Mail detection method and device, equipment, storage medium and program product

Abstract

The invention provides a mail detection method and device, equipment, a storage medium and a program product. The method comprises the steps of obtaining historical mails of an organization to which a sender of a to-be-detected mail belongs; determining a plurality of pieces of attribute information based on first attribute information extracted from the to-be-detected mail according to a first preset extraction rule and second attribute information extracted from the historical mail according to a second preset extraction rule; and determining whether the to-be-detected mail is a malicious mail or not based on the relevancy of any two pieces of attribute information in the multiple pieces of attribute information. According to the method and the device, the organized historical mails are determined through the organization structure to which the sender of the to-be-detected mail belongs, and the malicious behavior detection capability of the unknown mail is enhanced based on the relevancy of the attribute information in the to-be-detected mail and the historical mails.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and more specifically, to an email detection method, device, equipment, storage medium and program product. Background Art

[0002] With the continuous advancement of Internet technology, network security threats are also increasing. As the hardest hit area of ​​network attacks, emails are facing challenges from various new attack methods. For example, Advanced Persistent Threat (APT) attacks, Account Takeover (ATO) attacks, Business Email Compromise (BEC) attacks, etc. continue to emerge, and traditional email security protection systems can no longer effectively resist these complex network attacks.

[0003] Currently, static analysis and dynamic sandbox detection can be used to identify and trace complex email attack behaviors. However, due to their own limitations, the above methods may miss some malicious emails. Summary of the invention

[0004] Based on the above-mentioned technical defects, the present application proposes an email detection method, device, equipment, storage medium and program product, which determines the historical emails of the organization through the organizational structure to which the sender of the email to be detected belongs, and enhances the malicious behavior detection capability of unknown emails based on the correlation between the attribute information in the email to be detected and the historical emails.

[0005] The first aspect of the present application provides an email detection method, the method comprising:

[0006] Obtain historical emails of the organization to which the sender of the email to be detected belongs;

[0007] Determine multiple attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule;

[0008] Based on the correlation between any two of the plurality of attribute information, it is determined whether the to-be-detected email is a malicious email.

[0009] A second aspect of the present application provides a mail detection device, the device comprising:

[0010] An acquisition unit, used for acquiring historical emails of the organization to which the sender of the email to be detected belongs;

[0011] a determining unit, configured to determine a plurality of attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule;

[0012] The determination unit is further configured to determine whether the to-be-detected email is a malicious email based on the correlation between any two of the plurality of attribute information.

[0013] A third aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect above.

[0014] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect.

[0015] A fifth aspect of the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0016] The beneficial effects of this application include at least:

[0017] In an embodiment of the present application, historical emails of an organization are determined through the organizational structure to which the sender of the email to be detected belongs, and based on the correlation between the attribute information in the email to be detected and the historical emails, the malicious behavior detection capability of unknown emails is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present application and, together with the description, serve to explain the principles of the present application.

[0019] The present application can be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0020] Figure 1 A schematic diagram of an email attack provided by an exemplary embodiment of the present application is shown;

[0021] Figure 2 A schematic diagram of a flow chart of a mail detection method provided by an exemplary embodiment of the present application is shown;

[0022] Figure 3 A schematic diagram of a bilstm model structure provided by an exemplary embodiment of the present application is shown;

[0023] Figure 4 A schematic diagram of a flow chart of a mail detection method provided by an exemplary embodiment of the present application is shown;

[0024] Figure 5 A schematic diagram of the structure of a mail detection device provided by an exemplary embodiment of the present application is shown;

[0025] Figure 6 A schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application is shown;

[0026] Figure 7 A schematic diagram of a storage medium provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present application. It is obvious to those skilled in the art that the present application can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present application, some technical features known in the art are not described.

[0028] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of the features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0029] Now, exemplary embodiments according to the present application will be described in more detail with reference to the accompanying drawings. However, these exemplary embodiments may be implemented in a variety of different forms and should not be construed as being limited to the embodiments described herein. The accompanying drawings are not drawn to scale, and certain details may be magnified and certain details may be omitted for the purpose of clear expression. The shapes of the various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are merely exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0030] The following describes an exemplary embodiment according to the present application. It should be noted that the following embodiments are only shown to facilitate understanding of the spirit and principle of the present application, and the embodiments of the present application are not limited in this regard. On the contrary, the embodiments of the present application can be applied to any applicable scenario.

[0031] Based on the above background technology, malicious attackers use the collected well-known emails or leaked emails from users to send deceptive emails with malicious attachments or QR codes to lure users into taking actions. Figure 1 As shown, first the attacker will determine the target of attack, such as Figure 1 Client 1 in the example may be through searching for internal user information or through forged domains in external emails to prevent external targets from using them. The attacker attempts to convince the recipient that the message is from an internal user or a trusted source, possibly by using the name or reply address of an internal user, or by using a nearby domain, abusing a compromised mailbox or mail server, etc. as the sender. The attacker constructs relatively credible email content, using correct text and grammar, and may include personalized information such as the beginning of the recipient's name to increase credibility. The attacker sends an email containing a malicious link or attachment to Figure 1 Clients 2-4 in the above example, these emails may be disguised as legitimate email attachments, such as Microsoft Word documents, or email bodies written in HTML, and steal sensitive user information by disguising themselves as bank login pages, email service login pages, etc. Once a user clicks on a link or opens an attachment, malware may be downloaded and executed to send spam, steal bank information, extort, etc.

[0032] In order to defend against these complex network attacks, relevant technologies can identify and trace complex email attack behaviors through static analysis and dynamic sandbox detection.

[0033] Among them, static analysis mainly identifies malicious emails by analyzing static features in the email content, such as the sender address, subject line, email body content, etc. It also includes preliminary analysis of email attachments to check whether they contain known malware signatures or whether there are signs of macro viruses.

[0034] Dynamic sandbox detection creates an isolated environment to simulate the execution process of potential malicious code in email attachments or links. During this process, the sandbox monitors and records the behavior of the file, including API calls, network connections, file operations, etc., to determine whether it has malicious behavior. If common virus operations such as self-replication and file overwriting occur during the execution process, the current email can be determined to be a malicious email.

[0035] Since static analysis requires specifying encoding rules and analyzing static features in email content based on encoding rules to identify malicious emails, and encoding rules rely on external documents or can be interpreted subjectively, external documents will be constantly updated or changed, and encoding rules that rely on these documents also need to be updated accordingly, which increases the complexity and workload of maintenance. In addition, since the interpretation of rules may vary from person to person, some errors or omissions may occur, especially when the application of rules is unclear. Static analysis tools usually rely on clear and fixed rules to automatically check code. If the rules require external information or subjective judgment, these tools may not be able to execute accurately, reducing the efficiency and accuracy of automated inspections.

[0036] Although dynamic sandbox detection can monitor the behavior of malware in an isolated environment, some malware can sense the existence of a sandbox in the running environment, thereby hiding its malicious behavior, making it impossible for the sandbox to detect its true behavior. In addition, the technical implementation process of anti-sandbox is relatively covert and difficult to detect and identify. Moreover, this technology is constantly changing and updating, and the previous detection rules may become invalid as the malicious code evolves. Therefore, this method may miss some malicious emails.

[0037] In response to the above technical problems, the present application proposes an email detection method, device, equipment, storage medium and program product, the method comprising: obtaining historical emails of the organization to which the sender of the email to be detected belongs; determining multiple attribute information based on first attribute information extracted from the email to be detected according to a first preset extraction rule, and second attribute information extracted from the historical emails according to a second preset extraction rule; determining whether the email to be detected is a malicious email based on the correlation between any two attribute information in the multiple attribute information. The present application determines the historical emails of the organization through the organizational structure to which the sender of the email to be detected belongs, and based on the correlation between the attribute information in the email to be detected and the historical emails, enhances the malicious behavior detection capability of unknown emails.

[0038] The embodiment of the present application first describes the email detection method with the execution subject being a security device, wherein the security device may be a firewall or a gateway device, etc.

[0039] See also Figure 1 , the method comprises the following steps.

[0040] S101, obtaining historical emails of the organization to which the sender of the email to be detected belongs.

[0041] It is understandable that the current method of identifying malicious emails, whether static analysis or sandbox tool detection, is to detect the email information in the email to be detected. For example, only the sender address, subject line, email body content and other information of the email to be detected are detected. This results in the information used for detection being relatively simple, and sometimes missed detections may occur. In order to improve the accuracy of email detection, historical emails of the organization to which the sender of the email to be detected belongs can be obtained.

[0042] The embodiment of the present application takes the application scenario of an internal email scenario of an organization as an example to illustrate the above email detection method.

[0043] Since the application scenario is an internal email scenario of an organization, the security device can store historical emails of multiple organizations. When receiving an email to be detected, the organization to which the sender of the email to be detected belongs can be determined among multiple organizations, and the historical emails of the organization to which the sender belongs can be obtained, so as to determine whether the email to be detected is a malicious email based on the email information of the historical emails and the email to be detected.

[0044] S102: Determine a plurality of attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule.

[0045] Among them, the attribute information corresponding to the first preset extraction rule and the second preset extraction rule can be used to detect whether the email to be detected is a malicious email. The first preset extraction rule and the second preset extraction rule can be flexibly set based on actual conditions. The attribute information corresponding to the first preset extraction rule may include the sender's organizational department, sender, whether the email subject and content are related, the email content category, historical senders, whether the email contains a QR code, whether the email contains a link, and the attribute information corresponding to the second preset extraction rule may be the historical email exchange content category, the combination relationship between the sender and all recipients, etc.

[0046] In some embodiments, some attribute information can be determined through the email content of the email to be detected and the historical emails, or can be determined through a correlation model, so as to obtain the attribute information corresponding to the email to be detected and the historical emails.

[0047] For example, the sender, recipient, sender's organization, recipient's organization, email content category of the email to be tested, and whether the email to be tested includes data carrier information can be directly obtained through the email content of the email to be tested. Whether the subject and content of the email to be tested are related needs to be obtained by analyzing the subject and content of the email.

[0048] Based on the same principle, the historical sender of the target historical email and the email content category of the target historical email can be directly obtained through the email content of the historical email.

[0049] S103: Determine whether the email to be detected is a malicious email based on the correlation between any two pieces of attribute information among the multiple pieces of attribute information.

[0050] Generally, malicious attacks may only change certain attribute information in the email, but not all attribute information. Therefore, based on the correlation between any two attribute information in the attribute information, it is possible to detect whether the attribute information has changed to detect whether the email to be detected is a malicious email.

[0051] In some embodiments, the correlation between any two attribute information can be quantified to set a relevant preset correlation threshold, so that when the correlation value of any two attribute information is less than the preset correlation value, it is determined that there are abnormal attributes in the two attribute information. If the number of abnormal attributes exceeds a certain number, the email to be detected is determined to be a malicious email.

[0052] In some embodiments, the overall relevance score of the attribute information can be further determined by quantifying the relevance of any two attribute information, thereby setting a relevant relevance score threshold. When the overall relevance score is less than the relevance score threshold, the email to be detected is determined to be a malicious email.

[0053] The present application proposes an email detection method, which includes: obtaining historical emails of the organization to which the sender of the email to be detected belongs; determining multiple attribute information based on first attribute information extracted from the email to be detected according to a first preset extraction rule, and second attribute information extracted from the historical email according to a second preset extraction rule; determining whether the email to be detected is a malicious email based on the correlation between any two attribute information in the multiple attribute information. The present application determines the historical emails of the organization through the organizational structure to which the sender of the email to be detected belongs, and based on the correlation between the attribute information in the email to be detected and the historical email, strengthens the malicious behavior detection capability of unknown emails.

[0054] In some embodiments, based on the correlation between any two attribute information among multiple attribute information, determining whether the email to be detected is a malicious email includes: constructing a data matrix based on the attribute information; based on the data matrix, obtaining correlation scores of multiple attribute information through a correlation model; and determining whether the email to be detected is a malicious email based on the correlation scores.

[0055] It is understandable that in order to improve the detection efficiency of the email detection method, the relevance score of the attribute information can be obtained through the relevance model.

[0056] The relevance model can be a network structure of a Bilstm model, and the input of the model is a data matrix. Therefore, a corresponding data matrix can be constructed based on the attribute information, and the data matrix can be sent to the relevance model as the input of the model. The relevance score of the attribute information output by the relevance model is obtained, and whether the mail to be detected is a malicious mail is determined based on the relevance score.

[0057] In some embodiments, the attribute information is as shown in Table 1:

[0058]

[0059] Table 1

[0060] The values ​​of the attribute information described in Table 1 are constructed into a data matrix that can be input into the Bilstm model, the relevance score of the attribute information output by the relevance model is obtained, and based on the relevance score, it is determined whether the email to be detected is a malicious email.

[0061] In some embodiments, the training process of the trained correlation model includes: obtaining sample data, the sample data including sample attribute information and a target correlation score corresponding to the sample attribute information; constructing a sample data matrix based on the sample attribute information; performing a single training operation of the initial correlation model according to the sample data matrix and the target correlation score until a preset training completion condition is met to obtain a trained correlation model; wherein the single training operation of the initial correlation model includes: inputting the sample data matrix into the initial correlation model to obtain a predicted correlation score; calculating a loss function value based on the predicted correlation score and the target correlation score; and adjusting the model parameters of the initial correlation model based on the loss function value.

[0062] Among them, the training completion condition can be that the loss function value is less than a preset loss function value or the number of iterations meets the preset number of iterations.

[0063] It is understandable that the importance of the correlation between any two attribute information in the attribute information is different. For example, since the sender of the email to be detected belongs to a department with only one employee, if the correlation between the sender and the historical senders is relatively low, the email to be detected is considered to be a malicious email, and the importance of the correlation between the sender and the historical senders may be relatively important. However, the correlation between the sender and whether the email contains a QR code is not very strong, so the importance of the correlation between the sender and whether the email contains a QR code is relatively low.

[0064] The loss function value is calculated by the predicted relevance score and the target relevance score, and the model parameters of the initial relevance model are adjusted based on the loss function value to obtain a trained relevance model to obtain an accurate predicted relevance score.

[0065] Among them, the network structure of the Bilstm model is as follows Figure 3 As shown, the network structure of the Bilstm model includes multiple Bilstm model sub-network structures, each of which includes a forget gate, an input gate, an output gate, and a candidate cell state. X is the input, h is the hidden state, and c is the memory cell.

[0066] Forget gate: determines which information needs to be forgotten. It receives the current input and the previous state through an S-shaped network layer and outputs a value between 0 and 1, where 1 means full acceptance and 0 means full neglect.

[0067] Input gate: decides what new information needs to be added to the cell state. This consists of two parts: the sigmoid layer determines what information needs to be updated, and the tanh layer creates a new vector of candidate values.

[0068] Cell state update: According to the results of the forget gate and the input gate, the cell state is updated. The old state is multiplied by the output of the forget gate to forget unnecessary information, and the alternative value of the input gate is added to add new information.

[0069] Output gate: Determines the final output value. The S-shaped network layer determines which parts of the information need to be output, and then the cell state is input into the tanh layer and multiplied by the output of the output gate to obtain the final output.

[0070] When using the model, LSTM processes data through the following steps:

[0071] Input data: Input data usually includes sequence data, such as time series or text data. The shape of input data is usually (seq_len, batch, input_size), where seq_len is the sequence length, batch is the batch size, and input_size is the input feature dimension.

[0072] Forward propagation: LSTM processes input data through the forget gate, input gate and output gate, updates the cell state and finally outputs the result. The shape of the output data is usually (seq_len, batch, num_directions*hidden_size), where num_directions is the number of directions of LSTM (unidirectional or bidirectional), and hidden_size is the dimension of the hidden layer.

[0073] Training process: Through the back-propagation algorithm, the LSTM model learns how to better process the input data and optimize the parameters to reduce the prediction error. The loss function and optimization algorithm need to be defined during the training process.

[0074] In some embodiments, determining whether the email to be detected is a malicious email is based on the correlation between any two attribute information in the attribute information, including: determining the correlation between any two attribute information in the attribute information; obtaining weight coefficients corresponding to the correlations between any two attribute information; determining the correlation score of the attribute information based on the correlation between any two attribute information and the weight coefficients corresponding to the correlations between any two attribute information; determining whether the email to be detected is a malicious email based on the correlation score.

[0075] Among them, the correlation between any two attribute information can be determined by means of Pearson correlation coefficient, Spearman correlation coefficient, etc., and then the weight coefficients corresponding to the correlation between any two attribute information can be pre-set. Therefore, the correlation score of the attribute information can be determined based on the correlation between any two attribute information and the weight coefficients corresponding to the correlation between any two attribute information; based on the correlation score, it is determined whether the email to be detected is a malicious email.

[0076] In some embodiments, determining whether the email to be detected is a malicious email based on the relevance score includes: if the relevance score is less than a preset relevance score, determining that the email to be detected is a malicious email.

[0077] It can be understood that the higher the correlation score, the higher the correlation between the attribute information, and the smaller the possibility that the email to be detected is a malicious email. On the contrary, the lower the correlation score, the greater the possibility that the email to be detected is a malicious email. Therefore, the obtained correlation score can be compared with the preset correlation score. When the correlation score is less than the preset correlation score, it is determined that the email to be detected is a malicious email.

[0078] The preset relevance score can be flexibly set based on actual conditions, for example, it can be 0.5, 0.6, etc.

[0079] In some embodiments, the target historical emails related to the subject of the email to be detected can be determined from the historical emails of the organization to which the sender of the email to be detected belongs, and the historical senders and email content categories of the target historical emails can be further obtained.

[0080] The email content category may be related to the department to which the sender belongs. For example, if the sender belongs to the finance department, the corresponding email content category may be finance-related.

[0081] In some embodiments, the first attribute information includes: whether the subject and content of the email to be detected are related, and the method specifically determines whether the subject and content of the email to be detected are related in the following manner: determining at least one first content keyword corresponding to the subject of the email to be detected; extracting at least one second content keyword from the content of the email to be detected; and determining whether the subject and content of the email to be detected are related based on the relevance of each first content keyword and each second content keyword.

[0082] In some embodiments, before determining the content keywords of the subject and content, data preprocessing, word segmentation, stop word removal and other steps are performed on the email title and email content respectively to extract text features, and the extracted text features are further annotated. For example, if the email content is "System migration on August 15, 2024, please power off the equipment before leaving get off work for all relevant personnel", then the second content keywords extracted are August 15, 2024, system, migration, China, before leaving get off work and designers, etc.

[0083] Furthermore, the email subject corresponding to the email content can be obtained to determine at least one first content keyword corresponding to the email subject, wherein the security device can store multiple email subjects and at least one content keyword corresponding to the multiple email subjects respectively, and at least one first content keyword corresponding to the email subject can be determined from the at least one content keyword corresponding to the multiple email subjects respectively.

[0084] For example, the first content keyword corresponding to the email subject "Notification" is: time, place, notification action, people involved, etc.

[0085] Furthermore, it is determined whether the subject and content of the to-be-detected email are related based on the relevance of each first content keyword and each second content keyword.

[0086] For example, the email content is "System migration on August 15, 2024, please power off the equipment before leaving get off work" and the corresponding email subject is notification. The second content keywords are August 15, 2024, system, migration, China, before leaving work, and designer, etc. The time, place, notification action, and involved personnel in the first content keywords are consistent, so it can be determined that the subject and content of the email to be tested are related.

[0087] In some embodiments, determining whether the subject and content of the email to be detected are related is based on the relevance of each first content keyword and each second content keyword, including: obtaining a first keyword value corresponding to at least one first content keyword, the first keyword value being used to represent the keyword score corresponding to each preset content keyword; determining a total first keyword value corresponding to the subject based on at least one first keyword value; determining a second keyword value corresponding to at least one second content keyword, the second keyword value being used to represent the keyword score corresponding to each content keyword; determining a total second keyword value corresponding to the content based on at least one second keyword value; if the difference between the total first keyword value and the total second keyword value is within a preset difference range, determining that the subject and content are related.

[0088] In some embodiments, different values ​​may be marked for each keyword, so that the first keyword value corresponding to at least one first content keyword may be obtained and the total number of first keywords corresponding to the theme may be determined, and the total number of first keywords may be further compared with the total number of second keywords, wherein the total number of second keywords is determined based on the second keyword value corresponding to at least one second content keyword. Whether the theme and content are related is determined based on the comparison result.

[0089] The preset difference range can be flexibly set based on actual conditions.

[0090] In some embodiments, the email content category can be trained by using the model.fit() method through the Bilstm classification algorithm network.

[0091] Text Classification: Text classification is a task that divides text data into multiple categories. It is often used in applications such as spam filtering and news classification.

[0092] model.fit(x,y,batch_size=32,epochs=16,verbose=1,alidation_data=(x_val,y_val))

[0093] x: input data.

[0094] y: Input label.

[0095] batch_size: integer, specifies the number of samples to use each time the model is updated.

[0096] epochs: integer, defines the number of times the entire dataset will be traversed. One epoch means the entire dataset is used once to train the model.

[0097] verbose: log display mode. 0 means no log information is output to the standard output stream, 1 means output progress bar records, and 2 means output one line of records per epoch.

[0098] validation_data: A tuple of the form (x_val, y_val) used to evaluate the performance of the model at the end of each epoch.

[0099] Among them, the input data can be sample email content, and the input label can be the email content classification corresponding to the sample email content. By training the Bilstm classification algorithm network in this way, a trained Bilstm classification algorithm network can be obtained, so as to classify the emails to be detected in real time and obtain the email content classification of the emails to be detected.

[0100] In some embodiments, before obtaining historical emails of the organization to which the sender of the email to be detected belongs, the method also includes: extracting content information of the email to be detected based on a preset email protocol; determining whether the email to be detected is a malicious email based on the content information; and if the email to be detected is not a malicious email, executing the step of obtaining historical emails of the organization to which the sender of the email to be detected belongs.

[0101] It is understandable that most malicious emails can be detected by sandbox detection tools. Therefore, the content information of the email to be detected can be extracted based on the preset email protocol, where the content information may include executable programs, email content, email title, source IP address, recipient, and sender. And whether the email to be detected is a malicious email can be determined based on the content information.

[0102] When it is determined that the mail to be detected is not a malicious mail, the step of obtaining historical mails of the organization to which the sender of the mail to be detected belongs is performed to perform the next step of detection.

[0103] In some embodiments, determining whether the email to be detected is a malicious email based on content information includes: determining whether the email to be detected is a malicious email based on content information through a sandbox detection tool; when it is detected that the email to be detected is not a malicious email, obtaining domain name information in the content information; and determining whether the email to be detected is a malicious email based on a pre-stored domain name blacklist and domain name information.

[0104] The sandbox detection tool determines whether there are any suspicious operations on executable programs, QR codes, documents, etc. If there are any suspicious operations, the email to be detected is determined to be a malicious email. If there are no suspicious operations, the domain name information in the content information is obtained, and the domain name information can be the source address of the email to be detected. It is determined whether the source address is included in the blacklist stored in the security device. If the source address is included, the email to be detected is determined to be a malicious email. If the source address is not included, the step of obtaining the historical emails of the organization to which the sender of the email to be detected belongs is executed for the next step of detection.

[0105] For ease of understanding, the present application embodiment also provides a flowchart of an email detection method. Figure 4 As shown:

[0106] Among them, the security device is equipped with a processing module, a sandbox module, an intelligence module and an algorithm module.

[0107] The processing module is used to extract content information of the email to be detected based on a preset email protocol; and determine whether the email to be detected is a malicious email based on the content information.

[0108] The content information includes: executable program, email content, email title, source IP address, recipient, and sender.

[0109] The processing module sends the content information to the sandbox module.

[0110] The sandbox module creates an isolated environment to simulate the execution process of potential malicious code in email attachments or links, and determines whether there are malicious files and whether there are problems with the links and QR codes in the email content. If it is detected that the email to be detected is not a malicious email, the domain name information in the content information is obtained and sent to the intelligence module. The domain name information can be the source address of the email to be detected.

[0111] The intelligence module determines whether the source address is included in the blacklist stored in the security device. If the source address is included, it is determined that the email to be detected is a malicious email. If the source address is not included, it is determined that the email to be detected is not a malicious email.

[0112] When the intelligence module determines that the email to be detected is not a malicious email, obtain the historical emails of the organization to which the sender of the email to be detected belongs; based on the email to be detected and the historical emails, determine the attribute information, which may include the sender's organizational department, sender, historical senders, whether the email subject and content are related, email content category, historical email content category, whether the email contains a QR code, whether the email contains a link, the combination relationship between the sender and all recipients, etc.

[0113] Based on the correlation between any two pieces of attribute information in the attribute information, determine whether the email to be detected is a malicious email.

[0114] The present application also provides a mail detection device for performing the above Figure 2 The email detection method in the embodiment, such as Figure 5 As shown, the device comprises:

[0115] An acquisition unit 501 is used to acquire historical emails of the organization to which the sender of the email to be detected belongs;

[0116] A determining unit 502, configured to determine a plurality of attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule;

[0117] The determining unit 502 is further configured to determine whether the to-be-detected email is a malicious email based on the correlation between any two of the plurality of attribute information.

[0118] In some embodiments, the determining unit 502 is specifically configured to:

[0119] constructing a data matrix based on the plurality of attribute information;

[0120] Based on the data matrix, obtaining relevance scores of the plurality of attribute information through a relevance model;

[0121] Determine whether the email to be detected is a malicious email based on the relevance score.

[0122] In some embodiments, the training process of the trained relevance model includes:

[0123] Acquire sample data, the sample data including sample attribute information and a target relevance score corresponding to the sample attribute information;

[0124] Constructing a sample data matrix based on the sample attribute information;

[0125] According to the sample data matrix and the target relevance score, a single training operation of the initial relevance model is performed until a preset training completion condition is met to obtain a trained relevance model;

[0126] Among them, a single training operation of the initial relevance model includes: inputting the sample data matrix into the initial relevance model to obtain a predicted relevance score; calculating a loss function value based on the predicted relevance score and the target relevance score; and adjusting the model parameters of the initial relevance model based on the loss function value.

[0127] In some embodiments, the determining unit 502 is specifically configured to:

[0128] Determine the correlation between any two pieces of attribute information in the attribute information;

[0129] Obtaining weight coefficients corresponding to the correlations of any two pieces of attribute information;

[0130] Determine the relevance score of the attribute information based on the relevance of the two arbitrary attribute information and the weight coefficients corresponding to the relevance of the two arbitrary attribute information;

[0131] Determine whether the email to be detected is a malicious email based on the relevance score.

[0132] In some embodiments, the determining unit 502 is further specifically configured to:

[0133] When the relevance score is less than a preset relevance score, it is determined that the email to be detected is a malicious email.

[0134] In some embodiments,

[0135] The first attribute information includes: whether the subject and content of the to-be-detected email are related. The method specifically determines whether the subject and content of the to-be-detected email are related in the following manner:

[0136] Determine at least one first content keyword corresponding to the subject of the email to be detected;

[0137] Extracting at least one second content keyword from the content of the email to be detected;

[0138] Whether the subject and content of the to-be-detected email are related is determined based on the relevance of each first content keyword and each second content keyword.

[0139] In some embodiments, the determining unit 502 is further configured to:

[0140] Obtaining first keyword values ​​corresponding to the at least one first content keyword, wherein the first keyword values ​​are used to represent keyword scores corresponding to each preset content keyword;

[0141] Determine a total number of first keywords corresponding to the topic based on at least one of the first keyword values;

[0142] Determine a second keyword value corresponding to each of the at least one second content keyword, wherein the second keyword value is used to represent a keyword score corresponding to each of the content keywords;

[0143] Determine a total number of second keywords corresponding to the content based on at least one second keyword value;

[0144] If the difference between the total number of the first keywords and the total number of the second keywords is within a preset difference range, it is determined that the topic and content are related.

[0145] In some embodiments,

[0146] The acquisition unit 501 is also used to extract content information of the email to be detected based on a preset email protocol;

[0147] The determination unit 502 is further configured to determine whether the email to be detected is a malicious email based on the content information;

[0148] The execution unit is further configured to, when the email to be detected is not a malicious email, execute the step of obtaining historical emails of the organization to which the sender of the email to be detected belongs.

[0149] In some embodiments, the determining unit 502 is specifically configured to:

[0150] Determine whether the email to be detected is a malicious email based on the content information by using a sandbox detection tool;

[0151] When it is detected that the email to be detected is not a malicious email, obtaining domain name information in the content information;

[0152] Based on the pre-stored domain name blacklist and the domain name information, it is determined whether the email to be detected is a malicious email.

[0153] Please refer to the following Figure 6 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 6 As shown, the electronic device 7 includes: a processor 700, a memory 701, a bus 707 and a communication interface 703, and the processor 700, the communication interface 703 and the memory 701 are connected via the bus 707; the memory 701 stores a computer program that can be run on the processor 700, and when the processor 700 runs the computer program, it executes the email detection method provided in any of the aforementioned embodiments of the present application.

[0154] The memory 701 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 703 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0155] The bus 707 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 701 is used to store programs, and the processor 700 executes the programs after receiving the execution instruction. The mail detection method disclosed in any implementation of the above-mentioned embodiment of the present application may be applied to the processor 700, or implemented by the processor 700.

[0156] The processor 700 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 700. The above processor 700 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 701, and the processor 700 reads the information in the memory 701 and completes the steps of the above method in combination with its hardware.

[0157] The electronic device provided in the embodiment of the present application and the mail detection method provided in the embodiment of the present application are based on the same application concept and have the same beneficial effects as the methods adopted, operated or implemented therein.

[0158] The present application also provides a computer-readable storage medium corresponding to the email detection method provided in the above embodiment. Figure 7 The computer-readable storage medium shown is an optical disc 30 on which a computer program (ie, a program product) is stored. When the computer program is executed by a processor, the email detection method provided by any of the aforementioned embodiments will be executed.

[0159] In addition, examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0160] The computer-readable storage medium provided in the above-mentioned embodiment of the present application and the email detection method provided in the embodiment of the present application are based on the same application concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0161] It should be noted that the algorithms and displays provided herein are not inherently related to any particular computer, virtual device, or other device. Various general-purpose devices may also be used in conjunction with the teachings herein. Based on the above description, it is apparent that the structures required to construct such devices are suitable. In addition, the present application is not directed to any particular programming language. It should be understood that the contents of the present application described herein may be implemented using various programming languages, and the description of the specific languages ​​above is intended to disclose the best implementation of the present application.

[0162] Similarly, it should be understood that in order to streamline the present application and aid in understanding one or more of the various application aspects, in the above description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: the claimed application requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, the application aspects lie in less than all the features of the single embodiment disclosed above. Therefore, the claims following the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present application.

[0163] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the creation device of the virtual machine according to the embodiment of the present application. The present application can also be implemented as a device or device program for executing part or all of the methods described herein. The program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0164] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A mail detection method, characterized in that: The method comprises: Obtain historical emails of the organization to which the sender of the email to be detected belongs; Determine multiple attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule; Based on the correlation between any two of the plurality of attribute information, it is determined whether the to-be-detected email is a malicious email.

2. The method according to claim 1, characterized in that The determining whether the to-be-detected email is a malicious email based on the correlation between any two of the plurality of attribute information includes: constructing a data matrix based on the plurality of attribute information; Based on the data matrix, obtaining relevance scores of the plurality of attribute information through a trained relevance model; Determine whether the email to be detected is a malicious email based on the relevance score.

3. The method according to claim 2, characterized in that The training process of the trained relevance model includes: Acquire sample data, the sample data including sample attribute information and a target relevance score corresponding to the sample attribute information; Constructing a sample data matrix based on the sample attribute information; According to the sample data matrix and the target relevance score, a single training operation of the initial relevance model is performed until a preset training completion condition is met to obtain a trained relevance model; Among them, a single training operation of the initial relevance model includes: inputting the sample data matrix into the initial relevance model to obtain a predicted relevance score; calculating a loss function value based on the predicted relevance score and the target relevance score; and adjusting the model parameters of the initial relevance model based on the loss function value.

4. The method according to claim 1, characterized in that: The determining whether the to-be-detected email is a malicious email based on the correlation between any two of the plurality of attribute information includes: Determine the correlation between any two pieces of attribute information in the attribute information; Obtaining weight coefficients corresponding to the correlations of any two pieces of attribute information; Determine a relevance score of the attribute information based on the relevance of the arbitrary two attribute information and the weight coefficients respectively corresponding to the relevance of the arbitrary two attribute information; Determine whether the email to be detected is a malicious email based on the relevance score.

5. The method according to any one of claims 2 to 4, characterized in that: The determining whether the to-be-detected email is a malicious email based on the relevance score includes: When the relevance score is less than a preset relevance score, it is determined that the email to be detected is a malicious email.

6. The method according to claim 1, characterized in that The first attribute information includes: whether the subject and content of the to-be-detected email are related. The method specifically determines whether the subject and content of the to-be-detected email are related in the following manner: Determine at least one first content keyword corresponding to the subject of the email to be detected; Extracting at least one second content keyword from the content of the email to be detected; Whether the subject and content of the to-be-detected email are related is determined based on the relevance of each first content keyword and each second content keyword.

7. The method according to claim 6, characterized in that The determining whether the subject and content of the to-be-detected email are related based on the relevance of each first content keyword and each second content keyword includes: Obtaining first keyword values ​​respectively corresponding to the at least one first content keyword, wherein the first keyword values ​​are used to represent keyword scores respectively corresponding to the first content keywords; Determine a total number of first keywords corresponding to the topic based on at least one of the first keyword values; Determine a second keyword value corresponding to each of the at least one second content keyword, wherein the second keyword value is used to represent a keyword score corresponding to each of the content keywords; Determine a total number of second keywords corresponding to the content based on at least one second keyword value; If the difference between the total number of the first keywords and the total number of the second keywords is within a preset difference range, it is determined that the topic and the content are related.

8. The method according to claim 1, characterized in that Before obtaining historical emails of the organization to which the sender of the email to be detected belongs, the method further includes: Extract content information of the email to be detected based on the preset email protocol; Determine whether the email to be detected is a malicious email based on the content information; In the case that the email to be detected is not a malicious email, the step of obtaining historical emails of the organization to which the sender of the email to be detected belongs is performed.

9. The method according to claim 8, characterized in that The determining whether the to-be-detected email is a malicious email based on the content information includes: Determine whether the email to be detected is a malicious email based on the content information by using a sandbox detection tool; When it is detected that the email to be detected is not a malicious email, obtaining domain name information in the content information; Based on the pre-stored domain name blacklist and the domain name information, it is determined whether the email to be detected is a malicious email.

10. A mail detection device, characterized in that: The device comprises: An acquisition unit, used for acquiring historical emails of the organization to which the sender of the email to be detected belongs; a determining unit, configured to determine a plurality of attribute information based on first attribute information extracted from the to-be-detected email according to a first preset extraction rule and second attribute information extracted from the historical email according to a second preset extraction rule; The determination unit is further configured to determine whether the to-be-detected email is a malicious email based on the correlation between any two of the plurality of attribute information.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images