Risk assessment system and method for mailbox security

Abstract

The invention discloses a risk assessment system and method for mailbox security, and relates to the technical field of mailbox security risk assessment, the system comprises a mail feature processing module, a periodic analysis module, a mailbox security risk assessment module and a self-learning updating module; the output end of the mail feature processing module is connected with the input end of the periodic analysis module; the output end of the cycle analysis module is connected with the input end of the mailbox security risk assessment module; and the output end of the mailbox security risk assessment module is connected with the input end of the self-learning updating module. According to the method, long-term historical emails are analyzed, the long-term historical behavior characteristics of email senders are extracted, and the problem that the traditional email security detection technology only analyzes the reputation of single emails and cannot find risk emails from trustable bodies is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of mailbox security risk assessment, and in particular to a risk assessment system and method for mailbox security. Background Art

[0002] In the information age, email has become an important tool for corporate communication. However, with the continuous upgrading of email security attack methods, email attack methods have evolved from sending thousands of phishing emails widely on the Internet to sending phishing emails targeting specific individuals in combination with other network attacks. In the current technical means, most software can identify risks for emails from unfamiliar users, but for users of trusted entities (such as partners, subsidiaries, other companies in the group, and internal employees), they can often easily deceive the detection software. Traditional email security detection methods are difficult to identify email risks of trusted entities. Emerging email security detection technologies often rely only on email features for identification, such as common sending time periods, common email sending cities, common language types, common email signatures, frequently sent email objects, frequently sent attachment types, frequently discussed topics in emails, and common sending frequencies, etc., and then self-learn the feature library through big data portraits. However, in the self-learning process, too fast learning frequency will lead to data conflicts, faster fitting, and a large number of false alarms; too slow learning frequency will give some phishing emails an opportunity to take advantage of, so how to provide self-learning learning frequency according to different email features is one of the current problems that need to be solved. Summary of the invention

[0003] The purpose of the present invention is to provide a risk assessment system and method for mailbox security to solve the problems raised in the prior art.

[0004] To achieve the above object, the present invention provides the following technical solution: a risk assessment method for mailbox security, the method comprising the following steps: S1. Construct email analysis features, detect historical email database, and Organize the historical emails in the historical email database; S2. Setting a cycle for the historical mail database, wherein the cycle includes a data cycle and a verification cycle. The data period is used to extract email analysis feature data, and the verification period is used to extract the false positive rate and the wrong positive rate; S3. Build a mailbox security risk assessment model, form a sender-specific self-learning update mechanism based on sender characteristics, and feed it back to the data port; S4. The data port performs corresponding self-learning updates based on the ID information of different senders and retains the update records in the data cloud.

[0005] According to the above technical solution, in step S1, the email analysis features include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language and the email attachment format; The language of the email is determined by reading the Unicode codes of all characters in the email body, counting the number of Chinese characters within the Chinese Unicode range, and calculating whether the number of Chinese characters exceeds 50% of the number of all characters. If it exceeds 50%, it is considered that the email body uses Chinese; otherwise, it is considered that the email body does not use Chinese. The data sorting means: grouping according to the same sender, forming a historical email sequence in chronological order, and forming a data analysis group of historical emails, the data analysis group of historical emails is recorded as ,in, Refers to the sender's IP address; Refers to the time when the corresponding email is sent; Refers to the subject of the corresponding email; Refers to the language of the corresponding email; Refers to the corresponding attachment format; the attachment format includes documents, pictures, audio and video.

[0006] According to the above technical solution, in step S2, a data cycle is established for any sender. Verification cycle ; The verification cycle With data cycle Adjacent, for data cycle the latter period of time; Data collection cycle The data analysis group of historical emails under the collection period Fixed learning update duration under the following conditions; collection and verification cycle The false positive and false negative rates of internal mails; The false positive rate refers to the number of normal emails judged as warning files during the verification cycle. The percentage of the total number of emails from the same sender in the verification cycle; the false positive rate refers to the number of spam emails judged as normal files in the verification cycle The percentage of the total number of emails from the same sender in the message. The warning file refers to the file that is determined to be used to send an alert to the administrator port. Data analysis group based on historical emails to form data cycles The following training data set: ,in, Refers to the data cycle The number of IP addresses of the senders; Refers to the data cycle The difference in the sending time of the corresponding emails; Refers to the data cycle The number of different subjects of the corresponding emails; Refers to the data cycle The number of non-Chinese languages ​​in the corresponding emails below; Refers to the data cycle The number of corresponding attachment format types below; in, The central tendency is used for processing, with 24 hours per day as a range interval, the median is used to separate the data, and a fixed value t is set. The data outside the range are recorded as difference data, where K refers to the median of the email sending time; Build training data for the current sender for any sender, including data period The following training data set: ; Fixed update time period of the current sender; Verification period The sum of the false positive rate and the wrong positive rate of the emails.

[0007] According to the above technical solution, in step S3, building a mailbox security risk assessment model includes: Constantly changing data cycle The position on the time axis forms a number of training data of the current sender, which is recorded as the first data group of the current sender; Form the verification cycle of the current sender under a fixed update time period The sum of the false positive rate and the wrong positive rate of the emails and the data cycle The function fitting relationship between the training data sets below:

[0008] in, Refers to the current sender's verification cycle The sum of the false positive rate and the wrong positive rate of internal mails; refers to the error term; , , , , Represent the coefficients of function fitting respectively; The function fitting relationship is calculated for all senders, and the representative data coordinates are taken for each sender. The representative data coordinates are based on the sender's fixed update time period value as the vertical coordinate and the current sender's most recent data period as the vertical coordinate. Next As the basic data, the function fitting relationship of each sender is substituted, and the sum of the misjudgment rate and the wrong judgment rate is used as the horizontal axis; a number of coordinate scatter points are formed, and the linear equation is used for fitting to form:

[0009] in, Refers to the fixed update time period value of the sender; Refers to the function fitting relationship corresponding to the sender, using the most recent data period of the current sender Next The sum of the misjudgment rate and the wrong judgment rate formed as the basic data; represents the coefficient value, ; represents a constant term; Set fixed update time period threshold ;but ;exist When 0 is taken, if Dissatisfied , then take Output; in When 0 is taken, if satisfy , then take Output; Data port receiving update time period , and perform corresponding self-learning updates.

[0010] A risk assessment system for mailbox security, the system comprising a mail feature processing module, a periodic analysis module, a mailbox security risk assessment module and a self-learning update module; The email feature processing module is used to construct email analysis features, detect the historical email database, and organize the data of historical emails in the historical email database based on the email analysis features; the cycle analysis module is used to set a cycle for the historical email database, and the cycle includes a data cycle and a verification cycle. The data cycle is used to extract email analysis feature data, and the verification cycle is used to extract the false positive rate and the wrong positive rate; the mailbox security risk assessment module is used to construct a mailbox security risk assessment model, and form a sender-personalized self-learning update mechanism based on the sender's characteristics, and feed it back to the data port; the self-learning update module performs corresponding self-learning updates based on the ID information of different senders, and retains the update records to the data cloud; The output end of the email feature processing module is connected to the input end of the periodic analysis module; the output end of the periodic analysis module is connected to the input end of the mailbox security risk assessment module; the output end of the mailbox security risk assessment module is connected to the input end of the self-learning update module.

[0011] According to the above technical solution, the email feature processing module includes an email analysis feature extraction unit and a data sorting unit; The email analysis feature extraction unit is used to construct email analysis features, which include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language, and the email attachment format; the data sorting unit is used to detect the historical email database and sort the historical emails in the historical email database based on the email analysis features; The output end of the email analysis feature extraction unit is connected to the input end of the data sorting unit.

[0012] According to the above technical solution, the cycle analysis module includes a data cycle unit and a verification cycle unit; The data cycle unit is used to construct a data cycle and extract email analysis feature data; the verification cycle unit is used to construct a verification cycle and extract the false positive rate and the wrong positive rate; The verification period is adjacent to the data period and is a time period after the data period.

[0013] According to the above technical solution, the mailbox security risk assessment module includes a model analysis unit and a data feedback unit; The model analysis unit is used to construct a mailbox security risk assessment model and form a sender-personalized self-learning update mechanism based on sender characteristics; the data feedback unit obtains a self-learning update time period based on the self-learning update mechanism and feeds it back to the data port; The output end of the model analysis unit is connected to the input end of the data feedback unit.

[0014] According to the above technical solution, the self-learning update module includes a data port unit and a data cloud; The data port unit is used to query the sender's ID information and perform corresponding self-learning updates based on the ID information of different senders; the data cloud is used to retain update records; The output end of the data port unit is connected to the data cloud.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention extracts the long-term historical behavior characteristics of the email sender through the analysis of long-term historical emails, and uses this as the historical portrait of the email address, and matches it with the new emails from the sender's email address, discovers abnormal risk behaviors that are inconsistent with historical behaviors, and sends warnings to the enterprise IT administrator and receiving employees in a timely manner. It solves the problem that traditional email security detection technology only analyzes the reputation of "single emails" and cannot detect risky emails from trusted entities. Through the implementation of the present invention, enterprises can effectively detect risky emails from trusted partners, subsidiaries, other companies in the group, and internal employees, realize an adaptive self-learning update mechanism, reduce the risk of email fraud, and ensure enterprise information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The present invention is a flowchart of a risk assessment method for mailbox security. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Example: Figure 1 As shown, the present invention provides a risk assessment method for mailbox security, the method comprising: constructing an email analysis feature, detecting a historical email database, and sorting data of historical emails in the historical email database based on the email analysis feature; The email analysis features include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language, and the email attachment format; The language of the email is determined by reading the Unicode codes of all characters in the email body, counting the number of Chinese characters within the Chinese Unicode range, and calculating whether the number of Chinese characters exceeds 50% of the number of all characters. If it exceeds 50%, it is considered that the email body uses Chinese; otherwise, it is considered that the email body does not use Chinese. The data sorting refers to: grouping according to the same sender, forming a historical email sequence in chronological order, and forming a data analysis group of historical emails, the data analysis group of historical emails is recorded as ,in, Refers to the sender's IP address; Refers to the time when the corresponding email is sent; Refers to the subject of the corresponding email; Refers to the language of the corresponding email; Refers to the corresponding attachment format; the attachment format includes documents, pictures, audio and video.

[0019] A cycle is set for the historical mail database, the cycle including a data cycle and a verification cycle, The data period is used to extract email analysis feature data, and the verification period is used to extract the false positive rate and the wrong positive rate; Set up a data cycle for any sender Verification cycle ; The verification cycle With data cycle Adjacent, for data cycle the latter period of time; Data collection cycle The data analysis group of historical emails under the collection period Fixed learning update duration under the following conditions; collection and verification cycle The false positive and false negative rates of internal mails; The false positive rate refers to the number of normal emails judged as warning files during the verification cycle. The percentage of the total number of emails from the same sender in the verification cycle; the false positive rate refers to the number of spam emails judged as normal files in the verification cycle The percentage of the total number of emails from the same sender in the message. The warning file refers to the file that is determined to be used to send an alert to the administrator port. Data analysis group based on historical emails to form data cycles The following training data set: ,in, Refers to the data cycle The number of IP addresses of the senders; Refers to the data cycle The difference in the sending time of the corresponding emails; Refers to the data cycle The number of different subjects of the corresponding emails; Refers to the data cycle The number of non-Chinese languages ​​in the corresponding emails below; Refers to the data cycle The number of corresponding attachment format types below; in, The central tendency is used for processing, with 24 hours per day as a range interval, the median is used to separate the data, and a fixed value t is set. The data outside the range are recorded as difference data, where K refers to the median of the email sending time; Build training data for the current sender for any sender, including data period The following training data set: ; Fixed update time period of the current sender; Verification period The sum of the false positive rate and the wrong positive rate of the emails.

[0020] Build a mailbox security risk assessment model, form a sender-specific self-learning update mechanism based on sender characteristics, and feed it back to the data port; The construction of the mailbox security risk assessment model includes: Constantly changing data cycle The position on the time axis forms a number of training data of the current sender, which is recorded as the first data group of the current sender; Form the verification cycle of the current sender under a fixed update time period The sum of the false positive rate and the wrong positive rate of the emails and the data cycle The function fitting relationship between the training data sets below:

[0021] in, Refers to the current sender's verification cycle The sum of the false positive rate and the wrong positive rate of internal mails; refers to the error term; , , , , Represent the coefficients of function fitting respectively; The function fitting relationship is calculated for all senders, and the representative data coordinates are taken for each sender. The representative data coordinates are based on the sender's fixed update time period value as the vertical coordinate and the current sender's most recent data period as the vertical coordinate. Next As the basic data, the function fitting relationship of each sender is substituted, and the sum of the misjudgment rate and the wrong judgment rate is used as the horizontal axis; a number of coordinate scatter points are formed, and the linear equation is used for fitting to form:

[0022] in, Refers to the fixed update time period value of the sender; Refers to the function fitting relationship corresponding to the sender, using the most recent data period of the current sender Next The sum of the misjudgment rate and the wrong judgment rate formed as the basic data; represents the coefficient value, ; represents a constant term; Set fixed update time period threshold ;but ;exist When 0 is taken, if Dissatisfied , then take Output; in When 0 is taken, if satisfy , then take Output; Data port receiving update time period The data port performs corresponding self-learning updates based on the ID information of different senders and retains the update records in the data cloud.

[0023] In this embodiment, a risk assessment system for mailbox security is also provided, which includes an email feature processing module, a periodic analysis module, a mailbox security risk assessment module and a self-learning update module; The email feature processing module is used to construct email analysis features, detect the historical email database, and organize the data of historical emails in the historical email database based on the email analysis features; the cycle analysis module is used to set a cycle for the historical email database, and the cycle includes a data cycle and a verification cycle. The data cycle is used to extract email analysis feature data, and the verification cycle is used to extract the false positive rate and the wrong positive rate; the mailbox security risk assessment module is used to construct a mailbox security risk assessment model, and form a sender-personalized self-learning update mechanism based on the sender's characteristics, and feed it back to the data port; the self-learning update module performs corresponding self-learning updates based on the ID information of different senders, and retains the update records to the data cloud; The output end of the email feature processing module is connected to the input end of the periodic analysis module; the output end of the periodic analysis module is connected to the input end of the mailbox security risk assessment module; the output end of the mailbox security risk assessment module is connected to the input end of the self-learning update module.

[0024] The email feature processing module includes an email analysis feature extraction unit and a data sorting unit; The email analysis feature extraction unit is used to construct email analysis features, which include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language, and the email attachment format; the data sorting unit is used to detect the historical email database and sort the historical emails in the historical email database based on the email analysis features; The output end of the email analysis feature extraction unit is connected to the input end of the data sorting unit.

[0025] The cycle analysis module includes a data cycle unit and a verification cycle unit; The data cycle unit is used to construct a data cycle and extract email analysis feature data; the verification cycle unit is used to construct a verification cycle and extract the false positive rate and the wrong positive rate; The verification period is adjacent to the data period and is a time period after the data period.

[0026] The mailbox security risk assessment module includes a model analysis unit and a data feedback unit; The model analysis unit is used to construct a mailbox security risk assessment model and form a sender-personalized self-learning update mechanism based on sender characteristics; the data feedback unit obtains a self-learning update time period based on the self-learning update mechanism and feeds it back to the data port; The output end of the model analysis unit is connected to the input end of the data feedback unit.

[0027] The self-learning update module includes a data port unit and a data cloud; The data port unit is used to query the sender's ID information and perform corresponding self-learning updates based on the ID information of different senders; the data cloud is used to retain update records; The output end of the data port unit is connected to the data cloud.

[0028] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A risk assessment method for mailbox security, characterized by: The method comprises the following steps: S1. Build email analysis features, detect historical email database, and Organize the historical emails in the historical email database; S2. Setting a cycle for the historical mail database, wherein the cycle includes a data cycle and a verification cycle. The data period is used to extract email analysis feature data, and the verification period is used to extract the false positive rate and the wrong positive rate; S3. Build a mailbox security risk assessment model, form a sender-specific self-learning update mechanism based on sender characteristics, and feed it back to the data port; S4. The data port performs corresponding self-learning updates based on the ID information of different senders and retains the update records in the data cloud.

2. A risk assessment method for mailbox security according to claim 1, characterized in that: In step S1, the email analysis features include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language, and the email attachment format; The language of the email is determined by reading the Unicode codes of all characters in the email body, counting the number of Chinese characters within the Chinese Unicode range, and calculating whether the number of Chinese characters exceeds 50% of the number of all characters. If it exceeds 50%, it is considered that the email body uses Chinese; otherwise, it is considered that the email body does not use Chinese. The data sorting means: grouping according to the same sender, forming a historical email sequence in chronological order, and forming a data analysis group of historical emails, the data analysis group of historical emails is recorded as ,in, Refers to the sender's IP address; Refers to the time when the corresponding email is sent; Refers to the subject of the corresponding email; Refers to the language of the corresponding email; Refers to the corresponding attachment format; the attachment format includes documents, pictures, audio and video.

3. A risk assessment method for mailbox security according to claim 2, characterized in that: In step S2, a data cycle is established for any sender. Verification cycle ; The verification cycle With data cycle Adjacent, for data cycle the latter period of time; Data collection cycle The data analysis group of historical emails under the collection period Fixed learning update duration under the following conditions; collection and verification cycle The false positive and false negative rates of internal mails; The false positive rate refers to the number of normal emails judged as warning files during the verification cycle. The percentage of the total number of emails from the same sender in the verification cycle; the false positive rate refers to the number of spam emails judged as normal files in the verification cycle The percentage of the total number of emails from the same sender in the message. The warning file refers to the file that is determined to be used to send an alert to the administrator port. Data analysis group based on historical emails to form data cycles The following training data set: ,in, Refers to the data cycle The number of IP addresses of the senders; Refers to the data cycle The difference in the sending time of the corresponding emails; Refers to the data cycle The number of different subjects of the corresponding emails; Refers to the data cycle The number of non-Chinese languages ​​in the corresponding emails below; Refers to the data cycle The number of corresponding attachment format types below; in, The central tendency is used for processing, with 24 hours per day as a range interval, the median is used to separate the data, and a fixed value t is set. The data outside the range are recorded as difference data, where K refers to the median of the email sending time; Build training data for the current sender for any sender, including data period The following training data set: ; Fixed update time period of the current sender; Verification period The sum of the false positive rate and the wrong positive rate of the emails.

4. A risk assessment method for mailbox security according to claim 3, characterized in that: In step S3, the construction of the mailbox security risk assessment model includes: Constantly changing data cycle The position on the time axis forms a number of training data of the current sender, which is recorded as the first data group of the current sender; Form the verification cycle of the current sender under a fixed update time period The sum of the false positive rate and the wrong positive rate of the emails and the data cycle The function fitting relationship between the training data sets below: ， in, Refers to the current sender's verification cycle The sum of the false positive rate and the wrong positive rate of internal mails; refers to the error term; , , , , Represent the coefficients of function fitting respectively; The function fitting relationship is calculated for all senders, and the representative data coordinates are taken for each sender. The representative data coordinates take the sender's fixed update time period as the vertical coordinate and the current sender's most recent data period as the vertical coordinate. Next As the basic data, the function fitting relationship of each sender is substituted, and the sum of the misjudgment rate and the wrong judgment rate is used as the horizontal axis; a number of coordinate scatter points are formed, and the linear equation is used for fitting to form: ， in, Refers to the fixed update time period value of the sender; Refers to the function fitting relationship corresponding to the sender, using the most recent data period of the current sender Next The sum of the misjudgment rate and the wrong judgment rate formed as the basic data; represents the coefficient value, ; represents a constant term; Set fixed update time period threshold ;but ;exist When 0 is taken, if Dissatisfied , then take Output; in When 0 is taken, if satisfy , then take Output; Data port receiving update time period , and perform corresponding self-learning updates.

5. A risk assessment system for mailbox security, characterized in that: The system includes an email feature processing module, a cycle analysis module, an email security risk assessment module and a self-learning update module; The email feature processing module is used to construct email analysis features, detect the historical email database, and organize the data of historical emails in the historical email database based on the email analysis features; the cycle analysis module is used to set a cycle for the historical email database, and the cycle includes a data cycle and a verification cycle. The data cycle is used to extract email analysis feature data, and the verification cycle is used to extract the false positive rate and the wrong positive rate; the mailbox security risk assessment module is used to construct a mailbox security risk assessment model, and form a sender-personalized self-learning update mechanism based on the sender's characteristics, and feed it back to the data port; the self-learning update module performs corresponding self-learning updates based on the ID information of different senders, and retains the update records to the data cloud; The output end of the email feature processing module is connected to the input end of the periodic analysis module; the output end of the periodic analysis module is connected to the input end of the mailbox security risk assessment module; the output end of the mailbox security risk assessment module is connected to the input end of the self-learning update module.

6. A risk assessment system for mailbox security according to claim 5, characterized in that: The email feature processing module includes an email analysis feature extraction unit and a data sorting unit; The email analysis feature extraction unit is used to construct email analysis features, which include: the sender's email address, the sender's IP address, the email sending time, the email subject, the email language, and the email attachment format; the data sorting unit is used to detect the historical email database and sort the historical emails in the historical email database based on the email analysis features; The output end of the email analysis feature extraction unit is connected to the input end of the data sorting unit.

7. A risk assessment system for mailbox security according to claim 5, characterized in that: The cycle analysis module includes a data cycle unit and a verification cycle unit; The data cycle unit is used to construct a data cycle and extract email analysis feature data; the verification cycle unit is used to construct a verification cycle and extract the false positive rate and the wrong positive rate; The verification period is adjacent to the data period and is a time period after the data period.

8. A risk assessment system for mailbox security according to claim 5, characterized in that: The mailbox security risk assessment module includes a model analysis unit and a data feedback unit; The model analysis unit is used to construct a mailbox security risk assessment model and form a sender-personalized self-learning update mechanism based on sender characteristics; the data feedback unit obtains a self-learning update time period based on the self-learning update mechanism and feeds it back to the data port; The output end of the model analysis unit is connected to the input end of the data feedback unit.

9. A risk assessment system for mailbox security according to claim 5, characterized in that: The self-learning update module includes a data port unit and a data cloud; The data port unit is used to query the sender's ID information and perform corresponding self-learning updates based on the ID information of different senders; the data cloud is used to retain update records; The output end of the data port unit is connected to the data cloud.

Images