Targeted email detection methods, devices, computer equipment, and storage media

Abstract

This application relates to a method, apparatus, computer device, storage medium, and computer program product for detecting targeted emails. The method includes: acquiring emails to be detected from an account; parsing the emails to obtain structural elements and format elements constituting the emails; inputting each structural element and format element into a multimodal large-scale model; analyzing the independent feature information of individual elements and the correlation feature information between multiple elements based on the multimodal large-scale model; comparing the independent feature information and the correlation feature information with the corresponding feature information of the target email to obtain multiple analysis results; and determining whether the email is a target email based on the multiple analysis results. This application improves the accuracy of targeted email detection.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for detecting targeted emails. Background Technology

[0002] With the development of internet technology and the widespread adoption of online office work, email has become an indispensable part of information-based office operations. However, phishing emails, by sending carefully crafted messages to obtain users' personal information and privacy permissions, pose a significant security risk. Among related technologies, email detection models based on neural networks, such as LSTM and Transformer networks, trained through deep learning, can detect phishing emails. However, as phishing email technology continues to evolve, senders continuously optimize these models, causing them to become ineffective. Summary of the Invention

[0003] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product capable of detecting accurate target emails, addressing the aforementioned technical problems.

[0004] Firstly, this application provides a method for detecting targeted emails. The method includes:

[0005] Retrieve emails from accounts awaiting verification;

[0006] The email is parsed to obtain the structural elements and format elements that make up the email.

[0007] Each of the structural elements and format elements is input into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation feature information between multiple elements are analyzed. The independent feature information and the correlation feature information are compared with the corresponding feature information of the target email to obtain various analysis results.

[0008] Based on multiple analysis results, it was determined whether the email was the target email.

[0009] In one embodiment, the formatting elements include icon elements. The step of inputting each of the structural elements and each of the formatting elements into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0010] Get the set of standard icon elements corresponding to the icon element;

[0011] The icon element, the standard icon element set, other format elements, and each of the structural elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the icon element includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set.

[0012] In one embodiment, the structural elements include sender elements and body elements. The step of inputting each structural element and each format element into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0013] The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the association feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

[0014] In one embodiment, the structural elements include body elements and heading elements. The step of inputting each structural element and each formatting element into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0015] The text element, the title element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text element, the independent feature information of the title element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. Among them, the independent feature information of the text element and the independent feature information of the title element include time information and resource feedback information.

[0016] In one embodiment, the structural elements include text elements. The step of inputting each structural element and each format element into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0017] Obtain the set of historical emails for the account within a preset time period;

[0018] The text elements, the historical email set, other structural elements, and each of the format elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text elements, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the text elements includes the category matching degree between the text and the historical email set.

[0019] In one embodiment, determining whether the email is a target email based on multiple analysis results includes:

[0020] When the ratio of the number of target emails to the total number of analysis results is greater than a preset value, the email is determined to be a target email.

[0021] Secondly, this application also provides a target email detection device. The device includes:

[0022] The acquisition module is used to acquire emails for accounts to be checked;

[0023] The parsing module is used to parse the email to obtain the structural elements and format elements that make up the email;

[0024] The analysis module is used to input each of the structural elements and format elements into the multimodal large model, and based on the multimodal large model, analyze and obtain the independent feature information of a single element and the correlation feature information between multiple elements. The independent feature information and the correlation feature information are compared with the corresponding feature information of the target email to obtain various analysis results.

[0025] The determination module is used to determine whether the email is the target email based on multiple analysis results.

[0026] In one embodiment, the formatting element includes an icon element, and the analysis module is further configured to:

[0027] Get the set of standard icon elements corresponding to the icon element;

[0028] The icon element, the standard icon element set, other format elements, and each of the structural elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the icon element includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set.

[0029] In one embodiment, the structural elements include a sender element and a body element, and the analysis module is further configured to:

[0030] The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the association feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

[0031] In one embodiment, the structural elements include body text elements and heading elements, and the analysis module is further configured to:

[0032] The text element, the title element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text element, the independent feature information of the title element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. Among them, the independent feature information of the text element and the independent feature information of the title element include time information and resource feedback information.

[0033] In one embodiment, the structural element includes a text element, and the analysis module is further configured to:

[0034] Obtain the set of historical emails for the account within a preset time period;

[0035] The text elements, the historical email set, other structural elements, and each of the format elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text elements, the independent feature information of other elements, and the interaction feature information between multiple elements are analyzed. The independent feature information of the text elements includes the category matching degree between the text and the historical email set.

[0036] In one embodiment, the determining module is further configured to:

[0037] When the ratio of the number of target emails to the total number of analysis results is greater than a preset value, the email is determined to be a target email.

[0038] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method described in any of the embodiments of this disclosure.

[0039] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the methods described in any of the embodiments of this disclosure.

[0040] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the methods described in any of the embodiments of this disclosure.

[0041] The aforementioned target email detection method, apparatus, computer equipment, storage medium, and computer program product input each of the aforementioned structural elements and format elements into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation and interaction feature information between multiple elements are analyzed. The independent feature information and the correlation feature information are compared with the corresponding feature information of the target email to obtain various analysis results. The format elements are diverse, effectively capturing the characteristics of phishing emails using image embedding and sending from various official accounts. In addition to using the independent feature information of a single element, the correlation and interaction feature information of multiple elements is also used to analyze the behavioral matching degree between the sender and the email content, the matching degree between the recipient and the email content, etc., resulting in more intelligent analysis results. Furthermore, the use of a multimodal large model provides technical support for the implementation of the above technology, ensuring the feasibility of the method. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating a target email detection method in one embodiment;

[0043] Figure 2 This is an architecture diagram of a target email detection method in one embodiment;

[0044] Figure 3 Here is an architecture diagram of the target email detection method in another embodiment;

[0045] Figure 4 This is a structural block diagram of a target email detection device in one embodiment;

[0046] Figure 5 This is an internal structural diagram of a computer device in one embodiment;

[0047] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0049] In one embodiment, such as Figure 1As shown, a method for detecting targeted emails is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, or to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0050] Step S101: Obtain the email for the account to be checked.

[0051] The emails to be detected may include emails received by a terminal's logged-in email application or browser. In one exemplary embodiment, a browser plugin can be configured to automatically retrieve emails to be detected for the account. In another exemplary embodiment, a plugin can be configured in the email application to automatically retrieve the email address to be detected for the account. In yet another exemplary embodiment, the user can also export the emails and send them to a multimodal large model.

[0052] Step S103: Parse the email to obtain the structural elements and format elements that make up the email.

[0053] The structural elements of an email may include sender elements, CC elements, sending time elements, body elements, and attachment elements. The formatting elements may include text elements, image elements, audio elements, video elements, etc. It should be noted that the structural and formatting elements are not limited to the examples above. For instance, a signature element can also be used as a structural element. Those skilled in the art may make other modifications based on the essence of this application, but as long as the function and effect achieved are the same as or similar to that of this application, they should all be covered within the scope of protection of this application.

[0054] Step S105: Input each of the structural elements and format elements into the multimodal large model. Based on the multimodal large model, analyze and obtain the independent feature information of a single element and the correlation feature information between multiple elements. Compare the independent feature information and the correlation feature information with the corresponding feature information of the target email to obtain various analysis results.

[0055] The Multimodal Large Model (MM-VL) combines visual and linguistic information to process and understand complex tasks. Optionally, the MM-VL model can include VilBERT, VisualBERT, LAVIS, etc. It is understood that the above-mentioned MM-VL model can be trained using machine learning through sample structure elements or sample format elements to obtain a reasoning-capable MM-VL model. In this embodiment, the large model can exhibit good performance with only a small amount of data for fine-tuning. With the continuous development of phishing techniques and attackers constantly optimizing email models, the original detection model is prone to failure, and early obvious phishing features gradually disappear. At the same time, collecting a large amount of phishing email training data is difficult for most researchers; therefore, the large model can quickly update its detection capabilities by fine-tuning with a small amount of data.

[0056] In this embodiment of the disclosure, the target email may include phishing emails, spam emails, etc. Phishing emails typically aim to steal sensitive user information or execute malicious code on the user's terminal to launch network attacks.

[0057] In this embodiment of the disclosure, the independent feature information of a single element may include the independent feature information of a single structural element and the independent feature information of a single format element. The association feature information between multiple elements may include the association feature information between structural elements and format elements, the association feature information between structural elements, and the association feature information between format elements.

[0058] Taking a single element as an icon as an example, the icon and its corresponding set of standard icon elements are input into a multimodal large-scale model. The model analyzes the independent feature information of the icon element, such as the matching degree between the icon element and the target icon element in the set of standard icon elements. If this matching degree is lower than a preset value, for example, 80%, while the matching degree of the icon elements in the target email is 85%, it can be determined that the icon elements in the email are likely to have been tampered with, and the email is confirmed as the target email. Therefore, the analysis result based on the icon element can confirm that the email is the target email.

[0059] Taking multiple elements as sender and body elements as an example, the sender and body elements are input into a multimodal large model. The model analyzes the association features between the sender and body elements. For instance, if the body element is an email about tax refunds and the sender element is a personal QQ email address, since tax refund emails are generally not sent through personal QQ email addresses, the association feature between the sender and body elements could be a mismatch between them. Similarly, in the target email, the sender's source and body element could be mismatched. Therefore, the analysis based on the sender and body elements can confirm the email as the target email.

[0060] Step S107: Based on multiple analysis results, determine whether the email is the target email.

[0061] In this embodiment of the disclosure, when multiple analysis results indicate that the email is the target email, the email is determined to be the target email. In an exemplary embodiment, when multiple analysis results indicate that the email is not the target email, the email is determined to be not the target email. In an exemplary embodiment, when some analysis results indicate that the email is the target email and some analysis results indicate that the email is not the target email, a reminder message can be set, for example, to remind manual judgment.

[0062] In the specific implementation process, for example, based on the independent feature information of the image elements in the email, it is determined that the email has the independent feature information of the target email; based on the sender element and body element of the email, it is determined that the email has the associated feature information of the target email, and thus the email is ultimately determined to be the target email. On the other hand, based on the independent feature information of the image elements in the email, it is determined that the email does not have the independent feature information of the target email, or has very little of the independent feature information of the target email; based on the sender element and body element of the email, it is determined that the email does not have the associated feature information of the target email, and thus the email is ultimately determined to be a non-target email.

[0063] In the aforementioned target email detection method, each of the structural elements and format elements is input into a multimodal large model. Based on this model, the independent feature information of a single element and the correlation and interaction feature information between multiple elements are analyzed. The independent and correlation feature information are then compared with the corresponding feature information of the target email to obtain various analysis results. The rich variety of format elements effectively captures the characteristics of phishing emails, such as image embedding and sending from various official accounts. By using not only the independent feature information of a single element but also the correlation and interaction feature information of multiple elements, the method can analyze the behavioral matching degree between the sender and the email content, and the matching degree between the recipient and the email content, resulting in more intelligent analysis results. Furthermore, the use of a multimodal large model provides technical support for the implementation of the above techniques, ensuring the feasibility of the method.

[0064] In one embodiment, the formatting elements include icon elements. The step of inputting each of the structural elements and each of the formatting elements into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0065] Get the set of standard icon elements corresponding to the icon element;

[0066] The icon element, the standard icon element set, other format elements, and each of the structural elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the icon element includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set.

[0067] The formatting elements can include icon elements, such as graphic logos. A standard set of icon elements can be compiled from icons of government departments, banks, or businesses obtained from publicly available websites.

[0068] In this embodiment, other formatting elements may include formatting elements other than icon elements as described in the above embodiments. Structural elements may include sender elements, CC elements, sending time elements, body elements, and attachment elements, etc. In an exemplary embodiment, icon elements and their corresponding standard icon element sets are input into a multimodal large-scale model. The model analyzes the independent feature information of the icon elements, such as the degree of difference between the icon elements and target icon elements in the standard icon element set. If the matching degree is lower than a preset value, for example, a difference of 20%, while the difference of icon elements in the target email is 15%, it can be determined that the icon elements in the email are likely to have been tampered with, and the email is confirmed as the target email. Therefore, the analysis result based on the icon elements can confirm that the email is the target email.

[0069] In this embodiment of the disclosure, other elements include formatting elements and structural elements other than icon elements. Taking an image element as an example, the image element is input into a multimodal large model. Based on the multimodal large model, the independent feature information of the image element is analyzed, such as semantic features indicating urgency or the availability of rewards. This semantic feature is compared with the feature information of the target email. For example, the content of the target email usually includes promotions such as urgency and rewards. Therefore, the analysis result corresponding to the image element is determined to be: the email is the target email.

[0070] Taking multiple elements as sender and body elements as an example, the sender and body elements are input into a multimodal large model. The model analyzes the association features between the sender and body elements. For instance, if the body element is an email about tax refunds and the sender element is a personal QQ email address, since tax refund emails are generally not sent through personal QQ email addresses, the association feature between the sender and body elements could be a mismatch between them. Similarly, in the target email, the sender's source and body element could be mismatched. Therefore, the analysis based on the sender and body elements can confirm the email as the target email.

[0071] The above embodiments analyze the independent feature information of icon elements through multimodal large model analysis. The independent feature information of icon elements includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set. That is, by determining whether the icon element in the email is obtained by tampering with the standard icon element, it is possible to determine whether the email is the target element, thereby improving the accuracy of detection.

[0072] In one embodiment, the structural elements include sender elements and body elements. The step of inputting each structural element and each format element into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0073] The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the interaction feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

[0074] Other structural elements may include any structural element other than the sender element and the body element. The formatting elements may include the sender element, CC element, sending time element, body element, and attachment element, etc.

[0075] In one exemplary embodiment, the sender element and body element are input into a multimodal large model. The model analyzes the association features between the sender element and the body element. For example, the body element might be an email about a tax refund, and the sender element might be a personal QQ email address. Since tax refund emails are generally not sent through personal QQ email addresses, the association features between the sender element and the body element could be a mismatch between them. However, the sender element and body element in the target email could also be mismatched. Therefore, the analysis result based on the sender element and body element could identify the email as the target email.

[0076] In an exemplary embodiment, the interaction feature information between other elements may include the interaction feature information between structural elements, the interaction feature information between structural elements and format elements, and the interaction feature information between format elements. Taking image elements and sender elements as examples, the sender element and image element are input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the image element is analyzed. For example, the image element is an email about company benefits, and the sender element is a personal email address. Emails about company benefits are generally sent using official email addresses, and the association feature information between the sender element and the image element shows that the sender element and the image element do not match. However, the sender source in the target email may not match the image element. Therefore, the analysis result based on the sender element and image element can confirm that the email is the target email.

[0077] The independent feature information of a single element may include the independent feature information of a single structural element and the independent feature information of a single format element as described in the above embodiments. The concept of independent feature information has already been explained in the above embodiments and will not be repeated here.

[0078] In the above embodiments, the association feature information between the sender element and the body element is used. This association feature information includes the matching degree between the sender's identity and the body content. When there is a significant discrepancy between the sender's identity and the body content, the analysis result determined based on the sender element and the body element indicates that the email is the target email. This improves the accuracy of target email detection.

[0079] In one embodiment, the structural elements include body elements and heading elements. The step of inputting each structural element and each formatting element into a multimodal large model, and analyzing the independent feature information of a single element and the interaction feature information between multiple elements based on the multimodal large model, includes:

[0080] The text element, the title element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text element, the independent feature information of the title element, the independent feature information of other elements, and the interaction feature information between multiple elements are analyzed. Among them, the independent feature information of the text element and the independent feature information of the title element include time information and resource feedback information.

[0081] In this embodiment, other structural elements may include structural elements other than body elements and title elements. The format elements may include text elements, image elements, audio elements, video elements, etc. Body elements and format elements are input into a multimodal large model. Based on the multimodal large model, independent feature information of the body elements is analyzed, such as time is urgent or content with rewards. Independent feature information of the title elements is also analyzed, such as time is urgent or content with rewards. The body and title of the target email typically contain content with time urgency and rewards. For example: "Notice Regarding the Issuance of Summer High-Temperature Allowance for Employees in 2024. The scorching summer heat and continuous high temperatures have brought severe challenges to employees working on the front lines. To express our deep concern for our frontline employees and ensure that everyone can safely and healthily get through the heat, a summer high-temperature allowance of XX amount will be issued to all on-duty personnel in September 2024. Please fill in your 'Personal Information' by September 30th. If you have any questions, please contact the department's union specialist. Thank you!" (Personal Information Submission)

[0082] In this embodiment, the independent feature information of other elements may include independent feature information of elements other than body text elements and heading elements, including both independent feature information of structural elements and independent feature information of formatting elements. The independent feature information of other elements and the associated feature information between multiple elements have been described in the above embodiments and will not be repeated here.

[0083] The above embodiments, by using independent feature information of the body elements and independent feature information of the title elements, such as time information and resource feedback information, can supplement the content theme of the target email and improve the accuracy of target email detection.

[0084] In one embodiment, the structural elements include text elements. The step of inputting each structural element and each formatting element into a multimodal large model, and analyzing the independent feature information of a single element and the correlation feature information between multiple elements based on the multimodal large model, includes:

[0085] Obtain the set of historical emails for the account within a preset time period;

[0086] The text elements, the historical email set, other structural elements, and each of the format elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text elements, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the text elements includes the category matching degree between the text and the historical email set.

[0087] The historical email set for a preset time period can include emails from the account within the past three months or the past two weeks. In one embodiment, the body text elements are input into a multimodal large-scale model. Based on the multimodal large-scale model, the analysis of the body text elements determines that the email is a financial / tax-related email, the historical email set is game-related emails, and the independent feature information of the body text elements indicates that the body text and the historical email set categories do not match. However, a target email might be one whose body text and the historical email set categories do not match. Therefore, based on the body text elements and the historical email set, the analysis result determines that the email is the target email.

[0088] In this embodiment, other structural elements may include structural elements other than the body element. The format elements may include the sender element, CC element, sending time element, body element, and attachment element, etc. The independent feature information of other elements may include the independent feature information of structural elements other than the body element and the independent feature information of format elements. The associated feature information of multiple elements has been described in the above embodiments and will not be repeated here.

[0089] In the above embodiments, by using the independent feature information of the body elements, such as the category matching degree between the body and the historical email set, it is possible to capture the feature that the body of the target email does not match the category of the historical email set, thereby improving the accuracy of target email detection.

[0090] In one embodiment, determining whether the email is a target email based on multiple analysis results includes:

[0091] When the ratio of the number of target emails to the total number of analysis results is greater than a preset value, the email is determined to be a target email.

[0092] In one specific embodiment, reference is made to Figure 2 As shown, the structural elements email title and email body are input into a multimodal large-scale model. The model analyzes the independent feature information of the email title and body; for example, if the feature is time-sensitive or reward-related, it matches the characteristics of a target email (phishing email). Therefore, the analysis result for the email title and body is determined to be a target email. The format element email body icon is input into the multimodal large-scale model. The model analyzes the independent feature information of the icon; for example, if the icon is consistent with the target email, it does not match the characteristics of the target email. Therefore, the analysis result for the icon is determined to be a non-target email. The format element icon and icon set are input into the multimodal large-scale model. The model analyzes the independent feature information of the icon elements; if the icon is tampered with, the analysis result for the icon elements is determined to be a target email. In the above embodiment, if the analysis result is 2 / 3 of the emails as target emails, then the final analysis considers the email to be a target email.

[0093] In another specific embodiment, reference is made to... Figure 3 As shown, the format element icon element and the icon element set are input into the multimodal large model. Based on the analysis of the independent feature information of the icon element by the multimodal large model, the icon is found to have been tampered with, thus determining that the email is the target email. The sender element is input into the multimodal large model, and the analysis of the independent feature information of the sender element shows that the sender element and the body element may not match. The structure element email body and the historical email set are input into the multimodal large model, and the analysis of the independent feature information of the email body shows that the email body and the historical email set categories do not match. In the above embodiment, the proportion of analysis results indicating a target email is 3 / 3, therefore the email is ultimately considered a target email.

[0094] In the above embodiments, the model's multimodal capabilities are used to judge the semantics of the body text and identify the tampering of images and icons in the email. At the same time, in order to adaptively meet the phishing prevention needs of different individuals and scenarios, users can customize the historical reference emails to analyze the behavioral consistency of new emails, which effectively improves the identification accuracy of target emails.

[0095] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0096] Based on the same inventive concept, this application also provides a target email detection device for implementing the target email detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more target email detection device embodiments provided below can be found in the limitations of the target email detection method described above, and will not be repeated here.

[0097] In one embodiment, such as Figure 4 As shown, a target email detection device 400 is provided. The device includes:

[0098] Module 401 is used to retrieve emails for accounts to be checked;

[0099] Parsing module 403 is used to parse the email to obtain the structural elements and format elements that make up the email;

[0100] Analysis module 405 is used to input each of the structural elements and each of the format elements into the multimodal large model, and based on the multimodal large model, analyze and obtain the independent feature information of a single element and the correlation feature information between multiple elements, and compare the independent feature information and the correlation feature information with the corresponding feature information of the target email to obtain various analysis results;

[0101] The determination module 407 is used to determine whether the email is the target email based on multiple analysis results.

[0102] In one embodiment, the formatting element includes an icon element, and the analysis module is further configured to:

[0103] Get the set of standard icon elements corresponding to the icon element;

[0104] The icon element, the standard icon element set, other format elements, and each of the structural elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the icon element includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set.

[0105] In one embodiment, the structural elements include a sender element and a body element, and the analysis module is further configured to:

[0106] The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the association feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

[0107] In one embodiment, the structural elements include body text elements and heading elements, and the analysis module is further configured to:

[0108] The text element, the title element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text element, the independent feature information of the title element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. Among them, the independent feature information of the text element and the independent feature information of the title element include time information and resource feedback information.

[0109] In one embodiment, the structural element includes a text element, and the analysis module is further configured to:

[0110] Obtain the set of historical emails for the account within a preset time period;

[0111] The text elements, the historical email set, other structural elements, and each of the format elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text elements, the independent feature information of other elements, and the interaction feature information between multiple elements are analyzed. The independent feature information of the text elements includes the category matching degree between the text and the historical email set.

[0112] In one embodiment, the determining module is further configured to:

[0113] When the ratio of the number of target emails to the total number of analysis results is greater than a preset value, the email is determined to be a target email.

[0114] Each module in the aforementioned target email detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0115] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores target email detection data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a target email detection method.

[0116] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a method for detecting targeted emails. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0117] Those skilled in the art will understand that Figure 6The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0118] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0119] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0120] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting target emails, characterized in that, The method includes: Retrieve emails from accounts awaiting verification; The email is parsed to obtain the structural elements and format elements that make up the email; the structural elements include at least one of the following: sender element, CC element, sending time element, body element, and attachment element; the format elements include at least one of the following: text element, image element, voice element, video element, and icon element. Each of the structural elements and format elements is input into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation feature information between multiple elements are analyzed. The independent feature information and the correlation feature information are compared with the corresponding feature information of the target email to obtain multiple analysis results. The process of inputting each of the structural elements and format elements into the multimodal large model and analyzing the independent feature information of a single element and the correlation feature information between multiple elements includes: obtaining the standard icon element set corresponding to the icon element; inputting the icon element, the standard icon element set, other format elements, and each of the structural elements into the multimodal large model, and analyzing the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements based on the multimodal large model; wherein, the independent feature information of the icon element includes the difference between the icon element and the corresponding icon element in the standard icon element set. Based on multiple analysis results, it is determined whether the email is a target email; the target email includes phishing emails or spam emails.

2. The method according to claim 1, characterized in that, The structural elements include sender elements and body elements. Each structural element and each format element is input into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation feature information between multiple elements are analyzed, including: The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the association feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

3. The method according to claim 1, characterized in that, The structural elements include body text elements and heading elements. Each structural element and each formatting element is input into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation feature information between multiple elements are analyzed, including: The text element, the title element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text element, the independent feature information of the title element, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. Among them, the independent feature information of the text element and the independent feature information of the title element include time information and resource feedback information.

4. The method according to claim 1, characterized in that, The structural elements include text elements. The process involves inputting each structural element and each formatting element into a multimodal large model. Based on the multimodal large model, the independent feature information of a single element and the correlation feature information between multiple elements are analyzed, including: Obtain the set of historical emails for the account within a preset time period; The text elements, the historical email set, other structural elements, and each of the format elements are input into a multimodal large model. Based on the multimodal large model, the independent feature information of the text elements, the independent feature information of other elements, and the correlation feature information between multiple elements are analyzed. The independent feature information of the text elements includes the category matching degree between the text and the historical email set.

5. The method according to claim 1, characterized in that, The process of determining whether an email is the target email based on multiple analysis results includes: When the ratio of the number of target emails to the total number of analysis results is greater than a preset value, the email is determined to be a target email.

6. A target email detection device, characterized in that, The device includes: The acquisition module is used to acquire emails for accounts to be checked; The parsing module is used to parse the email to obtain the structural elements and format elements that make up the email; the structural elements include at least one of the following: sender element, CC element, sending time element, body element, and attachment element; the format elements include at least one of the following: text element, image element, audio element, video element, and icon element. The analysis module is used to input each of the structural elements and format elements into a multimodal large model, and based on the multimodal large model, analyze and obtain the independent feature information of a single element and the correlation feature information between multiple elements. The independent feature information and the correlation feature information are compared with the corresponding feature information of the target email to obtain multiple analysis results. The step of inputting each of the structural elements and format elements into the multimodal large model and analyzing and obtaining the independent feature information of a single element and the correlation feature information between multiple elements includes: obtaining a standard icon element set corresponding to the icon element; inputting the icon element, the standard icon element set, other format elements, and each of the structural elements into the multimodal large model, and based on the multimodal large model, analyzing the independent feature information of the icon element, the independent feature information of other elements, and the correlation feature information between multiple elements; wherein, the independent feature information of the icon element includes the degree of difference between the icon element and the corresponding icon element in the standard icon element set. The determination module is used to determine whether the email is a target email based on multiple analysis results; the target email includes phishing emails or spam emails.

7. The apparatus according to claim 6, characterized in that, The analysis module is also used for: The sender element, the body element, other structural elements, and each of the format elements are respectively input into a multimodal large model. Based on the multimodal large model, the association feature information between the sender element and the body element, the independent feature information of a single element, and the association feature information between other elements are analyzed. The association feature information between the sender element and the body element includes the matching degree between the sender's identity and the body content.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images