Phishing mail identification method, device, equipment and program product
By obtaining and verifying the sender information and email text of the phishing email, and combining the neural network model to analyze the content and attachments of the phishing email, the accuracy and comprehensiveness of the traditional recognition method are solved, ensuring the timely identification and processing of phishing emails.
Patent Information
- Application Number
- CN202510488196.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-17
- Publication Date
- 2025-07-25
AI Technical Summary
When identifying phishing emails in traditional ways, the identification results are not accurate and comprehensive enough to effectively protect the security of user information.
By obtaining the first information, second information and email text of the sender of the target email, verify whether the email is a phishing email, and when confirming it is a phishing email, extract the text content and attachments of the phishing email, output the recognition analysis results, and use preset templates and neural network models for analysis.
It realizes comprehensive and accurate identification of phishing emails, ensuring that recipients can process phishing emails in a timely manner and protect information security.
Smart Images
Figure CN120378152A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and particularly to a method, device, equipment and program product for identifying phishing emails. Background Art
[0002] A phishing email refers to an email that uses a disguised email to deceive the recipient into replying with information such as an account number and password to a specified recipient; or to guide the recipient to connect to a specially designed web page, which usually disguises itself as a real website, such as a bank or financial management web page, making the login user believe it is real and inputting credit card or bank card numbers, account names, passwords, etc. and thus being stolen.
[0003] In recent years, with the popularization of the Internet and email, phishing emails, as a widespread network attack means, have brought serious security threats to enterprises and individual users. Phishing emails use social engineering techniques to induce recipients to click on malicious links, download malicious attachments or provide personal sensitive information by disguising emails as legitimate sources, resulting in problems such as financial losses, data breaches and system infections. Therefore, in order to ensure user information security, it is necessary to identify phishing emails. However, when identifying phishing emails in traditional ways, there are generally problems of inaccurate and incomplete identification results. Summary of the Invention
[0004] In view of this, the present invention provides a method, device, equipment and program product for identifying phishing emails to solve the problems that traditional ways generally have inaccurate and incomplete identification results when identifying phishing emails.
[0005] In a first aspect, the present invention provides a method for identifying a phishing email, the method comprising:
[0006] Obtaining the email content of the target email, the email content including: the first information of the sender, the second information of the sender, the email body and the email attachment;
[0007] Verifying whether the target email is a phishing email according to the first information of the sender, the second information of the sender and the email body;
[0008] When the target email is a phishing email, extracting the text content of the phishing email according to a first preset template and outputting the identification and analysis result of the phishing email;
[0009] Identifying the email attachment of the phishing email according to the identification and analysis result of the phishing email.
[0010] In the phishing email recognition method according to the embodiments of the present disclosure, since the first information of the sender, the second information of the sender, and the email body are fully verified, the text content of the phishing email is further extracted for the verified phishing email, and the recognition and analysis result of the phishing email is output. Finally, the email attachment of the phishing email is combined. Therefore, the method according to the embodiments of the present disclosure can comprehensively and accurately recognize phishing emails.
[0011] In some alternative embodiments, after the step of recognizing the email attachment of the phishing email, the method further includes:
[0012] Mark the phishing email;
[0013] Push the phishing email to the recipient according to a second preset template through a communication tool.
[0014] The embodiments of the present disclosure push the phishing email to the recipient, which is beneficial for the recipient to process the phishing email in a timely manner, thereby ensuring the information security of the recipient.
[0015] In some alternative embodiments, the first information of the sender includes the forged email address of the sender and the real email address of the sender, the second information of the sender includes the email domain name of the sender and the email domain names added to the whitelist, the email body includes the email content of the sender and the identification information added to the blacklist, and the identification information includes: name, ID number, company, bank card number, password;
[0016] Verifying whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body includes:
[0017] Verify whether the forged email address is consistent with the real email address;
[0018] When the forged email address is consistent with the real email address, obtain the email domain name with the maximum length from the email domain names in the whitelist, and verify whether the email domain name with the maximum length is consistent with the email domain name of the sender;
[0019] When the email domain name with the maximum length is consistent with the email domain name of the sender, verify whether the email content of the sender contains at least two identifications in the identification information;
[0020] When the email content of the sender contains at least two identifications in the identification information, determine that the target email is a phishing email;
[0021] When the email domain name with the maximum length is inconsistent with the email domain name of the sender, determine that the target email is a phishing email;
[0022] When the email content of the sender does not contain at least two identifications in the identification information, determine that the target email is not a phishing email.
[0023] In the phishing email recognition method according to the embodiments of the present disclosure, since the forged email address of the sender is fully verified with the real email address, the email domain name of the sender with the email domain names added to the whitelist, and the email content of the sender and the identification information added to the blacklist, phishing emails can ultimately be comprehensively and accurately recognized.
[0024] In some alternative embodiments, verifying whether the email domain name with the maximum length is consistent with the email domain name of the sender includes:
[0025] Obtaining the i-th identifier in the email domain name of the sender and the i-th identifier in the email domain name with the maximum length;
[0026] Verifying whether the i-th identifier in the email domain name of the sender is consistent with the i-th identifier in the email domain name with the maximum length;
[0027] When the i-th identifier in the email domain name of the sender is consistent with the i-th identifier in the email domain name with the maximum length, marking the i-th identifier in the email domain name of the sender as the binary value 0;
[0028] When the i-th identifier in the email domain name of the sender is inconsistent with the i-th identifier in the email domain name with the maximum length, marking the i-th identifier in the email domain name of the sender as the binary value 1;
[0029] According to the numerical marking result of the i-th identifier in the email domain name of the sender, calculating the total value of the n identifiers in the email domain name of the sender;
[0030] When the total value of the n identifiers in the email domain name of the sender is less than or equal to a preset threshold, determining that the email domain name with the maximum length is consistent with the email domain name of the sender;
[0031] When the total value of the n identifiers in the email domain name of the sender is greater than the preset threshold, determining that the email domain name with the maximum length is inconsistent with the email domain name of the sender.
[0032] Through the above method, the embodiments of the present disclosure can accurately verify whether the email domain name with the maximum length in the email domain names added to the whitelist is consistent with the email domain name of the sender.
[0033] In some alternative embodiments, the first preset template presents the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation result of the email body in a semi-structured data format;
[0034] When the target email is a phishing email, extracting the text content of the target email according to the first preset template and outputting the recognition and analysis result of the phishing email, including:
[0035] When the target email is a phishing email, extract the text content of the target email through the target text recognition model according to the first preset template to obtain the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password in the email body. Among them, the target text recognition model is a neural network model pre-trained;
[0036] Take the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password in the email body as the recognition and analysis result of the phishing email, and output the recognition and analysis result of the phishing email.
[0037] Through the above method, the embodiments of the present disclosure are beneficial to immediately output the recognition and analysis result of the phishing email and ensure the information security of the recipient.
[0038] In some alternative embodiments, identify the email attachment of the phishing email according to the recognition and analysis result of the phishing email, including:
[0039] When the phishing email does not carry a password, use a sandbox to identify the email attachment of the phishing email;
[0040] When the phishing email carries a password, use the consultation password in the email body to decompress the email attachment of the phishing email to obtain the email file of the phishing email;
[0041] Obtain the current suffix name of the email file of the phishing email;
[0042] When the current suffix name of the email file of the phishing email is a preset suffix name, use a sandbox to identify the email file of the phishing email.
[0043] Through the above method, the embodiments of the present disclosure are beneficial to accurately identify the email attachment of the phishing email.
[0044] In some alternative embodiments, the second preset template presents the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email in an unstructured data format;
[0045] Push the phishing email to the recipient according to the second preset template through a communication tool, including:
[0046] Push the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email to the recipient according to the second preset template through a communication tool.
[0047] Through the above method, the embodiments of the present disclosure are beneficial to push the phishing email to the recipient, beneficial to the recipient to immediately process the phishing email, and further ensure the information security of the recipient.
[0048] Second aspect, the present invention provides a phishing email recognition device, which includes:
[0049] An acquisition module, configured to acquire the content of a target email, where the email content includes: the first information of the sender, the second information of the sender, the email body, and the email attachment;
[0050] A verification module, configured to verify whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body;
[0051] An output module, configured to, when the target email is a phishing email, extract the text content of the target email according to a first preset template and output the recognition and analysis result of the phishing email;
[0052] An identification module, configured to identify the email attachment of the phishing email according to the recognition and analysis result of the phishing email.
[0053] Third aspect, the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the phishing email recognition method according to the first aspect or any corresponding embodiment thereof.
[0054] Fourth aspect, the present invention provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to cause a computer to execute the phishing email recognition method according to the first aspect or any corresponding embodiment thereof. Description of the Drawings
[0055] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.
[0056] Figure 1 is a schematic flowchart of a phishing email recognition method according to an embodiment of the present invention;
[0057] Figure 2 is a schematic flowchart of another phishing email recognition method according to an embodiment of the present invention;
[0058] Figure 3 is a schematic flowchart of yet another phishing email recognition method according to an embodiment of the present invention;
[0059] Figure 4It is a schematic flowchart of another phishing email recognition method according to an embodiment of the present invention;
[0060] Figure 5 It is a schematic flowchart of another phishing email recognition method according to an embodiment of the present invention;
[0061] Figure 6 It is a structural block diagram of a phishing email recognition device according to an embodiment of the present invention;
[0062] Figure 7 It is a schematic hardware structure diagram of a computer device according to an embodiment of the present invention. Detailed implementation manners
[0063] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.
[0064] According to an embodiment of the present invention, an embodiment of a phishing email recognition method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order from that here.
[0065] In this embodiment, a phishing email recognition method is provided, which can be used in the above computer devices, such as mobile phones, tablet computers, desktop computers, portable laptops, servers, etc. Figure 1 It is a flowchart of a phishing email recognition method according to an embodiment of the present invention, as Figure 1 shown, and the process includes the following steps:
[0066] Step S101, obtain the email content of the target email, where the email content includes: the first information of the sender, the second information of the sender, the email body, and the email attachment.
[0067] Specifically, the target email can be an email sent by any sender or an email from the email gateway. Therefore, the target email can be collected for personal user emails through the email password, and the target email can also be collected for all emails at the email gateway, that is, the acquisition methods of the target email include but are not limited to the acquisition method through the email password, the acquisition method through the email gateway, etc.
[0068] The email content of the target email usually includes the following fields: Subject, To, Sender, From (from the forged sender), X-Real-From (from the real sender), X-Originating-IP (email header), multi-part message (each part of the information in the email). For example, according to the multi-part message, the text information of the email content, the complete html information of the email, the email attachments, and the sender information can be obtained. For example, the sender information includes the subject, email domain name, source IP, etc.
[0069] In a specific example, the first information of the sender includes: the forged email address of the sender and the real email address of the sender. The second information of the sender includes: the email domain name of the sender and the email domain names added to the whitelist. The email body includes: the email content of the sender and the identification information added to the blacklist. The identification information includes: name, ID number, company, bank card number, password.
[0070] The forged email address of the sender is the email address displayed in From, and the real email address of the sender is the email address displayed in X-Real-From. The email domain names of the sender are, for example, ctymun.cn and ctyun.com. The email domain names added to the whitelist are respectively: company1.com, company2.com, company3.com, company3.com. The email content of the sender is the text information in the sender's email, and the identification information added to the blacklist can be identification such as name, ID number, company, bank card number, password.
[0071] The email attachment is a file or compressed file added to the target email.
[0072] Step S102, verify whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body.
[0073] Since the first information of the sender includes: the forged email address of the sender and the real email address of the sender. The second information of the sender includes: the email domain name of the sender and the email domain names added to the whitelist. The email body includes: the email content of the sender and the identification information added to the blacklist. The identification information includes: name, ID number, company, bank card number, password.
[0074] Therefore, the first information of the sender, the second information of the sender, and the email body are verified in sequence, that is, the forged email address of the sender and the real email address of the sender, the email domain name of the sender and the email domain name added to the whitelist, and the email content of the sender and the identification information added to the blacklist are verified for matching. When the first information of the sender, the second information of the sender, or the email body does not match, it indicates that the target email is a phishing email. When the first information of the sender matches, the second information of the sender is then verified. When the second information of the sender matches, it is verified whether the email body matches. When the email body does not match, it indicates that the target email is a phishing email.
[0075] Step S103, when the target email is a phishing email, extract the text content of the target email according to the first preset template and output the identification and analysis result of the phishing email.
[0076] In a specific example, the first preset template presents the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation result of the email body in a semi-structured data format.
[0077] The semi-structured data format includes but is not limited to JSON, XML format, etc. The analysis reason of the phishing email is to analyze the specific reason why the first information of the sender, the second information of the sender, or the email body in the above example does not match. The measures taken for the phishing email can be some suggested measures or interception means, etc. The consultation result of the email body can be the specific analysis result of the phishing email.
[0078] In some optional implementation manners, in the above step S103, when the target email is a phishing email, extract the text content of the phishing email according to the first preset template and output the identification and analysis result of the phishing email, including:
[0079] Step a1, when the target email is a phishing email, extract the text content of the target email through the target text recognition model according to the first preset template to obtain the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password of the email body. Among them, the target text recognition model is a neural network model pre-trained.
[0080] The target text recognition model can be an LLM text recognition model, and this target text recognition model is a neural network model pre-trained. The LLM text recognition model can adopt the Qwen open-source large model.
[0081] The text content of the target email can be the email information input by the user. For example, the email information input by the user is "You are an emergency response security expert. I received an email from a sender with the email domain name %s. My domain name whitelist contains the domain name %s. Please compare the sender's email domain name with the domain name in the domain name whitelist in detail. The content of the email is: %s. Is this a phishing email? Please check if there is a password in it. The result of the answer should be in JSON format as follows: {The determination result of the phishing email is phishing email, the analysis reason of the phishing email: the measures taken for the phishing email: the consultation password in the email body}.
[0082] Through testing, the target text recognition model can excellently generate data in JSON format and does not need to be modified later. The user inputs the real email information of the sender at X-Real-From, then inputs the domain name whitelist information that has been built-in, and finally inputs the initial format html file.
[0083] Step a2, regard the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password in the email body as the recognition and analysis result of the phishing email, and output the recognition and analysis result of the phishing email.
[0084] For example: The recognition and analysis result of the phishing email is:
[0085] {
[0086] "The determination result of the phishing email": "yes",
[0087] "The analysis reason of the phishing email": "The email source does not match the domain name whitelist (admin@chintalacam.com instead of chinatelecom.cn), and the email contains unknown links and pictures, which may be phishing behavior.",
[0088] "The measures taken for the phishing email": "It is recommended not to click on the links in the email or download the attachments, and the authenticity of the email should be confirmed by directly accessing the company's internal system or contacting the administrator.",
[0089] "The consultation password in the email body": "sdfds%@245"
[0090] }
[0091] Through the above target text recognition model, the determination result is a phishing email!
[0092] Step S104, identify the email attachments of the phishing email according to the recognition and analysis result of the phishing email.
[0093] In some alternative embodiments, in step S104, according to the recognition and analysis results of phishing emails, the email attachments of phishing emails are recognized, including:
[0094] Step b1, when the phishing email does not carry a password, use a sandbox to recognize the email attachment of the phishing email.
[0095] In general tests, the attachments in emails exist in two forms: one is a passwordless attachment. For passwordless attachments, a sandbox can be used to recognize the email attachments of phishing emails.
[0096] Step b2, when the phishing email carries a password, use the password query in the email body to decompress the email attachment of the phishing email to obtain the email file of the phishing email.
[0097] The password query is sdfds%@245 in the above example.
[0098] Step b3, obtain the current file extension of the email file of the phishing email.
[0099] Step b4, when the current file extension of the email file of the phishing email is a preset file extension, use a sandbox to recognize the email file of the phishing email.
[0100] The preset file extensions include but are not limited to exe, bat, msi, lnk, vbs, msh, doc, docx, ppt, pptx, pdf, etc.
[0101] For example, for password-protected attachments, perform a decompression operation with the password query sdfds%@245 in the above example. Identify the file extension after decompression. If the current file extension of the email file of the phishing email matches the preset file extension: [exe, bat, msi, lnk, vbs, msh, doc, docx, ppt, pptx, pdf], the file is uploaded to the sandbox for detection. Taking the sandbox 1 analysis platform as an example, its detection status is: "malicious file", "detecting", "waiting", "no alarm". When encountering "detecting" or "waiting", wait for 5 seconds and then query again.
[0102] Generally speaking, the detection results of only one sandbox are not completely accurate. At this time, it can be uploaded to other sandboxes for detection. If the detection result of any sandbox is a malicious file, then the email is a malicious email.
[0103] In the phishing email recognition method according to the embodiments of the present disclosure, since the first information of the sender, the second information of the sender, and the email body are fully verified, the text content of the phishing email is further extracted for the verified phishing email, and the recognition and analysis results of the phishing email are output. Finally, the email attachment of the phishing email is combined. Therefore, the method according to the embodiments of the present disclosure can comprehensively and accurately identify phishing emails.
[0104] In this embodiment, a phishing email recognition method is provided for the above-mentioned computer devices, such as mobile phones, tablet computers, desktop computers, portable notebooks, servers, etc. Figure 2 It is a flowchart of the phishing email recognition method according to the embodiments of the present invention, as Figure 2 shown, and the process includes the following steps:
[0105] After the step S104 of recognizing the email attachment of the phishing email, it further includes:
[0106] Step S105, marking the phishing email.
[0107] Step S106, pushing the phishing email to the recipient according to a second preset template through a communication tool.
[0108] In a specific example, the second preset template presents the email address of the sender, the email subject, the recognition and analysis results of the phishing email, and the recognition results of the email attachment of the phishing email in an unstructured data format.
[0109] The unstructured data format includes pictures of text content, PDF documents, WORD documents, etc.
[0110] For example, the phishing email is marked through the mail gateway, and a mark ["Phishing Email"] is made at the personal email push place.
[0111] The above-mentioned communication tool includes but is not limited to communication tools such as Enterprise WeChat and DingTalk.
[0112] For example, the push result of the phishing email is as follows:
[0113] It is a phishing email,
[0114] This is a phishing email. The reasons are as follows:
[0115] 1. The sender in the email is "xxxx@msg.xxx.cn", and the email subject and content indicate that it is a notice sent by a forged sender and does not involve the status update of the Web application firewall.
[0116] 2. The email provides official contact information such as links, hotline numbers, and email addresses, which are not channels officially supported by xxx and do not match the domain names in the whitelist.
[0117] 3. Phishing emails usually contain malicious links that induce clicks or request users to provide sensitive information. There are suspicious links in the email that directly point to other websites, and users are required to provide passwords or other private information.
[0118] In summary, the content of the email does not conform to the format of the official notice, and there are signs indicating that this is a phishing email.
[0119] There is no password in the body of the email
[0120] There are also attachments in the email!
[0121] In some alternative embodiments, the phishing email recognition method in the embodiments of the present disclosure, such as Figure 3 shown, further includes:
[0122] Step S107, when the target email is not a phishing email, mark the non-phishing email.
[0123] Step S108, push the non-phishing email to the recipient according to the second preset template through a communication tool.
[0124] For example, mark the phishing email through the email gateway and mark ["Non-phishing email"] at the personal push email.
[0125] The communication tools mentioned above include but are not limited to communication tools such as Enterprise WeChat and DingTalk.
[0126] For example, the push result of the non-phishing email is as follows:
[0127] You have received an email from: xxxx@msg.xxx.cn
[0128] The subject of the email is: Resource Destruction
[0129] The AI phishing check result is as follows:
[0130] No
[0131] This is not a phishing email. The reasons are as follows:
[0132] 1. The sender in the email is "xxxx@msg.xxx.cn". Although it seems to be from xxx.cn, the subject and content of the email indicate that it is a notice sent by xxx official regarding the status update of the Web application firewall.
[0133] 2. The email provides official contact information such as the official website link, hotline number, and email address. These are all official support channels of xxx and are consistent with the domain names in the whitelist.
[0134] 3. Phishing emails usually contain malicious links that induce clicks or request users to provide sensitive information. However, there are no suspicious links directly pointing to other websites in the email, nor is the user requested to provide passwords or other private information.
[0135] In summary, the content of the email conforms to the format of the official notice, and there is no sign indicating that this is a phishing email.
[0136] There is no password in the body of the email
[0137] There are no attachments in the email!
[0138] For the above steps S101 - S106, refer to the above embodiments and will not be elaborated here.
[0139] In this embodiment, a method for identifying phishing emails is provided for the above computer devices, such as mobile phones, tablets, desktop computers, portable laptops, servers, etc. Figure 4 It is a flowchart of the method for identifying phishing emails according to an embodiment of the present invention. For the above step S102, according to the first information of the sender, the second information of the sender, and the body of the email, verify whether the target email is a phishing email. As Figure 4 shown, this process includes the following steps:
[0140] The first information of the sender includes: the forged email address of the sender and the real email address of the sender. The second information of the sender includes: the email domain name of the sender and the email domain names added to the whitelist. The body of the email includes: the email content of the sender and the identification information added to the blacklist. The identification information includes: name, ID number, company, bank card number, password.
[0141] Step S1041, verify whether the forged email address is consistent with the real email address.
[0142] For example, the forged email address is ctymun.cn, and the real email address is ctyun.com.
[0143] Step S1042, when the forged email address is consistent with the real email address, obtain the email domain name with the maximum length from the email domain names in the whitelist, and verify whether the email domain name with the maximum length is consistent with the email domain name of the sender.
[0144] For example, the email domain names in the whitelist include: ctyun.com, ctyun.com01, ctyun.com1, ctyun.com021.
[0145] Step S1043, when the email domain name with the maximum length is consistent with the email domain name of the sender, verify whether the email content of the sender contains at least two items of identification in the identification information.
[0146] For example, when the email domain name with the maximum length in the above example is ctyun.com021 and the email domain name of the sender is also ctyun.com021, verify whether the email content of the sender contains at least two identifiers among name, ID number, company, bank card number, and password.
[0147] Step S1044, when the email content of the sender contains at least two identifiers in the identifier information, determine that the target email is a phishing email.
[0148] When the email content of the sender contains at least two identifiers among identifier information such as name, ID number, company, bank card number, and password, determine that the target email is a phishing email.
[0149] Step S1045, when the email domain name with the maximum length is inconsistent with the email domain name of the sender, determine that the target email is a phishing email.
[0150] For example, when the email domain name with the maximum length in the above example is ctyun.com021 and the email domain name of the sender is ctyun.com, verify that the target email is a phishing email.
[0151] Step S1046, when the email content of the sender does not contain at least two identifiers in the identifier information, determine that the target email is a non-phishing email.
[0152] When the email content of the sender does not contain at least two identifiers among identifier information such as name, ID number, company, bank card number, and password, determine that the target email is a non-phishing email.
[0153] In the phishing email recognition method in the embodiments of the present disclosure, since the forged email address of the sender and the real email address, the email domain name of the sender and the email domain name added to the whitelist, and the email content of the sender and the identifier information added to the blacklist are fully verified, phishing emails can ultimately be comprehensively and accurately recognized.
[0154] In some optional implementation manners, as Figure 5 shown, the above step S1043, verifying whether the email domain name with the maximum length is consistent with the email domain name of the sender, includes:
[0155] Step S10431, obtain the i-th identifier in the email domain name of the sender and the i-th identifier in the email domain name with the maximum length.
[0156] For example, the email domain name of the sender is ctymun.cn, the email domain name with the maximum length is ctyun.com0, and the i-th bit identifier in the sender's email domain name can represent each bit identifier in the sender's email domain name. When i = 1, the i-th bit identifier in the sender's email domain name is c, and the i-th bit identifier in the email domain name with the maximum length is also c; when i = 2, the i-th bit identifier in the sender's email domain name is t, and the i-th bit identifier in the email domain name with the maximum length is also t; when i = 3, the i-th bit identifier in the sender's email domain name is y, and the i-th bit identifier in the email domain name with the maximum length is also y; when i = 4, the i-th bit identifier in the sender's email domain name is m, and the i-th bit identifier in the email domain name with the maximum length is also u; when i = 5, the i-th bit identifier in the sender's email domain name is u, and the i-th bit identifier in the email domain name with the maximum length is also n; when i = 6, the i-th bit identifier in the sender's email domain name is n, and the i-th bit identifier in the email domain name with the maximum length is also c; when i = 7, the i-th bit identifier in the sender's email domain name is c, and the i-th bit identifier in the email domain name with the maximum length is also o; when i = 8, the i-th bit identifier in the sender's email domain name is n, and the i-th bit identifier in the email domain name with the maximum length is also m; when i = 9, the i-th bit identifier in the sender's email domain name has no identifier, and the i-th bit identifier in the email domain name with the maximum length is also 0.
[0157] Step S10432, verify whether the i-th bit identifier in the sender's email domain name is consistent with the i-th bit identifier in the email domain name with the maximum length.
[0158] Step S10433, when the i-th bit identifier in the sender's email domain name is consistent with the i-th bit identifier in the email domain name with the maximum length, mark the i-th bit identifier in the sender's email domain name as the binary value 0.
[0159] For example, when i = 1, i = 2, i = 3, the i-th bit identifier in the sender's email domain name is consistent with the i-th bit identifier in the email domain name with the maximum length. When i = 1, i = 2, i = 3, mark the i-th bit identifier in the sender's email domain name at these positions as the binary value 0.
[0160] Step S10434, when the i-th bit identifier in the sender's email domain name is inconsistent with the i-th bit identifier in the email domain name with the maximum length, mark the i-th bit identifier in the sender's email domain name as the binary value 1.
[0161] For example, when i = 4, i = 5, i = 6, i = 7, i = 8, mark the i-th bit identifier in the sender's email domain name at these positions as the binary value 1.
[0162] Step S10435: According to the numerical marking result of the i-th digit identifier in the sender's email domain name, calculate the sum of the numerical values of the n-digit identifiers in the sender's email domain name.
[0163] In the above example, when i = 1, i = 2, i = 3, i = 4, i = 5, i = 6, i = 7, i = 8, the sum of the numerical values of the n-digit identifiers in the sender's email domain name is: 0 + 0 + 0 + 1 + 1 + 1 + 1 + 1 + 1 = 5.
[0164] Step S10436: When the sum of the numerical values of the n-digit identifiers in the sender's email domain name is less than or equal to the preset threshold, determine that the email domain name with the maximum length is the same as the sender's email domain name.
[0165] The preset threshold can be flexibly set according to the actual situation. For example, the preset threshold is set to 3. Since the sum of the numerical values of the n-digit identifiers in the sender's email domain name in the above example is 5.
[0166] Step S10437: When the sum of the numerical values of the n-digit identifiers in the sender's email domain name is greater than the preset threshold, determine that the email domain name with the maximum length is different from the sender's email domain name.
[0167] Since the sum of the numerical values of the n-digit identifiers in the sender's email domain name in the above example is 5, which is greater than the preset threshold of 3, it is determined that the email domain name with the maximum length is different from the sender's email domain name. Conversely, it is determined that the email domain name with the maximum length is the same as the sender's email domain name.
[0168] Through the above method, the embodiments of the present disclosure can accurately verify whether the email domain name with the maximum length in the email domain names added to the whitelist is the same as the sender's email domain name.
[0169] In this embodiment, a phishing email recognition device is further provided. The device is used to implement the above embodiments and preferred implementation manners, and the descriptions that have been given will not be repeated. As used hereinafter, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.
[0170] This embodiment provides a phishing email recognition device, as Figure 6 shown, including:
[0171] An acquisition module 601, configured to acquire the email content of the target email, where the email content includes: the first information of the sender, the second information of the sender, the email body, and the email attachment;
[0172] A verification module 602, configured to verify whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body.
[0173] An output module 603, configured to extract the text content of the target email according to a first preset template and output the recognition and analysis result of the phishing email when the target email is a phishing email;
[0174] A recognition module 604, configured to recognize the email attachment of the phishing email according to the recognition and analysis result of the phishing email.
[0175] In some optional embodiments, after the recognition module 604, the following is further included:
[0176] A marking module, configured to mark the phishing email;
[0177] A pushing module, configured to push the phishing email to the recipient according to a second preset template through a communication tool.
[0178] In some optional embodiments, the first information of the sender includes: the forged email address of the sender and the real email address of the sender, the second information of the sender includes: the email domain name of the sender and the email domain name added to the whitelist, the email body includes: the email content of the sender and the identification information added to the blacklist, and the identification information includes: name, ID number, company, bank card number, password;
[0179] The verification module 602 includes:
[0180] A first verification sub-module, configured to verify whether the forged email address is consistent with the real email address;
[0181] A second verification sub-module, configured to obtain the email domain name with the maximum length from the email domain names in the whitelist and verify whether the email domain name with the maximum length is consistent with the email domain name of the sender when the forged email address is consistent with the real email address;
[0182] A third verification sub-module, configured to verify whether the email content of the sender contains at least two identifications in the identification information when the email domain name with the maximum length is consistent with the email domain name of the sender;
[0183] A fourth verification sub-module, configured to determine that the target email is a phishing email when the email content of the sender contains at least two identifications in the identification information;
[0184] A first determination sub-module, configured to determine that the target email is a phishing email when the email domain name with the maximum length is inconsistent with the email domain name of the sender;
[0185] A second determination sub-module, configured to determine that the target email is a non-phishing email when the email content of the sender does not contain at least two identifications in the identification information.
[0186] In some alternative embodiments, the second verification sub-module includes:
[0187] An identification acquisition unit, configured to acquire the i-th identification in the sender's email domain name and the i-th identification in the email domain name with the maximum length;
[0188] An identification verification unit, configured to verify whether the i-th identification in the sender's email domain name is consistent with the i-th identification in the email domain name with the maximum length;
[0189] A first marking unit, configured to mark the i-th identification in the sender's email domain name as the binary value 0 when the i-th identification in the sender's email domain name is consistent with the i-th identification in the email domain name with the maximum length;
[0190] A second marking unit, configured to mark the i-th identification in the sender's email domain name as the binary value 1 when the i-th identification in the sender's email domain name is inconsistent with the i-th identification in the email domain name with the maximum length;
[0191] A numerical value statistical unit, configured to statistically calculate the total numerical value of the n identifications in the sender's email domain name according to the numerical value marking result of the i-th identification in the sender's email domain name;
[0192] When the total numerical value of the n identifications in the sender's email domain name is less than or equal to a preset threshold, it is determined that the email domain name with the maximum length is consistent with the sender's email domain name;
[0193] A numerical value determination unit, configured to determine that the email domain name with the maximum length is inconsistent with the sender's email domain name when the total numerical value of the n identifications in the sender's email domain name is greater than the preset threshold.
[0194] In some alternative embodiments, the first preset template presents the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation result of the email body in a semi-structured data format; the output module 603 includes:
[0195] An extraction sub-module, configured to, when the target email is a phishing email, extract the text content of the target email according to the first preset template through the target text recognition model, to obtain the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password of the email body, where the target text recognition model is a neural network model pre-trained;
[0196] An output sub-module, configured to use the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password of the email body as the recognition and analysis result of the phishing email, and output the recognition and analysis result of the phishing email.
[0197] In some alternative embodiments, the recognition module 604 includes:
[0198] A first recognition sub-module, configured to use a sandbox to recognize the email attachment of a phishing email when the phishing email does not carry a password;
[0199] A file decompression sub-module, configured to use the query password in the email body to decompress the email attachment of a phishing email to obtain the email file of the phishing email when the phishing email carries a password;
[0200] A suffix acquisition sub-module, configured to acquire the current suffix name of the email file of the phishing email;
[0201] A second recognition sub-module, configured to use a sandbox to recognize the email file of a phishing email when the current suffix name of the email file of the phishing email is a preset suffix name.
[0202] In some alternative embodiments, the second preset template presents the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email in an unstructured data format; the push module includes:
[0203] A push sub-module, configured to push the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email to the recipient through a communication tool according to the second preset template.
[0204] The further function descriptions of the above-mentioned various modules and units are the same as those in the corresponding foregoing embodiments, and will not be elaborated herein.
[0205] The phishing email recognition device in this embodiment is presented in the form of functional units. Here, the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and a memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.
[0206] The embodiment of the present invention further provides a computer device having the above-mentioned phishing email recognition device.
[0207] Please refer to Figure 7 , Figure 7 which is a schematic structural diagram of a computer device provided by an alternative embodiment of the present invention. As shown in Figure 7As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting the components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some alternative embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (such as an array of servers, a set of blade servers, or a multi-processor system). Figure 7 In the figure, a processor 10 is taken as an example.
[0208] The processor 10 can be a central processing unit, a network processor, or a combination thereof. Among them, the processor 10 can further include a hardware chip. The above-mentioned hardware chip can be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The above-mentioned programmable logic device can be a complex programmable logic device, a field-programmable gate array, a generic array logic, or any combination thereof.
[0209] Among them, the memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiments.
[0210] The memory 20 can include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the computer device, etc. In addition, the memory 20 can include a high-speed random access memory and can also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 can optionally include a memory remotely set relative to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.
[0211] The memory 20 can include a volatile memory, such as a random access memory; the memory can also include a non-volatile memory, such as a flash memory, a hard disk, or a solid-state drive; the memory 20 can also include a combination of the above types of memories.
[0212] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or communication networks.
[0213] Embodiments of the present invention also provide a computer-readable storage medium. The method according to the embodiments of the present invention can be implemented in hardware, firmware, or be implemented as computer code that can be recorded on a storage medium, or be implemented as computer code that is originally stored in a remote storage medium or a non-transitory machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored as such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code, and when the software or computer code is accessed and executed by the computer, the processor, or the hardware, the method shown in the above embodiments is implemented.
[0214] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations all fall within the scope defined by the appended claims.
Claims
1. A method for identifying phishing emails, characterized in that, The method includes: Obtain the email content of the target email, where the email content includes: the first information of the sender, the second information of the sender, the email body, and the email attachment; Verify whether the target email is a phishing email based on the first information of the sender, the second information of the sender, and the email body; When the target email is a phishing email, extract the text content of the phishing email according to the first preset template, and output the recognition and analysis result of the phishing email; Identify the email attachment of the phishing email according to the recognition and analysis result of the phishing email.
2. The phishing email recognition method according to claim 1, wherein, After the step of identifying the email attachment of the phishing email, it further includes: Mark the phishing email; Push the phishing email to the recipient according to the second preset template through a communication tool.
3. The phishing email recognition method according to claim 1, wherein The first information of the sender includes: the forged email address of the sender and the real email address of the sender. The second information of the sender includes: the email domain name of the sender and the email domain name added to the whitelist. The email body includes: the email content of the sender and the identification information added to the blacklist. The identification information includes: name, ID number, company, bank card number, password; Verifying whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body includes: Verify whether the forged email address is consistent with the real email address; When the forged email address is consistent with the real email address, obtain the email domain name with the maximum length from the email domain names in the whitelist, and verify whether the email domain name with the maximum length is consistent with the email domain name of the sender; When the email domain name with the maximum length is consistent with the email domain name of the sender, verify whether the email content of the sender contains at least two items of the identification information; When the email content of the sender contains at least two items of the identification information, determine that the target email is a phishing email; When the email domain name with the maximum length is inconsistent with the email domain name of the sender, determine that the target email is a phishing email; When the email content of the sender does not contain at least two items of the identification information, determine that the target email is a non-phishing email.
4. The phishing email recognition method according to claim 1, wherein Verifying whether the email domain name with the maximum length is consistent with the email domain name of the sender includes: Obtain the i-th identifier in the email domain name of the sender and the i-th identifier in the email domain name with the maximum length; Verify whether the i-th identifier in the email domain name of the sender is consistent with the i-th identifier in the email domain name with the maximum length; When the i-th identifier in the email domain name of the sender is consistent with the i-th identifier in the email domain name with the maximum length, mark the i-th identifier in the email domain name of the sender as the binary value 0; When the i-th identifier in the email domain name of the sender is inconsistent with the i-th identifier in the email domain name with the maximum length, mark the i-th identifier in the email domain name of the sender as the binary value 1; According to the numerical marking result of the i-th identifier in the sender's email domain name, calculate the sum of the numerical values of the n identifiers in the sender's email domain name; When the sum of the numerical values of the n identifiers in the sender's email domain name is less than or equal to the preset threshold, determine that the email domain name with the maximum length is the same as the sender's email domain name; When the sum of the numerical values of the n identifiers in the sender's email domain name is greater than the preset threshold, determine that the email domain name with the maximum length is different from the sender's email domain name.
5. The phishing email recognition method according to claim 1, wherein, The first preset template presents the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation result of the email body in a semi-structured data format; When the target email is a phishing email, extract the text content of the target email according to the first preset template, and output the recognition and analysis result of the phishing email, including: When the target email is a phishing email, extract the text content of the target email through the target text recognition model according to the first preset template, and obtain the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password of the email body. Among them, the target text recognition model is a neural network model pre-trained; Use the determination result of the phishing email, the analysis reason of the phishing email, the measures taken for the phishing email, and the consultation password of the email body as the recognition and analysis result of the phishing email, and output the recognition and analysis result of the phishing email.
6. The phishing email recognition method according to claim 1 or 5, characterized in that According to the recognition and analysis result of the phishing email, identify the email attachment of the phishing email, including: When the phishing email does not carry a password, use a sandbox to identify the email attachment of the phishing email; When the phishing email carries a password, use the consultation password of the email body to decompress the email attachment of the phishing email to obtain the email file of the phishing email; Obtain the current suffix name of the email file of the phishing email; When the current suffix name of the email file of the phishing email is the preset suffix name, use the sandbox to identify the email file of the phishing email.
7. The phishing email recognition method according to claim 2, wherein The second preset template presents the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email in an unstructured data format; Push the phishing email to the recipient according to the second preset template through a communication tool, including: Push the sender's email address, the email subject, the recognition and analysis result of the phishing email, and the recognition result of the email attachment of the phishing email of the phishing email to the recipient according to the second preset template through a communication tool.
8. An email phishing recognition device, characterized in that, The device includes: An acquisition module, configured to acquire the email content of the target email, where the email content includes: the first information of the sender, the second information of the sender, the email body, and the email attachment; A verification module, configured to verify whether the target email is a phishing email according to the first information of the sender, the second information of the sender, and the email body; An output module, configured to extract the text content of the target email according to a first preset template when the target email is a phishing email, and output the identification and analysis result of the phishing email; An identification module, configured to identify the email attachment of the phishing email according to the identification and analysis result of the phishing email.
9. A computer device, characterized in that, Comprising: A memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the phishing email identification method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Computer instructions are stored on the computer-readable storage medium, and the computer instructions are used to cause a computer to execute the phishing email identification method according to any one of claims 1 to 7.