E-mail link access protection method and device, terminal equipment and storage medium
By filtering risky email links and analyzing web page content using a large model, combined with the method of fuzzing processing to generate prompt pictures, the problem of high cost and low accuracy of malicious attack link recognition in the prior art is solved, and more efficient and secure link access protection is achieved.
Patent Information
- Application Number
- CN202411590290.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-08
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art is costly and has low accuracy when identifying malicious attack links, especially when links do not adopt common URL forms, it is difficult to accurately identify.
By filtering risk links from emails, replacing them with protection links, and analyzing web page content using a large model to provide prompt information; after the user ignores the prompt information, the web page content is blurred to generate a picture pointing to the original link until the user accesses the original link.
It reduces the cost of malicious attack link identification, improves the accuracy of identification, and effectively reduces the risk of users being maliciously attacked by providing favorable prompt information.
Smart Images
Figure CN119652558A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security, and in particular to an email link access protection method, apparatus, terminal equipment and storage medium. Background Art
[0002] Phishing software is the main source of security risks in email systems. Attackers send specific deceptive email content to trick users into clicking on malicious attack links in emails in order to steal accounts, implant viruses, and other purposes.
[0003] In order to solve the security risks of email systems, the existing technology usually allows users to avoid opening links in emails locally, and open links on cloud servers to better monitor abnormal links and avoid virus implantation. At the same time, it combines the method of prohibiting users from entering their account passwords to avoid the leakage of user account passwords. However, the above method requires independent browser memory resources for each user and requires a large amount of server resources to support, so the cost is relatively high. Some existing technologies identify the link address in the email and analyze the link address to determine the probability that the link has risks. However, this method is difficult to judge. When the link address does not use the URL (Uniform Resource Locator) format used by common abnormal links, it will lead to recognition errors.
[0004] Therefore, how to reduce the identification cost of malicious attack links while ensuring identification accuracy is a technical problem that needs to be solved at present. Summary of the invention
[0005] The present application provides an email link access protection method, apparatus, terminal device and storage medium to solve the technical problem of how to reduce the identification cost of malicious attack links while ensuring the identification accuracy.
[0006] In order to solve the above technical problems, in a first aspect, an embodiment of the present application provides an email link access protection method, comprising:
[0007] Filter risky emails from all emails and replace original links in the risky emails with preset protection links;
[0008] In response to a first access request of a user to the original link, jump to a first access page of the protected link, and return to the first access page a first prompt information output after analyzing the webpage content in the original link through the large model;
[0009] In response to a second access request to the original link after the user ignores the first prompt information, the webpage content is blurred to obtain a first image, and the first image is returned to the first access page; the first image points to the original link;
[0010] In response to the user's third access request for the first image, jump to the second access page of the original link.
[0011] Compared with the prior art, the embodiments of the present application have the following beneficial effects: by actively analyzing the web page content of the link in the risky email, users are prevented from opening the web page content locally, thereby reducing the risk of virus attacks, and at the same time, there is no need to use a large amount of server resources to open independent browser memory resources for each user, thereby reducing the cost of identifying malicious attack links; further, by combining the analysis with the web page content in the link, more judgment information is introduced compared to the method of only analyzing the URL, which not only improves the accuracy of malicious attack link identification, but also can provide more favorable and convincing prompt information to users, effectively reducing the risk of users being maliciously attacked.
[0012] In some embodiments of the first aspect of the present application, the returning to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model includes:
[0013] Extracting text data from the webpage content;
[0014] After the text data is concatenated with a preset prompt word, the concatenated text data is input into a preset large language model to obtain the first prompt information.
[0015] Compared with the prior art, the above embodiment has the following beneficial effects: the text data extracted from the web page content of the internal link of the risky email usually contains certain misleading text to lure users into entering their account passwords or downloading virus files, and the text data is recognized by a large language model, and corresponding prompt information is output for the risks existing in the risky email, which can greatly reduce the risk of users being attacked and improve the security of users accessing email links.
[0016] In some embodiments of the first aspect of the present application, the blurring the webpage content to obtain the first image includes:
[0017] Converting the webpage content into a second picture;
[0018] Identify risk content in the second picture, and replace the risk content with second prompt information;
[0019] The original link is embedded into the second image as a hyperlink to obtain the first image.
[0020] Compared with the prior art, the above embodiments have the following beneficial effects: First, in order to avoid being identified, some phishing websites that use QR codes as an attack method often split the QR code into multiple smaller pictures, which makes it impossible to identify whether there are risks in the web page by simply reading each picture in the web page. This application converts the complete web page content into a picture after waiting for the web page to be buffered, and identifies the risk content in the entire picture, so as to accurately determine whether there is risk content in the current web page content. In addition, compared with modifying the web page content, modifying the picture has the advantage of lower computational complexity. At the same time, only returning the picture containing the prompt information to the user can also prevent the user's terminal from being implanted with Trojan viruses or leaking personal information by malicious attack codes, effectively improving the user's security.
[0021] In some embodiments of the first aspect of the present application, responding to the user's third access request for the first image and jumping to the second access page of the original link includes:
[0022] When receiving a third access request from the user for the first picture, returning third prompt information for confirming whether to access the first access page;
[0023] In response to a confirmation operation by the user, the page is redirected from the first access page to the second access page.
[0024] Compared with the prior art, the above embodiment has the following beneficial effects: in order to prevent users from being unable to access links that are mistakenly identified as risky emails, after the user passes the double-layer prompt, the real web page content of the link is returned to the user, ensuring that the user can access the secure connection normally.
[0025] In a second aspect, an embodiment of the present application further provides an email link access protection device, comprising: a first screening module, a first response module, a second response module, and a third response module;
[0026] The first screening module is used to screen risky emails from all emails and replace the original links in the risky emails with preset protection links;
[0027] The first response module is used to respond to the user's first access request to the original link, jump to the first access page of the protected link, and return to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model;
[0028] The second response module is used to respond to a second access request to the original link after the user ignores the first prompt information, blur the webpage content, obtain the first image, and return the first image to the first access page; the first image points to the original link;
[0029] The third response module is used to respond to the user's third access request for the first image and jump to the second access page of the original link.
[0030] In some embodiments of the second aspect of the present application, the returning to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model includes:
[0031] Extracting text data from the webpage content;
[0032] After the text data is concatenated with a preset prompt word, the concatenated text data is input into a preset large language model to obtain the first prompt information.
[0033] In some embodiments of the second aspect of the present application, the blurring the webpage content to obtain the first image includes:
[0034] Converting the webpage content into a second picture;
[0035] Identify risk content in the second picture, and replace the risk content with second prompt information;
[0036] The original link is embedded into the second image as a hyperlink to obtain the first image.
[0037] In some embodiments of the second aspect of the present application, the step of responding to the user's third access request for the first image and jumping to the second access page of the original link includes:
[0038] When receiving a third access request from the user for the first picture, returning third prompt information for confirming whether to access the first access page;
[0039] In response to a confirmation operation by the user, the page is redirected from the first access page to the second access page.
[0040] In a third aspect, the present application also provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-mentioned email link access protection method when executing the computer program.
[0041] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned email link access protection method. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 A flowchart of an email link access protection method provided in some embodiments of the present application;
[0043] Figure 2 This is a schematic diagram of the structure of an email link access protection device provided in some embodiments of the present application. DETAILED DESCRIPTION
[0044] In order to solve the security risks of email systems, the existing technology usually allows users to avoid opening links in emails locally, and open links on cloud servers to better monitor abnormal links and avoid virus implantation. At the same time, it combines the method of prohibiting users from entering their account passwords to avoid the leakage of user account passwords. However, the above method requires independent browser memory resources for each user and requires the support of a large amount of server resources, so the cost is relatively high. Some existing technologies identify the link address in the email and analyze the link address to determine the probability that the link has risks. However, this method is difficult to judge. When the link address does not use the URL format used by common abnormal links, it will lead to recognition errors.
[0045] In order to solve the above technical problems, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0046] Embodiment 1
[0047] Please refer to Figure 1 , an email link access protection method provided by an embodiment of the present application, including S10 to S40, specifically:
[0048] S10: Filter risky emails from all emails, and replace original links in the risky emails with preset protection links.
[0049] Preferably, in some embodiments of the present application, risky emails can be screened from all emails by the following preferred implementations:
[0050] Text data can be extracted from the email and input into a shallow neural network algorithm for preliminary semantic analysis, and whether the current email is risky can be determined based on the preliminary semantic analysis results; URL links can be extracted from the email, and a pre-stored URL blacklist can be used to determine whether the URL link extracted from the email exists. If so, the email is determined to be risky; the email sender's email sending behavior characteristics can be obtained, such as when the sender simultaneously sends a large number of other recipients that are not associated with the recipient, the current email is considered to be risky, etc.
[0051] This application does not restrict the means of preliminary screening of emails to determine whether they contain risks. Any lightweight screening method is acceptable. The purpose of screening here is to reduce the reasoning burden of subsequent large models and focus reasoning resources on emails that may contain risks, thereby reducing the cost of risk identification and improving the accuracy of risk identification.
[0052] Preferably, in some embodiments of the present application, when an email is identified as a risky email, the risky email is isolated, such as moving the risky email into a recycle bin, and the user can obtain the isolated risky email from the recycle bin.
[0053] Preferably, in some embodiments of the present application, for a protection link used to replace an original link in a risky email, when accessing the protection link, the corresponding original link will be transmitted to the remote server as a parameter so that the remote server knows the original link that needs to be subsequently processed.
[0054] S20: Respond to the user's first access request to the original link, jump to the first access page of the protected link, and return to the first access page the first prompt information output after analyzing the web page content in the original link through the large model.
[0055] Furthermore, in some embodiments of the present application, the first prompt information output after analyzing the web page content in the original link through the large model is returned to the first access page, including: extracting text data in the web page content; splicing the text data with a preset prompt word, and inputting it into a preset large language model to obtain the first prompt information.
[0056] The text data extracted from the web page content of the internal link in the risky email usually contains certain misleading text to lure users into entering their account passwords or download virus files. The text data is recognized by a large language model, and corresponding prompt information is output based on the risks of the risky email. This can significantly reduce the risk of users being attacked and improve the security of users accessing email links.
[0057] Preferably, in some embodiments of the present application, the first prompt information can be obtained through the following preferred implementation method: when the remote server receives an access request to the protection link, it reads the parameters transmitted together (i.e., the original link) at the same time, downloads the html (Hyper Text Markup Language) content in the original link to the local, and can extract text data from the html. It can also directly use the html content, combined with certain prompt words, and input it into the large model, so that the large model analyzes the input content and outputs a judgment result. If it is determined that there is no risk, it directly jumps to the access page of the original link and returns to the user; otherwise, it returns the judgment result and the specific reason why the original link has a risk to the access page of the protection link, and returns a prompt message to the user whether to confirm to continue accessing.
[0058] Preferably, in some embodiments of the present application, when the content of the input large model is html content, the corresponding prompt words may be but are not limited to: "This is an html text that may be a phishing web page. Please help analyze this html text and point out the reasons why it is a phishing web page, including but not limited to: 1. The content of the html page is guiding the user to enter the account password; 2. The content of the html page is guiding the user to scan the QR code in the web page; 3. The content of the html page is guiding the user to click to download the file in the web page; 4. The above-mentioned guidance content includes but is not limited to the fact that users can receive subsidies and tax refunds, need to log in to the mailbox to receive electronic invoices, need to log in to the mailbox to read the content of attachments, etc."
[0059] Preferably, in some embodiments of the present application, the large model may adopt but is not limited to the following models: BERT (Bidirectional Encoder Representations from Transformers), GPT (Generative Pre-trained Transformer), T5 (Text-to-Text Transfer Transformer) and other LLM (Large Language Model) models.
[0060] S30: In response to a second access request to the original link after the user ignores the first prompt information, blurring the webpage content, obtaining a first image, and returning the first image to the first access page; the first image points to the original link.
[0061] Furthermore, in some embodiments of the present application, blurring the web page content to obtain a first image includes: converting the web page content into a second image; identifying risky content in the second image and replacing the risky content with second prompt information; and embedding the original link as a hyperlink into the second image to obtain the first image.
[0062] Because some phishing websites that use QR codes as a means of attack want to avoid being identified, this type of website often splits the QR code into multiple smaller images, making it impossible to identify whether there are risks in the web page by simply reading each image in the HTML content. This application renders the entire HTML corresponding web page into an image, identifies the risk content in the entire image, and can accurately determine whether there is risk content in the current web page content. In addition, compared with modifying the web page content, modifying the image has the advantage of lower computational complexity. At the same time, only returning the image containing the prompt information to the user can also prevent the user's terminal from being implanted with Trojan viruses or leaking personal information by malicious attack codes, effectively improving the user's security.
[0063] Preferably, in some embodiments of the present application, the web page content can be blurred through the following preferred implementation method: on the remote server, the html content is rendered into the corresponding page content through a headless browser, and the whole or part of the web page content is intercepted to obtain a first picture, wherein, during the rendering process, the headless browser needs to wait for the entire web page content to be buffered before taking a screenshot, such as graphics, text, pictures, etc.; further, the download link, account password input box, QR code and other web page content in the first picture are identified through image recognition technology, and this part of the content is replaced with a second prompt information, wherein the second prompt information can be a warning text, or any layer that serves as a coding effect; after the first picture is blurred, the original link is embedded in the first picture to obtain the second picture, so that the user can directly access the original link after clicking the second picture.
[0064] S40: Responding to the user's third access request for the first image, jumping to the second access page of the original link.
[0065] Further, in some embodiments of the present application, the response to the user's third access request for the first image and jumping to the second access page of the original link includes: when receiving the user's third access request for the first image, returning a third prompt message to confirm whether to access the first access page; and responding to the user's confirmation operation and jumping from the first access page to the second access page.
[0066] To prevent users from being unable to access links that are mistakenly identified as risky emails, after users pass the double-layer prompt, the actual web page content of the link is returned to the user, ensuring that the user can access the secure connection normally.
[0067] In summary, the email link access protection method provided by the embodiment of the present application has the following beneficial effects: by actively analyzing the web page content of the link in the risky email, users are prevented from opening the web page content locally, thereby reducing the risk of virus attacks, and at the same time, there is no need to use a large amount of server resources to open independent browser memory resources for each user, thereby reducing the cost of identifying malicious attack links; further, by combining the analysis of the web page content in the link, more judgment information is introduced compared to the method of only analyzing the URL, which not only improves the accuracy of malicious attack link identification, but also can provide more favorable and convincing prompt information to users, effectively reducing the risk of users being maliciously attacked.
[0068] Embodiment 2
[0069] refer to Figure 2 , is an email link access protection device provided in some embodiments of the present application, including: a first screening module 11, a first response module 12, a second response module 13 and a third response module 14.
[0070] In some embodiments of the present application, the first screening module 11 is used to screen risky emails from all emails, and replace the original links in the risky emails with preset protection links; the first response module 12 is used to respond to the user's first access request for the original link, jump to the first access page of the protection link, and return to the first access page the first prompt information output after analyzing the web page content in the original link through the large model; the second response module 13 is used to respond to the user's second access request for the original link after ignoring the first prompt information, blur the web page content, obtain the first image, and return the first image to the first access page; the first image points to the original link; the third response module 14 is used to respond to the user's third access request for the first image, and jump to the second access page of the original link.
[0071] In some embodiments of the present application, the first prompt information output after analyzing the web page content in the original link through a large model is returned to the first access page, including: extracting text data in the web page content; splicing the text data with a preset prompt word, and inputting it into a preset large language model to obtain the first prompt information.
[0072] In some embodiments of the present application, blurring the web page content to obtain a first image includes: converting the web page content into a second image; identifying risky content in the second image and replacing the risky content with second prompt information; embedding the original link as a hyperlink into the second image to obtain the first image.
[0073] In some embodiments of the present application, the response to the user's third access request for the first image and jumping to the second access page of the original link includes: when receiving the user's third access request for the first image, returning a third prompt message to confirm whether to access the first access page; and responding to the user's confirmation operation and jumping from the first access page to the second access page.
[0074] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. An email link access protection device provided by the embodiment of the present invention can implement any method item embodiment of the present invention, that is, the email link access protection method provided in embodiment one.
[0075] In summary, the email link access protection device provided by the embodiment of the present application has the following beneficial effects: by actively analyzing the web page content of the link in the risky email, users are prevented from opening the web page content locally, thereby reducing the risk of virus attacks, and at the same time, there is no need to use a large amount of server resources to open independent browser memory resources for each user, thereby reducing the cost of identifying malicious attack links; further, by combining the analysis with the web page content in the link, more judgment information is introduced compared to the method of only analyzing the URL, which not only improves the accuracy of malicious attack link identification, but also can provide more favorable and convincing prompt information to users, effectively reducing the risk of users being maliciously attacked.
[0076] Embodiment 3
[0077] Based on the above-mentioned embodiment of the email link access protection method, another embodiment of the present application provides an email link access protection terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the email link access protection method of any embodiment of the present application is implemented.
[0078] Exemplarily, in this embodiment, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the email link access protection device.
[0079] The email link access protection device may be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The email link access protection terminal device may include, but is not limited to, a processor and a memory.
[0080] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The processor is the control center of the email link access protection device, and uses various interfaces and lines to connect the various parts of the entire email link access protection device. The memory may be used to store the computer program and / or module, and the processor implements various functions of the email link access protection device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.
[0081] Embodiment 4
[0082] Based on the above-mentioned embodiments of the email link access protection method, another embodiment of the present application provides a storage medium, wherein the storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the email link access protection method of any embodiment of the present application.
[0083] In this embodiment, the storage medium is a computer-readable storage medium, and the computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.
[0084] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.
Claims
1. A method for protecting access to an email link, characterized in that: include: Filter risky emails from all emails and replace original links in the risky emails with preset protection links; In response to a first access request of a user to the original link, jump to a first access page of the protected link, and return to the first access page a first prompt information output after analyzing the webpage content in the original link through the large model; In response to a second access request to the original link after the user ignores the first prompt information, blurring the webpage content, obtaining the first image, and returning the first image to the first access page; The first picture points to the original link; In response to the user's third access request for the first image, jump to the second access page of the original link.
2. The method for protecting access to an email link according to claim 1, characterized in that: The returning to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model includes: Extracting text data from the webpage content; After the text data is concatenated with a preset prompt word, the concatenated text data is input into a preset large language model to obtain the first prompt information.
3. The method for protecting access to an email link according to claim 1, wherein: The step of performing blurring processing on the webpage content to obtain a first image includes: Converting the webpage content into a second picture; Identify risk content in the second picture, and replace the risk content with second prompt information; The original link is embedded into the second image as a hyperlink to obtain the first image.
4. The method for protecting access to an email link according to claim 1, characterized in that: The step of responding to the user's third access request for the first image and jumping to the second access page of the original link includes: When receiving a third access request from the user for the first picture, returning third prompt information for confirming whether to access the first access page; In response to a confirmation operation by the user, the page is redirected from the first access page to the second access page.
5. An email link access protection device, characterized in that: include: A first screening module, a first response module, a second response module, and a third response module; The first screening module is used to screen risky emails from all emails and replace the original links in the risky emails with preset protection links; The first response module is used to respond to the user's first access request to the original link, jump to the first access page of the protected link, and return to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model; The second response module is used to respond to a second access request to the original link after the user ignores the first prompt information, blur the webpage content, obtain the first image, and return the first image to the first access page; The first picture points to the original link; The third response module is used to respond to the user's third access request for the first image and jump to the second access page of the original link.
6. The electronic mail link access protection device as claimed in claim 5, characterized in that: The returning to the first access page the first prompt information output after analyzing the webpage content in the original link through the large model includes: Extracting text data from the webpage content; After the text data is concatenated with a preset prompt word, the concatenated text data is input into a preset large language model to obtain the first prompt information.
7. The electronic mail link access protection device according to claim 5, characterized in that: The step of performing blurring processing on the webpage content to obtain a first image includes: Converting the webpage content into a second picture; Identify risk content in the second picture, and replace the risk content with second prompt information; The original link is embedded into the second image as a hyperlink to obtain the first image.
8. The device for protecting access to an email link as claimed in claim 5, characterized in that: The step of responding to the user's third access request for the first image and jumping to the second access page of the original link includes: When receiving a third access request from the user for the first picture, returning third prompt information for confirming whether to access the first access page; In response to a confirmation operation by the user, the page is redirected from the first access page to the second access page.
9. A terminal device, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, an email link access protection method as claimed in any one of claims 1 to 4 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute an email link access protection method as claimed in any one of claims 1 to 4.