Target mail detection method and device, computer equipment and storage medium

Abstract

The invention relates to a target mail detection method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: acquiring a mail with a to-be-detected account; analyzing the mail to obtain each structural element and each format element which form the mail; respectively inputting each structural element and each format element into a multi-modal large model, and analyzing to obtain independent feature information of a single element and associated feature information among a plurality of elements based on the multi-modal large model, respectively comparing the independent feature information and the associated feature information with corresponding feature information of a target mail to obtain a plurality of analysis results; and determining whether the mail is a target mail based on various analysis results. According to the invention, the accuracy of target mail detection is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a target email detection method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] With the development of Internet technology and the popularization of online office, emails have become an indispensable part of information-based office. However, phishing emails obtain users' personal information and privacy rights by sending carefully constructed emails, which poses a great security risk. In related technologies, based on neural networks, such as LSTM networks and Transformer networks, email detection models are trained through deep learning to detect phishing emails. However, with the continuous development of phishing email technology, the senders of phishing emails continue to optimize the phishing email model, resulting in the failure of the email detection model. Summary of the invention

[0003] Based on this, it is necessary to provide a target email detection method, device, computer equipment, computer-readable storage medium and computer program product that can detect accuracy in response to the above technical problems.

[0004] In a first aspect, the present application provides a target email detection method. The method comprises:

[0005] Get the email of the account to be tested;

[0006] The email is parsed to obtain various structural elements and various format elements constituting the email.

[0007] Input each of the structural elements and each of the format elements into the multimodal large model respectively, analyze and obtain independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, and compare the independent feature information and the associated feature information with corresponding feature information of the target email respectively to obtain multiple analysis results;

[0008] Based on the various analysis results, determine whether the email is a target email.

[0009] In one embodiment, the format element includes an icon element, and the step of inputting each of the structural elements and each of the format elements into a multimodal large model, and analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model includes:

[0010] Obtain a set of standard icon elements corresponding to the icon element;

[0011] The icon element, the standard icon element set, other format elements and each of the structural elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set.

[0012] In one embodiment, the structural elements include a sender element and a body element, and the structural elements and the format elements are respectively input into a multimodal macro model, and independent feature information of a single element and associated feature information between multiple elements are analyzed based on the multimodal macro model, including:

[0013] The sender element, the text element, other structural elements and each of the format elements are respectively input into the multimodal big model, and based on the multimodal big model, the associated feature information between the sender element and the text element, the independent feature information of a single element and the associated feature information between other elements are analyzed to obtain; wherein the associated feature information between the sender element and the text element includes the matching degree between the sender's identity and the text content.

[0014] In one embodiment, the structural elements include body elements and title elements, and the steps of inputting the structural elements and the format elements into the multimodal macro model respectively, and analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal macro model include:

[0015] The main text elements, the title elements, other structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of the main text elements, independent feature information of the title elements, independent feature information of other elements and associated feature information between multiple elements are analyzed; wherein the independent feature information of the main text elements and the independent feature information of the title elements include time information and resource feedback information.

[0016] In one embodiment, the structural element includes a text element, and the step of inputting each of the structural elements and each of the format elements into a multimodal macro model, and analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal macro model includes:

[0017] Obtaining a collection of historical emails of the account within a preset period of time;

[0018] The body element, the historical email collection, other structural elements and each of the format elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the body element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the body element includes the category matching degree between the body and the historical email collection.

[0019] In one embodiment, determining whether the email is a target email based on multiple analysis results includes:

[0020] When the ratio of the number of target emails to the number of total analysis results is greater than a preset value, the email is determined to be the target email.

[0021] In a second aspect, the present application also provides a target mail detection device. The device comprises:

[0022] The acquisition module is used to obtain the emails of the account to be tested;

[0023] A parsing module, used for parsing the email to obtain various structural elements and format elements constituting the email;

[0024] An analysis module, used for inputting each of the structural elements and each of the format elements into the multimodal large model, analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, and comparing the independent feature information and the associated feature information with corresponding feature information of the target email, respectively, to obtain multiple analysis results;

[0025] The determination module is used to determine whether the email is a target email based on multiple analysis results.

[0026] In one embodiment, the format element includes an icon element, and the analysis module is further configured to:

[0027] Obtain a set of standard icon elements corresponding to the icon element;

[0028] The icon element, the standard icon element set, other format elements and each of the structural elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set.

[0029] In one embodiment, the structural elements include a sender element and a body element, and the analysis module is further configured to:

[0030] The sender element, the text element, other structural elements and each of the format elements are respectively input into the multimodal big model, and based on the multimodal big model, the associated feature information between the sender element and the text element, the independent feature information of a single element and the associated feature information between other elements are analyzed to obtain; wherein the associated feature information between the sender element and the text element includes the matching degree between the sender's identity and the text content.

[0031] In one embodiment, the structural elements include text elements and title elements, and the analysis module is further configured to:

[0032] The main text elements, the title elements, other structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of the main text elements, independent feature information of the title elements, independent feature information of other elements and associated feature information between multiple elements are analyzed; wherein the independent feature information of the main text elements and the independent feature information of the title elements include time information and resource feedback information.

[0033] In one embodiment, the structural element includes a text element, and the analysis module is further configured to:

[0034] Obtaining a collection of historical emails of the account within a preset period of time;

[0035] The body element, the historical email collection, other structural elements and each of the format elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the body element, the independent feature information of other elements and the interactive feature information between multiple elements are analyzed; wherein the independent feature information of the body element includes the category matching degree between the body and the historical email collection.

[0036] In one embodiment, the determining module is further configured to:

[0037] When the ratio of the number of target emails to the number of total analysis results is greater than a preset value, the email is determined to be the target email.

[0038] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any one of the embodiments of the present disclosure is implemented.

[0039] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the method described in any one of the embodiments of the present disclosure is implemented.

[0040] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the method described in any one of the embodiments of the present disclosure is implemented.

[0041] The above-mentioned target email detection method, device, computer equipment, storage medium and computer program product respectively input each of the structural elements and each of the format elements into the multimodal large model, and based on the multimodal large model, analyze and obtain the independent feature information of a single element and the associated interactive feature information between multiple elements, and compare the independent feature information and the associated feature information with the corresponding feature information of the target email respectively to obtain a variety of analysis results. Among them, the format elements are rich in variety, which can better capture the characteristics of phishing emails using picture implants and various official accounts. Not only the independent feature information of a single element is used, but also the associated interactive feature information of multiple elements is used, which can analyze the behavioral matching degree between the sender and the email content, the matching degree between the recipient and the email content, etc., and obtain the analysis results more intelligently. In addition, the use of a multimodal large model provides technical support for the implementation of the above-mentioned technology and ensures the feasibility of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a process flow of a target email detection method in one embodiment;

[0043] Figure 2 This is a diagram showing the architecture of a target email detection method in one embodiment;

[0044] Figure 3 This is a diagram showing the architecture of a target email detection method in another embodiment;

[0045] Figure 4 is a structural block diagram of a target mail detection device in an embodiment;

[0046] Figure 5 is an internal structure diagram of a computer device in one embodiment;

[0047] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] In one embodiment, Figure 1As shown, a target email detection method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0050] Step S101, obtaining the email of the account to be detected.

[0051] Among them, the emails to be detected may include emails received by the terminal when logging into the mailbox application or browser. In an exemplary embodiment, a browser plug-in can be set to automatically obtain the emails of the account to be detected. In another exemplary embodiment, a plug-in can be set in the email application to automatically obtain the mailbox of the account to be detected. In another exemplary embodiment, the user can also export the emails and send them to the multimodal large model.

[0052] Step S103: parsing the email to obtain various structural elements and format elements constituting the email.

[0053] Among them, the structural elements of the email may include the sender element, the carbon copy element, the sending time element, the body element, and the attachment element of the email. Among them, the format elements may include text elements, picture elements, voice elements, video elements, etc. It should be noted that the structural elements and format elements are not limited to the above examples. For example, the signature element can also be used as the above structural element. Under the inspiration of the technical essence of this application, technical personnel in the relevant field may also make other changes, but as long as the functions and effects achieved are the same or similar to those of this application, they should be covered within the protection scope of this application.

[0054] Step S105, input each of the structural elements and each of the format elements into the multimodal large model respectively, analyze and obtain independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, compare the independent feature information and the associated feature information with the corresponding feature information of the target email respectively, and obtain multiple analysis results.

[0055] Among them, the multimodal large model (MM-VL) can combine visual and language information to process and understand complex tasks. Optionally, the multimodal large model can include a VilBERT model, a VisualBERT model, a LAVIS model, etc. It is understandable that the above-mentioned multimodal large model can be trained by machine learning through sample structure elements or sample format elements to obtain a multimodal large model that can be inferred. In the disclosed embodiment, the large model can show good performance through fine-tuning with a small amount of data. With the continuous development of phishing technology, attackers continue to optimize the email model, which can easily lead to the failure of the original detection model, and the early obvious phishing features are gradually lost. At the same time, it is difficult for most researchers to collect a large amount of phishing email training data, so the large model can quickly update the detection capability by fine-tuning with a small amount of data.

[0056] In the embodiment of the present disclosure, the target email may include phishing emails, spam emails, etc. Among them, phishing emails usually aim to steal sensitive information of users or execute malicious codes on user terminals to carry out network attacks, etc.

[0057] In the disclosed embodiment, the independent feature information of a single element may include the independent feature information of a single structural element and the independent feature information of a single format element. The associated feature information between multiple elements may include the associated feature information between structural elements and format elements, the associated feature information between structural elements and structural elements, and the associated feature information between format elements and format elements.

[0058] Taking a single element as an icon element as an example, the icon element and the corresponding set of standard icon elements are input into the multimodal large model, and the independent feature information of the icon element is analyzed based on the multimodal large model, such as the matching degree between the icon element and the target icon element in the set of standard icon elements. If the matching degree is lower than the preset value, for example, the matching degree is 80%, and the icon element matching degree in the target email is 85%, it can be determined that the icon element in the email is likely to be tampered with, and the email is confirmed as the target email. Then the analysis result based on the icon element can be that the email is confirmed as the target email.

[0059] Taking multiple elements as sender elements and body elements as an example, the sender elements and body elements are input into the multimodal large model, and the associated feature information between the sender elements and the body elements is analyzed based on the multimodal large model. For example, the body element is an email about tax refunds, and the sender element is a personal QQ mailbox. Since tax refund emails are generally not sent through personal QQ mailboxes, the associated feature information between the sender element and the body element may be the mismatch between the sender element and the body element. The sender in the target email may not match the body element. The analysis result based on the sender element and the body element may be that the email is confirmed as the target email.

[0060] Step S107: determining whether the email is a target email based on the various analysis results.

[0061] In the embodiment of the present disclosure, when multiple analysis results all indicate that the email is a target email, the email is determined to be a target email. In an exemplary embodiment, when multiple analysis results all indicate that the email is a non-target email, the email is determined to be a non-target email. In an exemplary embodiment, when some of the multiple analysis results indicate that the email is a target email and some of the analysis results indicate that the email is a non-target email, a reminder message may be set, such as a reminder to manually make a judgment.

[0062] In a specific implementation process, for example, based on the independent feature information of the image element of the email, it is determined that the email has the independent feature information of the target email; based on the sender element and the body element of the email, it is determined that the email has the associated feature information of the target email, and finally the email is determined to be the target email. For another example, based on the independent feature information of the image element of the email, it is determined that the email does not have the independent feature information of the target email, or has less independent feature information of the target email, and based on the sender element and the body element of the email, it is determined that the email does not have the associated feature information of the target email, and finally the email is determined to be a non-target email.

[0063] In the above-mentioned target email detection method, each of the structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, the independent feature information of a single element and the associated interactive feature information between multiple elements are analyzed, and the independent feature information and the associated feature information are respectively compared with the corresponding feature information of the target email to obtain a variety of analysis results. Among them, the format elements are rich in variety, which can better capture the characteristics of phishing emails using picture implants and various official accounts. Not only the independent feature information of a single element is used, but also the associated interactive feature information of multiple elements is used, which can analyze the behavioral matching degree between the sender and the email content, the matching degree between the recipient and the email content, etc., and obtain more intelligent analysis results. In addition, the use of a multimodal large model provides technical support for the implementation of the above-mentioned technology and ensures the feasibility of the method.

[0064] In one embodiment, the format element includes an icon element, and the step of inputting each of the structural elements and each of the format elements into a multimodal large model, and analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model includes:

[0065] Obtain a set of standard icon elements corresponding to the icon element;

[0066] The icon element, the standard icon element set, other format elements and each of the structural elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set.

[0067] The format element may include an icon element, such as a pattern logo. The standard icon element set may include collecting and collating icons of administrative departments, banks, or enterprises obtained through public websites.

[0068] In the disclosed embodiments, other format elements may include format elements other than the icon elements in the above embodiments. Among them, the structural elements may include the sender element, the cc element, the sending time element, the body element, and the attachment element of the email. In an exemplary embodiment, the icon element and the corresponding set of standard icon elements are input into the multimodal large model, and the independent feature information of the icon element is analyzed based on the multimodal large model, such as the difference between the icon element and the target icon element in the set of standard icon elements. If the matching degree is lower than the preset value, for example, the difference is 20%, and the difference of the icon elements in the target email is 15%, it can be determined that the icon elements in the email are likely to be tampered with, and the email is confirmed as the target email. Then the analysis result based on the icon element can be that the email is confirmed as the target email.

[0069] In the disclosed embodiment, other elements include other format elements and structural elements other than icon elements. Taking the picture element as an example, the picture element is input into the multimodal large model, and the independent feature information of the picture element is analyzed based on the multimodal large model, such as semantic features such as time urgency and rewards. The semantic features are compared with the feature information of the target email. For example, the content of the target email usually has time urgency, rewards and other publicity, etc., so the analysis result corresponding to the picture element is determined to be: the email is the target email.

[0070] Taking multiple elements as sender elements and body elements as an example, the sender elements and body elements are input into the multimodal large model, and the associated feature information between the sender elements and the body elements is analyzed based on the multimodal large model. For example, the body element is an email about tax refunds, and the sender element is a personal QQ mailbox. Since tax refund emails are generally not sent through personal QQ mailboxes, the associated feature information between the sender element and the body element may be the mismatch between the sender element and the body element. The sender in the target email may not match the body element. The analysis result based on the sender element and the body element may be that the email is confirmed as the target email.

[0071] In the above embodiment, the independent feature information of the icon element is analyzed through a multimodal large model, wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set. That is, by judging whether the icon element in the email is obtained by tampering with the standard icon element, it is determined whether the email is the target element, thereby improving the accuracy of detection.

[0072] In one embodiment, the structural elements include a sender element and a body element, and the structural elements and the format elements are respectively input into the multimodal macro model, and based on the multimodal macro model, independent feature information of a single element and associated feature information between multiple elements are analyzed and obtained, including:

[0073] The sender element, the text element, other structural elements and each of the format elements are respectively input into the multimodal big model, and based on the multimodal big model, the associated feature information between the sender element and the text element, the independent feature information of a single element and the interactive feature information between other elements are analyzed to obtain; wherein the associated feature information between the sender element and the text element includes the matching degree between the sender's identity and the text content.

[0074] The other structural elements may include any other structural elements except the sender element and the body element. The format elements may include the sender element, the carbon copy element, the sending time element, the body element, and the attachment element of the email.

[0075] In an exemplary embodiment, the sender element and the body element are input into the multimodal macro model, and the associated feature information between the sender element and the body element is analyzed based on the multimodal macro model. For example, the body element is an email about tax refund, and the sender element is a personal QQ mailbox. Since tax refund emails are generally not sent through personal QQ mailboxes, the associated feature information between the sender element and the body element may be the mismatch between the sender element and the body element. The sender element and the body element in the target email may not match. Then the analysis result based on the sender element and the body element may be that the email is confirmed as the target email.

[0076] In an exemplary embodiment, the interactive feature information between other elements may include interactive feature information between structural elements and structural elements, interactive feature information between structural elements and format elements, and interactive feature information between format elements and format elements. Taking the other elements as picture elements and sender elements as examples, the sender elements and picture elements are input into the multimodal large model, and the associated feature information between the sender elements and the picture elements is analyzed based on the multimodal large model. For example, the picture element is an email about company welfare, and the sender element is a personal mailbox. The company welfare emails are generally sent using official emails. The associated feature information between the sender element and the picture element is that the sender element does not match the picture element. The sender in the target email may not match the picture element. The analysis result based on the sender element and the picture element may be that the email is confirmed as the target email.

[0077] The independent characteristic information of a single element may include the independent characteristic information of a single structural element and the independent characteristic information of a single format element in the above embodiment. The concept of independent characteristic information has been described in the above embodiment and will not be repeated here.

[0078] In the above embodiment, through the associated feature information of the sender element and the body element, wherein the associated feature information includes the matching degree of the sender identity and the body content, when there is a large deviation between the sender identity and the body content, the analysis result determined based on the sender element and the body element is that the email is the target email, thereby improving the accuracy of the target email detection.

[0079] In one embodiment, the structural elements include body elements and title elements, and the steps of inputting the structural elements and the format elements into the multimodal macro model respectively, and analyzing and obtaining independent feature information of a single element and interactive feature information between multiple elements based on the multimodal macro model include:

[0080] The main text elements, the title elements, other structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of the main text elements, independent feature information of the title elements, independent feature information of other elements and interactive feature information between multiple elements are analyzed; wherein the independent feature information of the main text elements and the independent feature information of the title elements include time information and resource feedback information.

[0081] In the disclosed embodiment, other structural elements may include structural elements other than body elements and title elements. The format elements may include text elements, picture elements, voice elements, video elements, etc. The body elements and format elements are input into the multimodal large model, and based on the multimodal large model, independent feature information of the body elements is analyzed, such as time is very tight, content with rewards, etc. The independent feature information of the title elements is analyzed, such as time is very tight, content with rewards, etc. The body and title of the target email usually have time urgency and reward content. For example: "Notice on the issuance of summer high temperature allowances for employees in 2024. The hot summer and the continuous high temperature weather have brought severe tests to the employees who stick to the front line. In order to express our deep concern for the vast number of front-line employees and ensure that everyone can spend the hot summer safely and healthily, summer high temperature allowances are now issued to all on-the-job personnel in September 2024: XX amount. Please fill in "Personal Information" as soon as possible before September 30. If you have any questions, please contact the department union specialist. Thank you! "Personal Information Filling".

[0082] In the embodiments of the present disclosure, the independent characteristic information of other elements may include the independent characteristic information of other elements except the text element and the title element, and may include the independent characteristic information of the structural element or the independent characteristic information of the format element. The independent characteristic information of other elements and the associated characteristic information between multiple elements have been described in the above embodiments, and will not be repeated in this disclosure.

[0083] In the above embodiment, the independent characteristic information of the body element and the independent characteristic information of the title element, such as time information and resource feedback information, can supplement the content theme of the target email, thereby improving the accuracy of target email detection.

[0084] In one embodiment, the structural elements include text elements, and the step of inputting each of the structural elements and each of the format elements into a multimodal macro model, and analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal macro model includes:

[0085] Obtaining a collection of historical emails of the account within a preset period of time;

[0086] The body element, the historical email collection, other structural elements and each of the format elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the body element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the body element includes the category matching degree between the body and the historical email collection.

[0087] Among them, the historical email collection of the preset time period may include emails of the account in the past three months or the past two weeks. In one embodiment, the body element is input into the multimodal macro model, and based on the multimodal macro model, the body element is analyzed to obtain that the email is a financial tax email, and the historical email collection is a game-related email. The independent feature information of the body element indicates that the body does not match the category of the historical email collection. Usually, the target email may be that the body of the email does not match the category of the historical email collection. Based on the body element and the historical email collection, the analysis result is determined to be that the email is the target email.

[0088] In the disclosed embodiment, other structural elements may include other structural elements other than the body element, and the format elements may include the sender element, the carbon copy element, the sending time element, the body element, and the attachment element of the email. The independent characteristic information of other elements may include the independent characteristic information of other structural elements other than the body element and the independent characteristic information of the format element. The associated characteristic information of multiple elements has been described in the above embodiment and will not be repeated here.

[0089] In the above embodiment, by including independent feature information of the body element, such as the category matching degree between the body and the historical email collection, the feature that the body of the target email does not match the category of the historical email collection can be captured, thereby improving the accuracy of target email detection.

[0090] In one embodiment, determining whether the email is a target email based on multiple analysis results includes:

[0091] When the ratio of the number of target emails to the number of total analysis results is greater than a preset value, the email is determined to be the target email.

[0092] In a specific embodiment, reference Figure 2 As shown, the structural elements of the email title and email body are input into the multimodal large model, and the independent feature information of the email title and email body is analyzed based on the multimodal large model. For example, if the time is urgent or it has a rewarding nature, then the independent feature information is consistent with the characteristics of the target email (phishing email), and the analysis result of the email title and email body is determined to be the target email. The format element email body icon is input into the multimodal large model, and the independent feature information of the text icon is analyzed based on the multimodal large model. For example, if there is consistency, then the independent feature information is inconsistent with the characteristics of the target email, and the analysis result of the text icon is determined to be that the email is not the target email. The format element icon element and the icon element set are input into the multimodal large model, and the independent feature information of the icon element is analyzed based on the multimodal large model. If the icon has been tampered with, the analysis result of the icon element is determined to be the target email. In the above embodiment, the analysis result is 2 / 3 of the target email, and the final analysis considers that the email is the target email.

[0093] In another specific embodiment, referring to Figure 3 As shown, the format element icon element and the icon element set are input into the multimodal large model. Based on the analysis of the multimodal large model, the independent feature information of the icon element is that the icon has been tampered with, and the analysis result of the icon element is determined to be the target email. The sender element is input into the multimodal large model. Based on the analysis of the multimodal large model, the independent feature information of the sender element is that the sender element and the body element may not match. The structural element email body and the historical email collection are input into the multimodal large model. The multimodal large model analyzes the independent feature information of the email body and finds that the email body does not match the category of the historical email collection. In the above embodiment, the analysis result is 3 / 3 of the target email, and the final analysis shows that the email is the target email.

[0094] In the above embodiment, the multimodal capability of the model is used to respectively judge the semantics of the text and identify tampering of image icons in emails; at the same time, in order to be able to adaptively meet the phishing prevention and control needs of different individuals and scenarios, users can customize historical reference emails to analyze the behavioral consistency of new emails, which effectively improves the recognition accuracy of target emails.

[0095] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0096] Based on the same inventive concept, the embodiment of the present application also provides a target mail detection device for implementing the target mail detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more target mail detection device embodiments provided below can refer to the limitations of the target mail detection method above, and will not be repeated here.

[0097] In one embodiment, Figure 4 As shown, a target mail detection device 400 is provided. The device comprises:

[0098] The acquisition module 401 is used to acquire the emails of the account to be detected;

[0099] The parsing module 403 is used to parse the email to obtain various structural elements and format elements constituting the email;

[0100] The analysis module 405 is used to input each of the structural elements and each of the format elements into the multimodal large model, analyze and obtain independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, and compare the independent feature information and the associated feature information with corresponding feature information of the target email to obtain multiple analysis results.

[0101] The determination module 407 is used to determine whether the email is a target email based on multiple analysis results.

[0102] In one embodiment, the format element includes an icon element, and the analysis module is further configured to:

[0103] Obtain a set of standard icon elements corresponding to the icon element;

[0104] The icon element, the standard icon element set, other format elements and each of the structural elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set.

[0105] In one embodiment, the structural elements include a sender element and a body element, and the analysis module is further configured to:

[0106] The sender element, the text element, other structural elements and each of the format elements are respectively input into the multimodal big model, and based on the multimodal big model, the associated feature information between the sender element and the text element, the independent feature information of a single element and the associated feature information between other elements are analyzed to obtain; wherein the associated feature information between the sender element and the text element includes the matching degree between the sender's identity and the text content.

[0107] In one embodiment, the structural elements include text elements and title elements, and the analysis module is further configured to:

[0108] The main text elements, the title elements, other structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of the main text elements, independent feature information of the title elements, independent feature information of other elements and associated feature information between multiple elements are analyzed; wherein the independent feature information of the main text elements and the independent feature information of the title elements include time information and resource feedback information.

[0109] In one embodiment, the structural element includes a text element, and the analysis module is further configured to:

[0110] Obtaining a collection of historical emails of the account within a preset period of time;

[0111] The body element, the historical email collection, other structural elements and each of the format elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the body element, the independent feature information of other elements and the interactive feature information between multiple elements are analyzed; wherein the independent feature information of the body element includes the category matching degree between the body and the historical email collection.

[0112] In one embodiment, the determining module is further configured to:

[0113] When the ratio of the number of target emails to the number of total analysis results is greater than a preset value, the email is determined to be the target email.

[0114] Each module in the above-mentioned target mail detection device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0115] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store target email detection data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a target email detection method is implemented.

[0116] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a target mail detection method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0117] Those skilled in the art will understand that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0119] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0120] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A target email detection method, characterized in that: The method comprises: Get the email of the account to be tested; Parsing the email to obtain various structural elements and format elements constituting the email; Input each of the structural elements and each of the format elements into the multimodal large model respectively, analyze and obtain independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, and compare the independent feature information and the associated feature information with corresponding feature information of the target email respectively to obtain multiple analysis results; Based on the various analysis results, determine whether the email is a target email.

2. The method according to claim 1, characterized in that The format element includes an icon element, and each of the structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of a single element and associated feature information between multiple elements are analyzed and obtained, including: Obtain a set of standard icon elements corresponding to the icon element; The icon element, the standard icon element set, other format elements and each of the structural elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set.

3. The method according to claim 1, characterized in that The structural elements include a sender element and a body element. The structural elements and the format elements are input into the multimodal macro model respectively. Based on the multimodal macro model, independent feature information of a single element and associated feature information between multiple elements are analyzed and obtained, including: The sender element, the text element, other structural elements and each of the format elements are respectively input into the multimodal big model, and based on the multimodal big model, the associated feature information between the sender element and the text element, the independent feature information of a single element and the associated feature information between other elements are analyzed to obtain; wherein the associated feature information between the sender element and the text element includes the matching degree between the sender's identity and the text content.

4. The method according to claim 1, characterized in that: The structural elements include body elements and title elements. The structural elements and format elements are input into the multimodal macro model respectively. Based on the multimodal macro model, independent feature information of a single element and associated feature information between multiple elements are analyzed and obtained, including: The main text elements, the title elements, other structural elements and each of the format elements are respectively input into the multimodal large model, and based on the multimodal large model, independent feature information of the main text elements, independent feature information of the title elements, independent feature information of other elements and associated feature information between multiple elements are analyzed; wherein the independent feature information of the main text elements and the independent feature information of the title elements include time information and resource feedback information.

5. The method according to claim 1, characterized in that The structural elements include text elements, and the structural elements and format elements are input into the multimodal macro model respectively, and independent feature information of a single element and associated feature information between multiple elements are analyzed based on the multimodal macro model, including: Obtaining a collection of historical emails of the account within a preset period of time; The body element, the historical email collection, other structural elements and each of the format elements are input into a multimodal large model, and based on the multimodal large model, the independent feature information of the body element, the independent feature information of other elements and the associated feature information between multiple elements are analyzed; wherein the independent feature information of the body element includes the category matching degree between the body and the historical email collection.

6. The method according to any one of claims 1 to 5, characterized in that The determining whether the email is a target email based on multiple analysis results includes: When the ratio of the number of target emails to the number of total analysis results is greater than a preset value, the email is determined to be the target email.

7. A target mail detection device, characterized in that: The device comprises: The acquisition module is used to obtain the emails of the account to be tested; A parsing module, used for parsing the email to obtain various structural elements and format elements constituting the email; An analysis module, used for inputting each of the structural elements and each of the format elements into the multimodal large model, analyzing and obtaining independent feature information of a single element and associated feature information between multiple elements based on the multimodal large model, and comparing the independent feature information and the associated feature information with corresponding feature information of the target email, respectively, to obtain multiple analysis results; The determination module is used to determine whether the email is a target email based on multiple analysis results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images