Mail detection model training method and device and electronic equipment

Abstract

The invention relates to the technical field of computers, in particular to a mail detection model training method and device and electronic equipment. The mail detection model comprises a convolutional neural network model and a deep neural network model. The method comprises the following steps: converting a mail text into an image, and extracting image features through a convolutional neural network model to obtain a first feature vector; and inputting the first feature vector into a deep neural network model to obtain a first predicted value and a first loss function. And converting the mail features into a second vector, splicing the second vector and the first vector to obtain a combined vector, and inputting the combined vector into the deep neural network model to obtain a second predicted value and a second loss function. And calculating the weighted sum of the first loss function and the second loss function to obtain an overall loss function, training the mail detection model based on the overall loss function until the overall loss function converges, and obtaining a trained mail detection model. According to the scheme, the accuracy of detecting the phishing mail can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and electronic device for training an email detection model. Background Art

[0002] Phishing emails are a very common and highly covert attack method in the field of network security. Attackers pretend to be legitimate senders of information (such as notifications sent by banks, reminders of online services, or internal company emails, etc.) to trick victims into revealing sensitive information (such as user names, passwords, bank card details, etc.) or performing harmful actions (such as clicking on links containing malware or downloading harmful attachments).

[0003] With the popularity of the Internet and email in daily life, phishing attacks have become a global network security risk. How to improve the accuracy of detecting phishing emails is a question worth discussing. Summary of the invention

[0004] The embodiments of the present application provide an email detection model training method, device and electronic device for improving the accuracy of detecting phishing emails.

[0005] In a first aspect, an embodiment of the present application provides a method for training an email detection model, wherein the email detection model includes a convolutional neural network model and a deep neural network model, and the method includes:

[0006] Convert the email texts in the email set to be trained into images, and extract features from the images using a convolutional neural network model to obtain a first feature vector;

[0007] Inputting the first feature vector into the deep neural network model to obtain a first prediction value indicating whether the email is a phishing email and a first loss function, wherein the first loss function indicates a loss of the deep neural network model in detecting the email based on the email image feature;

[0008] The email is classified by a set of email feature keywords to obtain email features, the email features are converted into a second vector, the second vector is concatenated with the first vector to obtain a combined vector, and the combined vector is input into a deep neural network model to obtain a second prediction value and a second loss function indicating whether the email is a phishing email, the second loss function indicating the loss of the deep neural network model in detecting the email after integrating image features and text feature information;

[0009] The weighted sum of the first loss function and the second loss function is calculated to obtain the overall loss function. The email detection model is trained based on the overall loss function until the overall loss function converges to obtain a trained email detection model. The sum of the weight values ​​of the first loss function and the second loss function is 1.

[0010] Optionally, the above email feature keyword set is obtained in the following way:

[0011] Using natural language processing technology to perform text analysis on the phishing email set to extract high-frequency words to obtain a target keyword set, performing text analysis on each email in the phishing email set, and combining phishing emails containing at least one keyword in the target keyword set into a first email set;

[0012] Encode each email in the first email set, generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of two vectors;

[0013] Compare the cosine similarity of the embedding vector pair with a preset similarity threshold to obtain a set of similar word pairs, delete duplicate word pairs in the set of similar word pairs, calculate the word frequency TF value of each word in the first email set, and the inverse document frequency IDF value of each word in the phishing email set, and perform part-of-speech tagging on each word in the email;

[0014] Based on the frequency of each word, the inverse document frequency, and the part-of-speech tagging result, it is determined whether to add the keyword to the email feature keyword set.

[0015] Optionally, the above-mentioned determining whether to add a keyword to the email feature keyword set based on the frequency value of each word, the inverse document frequency and the part-of-speech tagging result specifically includes:

[0016] Multiply the frequency value by the inverse document frequency value to get the word frequency-inverse document frequency value;

[0017] Multiply the word frequency-inverse document frequency value of each word by the weight corresponding to the part of speech to obtain the weighted word frequency-inverse document frequency value;

[0018] The weighted word frequency-inverse file frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

[0019] Optionally, the step of concatenating the second vector with the first vector to obtain a combined vector specifically includes:

[0020] Use a fully connected layer to expand the second vector to the same dimension as the first vector;

[0021] The expanded second vector is concatenated with the first vector to obtain a combined vector.

[0022] Optionally, the above-mentioned email set to be trained includes multiple emails and annotated labels of the multiple emails, the first loss function includes a cross-entropy loss function based on the output result of the deep neural network and the annotated labels, and the second loss function includes a cross-entropy loss function based on the output result of the deep neural network and the annotated labels.

[0023] Optionally, the above-mentioned use of natural language processing technology to perform text analysis on the phishing email collection to extract high-frequency words to obtain a target keyword set specifically includes:

[0024] Using natural language processing technology to perform text analysis on the phishing email collection to extract high-frequency words and obtain a first keyword set;

[0025] The first keyword set and the second keyword set are merged, the merged keyword set is traversed, repeated keywords are identified and deleted, and a target keyword set is obtained.

[0026] In a second aspect, an embodiment of the present application provides an email detection method, the method comprising:

[0027] Obtaining an email detection model obtained by using any of the above methods in the first aspect;

[0028] The email to be detected is input into the email detection model to determine whether the email to be detected is a phishing email.

[0029] In a third aspect, an embodiment of the present application provides an email detection model training device, the device comprising:

[0030] A processing module, used for converting email texts in the email set to be trained into images, and extracting features from the images through a convolutional neural network model to obtain a first feature vector;

[0031] A prediction module, used for inputting the first feature vector into a deep neural network model to obtain a first prediction value indicating whether the email is a phishing email and a first loss function, wherein the first loss function indicates a loss of the deep neural network model in detecting the email based on the email image feature;

[0032] The prediction module is further used to classify the email by using the email feature keyword set to obtain the email feature, convert the email feature into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into the deep neural network model to obtain a second prediction value indicating whether the email is a phishing email and a second loss function, wherein the second loss function indicates the loss of the deep neural network model after integrating the image feature and the text feature information to detect the email;

[0033] The processing module is also used to calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function, and train the email detection model based on the overall loss function until the overall loss function converges to obtain a trained email detection model, and the sum of the weight values ​​of the first loss function and the second loss function is 1.

[0034] In a fourth aspect, an embodiment of the present application provides a mail detection device, the device comprising:

[0035] An acquisition module, used to acquire an email detection model obtained by using any of the above methods of the first aspect;

[0036] The processing module is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

[0037] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any one of the email detection model training methods in the first aspect or any one of the email detection methods in the second aspect.

[0038] In the sixth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it implements any one of the email detection model training methods in the first aspect, or any one of the email detection methods in the second aspect.

[0039] In the seventh aspect, an embodiment of the present application also provides a computer program product, including a computer program, which is executed by a processor to implement an email detection model training method as described in any one of the first aspects above, or any one of the email detection methods as described in the second aspect.

[0040] The technical effects brought about by any one of the implementation methods in the third to seventh aspects can refer to the technical effects brought about by the corresponding implementation methods in the first to second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of an application scenario for email detection model training provided in an embodiment of the present application;

[0042] Figure 2 A flow chart of a method for training an email detection model provided in an embodiment of the present application;

[0043] Figure 3 A flowchart of a method for determining a set of email feature keywords provided in an embodiment of the present application;

[0044] Figure 4A schematic diagram of a device for training an email detection model provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of a mail detection device provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0048] The application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0049] Phishing emails are a very common and highly covert attack method in the field of network security. Attackers pretend to be legitimate senders of information (such as notifications sent by banks, reminders of online services, or internal company emails, etc.) to trick victims into revealing sensitive information (such as user names, passwords, bank card details, etc.) or performing harmful actions (such as clicking on links containing malware or downloading harmful attachments).

[0050] With the popularity of the Internet and email in daily life, phishing attacks have become a global network security risk. How to improve the accuracy of detecting phishing emails is a question worth discussing.

[0051] In order to solve the above problems, an embodiment of the present application provides a method for training an email detection model. The email detection model includes a convolutional neural network model and a deep neural network model. The method includes: converting the email text in the email set to be trained into an image, extracting features of the image through the convolutional neural network model to obtain a first feature vector. Inputting the first feature vector into the deep neural network model to obtain a first prediction value and a first loss function indicating whether the email is a phishing email, and the first loss function indicates the loss of the deep neural network model detecting the email based on the email image feature. Feature classification of the email through the email feature keyword set to obtain the email feature, converting the email feature into a second vector, splicing the second vector with the first vector to obtain a combined vector, and inputting the combined vector into the deep neural network model to obtain a second prediction value and a second loss function indicating whether the email is a phishing email, and the second loss function indicates the loss of the deep neural network model detecting the email after integrating the image feature and text feature information. Calculating the weighted sum of the first loss function and the second loss function to obtain the overall loss function, training the email detection model based on the overall loss function until the overall loss function converges, and obtaining a trained email detection model, the sum of the weight values ​​of the first loss function and the second loss function is 1.

[0052] In this way, by introducing the convolutional neural network model and the deep neural network model, the image features and text content features of the email are used for training to achieve accurate identification of phishing emails. By calculating the weighted sum of the first loss function and the second loss function, the overall loss function is obtained, and the email detection model is trained accordingly, which can ensure that the email detection model achieves a balance in understanding the image features and text content features of the email, thereby improving the training efficiency and performance of the model.

[0053] A schematic diagram of an application scenario of an optional email detection model training method in an embodiment of the present application. Figure 1 As shown, it includes a server 100 and a terminal 101. The server 100 and the terminal 101 can be communicatively connected through a network to implement the email detection model training method of the present application.

[0054] The user can use the server 100 to interact with the terminal 101 through the network, such as receiving or sending messages, etc. Various client applications can be installed on the terminal 101, such as program writing applications, web browser applications, search applications, etc.

[0055] It is understandable that in the embodiment of the present application, the server 100 can be implemented as an independent server or a server cluster composed of multiple servers. The terminal 101 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, desktop computers, etc.

[0056] The server 100 can be used to: convert the email text in the email set to be trained into an image, extract features from the image through a convolutional neural network model to obtain a first feature vector. Input the first feature vector into a deep neural network model to obtain a first prediction value and a first loss function indicating whether the email is a phishing email, and the first loss function indicates the loss of the deep neural network model detecting the email based on the email image feature. Feature classification of the email is performed through an email feature keyword set to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into a deep neural network model to obtain a second prediction value and a second loss function indicating whether the email is a phishing email, and the second loss function indicates the loss of the deep neural network model detecting the email after integrating the image feature and text feature information. Calculate the weighted sum of the first loss function and the second loss function to obtain an overall loss function, train the email detection model based on the overall loss function until the overall loss function converges, and obtain a trained email detection model, and the sum of the weight values ​​of the first loss function and the second loss function is 1.

[0057] like Figure 2 As shown, a flowchart of a method for training an email detection model provided in an embodiment of the present application. The email detection model includes a convolutional neural network model and a deep neural network model. Specifically, the following steps may be included.

[0058] Step S201: convert the email texts in the email set to be trained into images, and extract features from the images using a convolutional neural network model to obtain a first feature vector.

[0059] The email set to be trained includes multiple emails and annotated labels of the multiple emails.

[0060] In an optional embodiment, in order to analyze the content of the email using image processing and deep learning models, the email text content can be converted into an image such as 512x512 pixels by using techniques such as text-to-image rendering and visual representation of the email content. The above image is input into a convolutional neural network model, such as a residual network 50-layer model (ResNet50 model). After each email is processed by the ResNet50 model, a 768-dimensional feature vector is generated. Among them, ResNet50 is a convolutional neural network.

[0061] Step S202: Input the first feature vector into the deep neural network model to obtain a first prediction value and a first loss function indicating whether the email is a phishing email.

[0062] Among them, the first loss function represents the loss of the deep neural network model in detecting emails based on email image features.

[0063] For example, the first feature vector (such as a 768-dimensional feature vector) generated by the convolutional neural network model can be input into the deep neural network model to obtain a 1x1 first prediction value generated by the deep neural network model.

[0064] The first loss function is used to evaluate the difference between the predicted value of the vector and the actual target value, thereby guiding the optimization of the model during the training process.

[0065] In the above method, by converting the email text into images and using the convolutional neural network model for feature extraction and prediction, the intelligent analysis and processing of the email content can be achieved. By converting the email content into image form and combining it with graphic feature analysis technology, the commonality of phishing emails in visual presentation can be identified and utilized, not only limited to the email layout, color application, and font style, but also in-depth capture of the overall visual sensory features, significantly enhancing the robustness and accuracy of subsequent email detection.

[0066] Step S203: feature classify the email through the email feature keyword set to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into a deep neural network model to obtain a second prediction value indicating whether the email is a phishing email and a second loss function.

[0067] Among them, the second loss function represents the loss of email detection after the deep neural network model integrates image features and text feature information.

[0068] like Figure 3 As shown, an embodiment of the present application provides a flowchart of a method for determining a set of email feature keywords.

[0069] Step S301: Use natural language processing technology to perform text analysis on the phishing email set to extract high-frequency words to obtain a target keyword set, perform text analysis on each email in the phishing email set, and combine phishing emails containing at least one keyword in the target keyword set into a first email set.

[0070] For example, natural language processing technology can be used to perform text analysis on a phishing email collection to extract high-frequency words. A second keyword set in the phishing email collection determined by the user can also be received. The first keyword set and the second keyword set are merged, the merged keyword set is traversed, duplicate keywords are identified and deleted, and a target keyword set is obtained. The target keyword set can be used for subsequent email screening and feature extraction.

[0071] Perform text analysis on each email in the phishing email set, and group the phishing emails containing at least one keyword in the target keyword set into a first email set. After obtaining the first email set, perform text analysis on each email in the phishing email set to check whether the email content contains the keywords in the target keyword set. Group the phishing emails containing at least one keyword in the target keyword set into the first email set. In this way, the scope of subsequent analysis of phishing emails can be narrowed, and the efficiency and accuracy of analyzing phishing emails can be improved.

[0072] Optionally, a visualization tool (such as WordCloud) may be used to generate a keyword cloud diagram based on high-frequency words, so as to intuitively display the first keyword set in the phishing email.

[0073] Step S302: Encode each email in the first email set, generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, wherein the cosine similarity is used to measure the similarity between two vector directions.

[0074] For example, a preset text model may be used to encode each email in the first email collection to generate an embedding vector representing each word. For example, the preset text model may be a word embeddings (Word2Vec) model, a bidirectional encoder representation model (BidirectionalEncoder Representations from Transformer, BERT) model based on a transformer, or other models that can capture the semantic relationship between words. The cosine similarity of each pair of embedding vectors is calculated.

[0075] Step S303: Compare the cosine similarity of the embedding vector pair with a preset similarity threshold to obtain a set of similar word pairs, delete duplicate word pairs in the set of similar word pairs, calculate the word frequency TF value of each word in the first email set, and the inverse document frequency IDF value of each word in the phishing email set, and perform part-of-speech tagging on each word in the email.

[0076] For example, the cosine similarity of the embedding vector pair is compared with a preset similarity threshold to obtain a set of similar vocabulary pairs. If the cosine similarity of the embedding vector pair is greater than or equal to the preset similarity threshold, the vocabulary pair represented by the above embedding vector pair is a similar vocabulary pair. After obtaining the set of similar vocabulary pairs, in order to remove duplicates, the duplicate vocabulary pairs in the set of similar vocabulary pairs can be deleted.

[0077] Calculate the word frequency TF value of each word in the matching emails. The higher the frequency value, the more important the word is in the email. You can also calculate the inverse document frequency IDF value of each word in the phishing email collection. The higher the IDF value, the less the word appears in the phishing email collection.

[0078] You can also use NLP tools to tag each word in the email with a part of speech, such as verbs, nouns, adjectives, and other parts of speech. Based on the part of speech information, you can set different weights for different parts of speech. For example, verbs and nouns are more descriptive and important in the email content, so they can be given higher weights.

[0079] Step S304: Determine whether to add the keyword to the email feature keyword set based on the frequency of each word, the inverse document frequency, and the part-of-speech tagging result.

[0080] In an optional embodiment, the frequency value may be multiplied by the inverse document frequency value to obtain a word frequency-inverse document frequency value. The word frequency-inverse document frequency value of each word may be multiplied by the weight corresponding to the part of speech to obtain a weighted word frequency-inverse document frequency value. The weighted word frequency-inverse document frequency value may be compared with a preset threshold value to determine whether to add the keyword to the email feature keyword set.

[0081] It is understandable that the preset threshold value may be preset by those skilled in the art and may also be changed based on changes in application scenarios.

[0082] In the above method, by updating and expanding the email feature keyword set based on tempting words and keywords, it is possible to facilitate the subsequent timely identification and adaptation of new and unknown phishing emails, thereby improving the comprehensiveness and accuracy of detection.

[0083] For example, suppose the content of an email is: "I like to eat apples, and apples are very sweet." Then we need to calculate the word frequency of the word "apple". The total number of words in the email: 6 ("I", "like", "eat", "apple", "very", "sweet") The number of times "apple" appears: 2 times. Therefore, the word frequency (TF value) of "apple" is 2 / 6≈0.33.

[0084] Suppose the email collection contains 100 emails, of which the word "apple" appears in 10 emails. The total number of emails is 100. The number of emails containing "apple" is 10. Therefore, the inverse document frequency (IDF value) of "apple" is log(100 / (1+10))≈log(100 / 11)≈1.04.

[0085] Multiply the term frequency and inverse document frequency of "apple" to get its TF-IDF value: TF-IDF(apple) = TF(apple) × IDF(apple) ≈ 0.33 × 1.04 ≈ 0.34

[0086] Assume that the weight of nouns is 1.2, the weight of verbs is 1.0, and the weight of adjectives is 0.8. Since "apple" is a noun, multiply its TF-IDF value by the weight of the noun: weighted TF-IDF(apple) = TF-IDF(apple) × noun weight ≈ 0.34 × 1.2 ≈ 0.41.

[0087] The weighted TF-IDF value is compared with a preset threshold. Assume that the preset threshold is 0.35. Since weighted TF-IDF (apple) = 0.41> 0.35, "apple" can be added to the email feature keyword set.

[0088] In an optional embodiment, after the email features are obtained by feature classification of the email through the email feature keyword set, a fully connected layer can be used to expand the second vector to the same dimension as the first vector. The expanded second vector is concatenated with the first vector to obtain a combined vector. The combined vector is input into a deep neural network model to obtain a second prediction value indicating whether the email is a phishing email.

[0089] For example, the first vector is a 768-dimensional vector. The first vector is a 64-dimensional vector. In order to concatenate the first vector with the second vector, a fully connected layer needs to be applied to the second vector to expand its dimension to the same 768 dimensions as the first vector. The fully connected layer can learn a 768-dimensional output vector based on the 64 features of the input vector, where each output feature is a linear combination of the input features. Once the second vector is expanded to 768 dimensions, the expanded second vector can be simply concatenated with the first vector to obtain a 1536-dimensional combined vector.

[0090] It is understandable that the embodiment of the present application does not specifically limit how to splice vectors. For example, the vectors are connected end to end.

[0091] Step S204: Calculate the weighted sum of the first loss function and the second loss function to obtain an overall loss function, and train the email detection model based on the overall loss function until the overall loss function converges to obtain a trained email detection model.

[0092] The sum of the weight values ​​of the first loss function and the second loss function is 1.

[0093] The overall loss function is used in the training process of the email detection model, and the weights of the model can be updated through the back-propagation algorithm. The overall loss function satisfies the following formula:

[0094]

[0095] Among them, loss represents the overall loss function value, represents the preset weight, loss1 represents the first loss function value, and loss2 represents the second loss function value.

[0096] In the above method, the first loss function and the second loss function are integrated in the form of an overall loss function, thereby improving the accuracy and robustness of the prediction.

[0097] In an optional embodiment, after obtaining the trained email detection model, the trained email detection model can be obtained, and the email to be detected is input into the email detection model to determine whether the email to be detected is a phishing email.

[0098] In this way, the trained email detection model can quickly analyze the email content, determine whether it contains the characteristics of phishing attacks, and promptly identify and intercept phishing emails. Email detection and analysis can be completed automatically without manual intervention, which improves work efficiency and reduces the possibility of human error.

[0099] Figure 4 A schematic diagram of the structure of a mail detection model training device provided in an embodiment of the present application. Figure 4 As shown, the device includes: a processing module 401 and a prediction module 402.

[0100] The processing module 401 is used to convert the email text in the email set to be trained into an image, and extract features of the image through a convolutional neural network model to obtain a first feature vector;

[0101] A prediction module 402, configured to input the first feature vector into a deep neural network model to obtain a first prediction value indicating whether the email is a phishing email and a first loss function, wherein the first loss function indicates a loss of the deep neural network model in detecting the email based on the email image feature;

[0102] The prediction module 402 is further used to classify the email by using the email feature keyword set to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into the deep neural network model to obtain a second prediction value indicating whether the email is a phishing email and a second loss function, wherein the second loss function indicates the loss of the deep neural network model after integrating the image feature and the text feature information to detect the email;

[0103] Processing module 401 is also used to calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function, and train the email detection model based on the overall loss function until the overall loss function converges to obtain a trained email detection model, and the sum of the weight values ​​of the first loss function and the second loss function is 1.

[0104] Optionally, the email feature keyword set is obtained in the following way:

[0105] The processing module 401 is further used to: perform text analysis on the phishing email set using natural language processing technology to extract high-frequency words to obtain a target keyword set, perform text analysis on each email in the phishing email set, and combine phishing emails containing at least one keyword in the target keyword set into a first email set;

[0106] Encode each email in the first email set, generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of two vectors;

[0107] Compare the cosine similarity of the embedding vector pair with a preset similarity threshold to obtain a set of similar word pairs, delete duplicate word pairs in the set of similar word pairs, calculate the word frequency TF value of each word in the first email set, and the inverse document frequency IDF value of each word in the phishing email set, and perform part-of-speech tagging on each word in the email;

[0108] Based on the frequency of each word, the inverse document frequency, and the part-of-speech tagging result, it is determined whether to add the keyword to the email feature keyword set.

[0109] Optionally, based on the frequency value of each word, the inverse document frequency and the part-of-speech tagging result, determining whether to add the keyword to the email feature keyword set, the processing module 401 is specifically used to:

[0110] Multiply the frequency value by the inverse document frequency value to get the word frequency-inverse document frequency value;

[0111] Multiply the word frequency-inverse document frequency value of each word by the weight corresponding to the part of speech to obtain the weighted word frequency-inverse document frequency value;

[0112] The weighted word frequency-inverse file frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

[0113] Optionally, the second vector is concatenated with the first vector to obtain a combined vector, and the prediction module 402 is specifically used for:

[0114] Use a fully connected layer to expand the second vector to the same dimension as the first vector;

[0115] The expanded second vector is concatenated with the first vector to obtain a combined vector.

[0116] Optionally, the above-mentioned email set to be trained includes multiple emails and annotated labels of the multiple emails, the first loss function includes a cross-entropy loss function based on the output result of the deep neural network and the annotated labels, and the second loss function includes a cross-entropy loss function based on the output result of the deep neural network and the annotated labels.

[0117] Optionally, natural language processing technology is used to perform text analysis on the phishing email collection to extract high-frequency words to obtain a target keyword collection. The processing module 401 is specifically used to:

[0118] Using natural language processing technology to perform text analysis on the phishing email collection to extract high-frequency words and obtain a first keyword set;

[0119] The first keyword set and the second keyword set are merged, the merged keyword set is traversed, repeated keywords are identified and deleted, and a target keyword set is obtained.

[0120] Figure 5 This is a schematic diagram of the structure of a mail detection device provided in an embodiment of the present application. Figure 5 As shown, the device includes: an acquisition module 501 and a processing module 502.

[0121] An acquisition module 501 is used to acquire an email detection model obtained by using any method in claims 1 to 6;

[0122] The processing module 502 is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

[0123] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned email detection model training device or email detection device.

[0124] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0125] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.

[0126] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute a distributed training method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 4 or Figure 5 The functions of each module in the device shown.

[0127] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.

[0128] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a driver interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0129] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of a mail detection model training method or a mail detection method disclosed in the embodiments of the present application, it can be directly embodied as a hardware processor to be executed, or it can be executed by a combination of hardware and software modules in the processor.

[0130] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0131] By programming the processor 601, the code corresponding to the distributed training method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 A distributed training method of the embodiment shown. How to design and program the processor 601 is a technique known to those skilled in the art and will not be described in detail here.

[0132] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0133] An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are used to enable a computer to execute an email detection model training method or an email detection method in the above embodiment.

[0134] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0135] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 Flow or flows and / or boxes Figure 1 A device that performs the functions specified in a box or multiple boxes.

[0136] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 Flow or flows and / or boxes Figure 1 The functions specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Flow or flows and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0138] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for training an email detection model, characterized in that: The email detection model includes a convolutional neural network model and a deep neural network model, and the method includes: Converting email texts in the email set to be trained into images, and extracting features from the images using the convolutional neural network model to obtain a first feature vector; Inputting the first feature vector into the deep neural network model to obtain a first prediction value indicating whether the email is a phishing email and a first loss function, wherein the first loss function indicates a loss of the deep neural network model in detecting the email based on the email image feature; Feature classification of the email is performed using a set of email feature keywords to obtain email features, the email features are converted into a second vector, the second vector is concatenated with the first vector to obtain a combined vector, and the combined vector is input into the deep neural network model to obtain a second prediction value and a second loss function indicating whether the email is a phishing email, wherein the second loss function indicates the loss of the deep neural network model in detecting the email after integrating image features and text feature information; Calculate the weighted sum of the first loss function and the second loss function to obtain an overall loss function, train the email detection model based on the overall loss function until the overall loss function converges, and obtain a trained email detection model, where the sum of the weight values ​​of the first loss function and the second loss function is 1.

2. The method according to claim 1, characterized in that The email feature keyword set is obtained in the following way: Performing text analysis on the phishing email set using natural language processing technology to extract high-frequency words to obtain a target keyword set, performing text analysis on each email in the phishing email set, and combining phishing emails containing at least one keyword in the target keyword set into a first email set; Encode each email in the first email set, generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of two vectors; Compare the cosine similarity of the embedding vector pair with a preset similarity threshold to obtain a set of similar word pairs, delete duplicate word pairs in the set of similar word pairs, calculate the word frequency TF value of each word in the first email set, and the inverse document frequency IDF value of each word in the phishing email set, and perform part-of-speech tagging on each word in the email; Based on the frequency of each word, the inverse document frequency and the part-of-speech tagging result, it is determined whether to add the keyword to the email feature keyword set.

3. The method according to claim 2, characterized in that The step of determining whether to add a keyword to the email feature keyword set based on the frequency value of each word, the inverse document frequency, and the part-of-speech tagging result specifically includes: Multiplying the frequency value by the inverse document frequency value to obtain a word frequency-inverse document frequency value; Multiplying the word frequency-inverse document frequency value of each word by the weight corresponding to the part of speech to obtain a weighted word frequency-inverse document frequency value; The weighted word frequency-inverse file frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

4. The method according to claim 1, characterized in that: The step of concatenating the second vector with the first vector to obtain a combined vector specifically includes: Expanding the second vector to the same dimension as the first vector using a fully connected layer; The expanded second vector is concatenated with the first vector to obtain the combined vector.

5. The method according to any one of claims 1 to 3, characterized in that: The email set to be trained includes multiple emails and annotated labels of the multiple emails, the first loss function includes a cross entropy loss function based on the output result of the deep neural network and the annotated labels, and the second loss function includes a cross entropy loss function based on the output result of the deep neural network and the annotated labels.

6. The method according to claim 1, characterized in that The method of using natural language processing technology to perform text analysis on the phishing email collection to extract high-frequency words to obtain a target keyword collection specifically includes: Using natural language processing technology to perform text analysis on the phishing email collection to extract high-frequency words and obtain a first keyword set; The first keyword set and the second keyword set are merged, the merged keyword set is traversed, repeated keywords are identified and deleted, and the target keyword set is obtained.

7. A mail detection method, characterized in that: The method comprises: Obtaining an email detection model obtained by using any of the methods described in claims 1 to 6; The email to be detected is input into the email detection model to determine whether the email to be detected is a phishing email.

8. A mail detection model training device, characterized in that: The device comprises: A processing module, used for converting email texts in the email set to be trained into images, and extracting features from the images using the convolutional neural network model to obtain a first feature vector; A prediction module, configured to input the first feature vector into the deep neural network model to obtain a first prediction value indicating whether the email is a phishing email and a first loss function, wherein the first loss function indicates a loss of the deep neural network model in detecting the email based on the email image feature; The prediction module is further used to perform feature classification on the email through the email feature keyword set to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into the deep neural network model to obtain a second prediction value and a second loss function indicating whether the email is a phishing email, wherein the second loss function represents the loss of the deep neural network model after integrating image features and text feature information to detect the email; The processing module is also used to calculate the weighted sum of the first loss function and the second loss function to obtain an overall loss function, and train the email detection model based on the overall loss function until the overall loss function converges to obtain a trained email detection model, and the sum of the weight values ​​of the first loss function and the second loss function is 1.

9. A mail detection device, characterized in that: The device comprises: An acquisition module, used to acquire an email detection model obtained by using any method described in claims 1 to 6; The processing module is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 or claim 7 is implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to cause the computer to execute the method according to any one of claims 1 to 6 or claim 7.

12. A computer program product, characterized in that When the computer program product is called by a computer, the computer executes the method according to any one of claims 1 to 6 or claim 7.

Images