Phishing mail identification method and device, equipment and storage medium

Abstract

The invention discloses a phishing mail identification method and device, equipment and a storage medium. The method comprises the following steps: obtaining mail associated information of an internal mailbox user; extracting key information of an internal mailbox user from the mail associated information; scoring the internal mailbox users according to the key information, and taking the internal mailbox users whose scoring results meet preset conditions as risk users; and identifying the mail sent by the risk user as a phishing mail. The method comprises the following steps: performing information extraction on special mail associated information of an internal mailbox user to obtain key information of the internal mailbox user, determining an internal risk mailbox user according to the extracted key information, and identifying an internal phishing mail based on the internal risk mailbox user. Therefore, phishing mails appearing in an enterprise can be effectively prevented, and the enterprise or internal employees are prevented from being damaged.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, equipment and storage medium for identifying phishing emails. Background Art

[0002] In existing enterprises, especially medium-sized or large enterprises, the number of employees is huge. After being pushed phishing emails, at best some employees' assets may suffer losses, and at worst the enterprise may suffer heavy losses.

[0003] At present, it is still impossible to accurately identify phishing emails. Usually, it can only be identified through the LAN gateway for emails sent from external mailboxes. For emails sent from internal mailboxes, there is no gateway detection, so it is impossible to effectively prevent them. As a result, after attackers break into the company's internal mailbox, they will send phishing emails through the company's internal mailbox, causing serious damage to employees or companies. Summary of the invention

[0004] The present invention provides a method for identifying phishing emails, so as to realize effective identification of phishing emails sent from an internal mailbox.

[0005] According to a first aspect of the present invention, there is provided a method for identifying phishing emails, comprising: obtaining email-related information of an internal mailbox user, wherein the email-related information includes a network application firewall WAF attack log, a mail server security login log, an email sending and receiving log, and a list of existing mailbox users;

[0006] Extracting key information of the internal mailbox user from the email-related information;

[0007] Scoring the internal mailbox users according to the key information, and treating the internal mailbox users whose scoring results meet preset conditions as risky users;

[0008] The email sent by the risky user is identified as a phishing email.

[0009] According to another aspect of the present invention, a phishing email identification device is provided, comprising: an email-related information acquisition module, used to acquire email-related information of internal mailbox users, wherein the email-related information includes a network application firewall WAF attack log, a mail server security login log, an email sending and receiving log, and an existing mailbox user list;

[0010] A key information extraction module, used to extract the key information of the internal mailbox user from the email-related information;

[0011] A scoring module, used to score the internal mailbox users according to the key information, and regard the internal mailbox users whose scoring results meet the preset conditions as risky users;

[0012] The phishing email identification module is used to identify the emails sent by the risky users as phishing emails.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention extracts email-related information unique to internal email users to obtain key information of internal email users, determines internal risk email users based on the extracted key information, and identifies internal phishing emails based on the internal risk email users, thereby facilitating effective prevention of phishing emails appearing within the enterprise and avoiding losses to the enterprise or internal employees.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a method for identifying phishing emails provided according to Embodiment 1 of the present invention;

[0022] Figure 2 is a flow chart of a method for identifying phishing emails provided according to Embodiment 2 of the present invention;

[0023] Figure 3is a schematic diagram of the structure of a phishing email identification device provided according to Embodiment 3 of the present invention;

[0024] Figure 4 It is a schematic diagram of the structure of an electronic device provided by Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 A flowchart of a method for identifying phishing emails is provided for the first embodiment of the present invention. This embodiment is applicable to the case of risk identification of internal enterprise emails. The method can be executed by a phishing email identification device, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0029] Step S101, obtaining email-related information of internal mailbox users.

[0030] Specifically, the focus of this implementation is on risk identification of internal emails in the enterprise LAN. The executor of risk identification is the email server located in the enterprise LAN. The email server will collect email-related information from internal mailbox users, and the information collection can be performed at a scheduled time or periodically. This implementation does not specifically limit the information collection method of the email server.

[0031] It should be noted that the mail-related information collected by the mail server in this embodiment includes the Web Application Firewall (WAF) attack log, the mail server security login log, the mail sending and receiving log, and the existing mailbox user list. Among them, the WAF attack log contains all Internet mail access session logs entering from the outside. If it detects that it contains attack information or malicious IP, it will be blocked, and the blocking record will be recorded in the log. The mail server security login log belongs to the Windows system log, which contains the relevant parameters of different mailbox users logging into the mail server, such as login IP, login time, login user name and login status; the mail sending and receiving log contains all mail exchange records recorded in the mail server, including but not limited to parameters such as sender, recipient, mail subject and mail sending status; the existing mailbox user list is a list of security users pre-stored in the mail server, which records the common work places and common IPs of internal employees of the enterprise and other related parameters. Of course, this embodiment is only an example, and does not limit the specific parameters recorded in each log.

[0032] It should be noted that the mail server of this embodiment also stores a risky IP list, which records risky IPs with historical attack behaviors. The risky IP list can facilitate subsequent IP comparison to determine the risk assessment of internal mailbox users. Of course, this embodiment only uses the network application firewall WAF attack log, mail server security login log, mail sending and receiving log, and existing mailbox user list as examples for explanation, and does not limit the specific type of mail-related information. As long as it is related to the mail operation of the internal mailbox user, it is within the protection scope of this application, and is not limited in this embodiment.

[0033] Step S102: extracting key information of the internal mailbox user from the email-related information.

[0034] Optionally, extract key information of internal email users from email-related information, including: extracting the login IP of internal email users and the blocking record of login IP from the WAF attack log; extracting the login IP, login time, login user name and login status of the internal email user logging into the email server from the mail server security login log; extracting the email exchange records of internal email users from the email sending and receiving log, wherein the email exchange records include the sender, recipient, email subject and email sending status; extracting the common work locations and common IPs of existing secure email users in the email server from the existing mailbox user list.

[0035] Specifically, in this embodiment, after collecting the key information of the emails of the internal mailbox users, different extraction methods will be used for different types of key information of emails to extract parameters respectively. For example, for the WAF attack log, the login IP and the blocking record of the login IP in the log will be extracted through the regular method; for the mail server security login log, JSON parsing and regular parsing methods will be used to extract the login IP, login time, login user name and login status in the log; for the mail sending and receiving log, regular parsing or KV decomposition parsing methods will be used to extract the sender, recipient, email subject and email sending status in the log. Of course, this embodiment is only an example, and does not limit the extraction methods used for different logs. As long as the key information of the log can be extracted, it is within the protection scope of this application, and this embodiment does not limit it.

[0036] It should be noted that, in this embodiment, when extracting key information from logs, when memory resources are insufficient, a log sequential processing method can be used to ensure the accuracy of key information extraction; when memory resources are sufficient, a log parallel processing method can be used to extract key information, thereby ensuring the accuracy of key information extraction and improving the extraction rate. Of course, this embodiment is only an example, and does not limit the specific extraction strategy of key information.

[0037] Step S103, scoring the internal mailbox users according to the key information, and treating the internal mailbox users whose scoring results meet the preset conditions as risky users.

[0038] Optionally, scoring the internal mailbox user according to the key information includes: obtaining the scoring criteria corresponding to each key information; scoring the key information of the specified type according to the scoring criteria to obtain the corresponding threat score; and adding the threat scores to obtain the score of the internal mailbox user.

[0039] Optionally, internal email users whose scoring results meet preset conditions are regarded as risky users, including: when the scoring result is in the first score range, the internal email user is regarded as a first-level risk user; when the scoring result is in the second score range, the internal email user is regarded as a second-level risk user; when the scoring result is in the third score range, the internal email user is regarded as a third-level risk user, wherein the scores of the first score range, the second score range and the third score range decrease successively, and the risks of first-level risk users, second-level risk users and third-level risk users decrease successively.

[0040] Specifically, in this embodiment, after extracting the key information of the internal mailbox user, the internal mailbox user will be scored according to the extracted key information. When scoring, the corresponding threat score will be obtained according to different key information. By adding up multiple threat scores for the same internal mailbox user, the score of the internal mailbox user can be obtained, and the higher the score, the higher the risk of the internal mailbox user. The following table 1 shows the scoring criteria corresponding to different key information:

[0041] Table 1

[0042]

[0043]

[0044] Among them, in this implementation, for each internal mailbox user, the threat scores corresponding to the above-mentioned scoring indicators can be added to obtain the score of the internal mailbox user. The higher the score, the higher the risk of the mailbox user, and the greater the probability of sending phishing emails. The level of the risk user is determined according to the different score intervals where the score is located, wherein the first score interval can be greater than 80 points, the second score interval is 60 points to 80 points, and the third score interval is 30 points to 60 points. Of course, this implementation is only an example, and does not limit the specific range of each score interval.

[0045] Optionally, before scoring the internal mailbox users according to the key information, it also includes: obtaining the current time status, where the time status includes working hours, off-get off work hours, holidays and sleeping hours; determining the detection frequency corresponding to the current time status; scoring the internal mailbox users according to the key information, including: scoring the internal mailbox users based on the detection frequency according to the key information.

[0046] It should be noted that in this implementation, a self-adjusting detection frequency can be used when scoring email users, that is, the scoring frequency will be automatically adjusted according to the degree of impact of the security threat. Therefore, the current time status will be referred to when scoring. When the time status is during working hours, the internal email users will be scored according to the first detection frequency; when the time status is after get off work, the internal email users will be scored according to the second detection frequency; when the time status is during holidays and sleep, the internal email users will be scored according to the third detection frequency. Since there is no management personnel to manually intervene in monitoring during holidays or during sleep, in this case, the attacker is likely to take the opportunity to attack, so the third detection frequency value corresponding to this time state is the highest; although attackers will take the opportunity to attack during off-duty hours, a small number of on-duty personnel will participate in manual intervention monitoring, so the second detection frequency corresponding to this time state will decrease relative to the third detection frequency value; during working hours, there is a special monitoring management team to manually monitor and adjust the mail server, so the first detection frequency corresponding to this time state will decrease relative to the second detection frequency value, from which it can be known that the values ​​of the first detection frequency, the second detection frequency and the third detection frequency corresponding to the above different time states are successively increased. And in this implementation, the user scores in the past week will be compared. When it is higher than the specified number, for example, when the user score increases by 30% in a week during working hours, it means that there is a risk of being attacked, so the detection frequency will be automatically increased. Of course, this implementation is only an example, and does not limit the adjustment method of the detection frequency.

[0047] Step S104: Identify the email sent by the risky user as a phishing email.

[0048] Optionally, after the email sent by the risky user is identified as a phishing email, the method further includes: when there is no abnormality with the risky user after a specified period of time, restoring the risky user to a safe user.

[0049] Among them, in this embodiment, after the risky user is determined, the emails sent by the risky user will be treated as phishing emails and intercepted, so that the phishing emails can be indirectly identified by identifying the risky user, thereby achieving pre-emptive prevention and control of phishing emails.

[0050] It should be noted that in this embodiment, when it is determined that an internal mailbox user has become a risk user due to an external attack, the attacked internal mailbox user will be prompted to make corrections, such as virus detection, etc. Of course, this embodiment is only an example, and does not limit the specific correction method for risk users. And after a week of continuous observation, if there is no abnormality in the risk user, the risk user will be restored to a legitimate user, thereby ensuring the normal sending and receiving of emails by the user.

[0051] In the implementation mode of the present application, by extracting email-related information unique to internal email users, key information of internal email users is obtained, internal risk email users are determined based on the extracted key information, and internal phishing emails are identified based on the internal risk email users, thereby facilitating effective prevention of phishing emails appearing within the enterprise and preventing losses to the enterprise or internal employees.

[0052] Embodiment 2

[0053] Figure 2 A flow chart of a method for identifying phishing emails provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and, after identifying emails sent by risky users as phishing emails, further includes processing phishing emails in different ways according to different risk levels of risky users.

[0054] like Figure 2 As shown, the method includes:

[0055] Step S201, obtaining email-related information of internal mailbox users.

[0056] Step S202: extracting key information of the internal mailbox user from the email-related information.

[0057] Optionally, extract key information of internal email users from email-related information, including: extracting the login IP of internal email users and the blocking record of login IP from the WAF attack log; extracting the login IP, login time, login user name and login status of the internal email user logging into the email server from the mail server security login log; extracting the email exchange records of internal email users from the email sending and receiving log, wherein the email exchange records include the sender, recipient, email subject and email sending status; extracting the common work locations and common IPs of existing secure email users in the email server from the existing mailbox user list.

[0058] Step S203: score the internal mailbox users according to the key information, and regard the internal mailbox users whose scoring results meet the preset conditions as risky users.

[0059] Optionally, scoring the internal mailbox user according to the key information includes: obtaining the scoring criteria corresponding to each key information; scoring the key information of the specified type according to the scoring criteria to obtain the corresponding threat score; and adding the threat scores to obtain the score of the internal mailbox user.

[0060] Optionally, internal email users whose scoring results meet preset conditions are regarded as risky users, including: when the scoring result is in the first score range, the internal email user is regarded as a first-level risk user; when the scoring result is in the second score range, the internal email user is regarded as a second-level risk user; when the scoring result is in the third score range, the internal email user is regarded as a third-level risk user, wherein the scores of the first score range, the second score range and the third score range decrease successively, and the risks of first-level risk users, second-level risk users and third-level risk users decrease successively.

[0061] Optionally, before scoring the internal mailbox users according to the key information, it also includes: obtaining the current time status, where the time status includes working hours, off-get off work hours, holidays and sleeping hours; determining the detection frequency corresponding to the current time status; scoring the internal mailbox users according to the key information, including: scoring the internal mailbox users based on the detection frequency according to the key information.

[0062] Step S204: Identify the email sent by the risky user as a phishing email.

[0063] Optionally, after the email sent by the risky user is identified as a phishing email, the method further includes: when there is no abnormality with the risky user after a specified period of time, restoring the risky user to a safe user.

[0064] Step S205: Process phishing emails in different ways according to different risk levels of risky users.

[0065] Optionally, after identifying the emails sent by the risky user as phishing emails, it also includes: when the risky user is determined to be a first-level risk user, the login IP of the risky user is banned; when the risky user is determined to be a second-level risk user, the emails sent by the risky user are temporarily stored and intercepted, and early warning information is generated based on the phishing emails; when the risky user is determined to be a third-level risk user, a continuous attention prompt is generated.

[0066] Specifically, in this embodiment, after the risk user is determined, different methods will be used to handle the security threat of the emails sent by the risk user according to the different risk levels of the risk user. When it is determined to be a first-level risk user, the user's login IP will be directly banned to prevent it from further sending phishing emails within the enterprise; when it is determined to be a second-level risk user, the phishing emails sent by it will be temporarily intercepted and delayed by default until 1 hour after work. If it triggers conditions such as sleep period or fixed keywords, it will be further delayed by 2 hours, and an early warning message will be generated to facilitate the monitoring management team to confirm the email twice, wherein the early warning information specifically includes the sender of the email, the subject of the sending, the number of sending and the number of recipients, etc., which are core information for manual risk confirmation; when it is determined to be a third-level risk user, it means that the phishing email sent by the email is less dangerous, such as an email sent by an employee of the enterprise working remotely, and a continuous attention prompt will be generated at this time, so that the monitoring management team can focus on the mailbox user. In this embodiment, different email processing methods are used for users with different risk levels, so as to ensure both the security within the enterprise and the normal work of the enterprise employees.

[0067] In the implementation mode of the present application, by extracting the unique email-related information of the internal mailbox user, the key information of the internal mailbox user is obtained, the internal risk mailbox user is determined based on the extracted key information, and the internal phishing emails are identified based on the internal risk mailbox user, so as to effectively prevent the phishing emails that appear in the enterprise and avoid the loss of the enterprise or internal employees. In addition, different methods are used to handle the phishing emails sent by users with different risk levels, so as to ensure the security of the enterprise while meeting the needs of the normal sending of enterprise employees' emails.

[0068] Embodiment 3

[0069] Figure 3 This is a schematic diagram of the structure of a phishing email identification device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: an email-related information acquisition module 310 , a key information extraction module 320 , a scoring module 330 and a phishing email identification module 340 .

[0070] The email-related information acquisition module 310 is used to acquire email-related information of internal mailbox users, wherein the email-related information includes network application firewall WAF attack logs, mail server security login logs, email sending and receiving logs, and a list of existing mailbox users;

[0071] Key information extraction module 320, used to extract key information of internal mailbox users from email-related information;

[0072] Scoring module 330, used to score internal mailbox users according to key information, and to identify internal mailbox users whose scoring results meet preset conditions as risky users;

[0073] The phishing email identification module 340 is used to identify emails sent by risky users as phishing emails.

[0074] Optional, key information extraction module, used to extract the login IP of internal email users and the blocking records of login IP from the WAF attack log;

[0075] Extract the login IP, login time, login user name and login status of the internal email user logging into the mail server from the mail server security login log;

[0076] Extracting the email exchange records of internal email users from the email sending and receiving logs, wherein the email exchange records include the sender, the receiver, the email subject and the email sending status;

[0077] Extract the common work locations and common IP addresses of existing secure mailbox users in the mailbox server from the existing mailbox user list.

[0078] Optionally, a scoring module is used to obtain the scoring criteria corresponding to each key information;

[0079] Score the key information of the specified type according to the scoring criteria to obtain the corresponding threat score;

[0080] Add up the threat scores to get the score for internal mailbox users.

[0081] Optionally, a scoring module is used to treat the internal mailbox user as a first-level risk user when the scoring result is in the first score range;

[0082] When the scoring result is in the second score range, the internal email user is considered a second-level risk user;

[0083] When the scoring result is in the third score range, the internal email user is considered a third-level risk user.

[0084] Among them, the scores of the first score interval, the second score interval and the third score interval decrease successively, and the risks of first-level risk users, second-level risk users and third-level risk users decrease successively.

[0085] Optionally, the device further includes a phishing email processing module, which is used to block the login IP of the risk user when the risk user is determined to be a first-level risk user;

[0086] When the risk user is determined to be a secondary risk user, the emails sent by the risk user will be temporarily stored and intercepted, and warning information will be generated based on the phishing emails;

[0087] When the risk user is determined to be a level 3 risk user, a continuous attention prompt is generated.

[0088] Optionally, the device further includes a recovery module, which is used to restore the risky user to a safe user when there is no abnormality with the risky user after a specified period of time.

[0089] Optionally, the device further includes a detection frequency determination module, which is used to obtain the current time state, wherein the time state includes working hours, off-get off work hours, holidays and sleep periods; and determine the detection frequency corresponding to the current time state;

[0090] The scoring module is also used to score internal mailbox users based on the detection frequency according to the key information. The phishing email identification device provided by the embodiment of the present invention can execute the phishing email identification method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] Embodiment 4

[0092] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0093] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0094] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for identifying phishing emails.

[0096] In some embodiments, the method for identifying phishing emails may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for identifying phishing emails described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the method for identifying phishing emails in any other appropriate manner (e.g., by means of firmware).

[0097] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0099] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0101] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0102] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0103] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0104] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying phishing emails, characterized in that: include: Obtaining email-related information of internal mailbox users, wherein the email-related information includes network application firewall (WAF) attack logs, mail server security login logs, mail sending and receiving logs, and a list of existing mailbox users; Extracting key information of the internal mailbox user from the email-related information; Scoring the internal mailbox users according to the key information, and treating the internal mailbox users whose scoring results meet preset conditions as risky users; The email sent by the risky user is identified as a phishing email.

2. The method according to claim 1, characterized in that The step of extracting the key information of the internal mailbox user from the email-related information includes: Extract the login IP of the internal email user and the blocking record of the login IP from the WAF attack log; Extract the login IP, login time, login user name and login status of the internal email user logging into the email server from the email server security login log; Extracting the mail exchange records of internal mail users from the mail sending and receiving log, wherein the mail exchange records include the sender, the recipient, the mail subject and the mail sending status; Extract the common work locations and common IP addresses of existing secure mailbox users in the mailbox server from the existing mailbox user list.

3. The method according to claim 1, characterized in that The scoring of the internal mailbox user according to the key information includes: Obtaining scoring criteria corresponding to each of the key information; Scoring the key information of a specified type according to the scoring criteria to obtain corresponding threat scores; The threat scores are added together to obtain a score for the internal mailbox user.

4. The method according to claim 3, characterized in that: The internal mailbox users whose scoring results meet the preset conditions are regarded as risky users, including: When the scoring result is in the first score range, the internal mailbox user is regarded as a first-level risk user; When the scoring result is in the second score range, the internal mailbox user is regarded as a second-level risk user; When the scoring result is in the third score range, the internal mailbox user is regarded as a third-level risk user. The scores of the first score interval, the second score interval and the third score interval decrease in sequence, and the risks of the first-level risk user, the second-level risk user and the third-level risk user decrease in sequence.

5. The method according to claim 4, characterized in that After the email sent by the risky user is identified as a phishing email, the method further includes: When the risk user is determined to be a first-level risk user, the login IP of the risk user is banned; When the risk user is determined to be a secondary risk user, the email sent by the risk user is temporarily stored and intercepted, and a warning message is generated according to the phishing email; When it is determined that the risky user is a third-level risky user, a continuous attention prompt is generated.

6. The method according to claim 1, characterized in that After the email sent by the risky user is identified as a phishing email, the method further includes: When there is no abnormality with the risky user after a specified period of time, the risky user is restored to a safe user.

7. The method according to claim 1, characterized in that Before scoring the internal mailbox user according to the key information, the method further includes: Obtaining the current time status, wherein the time status includes working hours, off-get off work hours, holidays, and sleeping hours; Determine the detection frequency corresponding to the current time state; The scoring of the internal mailbox user according to the key information includes: scoring the internal mailbox user based on the detection frequency according to the key information.

8. A device for identifying phishing emails, characterized in that: include: An email-related information acquisition module is used to acquire email-related information of internal mailbox users, wherein the email-related information includes network application firewall WAF attack logs, mail server security login logs, email sending and receiving logs, and a list of existing mailbox users; A key information extraction module, used to extract the key information of the internal mailbox user from the email-related information; A scoring module, used to score the internal mailbox users according to the key information, and regard the internal mailbox users whose scoring results meet the preset conditions as risky users; The phishing email identification module is used to identify the emails sent by the risky users as phishing emails.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

Images