized in that: The analyzing the split contents based on the preset recognition engine to identify the behavior features in the email to be identified includes: Analyze the domain name of the email header or body of the email to be identified based on the threat intelligence engine to obtain corresponding threat intelligence information; Analyze the email body of the email to be identified based on the machine learning engine to obtain content features corresponding to the email body; The attachment information of the email to be identified is analyzed based on a virus scanning engine to obtain behavior features corresponding to the attachment information.

5. The method for identifying malicious emails based on a scoring mechanism according to claim 1, characterized in that: The email grading and scoring model constructed is used to score the identified behavior features and set the malicious level of the corresponding behavior features, including: Constructing the email grading and scoring model according to preset scoring rules and grading standards, and adjusting and optimizing parameters of the email grading and scoring model; Based on the email grading and scoring model, the identified behavior characteristics are scored according to the preset scoring rules, and the malicious level of the corresponding behavior characteristics is set according to the grading standard.

6. The method for identifying malicious emails based on a scoring mechanism according to claim 5, characterized in that: The step of scoring the identified behavior characteristics based on the email grading and scoring model according to the preset scoring rules, and setting the malicious level of the corresponding behavior characteristics according to the grading standard, includes: When the sender address of the email to be identified is empty or hidden, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; When the similarity between the sender domain name of the email to be identified and the enterprise domain name is less than the similarity threshold, the current behavior feature is set as a suspicious level, and the corresponding score is increased to a corresponding score; When the sender domain name of the email to be identified is a domain name generated by the DGA algorithm, the current behavior feature is set to a suspicious level, and the corresponding score is increased to a corresponding score; When the verification result of the sender policy framework of the email to be identified is failure, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score; When the threat intelligence engine analyzes the content of the email to be identified as malicious, the current behavior feature is set to the malicious level, and the corresponding score is increased to the corresponding score; When the analysis result of the virus scanning engine of the attachment information of the to-be-identified email is a malicious virus, the current behavior feature is set as a malicious level, and the corresponding score is increased to a corresponding score.

7. The method for identifying malicious emails based on a scoring mechanism according to claim 1, characterized in that: The comprehensive analysis is performed based on the scores of all behavioral characteristics and the malicious level, and the identification result corresponding to the email to be identified is output, including: Adjusting scores corresponding to maliciously exploited behavior features, multiple suspicious behavior features, and multiple malicious behavior features according to preset weighting rules; Comprehensively analyze the scores of all behavioral characteristics and malicious levels, and determine the final comprehensive evaluation threshold; The result obtained by comprehensive analysis is compared with the threshold of the final comprehensive evaluation to determine and output the identification result of the email to be identified; wherein the identification result is any one of malicious email, suspicious email and normal email.

8. A malicious email identification device based on a scoring mechanism, characterized in that: include: The mail acquisition and splitting module is used to acquire the content of the mail to be identified through the traffic gateway and split the content of the mail to be identified; A behavior feature analysis module, used to analyze the split content based on a preset recognition engine to identify the behavior features in the email to be identified; The scoring and grading module is used to score the identified behavior features based on the constructed email grading and scoring model, and set the malicious level of the corresponding behavior features; The comprehensive analysis and output module is used to perform a comprehensive analysis based on the scores of all behavioral characteristics and the malicious level, and output the identification result corresponding to the email to be identified.

9. A terminal, characterized in that: include: A processor and a memory, wherein the memory stores a malicious email identification program based on a scoring mechanism, and when the malicious email identification program based on a scoring mechanism is executed by the processor, it is used to implement the operation of the malicious email identification method based on a scoring mechanism as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a malicious email identification program based on a scoring mechanism, and when the malicious email identification program based on a scoring mechanism is executed by a processor, it is used to implement the operation of the malicious email identification method based on a scoring mechanism as described in any one of claims 1-7.

Images