Email identification method and system based on URL detection

Abstract

The invention discloses a mail identification method and system based on URL (Uniform Resource Locator) detection, and the method comprises the following steps: S1, judging whether an A tag exists in an HTML (Hypertext Markup Language) source code of a mail to be checked, and if the A tag exists, skipping to the next step; otherwise, ending and exiting; s2, extracting a display name of the label A, judging whether the display name of the label A is a URL (Uniform Resource Locator), and if the display name of the label A is the URL, skipping to the next step; otherwise, ending and exiting; and S3, extracting the href attribute used for specifying the URL in the tag A, judging whether the URL with the href attribute and the URL with the displayed name are consistent or not, and if not, judging that the checked mail is a phishing mail or a junk mail. The invention aims to solve the problems that the existing URL-based detection means depend on prior information such as data statistics and the like and the recognition accuracy is insufficient, and the mail recognition efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of email security detection, and in particular to a method and system for email identification based on detecting URL. Background Art

[0002] Phishing emails use disguised emails to trick recipients into replying their account numbers, passwords, and other information to designated recipients; or they direct recipients to connect to specially crafted web pages, which are usually disguised as real websites, such as bank or financial management web pages, so that the registrants believe them and enter their credit card or bank card numbers, account names, and passwords, which are then stolen. URLs, or uniform resource locators, are a method of indicating the location of information on the World Wide Web. Existing URL-based detection methods include: segmenting URLs, performing statistical analysis on the segmentation results, and determining whether it is a phishing email based on the score. Performing a blacklist check on the URL, and determining it as a phishing email if it is on the blacklist. However, existing URL-based detection methods all have the problem of relying on prior information such as data statistics, and the problem of insufficient recognition accuracy. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a method and system for email recognition based on URL detection are provided. The present invention aims to solve the problem that the existing URL-based detection methods all rely on prior information such as data statistics and have insufficient recognition accuracy, and to improve the efficiency and accuracy of email recognition.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for email identification based on detecting URLs comprises the following steps: S1, for the checked email, determine whether there is an A tag defining a hyperlink in the HTML source code of the email, if there is an A tag defining a hyperlink, jump to the next step; otherwise, end and exit; S2, extract the display name of the A tag, and determine whether the display name of the A tag is a URL. If it is a URL, jump to the next step; otherwise, end and exit; S3, extracting the href attribute for specifying the URL in the A tag, and determining whether the URL of the href attribute and the URL of the display name are consistent. If they are inconsistent, the checked email is determined to be a phishing email or a spam; otherwise, the process ends and exits.

[0005] Optionally, before determining whether the URL of the href attribute and the URL of the display name are consistent in step S3, the step further includes converting the URL of the href attribute and the URL of the display name into lowercase letters or uppercase letters at the same time.

[0006] Optionally, before determining whether the URL of the href attribute and the URL of the display name are consistent in step S3, the step further includes extracting the last character of the URL of the href attribute and the URL of the display name. If one of the last characters of the two is a backslash and the other is a non-backslash, the backslash is removed or a backslash is added after the non-backslash character, so that the last characters of the URL of the href attribute and the URL of the display name are both a backslash or a non-backslash.

[0007] Optionally, after determining whether the URL address of the href attribute and the URL address of the display name are consistent in step S3, it also includes continuing to use a specified email detection mechanism to perform email identification on the URL address of the href attribute to determine whether the checked email is a phishing email or spam when the URL address of the href attribute and the URL address of the display name are consistent.

[0008] Optionally, the use of a designated email detection mechanism to perform email identification to determine whether the checked email is a phishing email or a spam email includes: using a word segmenter to segment the URL address of the href attribute, and for each word element obtained by the segmentation, obtaining the score of the word element according to a preset word element statistics table, and if the score of any word element exceeds a preset threshold, the checked email is determined to be a phishing email or a spam email; the preparation of the preset word element statistics table includes: using a word segmenter to segment a known batch of illegal URL address samples, and for each word element obtained by the segmentation, then determining the score of each word element according to the frequency of occurrence of each word element in the batch of illegal URL address samples, thereby obtaining a word element statistics table consisting of each word element and the score of the word element.

[0009] Optionally, the use of a designated email detection mechanism to perform email identification to determine whether the checked email is a phishing email or spam includes: querying a preset blacklist for the URL address of the href attribute, and if the URL address of the href attribute is in the preset blacklist, determining that the checked email is a phishing email or spam.

[0010] Optionally, after extracting the href attribute for specifying the URL in the A tag in step S3 and before determining whether the URL of the href attribute and the URL of the display name are consistent, the process also includes querying a preset whitelist for the URL of the href attribute. If the URL of the href attribute is in the preset whitelist, it is determined that the checked email is not a phishing email or spam, and the process ends and exits.

[0011] In addition, the present invention also provides a system for mail identification based on detecting URL, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the method for mail identification based on detecting URL.

[0012] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the method of email identification based on detecting URL through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or an instruction, wherein the computer program or the instruction is programmed or configured to execute the method of email identification based on detecting URL through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: 1. The method of the present invention comprises the following steps: S1, for the mail being checked, determine whether there is an A tag in the HTML source code of the mail, if there is an A tag, jump to the next step; otherwise, end and exit; S2, extract the display name of the A tag, determine whether the display name of the A tag is a URL, if it is a URL, jump to the next step; otherwise, end and exit; S3, extract the href attribute for specifying the URL in the A tag, determine whether the URL of the href attribute and the URL of the display name are consistent, if they are inconsistent, determine that the mail being checked is a phishing mail or a spam. The present invention aims to solve the problem that the existing detection methods based on URL all rely on prior information such as data statistics, and have insufficient recognition accuracy, and improve the efficiency and accuracy of mail recognition.

[0015] 2. The present invention can be used as a supplementary detection mechanism for the existing mail identification mechanism and can be pre- or post-placed in the existing mail identification mechanism. It has good compatibility and can further improve the efficiency and accuracy of mail identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0018] Emails, like web pages, are displayed in rich text format based on HTML. HTML contains a series of syntax definitions, among which the A tag is used to define a hyperlink, that is, a link from one page to another. The most important attribute of the A tag is the href (HyperText Reference) attribute, which specifies the target address of the link. For example, the following A tag (anchor tag, used to define a hyperlink) in the HTML source code: xxxx The "xxxx" is the display name of the A tag, and "http: / / www.abc.cn / " is the URL of the href attribute of the A tag. In the rendered email, the A tag will only display "xxxx", and the "xxxx" can be clicked, and clicking it will enter the URL "http: / / www.abc.cn / ". In actual research, it was found that there is a phenomenon of forged URLs. The display name of the A tag looks like a URL, but it is inconsistent with the actual URL of the href attribute. For example: http: / / www.abc.cn / The display effect of the above A label in the email client is a link http: / / www.abc.cn / , and the "http: / / www.abc.cn / " can be clicked, and clicking it will lead to the URL "http: / / www.def.cn". The user will mistakenly think that the URL he opened is http: / / www.abc.cn, but in fact he has entered a malicious URL. In response to the above problem, if Figure 1 As shown, the method for email identification based on detecting URL in this embodiment includes the following steps: S1, for the checked email, determine whether there is an A tag defining a hyperlink in the HTML source code of the email, if there is an A tag defining a hyperlink, jump to the next step; otherwise, end and exit; S2, extract the display name of the A tag, and determine whether the display name of the A tag is a URL. If it is a URL, jump to the next step; otherwise, end and exit; S3, extracting the href attribute for specifying the URL in the A tag, and determining whether the URL of the href attribute and the URL of the display name are consistent. If they are inconsistent, the checked email is determined to be a phishing email or a spam; otherwise, the process ends and exits.

[0019] In order to avoid the problem of misjudgment of the href attribute URL and the display name URL due to inconsistent capitalization of the href attribute URL and the display name URL, before determining whether the href attribute URL and the display name URL are consistent in step S3 of this embodiment, the href attribute URL and the display name URL are converted into lowercase or uppercase letters at the same time.

[0020] Since the last character of a URL can be a backslash or not, in order to avoid the problem that the last backslash of the href attribute URL and the display name URL causes misjudgment of both the href attribute URL and the display name URL, before determining whether the href attribute URL and the display name URL are consistent in step S3 of this embodiment, the step further includes extracting the last character of the href attribute URL and the display name URL. If one of the last characters is a backslash and the other is not a backslash, the backslash is removed or a backslash is added after the non-backslash character, so that the last character of both the href attribute URL and the display name URL is a backslash or a non-backslash.

[0021] In order to achieve compatibility with the existing email identification mechanism, after determining whether the URL address of the href attribute and the URL address of the display name are consistent in step S3 of this embodiment, it also includes continuing to use the specified email detection mechanism to perform email identification on the URL address of the href attribute when the URL address of the href attribute and the URL address of the display name are consistent to determine whether the checked email is a phishing email or spam.

[0022] As an optional implementation, this embodiment uses a designated email detection mechanism to perform email identification to determine whether the checked email is a phishing email or a spam email, including: using a word segmenter to segment the URL address of the href attribute, and for each word element obtained by the segmentation, obtaining the score of the word element according to a preset word element statistics table; if the score of any word element exceeds a preset threshold, the checked email is determined to be a phishing email or a spam email; the preparation of the preset word element statistics table includes: using a word segmenter to segment a known batch of illegal URL address samples, and for each word element obtained by the segmentation, then determining the score of each word element according to the frequency of occurrence of each word element in the batch of illegal URL address samples, thereby obtaining a word element statistics table consisting of each word element and the score of the word element.

[0023] As an optional implementation, this embodiment uses a designated email detection mechanism to perform email identification to determine whether the email being checked is a phishing email or spam, including: querying a preset blacklist for the URL address of the href attribute; if the URL address of the href attribute is in the preset blacklist, then determining that the email being checked is a phishing email or spam.

[0024] As an optional implementation, in step S3 of this embodiment, after extracting the href attribute for specifying the URL in the A tag and before determining whether the URL of the href attribute and the URL of the display name are consistent, it also includes querying a preset whitelist for the URL of the href attribute. If the URL of the href attribute is in the preset whitelist, it is determined that the checked email is not a phishing email or spam, and the process ends and exits.

[0025] In addition, this embodiment also provides a system for email identification based on detecting URL, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the method for email identification based on detecting URL.

[0026] In addition, this embodiment further provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the method of email identification based on detecting URL through a processor.

[0027] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the method of email identification based on detecting URLs through a processor.

[0028] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0029] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for email identification based on detecting URL, characterized in that: The steps include: S1, for the checked email, determine whether there is an A tag defining a hyperlink in the HTML source code of the email, if there is an A tag defining a hyperlink, jump to the next step; otherwise, end and exit; S2, extract the display name of the A tag, and determine whether the display name of the A tag is a URL. If it is a URL, jump to the next step; otherwise, end and exit; S3, extracting the href attribute for specifying the URL in the A tag, and determining whether the URL of the href attribute and the URL of the display name are consistent. If they are inconsistent, the checked email is determined to be a phishing email or a spam; otherwise, the process ends and exits.

2. The method for email identification based on detecting URL according to claim 1, characterized in that: Before determining whether the URL of the href attribute and the URL of the display name are consistent in step S3, the process further includes converting the URL of the href attribute and the URL of the display name into lowercase letters or uppercase letters at the same time.

3. The method for email identification based on detecting URL according to claim 2, characterized in that: Before determining whether the URL of the href attribute and the URL of the display name are consistent in step S3, the step also includes extracting the last character of the URL of the href attribute and the URL of the display name. If one of the last characters of the two is a backslash and the other is not a backslash, the backslash is removed or a backslash is added after the non-backslash character, so that the last character of the URL of the href attribute and the URL of the display name is both a backslash or a non-backslash.

4. The method for email identification based on detecting URL according to claim 3, characterized in that: After determining whether the URL address of the href attribute and the URL address of the display name are consistent in step S3, the process also includes continuing to use a specified email detection mechanism to perform email identification on the URL address of the href attribute to determine whether the checked email is a phishing email or a spam email when the URL address of the href attribute and the URL address of the display name are consistent.

5. The method for email identification based on detecting URL according to claim 4, characterized in that: The method of using a designated email detection mechanism to perform email identification to determine whether the checked email is a phishing email or a spam email includes: using a word segmenter to segment the URL address of the href attribute, and for each word element obtained by the segmentation, obtaining the score of the word element according to a preset word element statistical table, and if the score of any word element exceeds a preset threshold, the checked email is determined to be a phishing email or a spam email; the preparation of the preset word element statistical table includes: using a word segmenter to segment a known batch of illegal URL address samples, and for each word element obtained by the segmentation, then determining the score of each word element according to the frequency of occurrence of each word element in the batch of illegal URL address samples, thereby obtaining a word element statistical table consisting of each word element and the score of the word element.

6. The method for email identification based on detecting URL according to claim 5, characterized in that: The method of using a designated email detection mechanism to identify an email to determine whether the email being checked is a phishing email or a spam email includes: querying a preset blacklist for the URL address of the href attribute; if the URL address of the href attribute is in the preset blacklist, determining that the email being checked is a phishing email or a spam email.

7. The method for email identification based on detecting URL according to claim 5, characterized in that: In step S3, after extracting the href attribute for specifying the URL in the A tag and before determining whether the URL of the href attribute and the URL of the display name are consistent, the process also includes querying a preset whitelist for the URL of the href attribute. If the URL of the href attribute is in the preset whitelist, it is determined that the checked email is not a phishing email or a spam, and the process ends and exits.

8. A system for mail identification based on detecting URL, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the method for mail identification based on detecting URL as claimed in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the method for email identification based on detecting URL as claimed in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the method for email identification based on detecting URL as claimed in any one of claims 1 to 7 through a processor.

Images