Phishing mail information extraction method based on large language model

Abstract

A phishing mail information extraction method based on a large language model is characterized by comprising the following steps: step 1, scanning a received mail; 2, extracting a password from the text of the mail by adopting a GPT model; judging whether the attachment of the mail is a compressed package or not, and if yes, entering the step 3; step 3, decompressing the compressed package by using the password extracted in the step 2; 4, performing Trojan virus detection on the decompressed original file; the functions of the method belong to a part of a'mail filter ', features which cannot be extracted by some traditional technologies are extracted through an AI large model (LLM, Large Language Model) technology so as to improve the accuracy of the whole filtering function, the ability of the AI large model technology such as GPT for semantic understanding is introduced, traditional keyword matching and regular matching are replaced, and the accuracy of the whole filtering function is improved. Therefore, a more perfect detection effect is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of phishing email information extraction, and in particular to a phishing email information extraction method based on a large language model. Background Art

[0002] Phishing emails usually embed viruses or Trojans in the emails, or use misleading text in the body of the emails to induce users to click on phishing links or download viruses and Trojans to complete phishing attacks (attackers). The email detection gateway (defender) will detect and intercept the above behaviors to achieve the purpose of isolation and risk prevention.

[0003] As the means of attack and defense continue to escalate, some phishing emails have begun to encapsulate viruses, Trojans or misleading texts into compressed packages such as zip / rar / 7z to evade detection and interception by the gateway. Some more advanced attacks will further use encrypted compressed packages to increase the difficulty of interception. Such compressed packages require users to enter passwords when unpacking, and attackers will use various means to hide passwords in various locations in the email. Early password prompts were relatively simple, such as prompting "decompression password is 123456" in the title or body of the email. Such passwords can be extracted through regular matching or simple lexical analysis, and then handed over to the gateway to decompress the compressed package to complete the subsequent detection task.

[0004] However, at this stage, there are many more complex password description methods, which add logic and association relationships, such as "the decompression password is 6 2s", or "the decompression password is my email", etc. These passwords are easy for the human brain to extract, but they cannot be extracted by software and machines through traditional regular matching or lexical analysis, which leads to the failure of the detection task of the email detection gateway. To solve the above problems, a phishing email information extraction method based on a large language model is proposed. Summary of the invention

[0005] In view of the above technical problems, the present invention provides a method for extracting phishing email information based on a large language model, which is characterized by comprising the following steps:

[0006] Step 1: Scan the received emails;

[0007] Step 2: Use the GPT model to extract the password from the email text; determine whether the email attachment is a compressed package. If it is a compressed package, proceed to step 3;

[0008] Step 3: Decompress the compressed package using the password extracted in step 2;

[0009] Step 4: Detect the Trojan virus on the decompressed original file;

[0010] The email received in step 1 is in the email filter;

[0011] If the attachment of the email in step 2 is not a compressed package, the attachment decompression step is skipped and the subsequent other detection processes are entered;

[0012] In step 2, the GPT model is based on the base model of the GPT class to perform prompt word engineering to guide it to achieve the password extraction function. The steps are as follows:

[0013] A. Select the GPT base model: select one or more of Llama, Mistral, Mixtral;

[0014] B. Write the corresponding prompt words, "Determine whether the decompression password of the attachment is mentioned in the email text below. If so, extract it";

[0015] C. Input the above prompt words and email content into the model;

[0016] D. Read the output of the model and obtain the decompression password for subsequent decompression and detection processes;

[0017] In step 2, the GPT model is fine-tuned on the base model on a specific training sample to achieve the password extraction function. The steps are as follows:

[0018] A. Select the GPT base model, and select one or more of Llama, Mistral, and Mixtral;

[0019] B. Prepare the corresponding training sample data according to the model requirements. The sample data includes the email body text and the decompression password described in the corresponding text;

[0020] C. Based on the base model, input the above training samples and fine-tune the parameters of the base model;

[0021] D. After fine-tuning, a dedicated "password extraction model" is obtained;

[0022] E. In the email filtering stage, the "password extraction model" is called, the email content is input, and the extracted password is obtained for the subsequent decompression and detection process;

[0023] The Trojan virus detection in step 4 calculates the MD5 of the file and the binary data features, and compares them with the virus feature library on the network for detection.

[0024] Beneficial effects of the present invention:

[0025] The present invention targets the increasingly complex phishing email attack methods. Traditional methods such as keyword matching and regular expression matching cannot solve the problem of semantic understanding, resulting in some attacks being unable to be detected by email filtering gateways. This application introduces the semantic understanding capabilities of AI large model technologies such as GPT, replacing traditional keyword matching and regular expression matching to achieve a more complete detection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of the overall process of a method for extracting phishing email information based on a large language model according to the present invention;

[0027] Figure 2 This is a schematic diagram of the existing mail processing process;

[0028] Figure 3 It is a schematic diagram of the existing mail extraction method;

[0029] Figure 4 A schematic diagram of an extraction method of a phishing email information extraction method based on a large language model of the present invention;

[0030] Figure 5 A schematic diagram of an existing email filtering method. DETAILED DESCRIPTION

[0031] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0033] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances. In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0034] Example 1

[0035] The present invention provides a method for extracting phishing email information based on a large language model, which is characterized by comprising the following steps:

[0036] Step 1: Scan the received emails;

[0037] Step 2: Use the GPT model to extract the password from the email text; determine whether the email attachment is a compressed package. If it is a compressed package, proceed to step 3;

[0038] Step 3: Decompress the compressed package using the password extracted in step 2;

[0039] Step 4: Detect the Trojan virus on the decompressed original file;

[0040] The email received in step 1 is in the email filter;

[0041] If the attachment of the email in step 2 is not a compressed package, the attachment decompression step is skipped and the subsequent other detection processes are entered;

[0042] In step 2, the GPT model is based on the base model of the GPT class to perform prompt word engineering to guide it to achieve the password extraction function. The steps are as follows:

[0043] A. Select the GPT base model: select one or more of Llama, Mistral, Mixtral;

[0044] B. Write the corresponding prompt words, "Determine whether the decompression password of the attachment is mentioned in the email text below. If so, extract it";

[0045] C. Input the above prompt words and email content into the model;

[0046] D. Read the output of the model and obtain the decompression password for subsequent decompression and detection processes;

[0047] In step 2, the GPT model is fine-tuned on the base model on a specific training sample to achieve the password extraction function. The steps are as follows:

[0048] A. Select the GPT base model, and select one or more of Llama, Mistral, and Mixtral;

[0049] B. Prepare the corresponding training sample data according to the model requirements. The sample data includes the email body text and the decompression password described in the corresponding text;

[0050] C. Based on the base model, input the above training samples and fine-tune the parameters of the base model;

[0051] D. After fine-tuning, a dedicated "password extraction model" is obtained;

[0052] E. In the email filtering stage, the "password extraction model" is called, the email content is input, and the extracted password is obtained for the subsequent decompression and detection process;

[0053] The Trojan virus detection in step 4 calculates the MD5 of the file and the binary data features, and compares them with the virus feature library on the network for detection.

[0054] Example 2

[0055] The work process of this application involves the following roles and functional modules:

[0056] a) Sender: The sender of the email, who may be a well-intentioned person or an attacker with malicious intent;

[0057] b) Recipient (and the recipient's corporate organization): The recipient of the email is the target and potential victim of the malicious attack;

[0058] c) Mail relay or routing server: a public address on the Internet, responsible for delivering and distributing mail on the Internet, and delivering mail to the final destination server by relay;

[0059] d) Mailbox server: the destination server of the email. After a series of transmission processes, the email will eventually be delivered to the server and stored in it. The subsequent recipients can access the server to receive their own emails. There are two types of mailbox servers: one is owned by an enterprise or organization, providing email services to employees or members of the organization, and the other is owned by a cloud hosting service provider, providing email services to third-party enterprises / organizations and their employees / members.

[0060] Mail filter (similar names include mail gateway service, mail filtering service, etc.): usually located upstream of the mailbox server, at the edge of the internal network firewall of an enterprise or organization. After the mail enters the intranet of an enterprise or organization from the Internet, it first judges the content and various characteristics of the mail, and then releases normal mail to the mail server in the downstream intranet, and filters and isolates junk and phishing mails to ensure the information security of the recipients themselves and the information security of related enterprises and organizations;

[0061] The function of this application is part of the "mail filter". It uses AI big model technology to extract some features that cannot be extracted by traditional technology to improve the accuracy of the overall filtering function;

[0062] There is a large category of attacks that embeds Trojans or virus software in a compressed package in the zip / rar / 7zip format, and then adds the compressed package as an attachment to an email and sends it to the potential victim. When the potential victim follows the instructions in the email, he decompresses the attachment and runs the Trojan virus software in it, and the attack is completed;

[0063] Traditional email filters can already detect and prevent this type of attack. The specific method is to determine that the attachment in the email is a compressed file, then decompress it through a program, and then detect the decompressed file for Trojans and viruses.

[0064] In this confrontation process, attackers have developed more complex attack methods, which is to password-protect the compressed package, and then encode the specific decompression password into the body, title or compressed package file name of the email, and prompt the user;

[0065] These coding methods are easy for the human brain to understand and parse, but very difficult for programs to parse. For example, "The password for decompressing the attachment is six 2s" and "The password for decompressing is my email address" are password hints that involve the association of semantic elements or logical deduction. Ordinary keyword matching, regular expression matching and other methods cannot correctly extract the decompression password, resulting in decompression failure, and further failure to detect Trojans and viruses in the compressed package, leading to serious security vulnerabilities.

[0066] The method proposed in this application is to use GPT-type AI large model technology to perform semantic analysis on the text in the email and extract the decompression password;

[0067] In response to the increasingly complex phishing email attack methods, traditional methods such as keyword matching and regular expression matching cannot solve the problem of semantic understanding, resulting in some attacks not being detected by email filtering gateways;

[0068] The innovation of this application is to introduce the semantic understanding capabilities of AI large model technologies such as GPT, replacing traditional keyword matching and regular matching to achieve a more complete detection effect.

[0069] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. The various components mentioned in the present invention are common technologies in the existing field. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only to illustrate the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for extracting phishing email information based on a large language model, characterized in that: The following steps are involved: Step 1: Scan the received emails; Step 2: Use the GPT model to extract the password from the email text; determine whether the email attachment is a compressed package. If it is a compressed package, proceed to step 3; Step 3: Decompress the compressed package using the password extracted in step 2; Step 4: Detect the Trojan virus on the decompressed original file.

2. According to the method for extracting phishing email information based on a large language model according to claim 1, it is characterized in that: The email received in step 1 is in the email filter.

3. According to claim 2, a method for extracting phishing email information based on a large language model is characterized in that: If the attachment of the email in step 2 is not a compressed package, the attachment decompression step is skipped and the subsequent other detection processes are entered.

4. According to claim 3, a method for extracting phishing email information based on a large language model is characterized in that: In step 2, the GPT model is based on the base model of the GPT class to perform prompt word engineering to guide it to achieve the password extraction function. The steps are as follows: A. Select the GPT base model: select one or more of Llama, Mistral, Mixtral; B. Write corresponding prompt words; C. Input the above prompt words and email content into the model; D. Read the output results of the model and obtain the decompression password for subsequent decompression and detection processes.

5. According to claim 3, a method for extracting phishing email information based on a large language model is characterized in that: In step 2, the GPT model is fine-tuned on the base model on a specific training sample to achieve the password extraction function. The steps are as follows: A. Select the GPT base model, and select one or more of Llama, Mistral, and Mixtral; B. Prepare the corresponding training sample data according to the model requirements. The sample data includes the email body text and the decompression password described in the corresponding text; C. Based on the base model, input the above training samples and fine-tune the parameters of the base model; D. After fine-tuning, a dedicated "password extraction model" is obtained; E. During the email filtering stage, the "password extraction model" is called, the email content is input, and the extracted password is obtained for the subsequent decompression and detection process.

6. According to the method for extracting phishing email information based on a large language model as described in claim 3, it is characterized in that: The Trojan virus detection in step 4 calculates the MD5 of the file and the binary data features, and compares them with the virus feature library on the network for detection.

Images