Email security detection method and system based on frequency domain and semantic analysis, electronic device, and computer-readable storage medium

Abstract

The present invention belongs to the field of office automation technology and discloses an email security detection method and system based on frequency domain and semantic analysis, an electronic device, and a computer-readable storage medium. The method comprises obtaining an email to be detected and preprocessing images in its attachments; performing a block operation on the preprocessed image, then performing a DCT transform on each block to generate a corresponding DCT coefficient matrix; calculating the high-frequency component entropy value #imgabs0# corresponding to each block based on the DCT coefficient matrix; determining the steganographic suspicion detection result of the email based on the #imgabs1# value; triggering SMTP traffic semantic analysis of the email based on the steganographic suspicion detection result to obtain a comprehensive risk score #imgabs2#; and triggering a multi-level alarm linkage mechanism based on the comprehensive risk score #imgabs3#. The present invention achieves a high detection rate, low latency, and highly adaptable data theft protection for emails, providing reliable technical support for enterprise-level network security.

Description

Technical Field

[0001] The present invention belongs to the technical field of office automation, and in particular relates to an email security detection method and system based on frequency domain and semantic analysis, an electronic device, and a computer-readable storage medium. Background Art

[0002] In office automation systems, email serves as a core communication tool, and its security is directly related to the protection of corporate business data. Existing technologies primarily rely on content filtering, rule engines, or traditional encryption methods for email security management. However, these methods are significantly inadequate for addressing advanced threats, such as steganographic attacks.

[0003] 1. Weak steganography detection capabilities: Existing systems are mostly based on spatial analysis (such as LSB steganography detection).

[0004] The recognition rate is low (for example, the UCID dataset verification rate is only 25%), making it difficult to effectively identify frequency domain steganographic data.

[0005] 2. Insufficient semantic analysis at the protocol layer: SMTP traffic analysis is mostly limited to protocol compliance checks and lacks

[0006] Deep semantic analysis of TLS encrypted traffic cannot intercept the outbound transmission of sensitive words in real time.

[0007] 3. Response mechanisms are isolated and have high latency: Traditional solutions rely on software processing, with detection results and alarm actions being isolated.

[0008] The lack of dynamic linkage results in interception delays of up to 15 seconds. For example, even if an anomaly is detected, manual intervention or step-by-step processing is required for alarm triggering, email blocking, and logging, preventing a multi-level automated response. Furthermore, the synchronization of alarm logs with the security event management system is inefficient, resulting in delayed threat response.

[0009] 4. Weak hardware acceleration support: The existing alarm mechanism is difficult to utilize hardware acceleration technologies such as FPGA / DPDK.

[0010] It cannot meet the stringent real-time requirements (such as millisecond-level response) in office automation scenarios.

[0011] Therefore, there is an urgent need for a technical solution that combines frequency domain analysis, protocol layer semantic analysis and an efficient linkage alarm mechanism to enhance the email security protection capabilities of office automation systems and achieve integrated real-time response of detection, blocking and log synchronization. Summary of the Invention

[0012] The purpose of the present invention is to provide an email security detection method and system based on frequency domain and semantic analysis, an electronic device, and a computer-readable storage medium to solve the email security problem in an automated office environment.

[0013] The present invention provides an email security detection method based on frequency domain and semantic analysis, which includes the following steps:

[0014] Step 1: Get the email to be detected and pre-process the images in its attachments;

[0015] Step 2: Perform block operation on the preprocessed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix;

[0016] Step 3: Calculate the high-frequency component entropy value corresponding to each block according to the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email;

[0017] Step 4: Based on the steganography suspicion detection result, trigger the SMTP traffic semantic analysis of the email to obtain a comprehensive risk score ; The step 4 specifically includes:

[0018] Step 4.1: Decrypt TLS traffic and extract the corresponding plaintext;

[0019] Step 4.2: Real-time matching of sensitive words to obtain sensitive word scores ;

[0020] Step 4.3: Semantic association analysis to obtain semantic scores ;

[0021] Step 4.4: Scoring based on sensitive words and semantic scoring Generate a composite risk score

[0022] ;

[0023] Step 5: Based on the comprehensive risk score , triggering a multi-level alarm linkage mechanism; its specific judgment rules are: when When ≥0.9, a level 1 alarm is triggered, and emails, sound and light alarms, and the center station are notified immediately; when 0.75≤ When <0.9, a secondary alarm is triggered, and a delay of 500ms is used for secondary verification. After confirmation, the log is recorded and the administrator is prompted. When it is less than 0.75, a level 3 alarm is triggered and only logs are recorded for manual review by the administrator.

[0024] The email security detection method based on frequency domain and semantic analysis as described above is further preferably configured such that the preprocessing operation in step 1 is specifically grayscale processing of the image.

[0025] The above-mentioned email security detection method based on frequency domain and semantic analysis is further preferably implemented such that the implementation of step 2 specifically includes the following steps:

[0026] First, the grayscale image is divided into 8×8 blocks; then, a two-dimensional discrete cosine transform (DCT) is performed on each 8×8 block to generate the corresponding 8×8 DCT coefficient matrix.

[0027] The above-mentioned email security detection method based on frequency domain and semantic analysis is further preferably implemented such that the implementation of step 3 specifically includes the following steps:

[0028] Step 3.1: Select high-frequency components: In the 8×8 DCT coefficient matrix, define the high-frequency components as the 20 coefficients located in the lower right corner of the matrix;

[0029] Step 3.2: Calculate the probability distribution: Calculate the normalized probability distribution of the high-frequency component of each block;

[0030] Step 3.3: Based on the probability distribution obtained in step 3.2, calculate the entropy value of the high-frequency component of the block;

[0031] Step 3.4: Count the number of abnormal blocks based on the entropy value of the high-frequency components of the blocks, and determine whether the email is suspected of steganography based on the number of abnormal blocks.

[0032] The email security detection method based on frequency domain and semantic analysis described above is further preferably configured such that the calculation formula for the sensitive word score in step 4.2 is:

[0033]

[0034] in, The weight corresponding to the sensitive word hit; The total number of sensitive words hit; the total number of fragments is the total number of independent processing units into which the complete SMTP email data is split according to logic or fixed size.

[0035] The above-mentioned email security detection method based on frequency domain and semantic analysis is further preferably that the step 4.3 specifically includes: first, using the lightweight BERT-Tiny model to perform a binary classification task on the email body, and outputting a probability value , indicating the confidence level that the email is abnormally sent, where Secondly, context detection is performed. If the text is described as "regular report" but the attachment is an encrypted compressed package, a contradiction mark is made. If the same recipient receives multiple emails containing sensitive words in a short period of time, an abnormal mark is made. Finally, semantic scoring is performed. When a contradiction or abnormal mark appears, Perform dynamic weighting to obtain semantic scores , its dynamic weighted formula is:

[0036]

[0037] in, It is a weighting coefficient that can be dynamically adjusted according to the strategy.

[0038] The above-mentioned email security detection method based on frequency domain and semantic analysis is further preferably configured such that the secondary verification in step 5 specifically includes the following steps:

[0039] Step 5.1: Set the delay window and cache data;

[0040] Step 5.2: Multimodal deep correlation analysis: In this sub-step, a deep correlation analysis is performed by combining frequency domain-semantic cross-validation and behavioral profile matching validation.

[0041] Step 5.3: Dynamically modify the score and decision: The score modification rules are:

[0042]

[0043] Based on the revised rating Upgrade / downgrade the alarm.

[0044] The present invention also discloses an email security detection system based on frequency domain and semantic analysis. The system implements the above-mentioned email security detection method based on frequency domain and semantic analysis. The system specifically includes:

[0045] Preprocessing module: used to obtain the email to be detected and preprocess the images in its attachments;

[0046] DCT coefficient matrix generation module: used to perform block operation on the pre-processed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix;

[0047] Steganalysis suspicion detection module: used to calculate the high-frequency component entropy value corresponding to each block based on the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email;

[0048] Semantic analysis module: used to trigger SMTP traffic semantic analysis of the email based on the steganography suspicion detection results to obtain a comprehensive risk score ;

[0049] Multi-level alarm linkage mechanism: used based on comprehensive risk scoring , triggering multi-level alarms.

[0050] The present invention also discloses an electronic device, comprising one or more processors; a storage device for storing one or more computer programs. When the one or more computer programs are executed by the one or more processors, the electronic device implements the above-mentioned email security detection method based on frequency domain and semantic analysis.

[0051] The present invention also discloses a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor of an electronic device, the electronic device executes the above-mentioned email security detection method based on frequency domain and semantic analysis.

[0052] The beneficial effects of the present invention are as follows: the present invention obtains the mail to be detected, performs preprocessing operation on the image in its attachment; performs block operation on the preprocessed image, and then performs DCT transformation on each block to generate the corresponding DCT coefficient matrix; calculates the high frequency component entropy value corresponding to each block according to the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email; based on the steganography suspicion detection result, trigger the SMTP traffic semantic analysis of the email to obtain a comprehensive risk score ; Based on comprehensive risk score , triggering a multi-level alarm linkage mechanism. Through deep collaboration between frequency domain and semantic dual modalities, innovative hardware acceleration architecture, and multi-level alarm linkage design, this invention achieves a high detection rate, low latency, and highly adaptable data theft protection effect, providing reliable technical support for enterprise-level network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flowchart of the steps of the email security detection method based on frequency domain and semantic analysis;

[0054] Figure 2 A flowchart of the steps for secondary verification of the email security detection method;

[0055] Figure 3 This is a structural diagram of the email security detection system based on frequency domain and semantic analysis. DETAILED DESCRIPTION

[0056] The present invention will be described in detail below through examples.

[0057] To further illustrate the technical means and effectiveness of the present invention in achieving its intended objectives, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effectiveness of the email security detection method and system based on frequency domain and semantic analysis proposed by the present invention. In the following description, references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0058] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0059] The specific scheme of the email security detection method and system based on frequency domain and semantic analysis provided by the present invention is described in detail below with reference to the accompanying drawings.

[0060] See also Figure 1 , which shows a flowchart of the steps of an email security detection method based on frequency domain and semantic analysis provided by an embodiment of the present invention, such as Figure 1 As shown, the email security detection method based on frequency domain and semantic analysis provided in the embodiment of the present application includes the following steps 1 to 5:

[0061] Step 1: Get the email to be detected and pre-process the images in its attachments;

[0062] It should be noted that the image format in the email attachment can be JPEG, PNG, etc. During the preprocessing operation, the image in the attachment needs to be grayscale processed and uniformly converted into 8-bit grayscale image to simplify subsequent operations.

[0063] Step 2: Perform block operation on the preprocessed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix;

[0064] It should be noted that the grayscaled image is partitioned into 8×8 blocks. For example, a 1024×1024 image will be divided into 16,384 blocks, each consisting of non-overlapping 8×8 pixel blocks. The 8×8 block size is chosen for computational efficiency and high-frequency component localization. DCT transform complexity is exponentially related to block size, and 8×8 is a universal standard for balancing computational efficiency and frequency domain resolution. The lower right region of the 8×8 matrix concentrates on high-frequency information in the image, making it suitable for detecting subtle perturbations introduced by steganography.

[0065] Perform a two-dimensional discrete cosine transform (DCT) on each 8×8 block to generate the corresponding 8×8 DCT coefficient matrix. The DCT formula is as follows:

[0066]

[0067] Among them, C(u) and C(v) are normalization coefficients. (when u,v=0), otherwise 1; It is the grayscale value of the pixel in the mth row and nth column in the block; u and v represent the frequency components of the image block in the horizontal and vertical directions respectively.

[0068] Step 3: Calculate the high-frequency component entropy value corresponding to each block according to the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email;

[0069] It should be noted that: First, the high-frequency components are selected: in the 8×8 DCT coefficient matrix, the high-frequency components are defined as the 20 coefficients located in the lower right corner of the matrix, and their positions meet This region is more sensitive to noise introduced by the steganographic operation and has a naturally low energy characteristic, making it easier to detect abnormal entropy fluctuations.

[0070] Secondly, calculate the probability distribution: calculate the normalized probability distribution of the high-frequency components of each block. Assume that the 20 high-frequency coefficients are , the specific method is:

[0071] Take the absolute value of the 20 high-frequency coefficients of each block and get , , , ;

[0072] Calculate the probability of each coefficient:

[0073]

[0074] This calculation process is to convert the energy distribution of high-frequency components into a probability distribution and eliminate the influence of energy differences in the image content itself.

[0075] Calculate entropy:

[0076] Calculate the entropy value of the high-frequency component based on the probability distribution obtained by the above calculation process:

[0077]

[0078] Here, we use the logarithm with base 2 to make the entropy value unit bit, which is convenient for unified quantization. For the threshold setting, the UCID dataset experiment verifies that the normal image The mean value is about 5.1, and the introduction of random noise in the steganographic image leads to a uniform probability distribution and a significant increase in entropy.

[0079] The process of judging the suspected steganography based on the calculated block entropy value is as follows:

[0080] If the entropy value of a block satisfies , then mark the block as an abnormal block;

[0081] When the proportion of abnormal blocks in a single image exceeds the preset threshold (the default setting is ), and determined that the image is suspected of steganography.

[0082]

[0083] Step 4: Based on the steganography suspicion detection results, trigger the SMTP traffic semantic analysis of the email to obtain a comprehensive risk score ;

[0084] It should be noted that when an email is suspected of steganography, SMTP traffic semantic analysis of the email is triggered. The specific steps are as follows:

[0085] Step 4.1: Decrypt TLS traffic and extract the corresponding plaintext;

[0086] First, the SMTP traffic of the email is intercepted at the enterprise egress gateway to identify the TLS encrypted session (port 465 or 587). Then, a pre-deployed TLS MitM Proxy is used to decrypt the traffic and extract the application layer plaintext data, such as the email body and attachment metadata. Finally, the decrypted data is temporarily stored in a cache area (based on the DPDK memory pool, with low read and write latency). 1ms), for subsequent semantic analysis module to call.

[0087] Step 4.2: Real-time matching of sensitive words to obtain sensitive word scores ;

[0088] First, load the keyword library: synchronize the Top 500 sensitive word library from the cloud to the local FPGA on-chip memory, and update the cycle 5 minutes, with the vocabulary formatted as a hash table (SHA-256 index). The parallel matching engine then uses FPGA hardware acceleration for multi-threaded keyword scanning, with each thread independently processing a single email segment. The matching logic performs regular expression matching on the email body, attachment names, and metadata, marking any matches as anomalies. Email segmentation here refers to the logical or fixed-size division of the complete SMTP email data (including the decrypted body, attachment metadata, etc.) into multiple independent processing units, enabling efficient parallel processing through multi-threading and hardware acceleration. Its core design goal is to improve semantic analysis throughput while ensuring accurate keyword matching and low latency.

[0089] At the same time, in order to take into account the subsequent multi-level linkage alarms, it is necessary to define and assign the weights of sensitive words here.

[0090] Specifically, the definition and assignment method of sensitive word weights are as follows:

[0091] Weight classification:

[0092] Static weight: A fixed weight is preset for each sensitive word based on the enterprise security policy, reflecting its risk level, as shown in the following table:

[0093]

[0094] Dynamic weighting: Dynamic adjustment based on context and historical data: (1) Word frequency weighting: The weight of sensitive words that appear frequently in the recent period is increased, such as weight × 1.2; (2) Combination enhancement: The weight of sensitive word combinations, such as "patent number + amount", is superimposed, such as .

[0095] Weight storage and update:

[0096] The sensitive word library is stored in the BRAM on the FPGA chip in the form of a hash table (key: sensitive word SHA-256 digest, value: weight); the cloud synchronizes the updated strategy to the local server every 3 minutes to ensure real-time performance.

[0097] Based on the weights corresponding to the above-mentioned sensitive words, the sensitive word score is calculated. The specific calculation formula is:

[0098]

[0099] It should be noted that the sensitive word scores are normalized according to the number of shards to avoid weight bias in long emails. Distortion; for example, if the weight range of sensitive words is large (such as high-risk words , low-risk words ), multiple hits on low-risk keywords in long emails can lead to an inflated total score, disrupting risk assessment. Of course, in the above calculation formula, since the total weights of sensitive keywords vary across emails, directly dividing by the total number of shards may not eliminate the impact of differences in absolute weights. Therefore, we can introduce a "total weight sum" to the above formula to perform "normalization."

[0100] Step 4.3: semantic association analysis;

[0101] NLP model selection

[0102] Model architecture: A lightweight BERT-Tiny model (4-layer Transformer, 4.3M parameters) is used, adapted for hardware acceleration; the lightweight BERT-Tiny model performs a binary classification task on the email body and outputs a probability value between 0 and 1 ( ), indicating the confidence level that the email was sent abnormally.

[0103] For example:

[0104]

[0105] Input processing: (1) The email body is truncated to 512 words after word segmentation and a token sequence is generated; (2) metadata features are attached, such as sender credibility, attachment type, etc.

[0106] Output logic: The model generates a probability value using the Softmax or Sigmoid function, reflecting the degree of match between the email content and the abnormal samples in the training data.

[0107] Semantic Risk Identification

[0108] Intent classification: outputs the probability of email intent and normal / abnormal outgoing messages;

[0109] Context detection: (1) If the body of the email is described as a “regular report” but the attachment is an encrypted compressed package, it will be marked as a contradiction; (2) If the same recipient receives multiple emails containing sensitive words within a short period of time, it will be marked as an anomaly.

[0110] Semantic scoring

[0111] (1) The model output is a probability between 0 and 1, indicating the risk of abnormal outward transmission;

[0112] (2) When contradictions or abnormal marks appear, the score is weighted and improved. The weighted improvement rule is as follows:

[0113] When a contextual inconsistency is detected (e.g., a conflict between the body description and the attachment type) or an abnormal frequency (e.g., the same recipient receives multiple emails containing sensitive words within a short period of time), the original score is dynamically weighted:

[0114]

[0115] in, is a weighting coefficient (such as 1.5), which can be dynamically adjusted according to the strategy, while the min function ensures that the score does not exceed 1.0.

[0116] Step 4.4: Scoring based on sensitive words and semantic scoring Generate a composite risk score ;

[0117] Sensitive word score obtained by combining the above calculations and semantic scoring Generate a composite risk score , and its specific calculation formula is:

[0118]

[0119] in, The initial value is 0.7, which represents the coefficient corresponding to the sensitive word score. At the same time, its value can be dynamically adjusted according to corporate strategies, such as increasing it to 0.8 during high-risk periods.

[0120] Step 5: Based on the comprehensive risk score , triggering a multi-level alarm linkage mechanism.

[0121] Based on the comprehensive risk score , combined with the predetermined multi-level thresholds for judgment, the specific judgment rules are:

[0122]

[0123] Furthermore, another embodiment of the present invention provides a method for dynamically adjusting alarm priority, the specific process of which is as follows:

[0124] When the frequency domain is abnormal ( ) and semantic score , it is upgraded to a level one alarm;

[0125] When only the frequency domain is abnormal but the semantic score is low ( ), it is downgraded to level 3 alarm.

[0126] See also Figure 2 , which shows a flowchart of the steps of secondary verification provided by another embodiment of the present invention, such as Figure 2 As shown, the secondary verification method provided in the embodiment of the present application includes the following steps 1 to 3:

[0127] Step 1: Set the delay window and cache data

[0128] Delay time: Set a time window of 500ms to suspend the blocking action. During this time, the email data is cached in high-speed memory (such as the DPDK memory pool);

[0129] Cached content: includes the decrypted email body, attachment metadata, and preliminary detection results (sensitive word hit records, frequency domain entropy values, etc.).

[0130] Step 2: Multimodal deep correlation analysis

[0131] In this step, we use a combination of two methods to perform deep correlation analysis: frequency domain-semantic cross-validation and behavioral profile matching. The specific operations are as follows:

[0132] Frequency domain-semantic cross validation, the steps are as follows: (1) If the frequency domain detection is abnormal , force triggering deep parsing of the attachment: using OCR to extract hidden text in the image; checking whether the attachment hash value matches the known malicious file library. (2) If the semantic score is abnormal , upgrade the NLP model (such as switching from BERT-Tiny to BERT-Base), and re-analyze potential contradictions in the email body (such as the conflict between "regular report" and additional encryption behavior).

[0133] Behavioral profile matching, the steps are as follows: real-time query sender historical behavior database, evaluate the following indicators: (1) sending frequency: the number of similar emails in the past hour; (2) recipient reputation: whether the target mailbox is a high-risk external domain name (such as personal Gmail, unknown corporate domain name); (3) permission verification: whether the sender has the permission to send sensitive data externally.

[0134] Step 3: Dynamically revise scoring and decision making

[0135] Rating correction rules:

[0136]

[0137] Among them, multimodal contradictions include the following situations, as described: (1) High risk of frequency domain detection ( ): Image attachments are suspected of steganography; semantic detection shows low risk ( ): The email body does not contain any sensitive words, and the intent is classified as normal. Contradictory manifestation: The carrier (attachment) shows obvious signs of tampering, but the outgoing intent is not abnormal. It is possible that the attacker deliberately disguised the body to cover up the steganographic behavior. (2) Semantic detection high risk ( ): The text contains high-risk sensitive words (such as "patent number"), and the intent is classified as abnormal outbound; the frequency domain detection is normal ( ): The attachment has no steganographic features. Contradictory manifestations: The email content clearly indicates a data leak, but no tampering has been found in the carrier. This may be sensitive information sent in plain text or a new steganographic technique to evade detection.

[0138] Alarm upgrade / downgrade

[0139] (1) If , it will be upgraded to a level one alarm and immediately blocked;

[0140] (2) If , then maintain the second-level alarm, record the log and prompt the administrator;

[0141] (3) If , downgraded to level 3 warning, only logs are recorded.

[0142] The actual application scenarios are as follows:

[0143] Scenario: Sensitive words appear frequently but have ambiguous meanings

[0144] Preliminary testing:

[0145] Sensitive word score: 0.7 (5 hits for the medium-risk word "internal documents"); Semantic score: 0.6 (the text is described as "department shared information"); Comprehensive risk score: ,but ,At this time, the second-level alarm threshold has not been reached, but the secondary verification is triggered due to ,abnormal sending frequency.

[0146] Secondary verification:

[0147] 1. The behavior profile shows that the sender sent 10 similar emails to external domains in the past hour;

[0148] 2. Upgrading the NLP model found a discrepancy between the "shared data" in the text and the attachment type (encrypted compressed package);

[0149] 3. Corrected score , a level 2 alarm is triggered, a log is recorded, and an administrator is prompted.

[0150] See also Figure 3 , which shows a structural diagram of an email security detection system based on frequency domain and semantic analysis provided by another embodiment of the present invention, such as Figure 3 As shown, the email security detection system based on frequency domain and semantic analysis provided by the embodiment of the present application includes: a preprocessing module, a DCT coefficient matrix generation module, a steganography suspicion detection module, a semantic analysis module and a multi-level alarm linkage mechanism, wherein:

[0151] Preprocessing module: used to obtain the email to be detected and preprocess the images in its attachments;

[0152] It should be noted that the image format in the email attachment can be JPEG, PNG, etc. During the preprocessing operation, the image in the attachment needs to be grayscale processed and uniformly converted into 8-bit grayscale image to simplify subsequent operations.

[0153] DCT coefficient matrix generation module: used to perform block operation on the pre-processed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix;

[0154] It should be noted that the specific implementation process is basically the same as step 2 in the above detection method, and will not be repeated here.

[0155] Steganalysis suspicion detection module: used to calculate the high-frequency component entropy value corresponding to each block based on the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email;

[0156] It should be noted that the specific implementation process is basically the same as step 3 in the above detection method, and will not be repeated here.

[0157] Semantic analysis module: used to trigger SMTP traffic semantic analysis of the email based on the steganography suspicion detection results to obtain a comprehensive risk score ;

[0158] It should be noted that the specific implementation process is basically the same as step 4 in the above detection method, and will not be repeated here.

[0159] Multi-level alarm linkage mechanism: used based on comprehensive risk scoring , triggering multi-level alarms.

[0160] It should be noted that the specific implementation process is basically the same as step 5 in the above detection method, and will not be repeated here.

[0161] The email security detection method and system based on frequency domain and semantic analysis provided by the present invention achieve the following technical effects: through deep collaboration of frequency domain and semantic dual modalities, hardware acceleration architecture innovation and multi-level alarm linkage design, it achieves high detection rate, low latency and strong adaptability of data theft protection effect, providing reliable technical guarantee for enterprise-level network security.

[0162] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, hard disk, tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0163] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principles and purpose of the present invention.

Claims

1. A method for email security detection based on frequency domain and semantic analysis, characterized in that: The method comprises the following steps: Step 1: Get the email to be detected and pre-process the images in its attachments; Step 2: Perform block operation on the preprocessed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix; Step 3: Calculate the high-frequency component entropy value corresponding to each block according to the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email; Step 4: Based on the steganography suspicion detection result, trigger the SMTP traffic semantic analysis of the email to obtain a comprehensive risk score ; The step 4 specifically includes: Step 4.1: Decrypt TLS traffic and extract the corresponding plaintext; Step 4.2: Real-time matching of sensitive words to obtain sensitive word scores ; Step 4.3: Semantic association analysis to obtain semantic scores ; Step 4.4: Scoring based on sensitive words and semantic scoring Generate a composite risk score ; Step 5: Based on the comprehensive risk score , triggering a multi-level alarm linkage mechanism; its specific judgment rules are: when When ≥0.9, a level 1 alarm is triggered, and emails, sound and light alarms, and the center station are notified immediately; when 0.75≤ When the value is less than 0.9, a secondary alarm is triggered and a secondary verification is performed. After confirmation, a log is recorded and the administrator is prompted. When it is less than 0.75, a level 3 alarm is triggered and only logs are recorded for manual review by the administrator.

2. The email security detection method based on frequency domain and semantic analysis according to claim 1 is characterized in that: The preprocessing operation in step 1 is specifically to perform grayscale processing on the image.

3. The email security detection method based on frequency domain and semantic analysis according to claim 2 is characterized in that: The implementation of step 2 specifically includes the following steps: First, the grayscale image is divided into 8×8 blocks; then, a two-dimensional discrete cosine transform (DCT) is performed on each 8×8 block to generate the corresponding 8×8 DCT coefficient matrix.

4. The email security detection method based on frequency domain and semantic analysis according to claim 3 is characterized in that: The implementation of step 3 specifically includes the following steps: Step 3.1: Select high-frequency components: In the 8×8 DCT coefficient matrix, define the high-frequency components as the 20 coefficients located in the lower right corner of the matrix; Step 3.2: Calculate the probability distribution: Calculate the normalized probability distribution of the high-frequency component of each block; Step 3.3: Based on the probability distribution obtained in step 3.2, calculate the entropy value of the high-frequency component of the block; Step 3.4: Count the number of abnormal blocks based on the entropy value of the high-frequency components of the blocks, and determine whether the email is suspected of steganography based on the number of abnormal blocks.

5. The email security detection method based on frequency domain and semantic analysis according to claim 4 is characterized in that: The calculation formula for the sensitive word score in step 4.2 is: in, The weight corresponding to the sensitive word hit; The total number of sensitive words hit; the total number of fragments is the total number of independent processing units into which the complete SMTP email data is split according to logic or fixed size.

6. The email security detection method based on frequency domain and semantic analysis according to claim 5, It is characterized in that The step 4.3 specifically includes: first, using the lightweight BERT-Tiny model to perform a binary classification task on the email body and output the probability value , indicating the confidence level that the email is abnormally sent, where Secondly, context detection is performed. If the body text is described as "regular report" but the attachment is an encrypted compressed package, a contradiction mark is made. If the same recipient receives multiple emails containing sensitive words in a short period of time, an abnormal mark is made. Finally, semantic scoring is performed. When a contradiction or abnormal mark appears, Perform dynamic weighting to obtain semantic scores , its dynamic weighted formula is: in, It is a weighting coefficient that can be dynamically adjusted according to the strategy.

7. The email security detection method based on frequency domain and semantic analysis according to claim 6 is characterized in that: The secondary verification in step 5 specifically includes the following steps: Step 5.1: Set the delay window and cache data; Step 5.2: Multimodal deep correlation analysis: In this sub-step, a deep correlation analysis is performed by combining frequency domain-semantic cross-validation and behavioral profile matching validation. Step 5.3: Dynamically modify the score and decision: The score modification rules are: Based on the revised rating Upgrade / downgrade the alarm.

8. An email security detection system based on frequency domain and semantic analysis, the system executing the email security detection method based on frequency domain and semantic analysis as described in any one of claims 1 to 7, characterized in that: The system specifically includes: Preprocessing module: used to obtain the email to be detected and preprocess the images in its attachments; DCT coefficient matrix generation module: used to perform block operation on the pre-processed image, and then perform DCT transformation on each block to generate the corresponding DCT coefficient matrix; Steganalysis suspicion detection module: used to calculate the high-frequency component entropy value corresponding to each block based on the DCT coefficient matrix ;according to The value determines the steganography suspicion detection result of the email; Semantic analysis module: used to trigger SMTP traffic semantic analysis of the email based on the steganography suspicion detection results to obtain a comprehensive risk score ; Multi-level alarm linkage mechanism: used based on comprehensive risk scoring , triggering multi-level alarms.

9. An electronic device, characterized in that: It includes one or more processors; a storage device for storing one or more computer programs, and when the one or more computer programs are executed by the one or more processors, the electronic device implements the email security detection method based on frequency domain and semantic analysis as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of an electronic device, the electronic device executes the email security detection method based on frequency domain and semantic analysis as described in any one of claims 1 to 7.

Images