Mail data processing method, mail identification method and computing device

Abstract

The invention relates to the technical field of data processing, and discloses a mail data processing method, a mail identification method and computing equipment, and the method comprises the steps: obtaining to-be-processed mail data; determining the source credibility corresponding to the mail data based on the mail sending address corresponding to the mail data; determining a target detection strategy corresponding to the mail data in a plurality of candidate detection strategies based on the source credibility corresponding to the mail data; wherein the detection intensity of each candidate detection strategy in the plurality of candidate detection strategies is different; the source credibility corresponding to the sending address is negatively correlated with the detection intensity of the target detection strategy; and detecting the mail data based on the target detection strategy to determine whether the mail data is high-quality data or low-quality data. According to the method and the device, the accuracy of determining the inferior mail data can be improved, so that the training effect of the model can be improved when the model is trained based on the determined high-quality mail data.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of data processing, and in particular, to a method for processing email data, a method for identifying emails, and a computing device. Background Art

[0002] With the development of the Internet, email has become an indispensable communication tool in the daily life of enterprises and individuals, playing an important role in information transmission and business communication. The email gateway is an important part of enterprise network security, and can filter, detect, and manage the emails entering and leaving the enterprise through artificial intelligence (AI) technology to ensure the security and compliance of email communication.

[0003] However, when training the AI model of the email gateway, the training data set used may contain email data that is not standard enough (i.e., of low quality), resulting in a decline in the training effect of the AI model. Therefore, it is necessary to detect the low-quality email data from the training data set to retain the high-quality email data for training the AI model. Summary of the Invention

[0004] The embodiments of the present application provide a method for processing email data, a method for identifying emails, and a computing device, which can better determine the inferior training data in the training data set, thereby improving the training effect of the model.

[0005] To achieve the above object, the embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, the embodiments of the present application provide a method for processing email data, the method including: obtaining the email data to be processed; determining the source credibility corresponding to the email data based on the sender address corresponding to the email data; determining the target detection strategy corresponding to the email data from multiple candidate detection strategies; wherein, the detection intensities of the candidate detection strategies in the multiple candidate detection strategies are different; the source credibility corresponding to the sender address is negatively correlated with the detection intensity of the target detection strategy; detecting the email data based on the target detection strategy to determine whether the email data is high-quality data or inferior data.

[0007] Based on this implementation, it is possible to dynamically select the corresponding detection strategy based on the source credibility, thereby avoiding detecting all email data with a unified intensity, and realizing the differential processing of email data. Moreover, by selecting the target detection strategy with the corresponding detection intensity based on the source credibility, it is possible to optimize the allocation of computing resources while ensuring the detection accuracy.

[0008] In a possible implementation, determining the target detection strategy corresponding to the above email data from multiple candidate detection strategies based on the source credibility corresponding to the above email data includes: when the source credibility corresponding to the above email data is equal to the first preset value, determining that the target detection strategy corresponding to the above email data is empty; when the source credibility corresponding to the above email data is equal to the second preset value, determining that the target detection strategy corresponding to the above email data is the first detection strategy; when the source credibility corresponding to the above email data is equal to the third preset value, determining that the target detection strategy corresponding to the above email data is the second detection strategy; where the first preset value is greater than the second preset value, the second preset value is greater than the third preset value, and the detection intensity of the second detection strategy is greater than the detection intensity of the first detection strategy.

[0009] Based on this implementation, by hierarchically setting the source credibility threshold and matching detection strategies with different detection intensities, it is possible to perform higher-intensity detection on email data with low source credibility to improve the accuracy of identifying inferior data; and perform lower-intensity detection on email data with high source credibility to reduce waste of computing resources and improve the efficiency of identifying inferior data.

[0010] In another possible implementation, detecting the above email data based on the above target detection strategy to determine whether the above email data is high-quality data or inferior data includes: when the target detection strategy is the above first detection strategy, performing natural language processing on the email body corresponding to the above email data to determine whether there is incorrect content in the email body corresponding to the above email data; where the incorrect content includes grammar errors and / or spelling errors; when there is the above incorrect content in the email body corresponding to the above email data, determining that the above email data is inferior data; when there is no such incorrect content in the email body corresponding to the above email data, determining that the above email data is high-quality data.

[0011] Based on this implementation, when there is no incorrect content in the email body corresponding to the email data, or when there is less incorrect content in the email body corresponding to the email data, the email data can be determined as high-quality data and retained in the first dataset.

[0012] In yet another possible implementation, detecting the above-mentioned email data based on the above-mentioned object detection strategy to determine whether the above-mentioned email data is high-quality data or low-quality data includes: when the above-mentioned object detection strategy is the above-mentioned second detection strategy, detecting the above-mentioned email data based on each of the above-mentioned detection dimensions in a plurality of detection dimensions to obtain the detection scores of each of the above-mentioned detection dimensions corresponding to the above-mentioned email data; wherein, the above-mentioned plurality of detection dimensions include email authenticity, email timeliness, and the legality of the sending scope; determining the target detection score corresponding to the above-mentioned email data based on the detection scores of each of the above-mentioned detection dimensions corresponding to the above-mentioned email data and the above-mentioned source credibility; when the target detection score is less than the preset score, determining that the above-mentioned email data is low-quality data; when the target detection score is greater than or equal to the above-mentioned preset score, determining that the above-mentioned email data is high-quality data.

[0013] Based on this implementation, when the source credibility of the email data is relatively low, the quality of the email data can be comprehensively evaluated through multi-dimensional detection, thereby improving the accuracy of screening low-quality data.

[0014] In yet another possible implementation, when the above-mentioned object detection strategy is the above-mentioned second detection strategy, detecting the above-mentioned email data based on each of the above-mentioned detection dimensions in a plurality of detection dimensions to obtain the detection scores of each of the above-mentioned detection dimensions corresponding to the above-mentioned email data includes: determining the first detection score corresponding to the above-mentioned email data based on the email body corresponding to the above-mentioned email data; wherein, the above-mentioned first detection score is used to characterize the authenticity of the above-mentioned email data; determining the second detection score corresponding to the above-mentioned email data based on the email body and the sending time corresponding to the above-mentioned email data; wherein, the above-mentioned second detection score is used to characterize the timeliness of the above-mentioned email data; determining the third detection score corresponding to the above-mentioned email data based on the email body and the recipient address corresponding to the above-mentioned email data; wherein, the above-mentioned third detection score is used to characterize the legality of the sending scope of the above-mentioned email data.

[0015] Based on this implementation, specific detection methods can be set for email data according to different detection dimensions to ensure the accuracy of quality evaluation of email data.

[0016] In yet another possible implementation, determining the first detection score corresponding to the above-mentioned email data based on the email body corresponding to the above-mentioned email data includes: performing semantic recognition on the email body corresponding to the above-mentioned email data to obtain the semantic recognition result of the email body corresponding to the above-mentioned email data; performing logical analysis and processing on the email body corresponding to the above-mentioned email data to obtain the logical analysis result of the email body corresponding to the above-mentioned email data; determining the first detection score corresponding to the above-mentioned email data based on the semantic recognition result and the logical analysis result of the email body corresponding to the above-mentioned email data.

[0017] Based on this implementation, it is possible to analyze the semantics and logic of the email body, and accurately quantify the authenticity of the email body, thereby providing a reliable basis for the quality assessment of email data.

[0018] In another possible implementation, determining the second detection score corresponding to the above email data based on the email body and the sending time corresponding to the above email data includes: determining the keywords in the email body corresponding to the above email data, and determining target keywords that are not within the detection time limit among the above keywords; determining the second detection score corresponding to the above email data according to the sending time corresponding to the above email data and the number of the above target keywords.

[0019] Based on this implementation, it is possible to perform timeliness detection on email data, assign a lower second detection score to data that does not conform to the current detection trend, thereby ensuring that the training data is synchronized with the latest trend.

[0020] In another possible implementation, determining the third detection score corresponding to the above email data based on the email body and the recipient address corresponding to the above email data includes: determining whether the number of recipient addresses corresponding to the above email data exceeds a preset number, and whether the above email data includes email body or attachment information, and obtaining a sending range detection result; determining the above third detection score corresponding to the above email data based on the above sending range detection result.

[0021] Based on this implementation, it is possible to automatically analyze the recipient address of the email data and whether it includes email body or attachment information to further ensure the quality of the training data.

[0022] In a second aspect, an embodiment of the present application further provides an email recognition method, which includes: obtaining a training data set, and determining high-quality training data in the above training data set based on the email data processing method described in the first aspect; wherein, the above training data set includes multiple email data, and the above multiple email data includes the above high-quality training data; determining a target training data set based on the above high-quality training data; wherein, the email data in the above target training data set is high-quality training data; training a to-be-trained email recognition model based on the above target training data set to obtain a trained email recognition model; processing the to-be-recognized email data based on the above trained email recognition model to determine whether the to-be-recognized email data is malicious email data or non-malicious email data.

[0023] Based on this implementation manner, it is possible to determine high-quality training data and low-quality training data in the training data set based on the email data processing method described in the first aspect, thereby improving the accuracy of determining high-quality training data and low-quality training data. Furthermore, when training the email recognition model to be trained based on the target training data set including high-quality training data, the training effect of the model can be improved, so that the accuracy of the trained email recognition model in email recognition is higher.

[0024] In a third aspect, an embodiment of the present application further provides an email data processing device, including: an acquisition module configured to acquire email data to be processed; a first determination module configured to determine the source credibility corresponding to the email data based on the sender address corresponding to the email data; a second determination module configured to determine the target detection strategy corresponding to the email data from multiple candidate detection strategies based on the source credibility corresponding to the email data; wherein, the detection intensities of the candidate detection strategies in the multiple candidate detection strategies are different; the source credibility corresponding to the sender address is negatively correlated with the detection intensity of the target detection strategy; a detection module configured to detect the email data based on the target detection strategy to determine whether the email data is high-quality data or low-quality data.

[0025] In a possible implementation manner, the second determination module is specifically configured to: when the source credibility corresponding to the email data is equal to a first preset value, determine that the target detection strategy corresponding to the email data is empty; when the source credibility corresponding to the email data is equal to a second preset value, determine that the target detection strategy corresponding to the email data is a first detection strategy; when the source credibility corresponding to the email data is equal to a third preset value, determine that the target detection strategy corresponding to the email data is a second detection strategy; wherein, the first preset value is greater than the second preset value, the second preset value is greater than the third preset value, and the detection intensity of the second detection strategy is greater than the detection intensity of the first detection strategy.

[0026] In another possible implementation manner, the detection module is specifically configured to: when the target detection strategy is the first detection strategy, perform natural language processing on the email body corresponding to the email data to determine whether there is incorrect content in the email body corresponding to the email data; wherein, the incorrect content includes grammar errors and / or spelling errors; when there is the incorrect content in the email body corresponding to the email data, determine that the email data is low-quality data; when there is no such incorrect content in the email body corresponding to the email data, determine that the email data is high-quality data.

[0027] In yet another possible implementation, the above detection module is specifically configured as follows: when the above target detection policy is the above second detection policy, the email data is detected based on each of the above detection dimensions among multiple detection dimensions, and detection scores corresponding to each of the above detection dimensions of the email data are obtained; wherein, the above multiple detection dimensions include email authenticity, email timeliness, and the legality of the sending scope; based on the detection scores corresponding to each of the above detection dimensions of the email data and the above source credibility, a target detection score corresponding to the email data is determined; when the target detection score is less than a preset score, the email data is determined to be inferior data; when the target detection score is greater than or equal to the preset score, the email data is determined to be high-quality data.

[0028] In yet another possible implementation, the above detection module is specifically configured as follows: based on the email body corresponding to the email data, a first detection score corresponding to the email data is determined; wherein, the above first detection score is used to represent the authenticity of the email data; based on the email body and the sending time corresponding to the email data, a second detection score corresponding to the email data is determined; wherein, the above second detection score is used to represent the timeliness of the email data; based on the email body and the recipient address corresponding to the email data, a third detection score corresponding to the email data is determined; wherein, the above third detection score is used to represent the legality of the sending scope of the email data.

[0029] In yet another possible implementation, the above detection module is specifically configured as follows: semantic recognition is performed on the email body corresponding to the email data to obtain a semantic recognition result of the email body corresponding to the email data; logical analysis processing is performed on the email body corresponding to the email data to obtain a logical analysis result of the email body corresponding to the email data; based on the semantic recognition result and the logical analysis result of the email body corresponding to the email data, a first detection score corresponding to the email data is determined.

[0030] In yet another possible implementation, the above detection module is specifically configured as follows: keywords in the email body corresponding to the email data are determined, and target keywords not within the detection time limit are determined among the above keywords; based on the sending time corresponding to the email data and the number of the above target keywords, a second detection score corresponding to the email data is determined.

[0031] In yet another possible implementation, the above detection module is specifically configured as follows: it is determined whether the number of recipient addresses corresponding to the email data exceeds a preset number, and whether the email data contains email body or attachment information, and a sending scope detection result is obtained; based on the sending scope detection result, a third detection score corresponding to the email data is determined.

[0032] Fourth aspect, an embodiment of the present application further provides a mail recognition device, which includes: a third determination module configured to obtain a target training data set determined after processing a training data set based on a mail data processing method; wherein, the target training data set includes a plurality of mail data, and the plurality of mail data are high-quality training data; a training module configured to train a mail recognition model to be trained based on the target training data set to obtain a trained mail recognition model; a processing module configured to process the mail data to be recognized based on the trained mail recognition model to determine whether the mail data to be recognized is malicious mail data or non-malicious mail data.

[0033] Fifth aspect, an embodiment of the present application further provides a computing device, including: a processor and a memory; the processor and the memory are coupled; the memory is used to store program instructions; the processor is used to execute the program instructions to execute the method of any one of the first aspects above, or the method of any one of the second aspects above.

[0034] Sixth aspect, an embodiment of the present application provides a chip, which is used to execute the method of any one of the first aspects above, or the method of any one of the second aspects above.

[0035] Seventh aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored, and when the computer execution instructions are executed by a computer, the method of any one of the first aspects above, or the method of any one of the second aspects above is implemented.

[0036] Eighth aspect, an embodiment of the present application provides a program product, including a computer program, and when the computer program is executed by a processor, the method of any one of the first aspects above, or the method of any one of the second aspects above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flowchart of a mail data processing method provided by an embodiment of the present application;

[0038] Figure 2 It is a flowchart of determining a first data set provided by an embodiment of the present application;

[0039] Figure 3 It is a flowchart of determining a target detection strategy corresponding to mail data provided by an embodiment of the present application;

[0040] Figure 4 It is a flowchart of determining whether mail data is high-quality data or low-quality data provided by an embodiment of the present application;

[0041] Figure 5Another flowchart for determining whether email data is high-quality data or low-quality data provided by an embodiment of the present application;

[0042] Figure 6 A flowchart for determining the detection scores of each detection dimension corresponding to email data provided by an embodiment of the present application;

[0043] Figure 7 A flowchart for determining the first detection score corresponding to email data provided by an embodiment of the present application;

[0044] Figure 8 A flowchart for determining the second detection score corresponding to email data provided by an embodiment of the present application;

[0045] Figure 9 A flowchart for determining the third detection score corresponding to email data provided by an embodiment of the present application;

[0046] Figure 10 A flowchart for determining the target detection score corresponding to email data provided by an embodiment of the present application;

[0047] Figure 11 A flowchart for processing low-quality data provided by an embodiment of the present application;

[0048] Figure 12 A flowchart for an email recognition method provided by an embodiment of the present application;

[0049] Figure 13 A flowchart for another email data processing method provided by an embodiment of the present application;

[0050] Figure 14 A schematic diagram of an email data processing device provided by an embodiment of the present application;

[0051] Figure 15 A schematic diagram of an email recognition device provided by an embodiment of the present application;

[0052] Figure 16 A schematic diagram of a computing device provided by an embodiment of the present application. Detailed implementation manners

[0053] Next, the technical solutions in the embodiments of the present application will be described in conjunction with the accompanying drawings in the embodiments of the present application. For the convenience of clearly describing the technical solutions in the embodiments of the present application, the first, second, etc. descriptions that appear in the embodiments of the present application are only for schematic and distinguishing the description objects, without order, and do not represent the special limitation on the number of devices in the embodiments of the present application, and cannot constitute any limitation on the embodiments of the present application.

[0054] The email data processing method provided by the embodiments of the present application can be applied to a computing device, which can be a server or a terminal device. If there is low-quality training data (hereinafter referred to as inferior training data) in the training data set for model training, a corresponding detection strategy can be determined according to the source credibility of the email data, so as to determine whether the email data is inferior training data based on the detection strategy, and then remove the inferior training data from the training data set to retain high-quality training data for model training, thereby improving the training effect of the model.

[0055] Figure 1 It is a flowchart of an email data processing method provided by the embodiments of the present application. As Figure 1 shown, the method includes steps 110 to 140.

[0056] Step 110, obtain the email data to be processed.

[0057] In some embodiments, when training a preset model (such as a model for identifying spam and malicious emails) based on the email data in the current training data set (hereinafter referred to as the first data set), if there is inferior data (i.e., low-quality training data) in the first data set with problems such as low source credibility, low content authenticity, poor timeliness, and wide sending range, it may cause the model performance of the preset model to decline compared to the model performance before training based on the first data set, that is, the preset model deteriorates. Among them, the model performance of the preset model refers to the degree of consistency between the processing result obtained after the model processes the data and the real result; the preset model can include machine learning models (such as support vector machines, decision trees) or large-scale pre-trained models based on deep learning (such as Transformer, BERT), etc. The specific type of the preset model is not limited in this embodiment.

[0058] For example, if the source credibility of the email data is low, that is, the sender address corresponding to the email data is an untrusted sender, then it is very likely that the body content of these email data contains malicious or false information. Therefore, if this type of email data is used for model training, it will cause the preset model to learn incorrect patterns or features, resulting in a reduction in the training effect of the model.

[0059] If the content authenticity of the email data is low, that is, the content of the email data lacks objectivity, there are exaggerated or unsubstantiated remarks or promotional information, rather than being based on facts or verifiable information. Therefore, if this type of email data is used for model training, it may cause the preset model to learn biased or incorrect information, thereby weakening the reliability and generalization ability of the preset model and making it difficult to correctly process diverse inputs.

[0060] The timeliness of email data refers to whether the content of the email body conforms to the current environment or trend. If the timeliness of the email data is poor, that is, the content of the email data body is outdated, it may lead to a decline in the model's adaptability to new trends, thereby affecting the accuracy and generalization ability of the model.

[0061] If the sending scope of the email data is wide, that is, the audience of the email data is wide, its content of the email body is usually designed according to the characteristics of normal emails (such as imitating the language and format of emails from legitimate institutions). If such email data is used as training data, it may cause the preset model to wrongly learn these misleading characteristics, and further cause the preset model to misjudge normal emails as malicious emails during the actual reasoning process, or fail to identify real malicious emails, thus reducing the accuracy of the preset model.

[0062] Therefore, if the first data set causes the degradation of the preset model, the first data set can be processed to determine the poor-quality data (i.e., poor-quality training data) in the first data set that causes the degradation of the preset model. The other data in the first data set except the poor-quality training data can be determined as high-quality data (i.e., high-quality training data).

[0063] Step 120: Determine the source credibility corresponding to the email data based on the sender address corresponding to the email data.

[0064] In some embodiments, when determining the poor-quality training data in the first data set, the sources of each email data in the first data set can be classified first. Among them, the source of the email data can be determined according to the sender address corresponding to the email data, and the sender address includes an email prefix and an email suffix (i.e., email domain name).

[0065] Exemplarily, the sources of the email data can be divided into internal enterprise managers, other internal enterprise personnel, external enterprise personnel; or, it can also be divided into whether the email address is in the email blacklist or whitelist, etc. Among them, the email blacklist includes untrusted email addresses, and the email whitelist includes trusted email addresses. It should be noted that the above classification methods of the sources of the email data are only examples, and this embodiment does not limit this.

[0066] In some embodiments, corresponding source credibility can be set for email data from different sources. For example, for email data sent by managers within an enterprise, the highest source credibility (such as a first preset value) can be set; for email data sent by other personnel within the enterprise, the second highest source credibility (such as a second preset value) can be set; and for email data sent by external personnel, the lowest source credibility (such as a third preset value) can be set. Another example is that for email data with a sender address belonging to the email whitelist, the highest source credibility can be set; for email data with a sender address not belonging to the email whitelist or the email blacklist, the second highest source credibility can be set; and for email data with a sender address belonging to the email blacklist, the lowest source credibility can be set. Exemplarily, after determining the low-quality training data in the first dataset, if it is found through manual intervention that the determined low-quality training data is actually not low-quality training data, that is, a misjudgment occurs, and the frequency of misjudgment for email data of a certain source is relatively high, then a higher source credibility can be set for the email data corresponding to this source to reduce the occurrence of misjudgment for the email data of this source.

[0067] Step 130, based on the source credibility corresponding to the email data, determine the target detection strategy corresponding to the email data from multiple candidate detection strategies.

[0068] In some embodiments, detection strategies with corresponding detection intensities can be determined for different source credibilities, so as to adopt detection strategies with different detection intensities for email data with different source credibilities, thereby improving the efficiency of determining low-quality training data.

[0069] Exemplarily, the detection strategy with a lower detection intensity can include basic format checks, grammar and spelling checks, logical checks, etc. on the text content of the email data; the detection strategy with a higher detection intensity can include in-depth detections in multiple dimensions such as the authenticity, timeliness, and legality of the sending scope of the email data.

[0070] In some embodiments, based on the source credibility corresponding to the email data, the target detection strategy corresponding to the email data can be determined from multiple candidate detection strategies with different detection intensities. Among them, the source credibility corresponding to the sender address is negatively correlated with the detection intensity of the target detection strategy, that is, the lower the source credibility corresponding to the email data, the higher the detection intensity of the target detection strategy; the higher the source credibility corresponding to the email data, the lower the detection intensity of the target detection strategy.

[0071] For example, if the source of the email data is an internal employee of the enterprise, it can be determined that the source credibility corresponding to the email data is relatively high, and the target detection strategy corresponding to the email data can be determined as a mild detection strategy for grammar, logic, etc. of the email data; if the source of the email data is an external person of the enterprise, it can be determined that the source credibility corresponding to the email data is relatively low, and the target detection strategy corresponding to the email data can be determined as a multi-dimensional in-depth detection.

[0072] For another example, if the source of the email data belongs to the email whitelist, it can be determined that the source credibility corresponding to the email data is relatively high, and the target detection strategy corresponding to the email data can be determined as a mild detection strategy; if the source of the email data belongs to the email blacklist, it can be determined that the source credibility corresponding to the email data is relatively low, and the target detection strategy corresponding to the email data can be determined as a multi-dimensional in-depth detection.

[0073] Step 140: Detect the email data based on the target detection strategy to determine whether the email data is high-quality data or low-quality data.

[0074] In some embodiments, after determining the target detection strategy corresponding to the email data, detect the email data based on the target detection strategy to obtain a detection result, and then determine whether the email data is high-quality training data or low-quality training data based on the detection result.

[0075] For example, if the source credibility of the email data is relatively high and the corresponding target detection strategy is grammar and logic detection, then after detecting the email data based on the target detection strategy, if the obtained detection result shows that the grammar and logic of the email data are correct, it can be determined that the email data is high-quality training data; if the obtained detection result shows that the grammar or logic of the email data is incorrect, it can be determined that the email data is low-quality training data.

[0076] For another example, if the source credibility of the email data is relatively high and the corresponding target detection strategy is multi-dimensional detection, then after detecting the email data based on the target detection strategy, if the obtained detection result shows that the content of the email data is highly authentic, has strong timeliness, and a narrow sending range, it can be determined that the email data is high-quality training data; if the obtained detection result shows that the content of the email data has low authenticity, poor timeliness, or a wide sending range, it can be determined that the email data is low-quality training data.

[0077] Exemplarily, when performing multi-dimensional detection on email data based on a target detection strategy, the detection results corresponding to each detection dimension can be quantified to determine the detection scores corresponding to each detection dimension; and based on a preset detection score and the detection scores corresponding to each detection dimension, the email data is determined to be high-quality training data or low-quality training data. For example, if the sum of the detection scores corresponding to each detection dimension is greater than or equal to the preset detection score, the email data is determined to be high-quality training data; if the sum of the detection scores corresponding to each detection dimension is less than the preset detection score, the email data is determined to be low-quality training data.

[0078] Through the above solution, it is possible to dynamically select corresponding detection strategies based on the source credibility, thereby avoiding unified high-intensity detection of all email data and achieving differential processing of email data. Moreover, by exempting high-credibility email data from inspection to reduce unnecessary computational overhead, performing simple detection on medium-credibility email data to quickly screen out obvious errors, and performing in-depth detection on low-credibility email data to comprehensively evaluate data quality, it is possible to optimize the allocation of computing resources while ensuring detection accuracy.

[0079] Figure 2 A flowchart for determining a first data set provided by an embodiment of the present application is as Figure 2 shown, and the above step 110 includes steps 210 to 240.

[0080] Step 210, training a preset model based on the first data set to obtain a trained first preset model.

[0081] In some embodiments, during the process of training the preset model, the preset model can be trained based on multiple training data sets in sequence to gradually optimize the model performance of the preset model. For example, after training the preset model based on the current first data set, a trained preset model (hereinafter referred to as the first preset model) can be obtained.

[0082] Step 220, obtaining a test data set and processing the test data set based on the first preset model to obtain a processing result.

[0083] In some embodiments, after training the preset model based on the first data set to obtain the first preset model, the model performance of the first preset model can be tested to determine whether the model performance of the first preset model has improved or declined compared to the previous model performance.

[0084] In some embodiments, the performance of the first preset model can be tested by inputting the test data set, and a first test score corresponding to the first preset model can be determined. Among them, the test data set can include multiple email data for model testing; the email data in the test data set has real label information.

[0085] Step 230: Score the processing result to obtain a first test score corresponding to the first preset model.

[0086] In some embodiments, after the first preset model finishes processing the test data set, the processing result of the first preset model can be scored to obtain a first test score, so as to evaluate the model performance of the first preset model based on the first test score.

[0087] Exemplarily, based on indicators such as true positive (TP), true negative (TN), false positive (FP), false negative (FN), accuracy, precision, recall, and F1-score corresponding to the processing result of the first preset model on the test data set, the first test score corresponding to the first preset model can be determined.

[0088] For example, take the first preset model as a binary classification model for identifying malicious emails. The number of test data in the test data set is 100, and the number of malicious emails (i.e., positive samples) is 30, and the number of legitimate emails (i.e., negative samples) is 70. If the processing result obtained after the first preset model processes this test data set is: the number of legitimate emails is 50, and the number of malicious emails is 50, then it can be determined that the TP (the number of emails predicted as malicious and actually malicious) corresponding to this processing result = 30, TN (the number of emails predicted as legitimate and actually legitimate) = 50, FP (the number of emails predicted as malicious but actually legitimate) = 20, FN (the number of emails predicted as legitimate but actually malicious) = 0; furthermore, it can be determined that the accuracy corresponding to this processing result = the number of correct predictions / the total number of test data = (TP + TN) / the total number of test data = (30 + 50) / 100 = 80%. Exemplarily, the first test score of the first preset model can be determined to be 80 points based on this accuracy.

[0089] If after the first preset model processes the test data set, the obtained processing result is: the number of legitimate emails is 65, and the number of malicious emails is 35, then it can be determined that the TP (the number of emails predicted as malicious and actually malicious) corresponding to this processing result = 30, TN (the number of emails predicted as legitimate and actually legitimate) = 65, FP (the number of emails predicted as malicious but actually legitimate) = 5, FN (the number of emails predicted as legitimate but actually malicious) = 0; furthermore, it can be determined that the accuracy rate corresponding to this processing result = the number of correct predictions / the total number of test data = (TP + TN) / the total number of test data = (30 + 65) / 100 = 95%. Exemplarily, the first test score of the first preset model can be determined to be 95 points based on this accuracy rate.

[0090] It should be noted that the specific method for determining the first test score corresponding to the first preset model above is only an example, and this is not limited in this embodiment.

[0091] Step 240, in the case where the first test score is less than or equal to the preset test score, determine the first data set as the first data set.

[0092] In some embodiments, after obtaining the first test score corresponding to the first preset model, the first test score corresponding to the first preset model can be compared with the preset test score of the preset model, and it can be determined whether the first test score is less than or equal to the preset test score. Among them, the preset test score is used to represent the preset performance of the preset model, that is, after training the preset model based on the previous training sample set, the preset test score obtained after testing the preset model corresponding to the previous training sample set based on the test sample; the method for determining the preset test score can refer to the method of the above prediction score, which will not be elaborated here.

[0093] If the first test score of the first preset model is less than the preset test score, that is, the model performance of the first preset model is lower than or equal to the preset performance, it means that the first data set contains inferior training data, then the first data set can be determined as the first data set to process the first data set and determine the inferior training data therein. Among them, the preset performance can be the model performance corresponding to the preset model trained based on the previous first data set.

[0094] If the first test score of the first preset model is greater than or equal to the preset test score, that is, the model performance of the first preset model is greater than the preset performance, it means that the first data set does not contain inferior training data, then the first preset model can continue to be trained based on the next first data set.

[0095] Continuing with the above example, if the preset test score is 90 points, when the first test score of the first preset model is 80 points, the first test score of the first preset model is less than the preset test score, then it can be determined that the first dataset includes poor-quality training data; when the first test score of the first preset model is 95 points, the first test score of the first preset model is greater than the preset test score, then it can be determined that the first dataset does not include poor-quality training data.

[0096] Through the above solution, it is possible to perform a performance test on the trained preset model based on the test dataset to determine whether the performance of the trained preset model has decreased, so as to determine whether the first dataset contains poor-quality training data.

[0097] Figure 3 The flowchart for determining the target detection strategy corresponding to the email data provided by the embodiment of the present application is as Figure 3 shown, and the above step 130 includes steps 310 to 330.

[0098] Step 310, when the source credibility corresponding to the email data is equal to the first preset value, determine that the target detection strategy corresponding to the email data is empty.

[0099] In some embodiments, if the source credibility corresponding to the email data is the highest credibility (i.e., the first preset value), then the email data may not be detected, that is, the target detection strategy is empty. For example, if the sender of the email data is an enterprise manager, an official agency, a long-term partner, or belongs to the email whitelist, etc., then it can be directly released without detection.

[0100] Step 320, when the source credibility corresponding to the email data is equal to the second preset value, determine that the target detection strategy corresponding to the email data is the first detection strategy.

[0101] In some embodiments, if the source credibility corresponding to the email data is medium credibility (i.e., the second preset value), then the email data can be mildly detected, that is, determine that the target detection strategy is the first detection strategy, such as checking for spelling mistakes, grammar mistakes, logical mistakes, etc. Among them, the first preset value is greater than the second preset value.

[0102] Step 330, when the source credibility corresponding to the email data is equal to the third preset value, determine that the target detection strategy corresponding to the email data is the second detection strategy.

[0103] In some embodiments, if the source credibility corresponding to the email data is the lowest credibility (i.e., the third preset value), the email data can be deeply detected, that is, the target detection strategy is determined to be the second detection strategy. For example, the authenticity, timeliness, and legality of the sending range of the email are detected. Among them, the second preset value is greater than the third preset value; the detection intensity of the second detection strategy is greater than the detection intensity of the first detection strategy.

[0104] Through the above solution, it is possible to set source credibility thresholds hierarchically and match detection strategies with different detection intensities, so as to perform higher-intensity detection on email data with low source credibility to improve the accuracy of identifying inferior training data; and perform lower-intensity detection on email data with high source credibility to reduce waste of computing resources and improve the efficiency of identifying inferior training data.

[0105] Figure 4 The following is a flowchart for determining whether email data is high-quality data or inferior data provided by an embodiment of the present application. As Figure 4 shown, the above step 140 includes steps 410 to 430.

[0106] Step 410, when the target detection strategy is the first detection strategy, perform natural language processing on the email body corresponding to the email data to determine whether there is incorrect content in the email body corresponding to the email data.

[0107] In some embodiments, when detecting email data using the first detection strategy, natural language processing (NLP) technology can be used to process the email data to identify whether there is incorrect content such as grammar errors and spelling mistakes in the email body of the email data.

[0108] Exemplarily, the email body can be preprocessed first (such as word segmentation and punctuation removal), and then a spelling check tool and a grammar analysis tool are used respectively to detect whether there are spelling mistakes or grammar problems in the email body. In some examples, the words in the preset dictionary can be compared with the words in the email body to identify the words in the email body that are not in the preset dictionary, and then determine whether there are spelling mistakes; and the structural anomalies in the sentence, such as subject-verb disagreement and lack of necessary components, can be detected through predefined grammar rules and syntactic structures, so as to identify grammar errors in the email body. It is also possible to identify parts of the email body that do not conform to conventional grammar and spelling mistakes based on the Transformer model. In this embodiment, the method for determining whether there is incorrect content in the email body is not limited.

[0109] Step 420, when there is incorrect content in the email body corresponding to the email data, determine that the email data is inferior data.

[0110] In some embodiments, when there is incorrect content in the email body corresponding to the email data, or when there is a relatively large amount of incorrect content in the email body corresponding to the email data, the email data can be determined as low-quality training data and deleted from the first dataset, thereby filtering out the low-quality training data in the first dataset.

[0111] Step 430, when there is no incorrect content in the email body corresponding to the email data, determine that the email data is high-quality data.

[0112] In some embodiments, when there is no incorrect content in the email body corresponding to the email data, or when there is a relatively small amount of incorrect content in the email body corresponding to the email data, the email data can be determined as high-quality training data and retained in the first dataset.

[0113] Through the above solution, it is possible to detect grammar and spelling errors in the text through natural language processing, so as to accurately identify email data with low content quality and improve the quality of the first dataset.

[0114] Figure 5 Another flowchart for determining whether email data is high-quality data or low-quality data provided by an embodiment of this application is as Figure 5 shown, and the above step 140 includes steps 510 to 540.

[0115] Step 510, when the target detection strategy is the second detection strategy, detect the email data based on each detection dimension among multiple detection dimensions to obtain the detection scores of each detection dimension corresponding to the email data.

[0116] In some embodiments, when the second detection strategy is adopted, multiple detection dimensions can be set to perform in-depth detection on the email data in multiple aspects. Among them, the multiple detection dimensions can include email authenticity, email timeliness, and legality of the sending scope, etc. After detecting the email data based on each detection dimension among the multiple detection dimensions, the detection results corresponding to each detection dimension can be quantified to determine the detection scores of each detection dimension corresponding to the email data, so as to facilitate the evaluation of the quality of the email data.

[0117] Step 520, based on the detection scores of each detection dimension corresponding to the email data and the source credibility, determine the target detection score corresponding to the email data.

[0118] In some embodiments, after obtaining the detection scores of each detection dimension corresponding to the mail data, the target detection score corresponding to the mail data can be determined based on the detection scores of each detection dimension and the source credibility at the same time, so as to evaluate the quality of the mail data based on dimensions such as source credibility, mail authenticity, mail timeliness, and legality of the sending range at the same time.

[0119] Exemplarily, the source credibility and the detection scores of each detection dimension can be added to obtain the target detection score; alternatively, corresponding weights can also be set for the source credibility and each detection dimension, and the target detection score can be determined based on the product of the source credibility and each detection dimension and the corresponding weights.

[0120] Step 530, when the target detection score is less than the preset score, determine that the mail data is low-quality data.

[0121] In some embodiments, after obtaining the target detection score of the mail data, the target detection score can be compared with the preset score. If the target detection score of the mail data is less than the preset score, it can be determined that the mail data is low-quality mail data. For example, if the target detection score of mail data A is 60 points and the preset score is 70 points, it can be determined that the mail data A is low-quality mail data.

[0122] Step 540, when the target detection score is greater than or equal to the preset score, determine that the mail data is high-quality data.

[0123] In some embodiments, if the target detection score of the mail data is greater than or equal to the preset score, it can be determined that the mail data is high-quality mail data. For example, if the target detection score of mail data B is 80 points and the preset score is 70 points, it can be determined that the mail data B is high-quality mail data.

[0124] Through the above solution, when the source credibility of the mail data is low, the quality of the mail data can be comprehensively evaluated through multi-dimensional detection, so as to improve the accuracy of screening low-quality data.

[0125] Figure 6 The figure is a flowchart for determining the detection scores of each detection dimension corresponding to the mail data provided by the embodiments of the present application. As Figure 6 shown, the above step 510 includes steps 610 to 630.

[0126] Step 610, based on the mail body corresponding to the mail data, determine the first detection score corresponding to the mail data.

[0127] In some embodiments, when performing authenticity detection on email data using the second detection strategy, the email body corresponding to the email data can be obtained, and the semantics and logic of the email body can be identified to obtain the detection results of the semantics and logic of the email body. After obtaining the detection results, the detection results can be quantified to obtain the first detection score corresponding to the email data.

[0128] Step 620: Determine the second detection score corresponding to the email data based on the email body and the sending time corresponding to the email data.

[0129] In some embodiments, when performing timeliness detection on email data using the second detection strategy, the email body and the sending time corresponding to the email data can be obtained, and the detection timeliness corresponding to the content described in the email body can be compared with the email sending time to determine whether the sending time of the email is within the detection timeliness range of the email body, so as to obtain the detection result of the timeliness corresponding to the email data. If the sending time of the email exceeds the detection timeliness of the email body, it can be determined that the timeliness corresponding to the email data is low; if the sending time of the email does not exceed the detection timeliness of the email body, it can be determined that the timeliness corresponding to the email data is high. Then the detection result can be quantified to obtain the second detection score corresponding to the email data.

[0130] Step 630: Determine the third detection score corresponding to the email data based on the email body and the recipient address corresponding to the email data.

[0131] In some embodiments, when performing detection on the legality of the sending range of email data using the second detection strategy, the email body and the recipient address corresponding to the email data can be obtained, and it can be determined whether the email data contains the email body, whether there is a recipient address, and whether the number of recipient addresses exceeds a preset number, etc., so as to determine whether the email data is mass spam and obtain the detection result of the legality of the sending range corresponding to the email data. Then the detection result can be quantified to obtain the third detection score corresponding to the email data.

[0132] Through the above solution, specific detection methods can be set for email data for different detection dimensions to ensure the accuracy of the quality assessment of email data.

[0133] Figure 7 The flowchart for determining the first detection score corresponding to the email data provided by the embodiment of the present application is as Figure 7 shown, and the above step 610 includes steps 710 to 730.

[0134] Step 710: Perform semantic recognition on the email body corresponding to the email data to obtain the semantic recognition result of the email body corresponding to the email data.

[0135] In some embodiments, when detecting the authenticity of email data, natural language processing techniques (such as semantic relation extraction, semantic role labeling, dependency parsing, etc.) can be used to perform semantic recognition on the email body to analyze whether there are rhetorical expressions that do not conform to conventional descriptions, narrative patterns that deviate from conventional techniques, unreasonable jumps or breaks in semantics, or combinations of extreme adjectives and adverbs in the email body, and obtain the semantic recognition result, so as to determine whether the email body contains exaggerated and untrue content according to the semantic recognition result.

[0136] Exemplarily, taking the email body "The chip we developed ourselves is equipped with the world's only AI quantum engine, which can truly achieve zero-latency computing, far exceeding all traditional architectures; our chip can not only learn autonomously, but also predict future computing needs and can complete computing before the task arrives" as an example, after performing semantic recognition on this email body, it can be determined that there are exaggerated descriptions that do not conform to the facts in this email body, such as "the only AI quantum engine", "far exceeding all", "predicting the future", and "completing computing before the task arrives".

[0137] Step 720, perform logical analysis processing on the email body corresponding to the email data to obtain the logical analysis result of the email body corresponding to the email data.

[0138] In some embodiments, in addition to performing semantic recognition, logical analysis processing can also be performed on the email body, and it can be determined whether the logic of the content described in the email body is reasonable and self-consistent according to the logical analysis result.

[0139] Exemplarily, a logical reasoning algorithm can be used to check whether there are self-contradictory or causally inconsistent parts in the email body, or the degree of logical falsity of the email body can be predicted based on a pre-trained large language model to judge its deviation degree from the facts. Among them, when training the large language model, texts that conform to the facts and texts of false propaganda can be used as training data.

[0140] Continuing with the above example, for the description in this email body that the chip has "autonomous learning" and "prediction of future computing needs", there is no theoretical data support; moreover, currently quantum computers are only used in specific fields (such as cryptography, drug research and development), and are large in size and cannot be integrated into ordinary chips; and the current fastest computing devices (such as superconducting qubits) still have nanosecond-level delays and cannot achieve "zero latency"; the technical details, test reports, and cooperation cases in the email body are also missing. Therefore, it can be determined that the logic of this email body is not reasonable.

[0141] Step 730, based on the semantic recognition result and logical analysis result of the email body corresponding to the email data, determine the first detection score corresponding to the email data.

[0142] In some embodiments, subsequently, the first detection score corresponding to the email data may be determined according to the proportion of exaggerated content included in the email body indicated by the semantic recognition result and the degree of logical unreasonableness in the email body indicated by the logical analysis result.

[0143] For example, if the semantic recognition result indicates that the exaggerated content in the email body accounts for 80% of the total content, and the logical analysis result indicates that the degree of logical unreasonableness in the email body is 90%, then the first detection score corresponding to the email data can be determined as (80% + 90%) × 100 / 2 = 65. It should be noted that the above method for determining the first detection score based on the semantic recognition result and the logical analysis result is only an example, and this embodiment does not limit it.

[0144] Through the above solution, the semantics and logic of the email body can be analyzed, and the authenticity of the email body can be accurately quantified, thereby providing a reliable basis for the quality assessment of email data.

[0145] Figure 8 The following is a flowchart for determining the second detection score corresponding to the email data provided by the embodiment of the present application. As Figure 8 shown, the above step 620 includes steps 810 to 820.

[0146] Step 810: Determine the keywords in the email body corresponding to the email data, and determine the target keywords that are not within the detection timeliness.

[0147] In some embodiments, when performing timeliness detection on the email body, the keywords in the email body may be extracted first based on natural language processing technology, and the detection timeliness corresponding to the keywords may be determined.

[0148] Exemplarily, a keyword library can be constructed and updated regularly. The keyword library may include terms, policies, product information, etc. that are not outdated (i.e., within the detection timeliness). For example, "Windows11 support", "2025 patches", "ChatGPT vulnerabilities" in the field of network security, "2025 stock market forecast" in the financial field, "Double 11 2025 promotion", "2025 Spring Festival discount" in the field of e-commerce, etc., to adapt to emerging scenarios.

[0149] Taking the email body "Our company offers a long-term support plan for Windows 7 Professional Edition, valid until the end of 2023" as an example, the target keywords "Windows7" and "2023" in this email body are not included in the keyword library; taking the email body "The growth rate of the cloud computing market this quarter reached 15%, and it is expected to continue to grow throughout the year" as an example, the target keywords that are known to be outdated are not included in this email body.

[0150] Step 820: Determine the second detection score corresponding to the email data according to the sending time of the email data and the number of target keywords.

[0151] In some embodiments, the sending time of the email can also be extracted from the header field of the email data, the time difference from the current time can be calculated, and it can be determined whether the time difference exceeds a preset time threshold. Exemplarily, the determination method of the time difference can refer to formula (1):

[0152] ΔT = T current - T send ; (1)

[0153] Where, T current is the current time, T send is the sending time of the email data, and ΔT is the time difference.

[0154] For example, if ΔT exceeds the preset time threshold (such as 365 days), it means that there may be a timeliness problem with the email data.

[0155] In some embodiments, after determining the above time difference and the number of target keywords, the second detection score corresponding to the email data can be determined according to formula (2):

[0156] S time = W1 × F date - W2 × F keywords ; (2)

[0157] Where, W1 and W2 are preset weights; the email freshness F date is determined according to the time difference ΔT. The larger ΔT is, the smaller F date is; F keywords is the number of target keywords; S time is the second detection score. In some examples, the determination method of F date can refer to the formula (3) shown:

[0158] `

[0159] Where, T threshold is the preset time threshold, and maxscore is the preset maximum second detection score.

[0160] Exemplarily, taking the maximum second detection score as 100 points, T threshold as 365 days, W1 as 0.4, and W2 as 0.6 as an example, if the sending time T of the email data send is 2024-10-17, the current time T current is 2025-03-25, and the number of target keywords is 5, then according to formula (1), the time difference ΔT can be determined to be 160 days, and according to formula (3), the email currency F date = 57 can be determined. Then, according to formula (2), the second detection score S of the email data can be determined time = 0.4×57 - 0.6×5 = 19.8.

[0161] Through the above solution, the timeliness of email data can be detected, and a lower second detection score can be given to the data that does not conform to the current detection trend, so as to ensure that the training data is synchronized with the latest trend.

[0162] Figure 9 The flowchart for determining the third detection score corresponding to the email data provided by the embodiment of the present application is as follows Figure 9 shown. The above step 630 includes steps 910 to 920.

[0163] Step 910, determine whether the number of recipient addresses corresponding to the email data exceeds the preset number, and whether the email data contains email body or attachment information, and obtain the sending range detection result.

[0164] In some embodiments, when detecting the sending range of the email data, the sending range detection result can be obtained by determining the number of recipient addresses, whether it contains the email body, attachments, etc., and determine whether the email data is spam based on the sending range detection result. Among them, the recipient address corresponding to the email data can be obtained by parsing the recipient address field of the email.

[0165] Step 920, determine the third detection score corresponding to the email data based on the sending range detection result.

[0166] In some embodiments, after determining the above sending range detection result, determine the third detection score corresponding to the email data based on the sending range detection result. Exemplarily, if the number of recipient addresses exceeds the preset number of recipient addresses, then on the basis of the preset maximum third detection score, subtract the score equal to the number of recipient addresses exceeding the preset threshold; and in the case that the email data does not contain the email body or attachments, subtract the preset deduction score on the basis of the preset maximum third detection score.

[0167] For example, taking the preset maximum third detection score as 100 points, the preset deduction score as 20 points, and the preset number of recipient addresses as 20 as an example, if the number of recipient addresses corresponding to the mail data is 25 and the mail data does not contain a mail body or attachments, it can be determined that the third detection score corresponding to the mail data is 100 - (25 - 20) - 20 = 75 points.

[0168] Through the above solution, it is possible to automatically analyze the recipient addresses of mail data and whether it contains mail body or attachment information to further ensure the quality of training data.

[0169] Figure 10 A flowchart for determining the target detection score corresponding to mail data provided by an embodiment of the present application is as Figure 10 shown, and the above step 520 includes steps 1010 to 1020.

[0170] Step 1010, determine the first weight corresponding to the source credibility and the second weights corresponding to each detection dimension.

[0171] In some embodiments, after determining the source credibility corresponding to the mail data and the detection scores corresponding to each detection dimension (including the first detection score, the second detection score, and the third detection score), the target detection score corresponding to the mail data can be determined based on the source credibility and the detection scores corresponding to each detection dimension.

[0172] Exemplarily, corresponding weights can be set for the source credibility and each detection dimension respectively, so as to determine the target detection score based on the weight corresponding to the source credibility (such as the first weight) and the weights corresponding to each detection dimension (such as the second weights). For example, the first weight corresponding to the source credibility can be set to 0.4, the second weight corresponding to the authenticity (i.e., the first detection score) in each detection dimension is 0.4, the second weight corresponding to the timeliness (i.e., the second detection score) is 0.1, and the second weight corresponding to the legality of the sending range (i.e., the third detection score) is 0.1.

[0173] Step 1020, determine the target detection score based on the product between the source credibility and the first weight, and the products between the detection scores of each detection dimension and the corresponding second weights.

[0174] In some embodiments, the target detection score can be determined according to the product between the source credibility and its corresponding first weight, the products between the detection scores of each detection dimension and the corresponding second weights, and the sum of the above two products.

[0175] Continuing with the above example, if the source credibility corresponding to the email data is 30 points, the first detection score is 40 points, the second detection score is 50 points, and the third detection score is 60 points, then the target detection score of the email data is 30×0.4 + 40×0.4 + 50×0.1 + 60×0.1 = 39 points.

[0176] Through the above technical solution, the weights corresponding to the source credibility and each detection dimension can be dynamically adjusted according to the source credibility, the priority of each detection dimension, the actual requirements, and the recognition result of the inferior training data, thereby improving the recognition accuracy of the inferior training data.

[0177] Figure 11 The flowchart for processing inferior data provided by an embodiment of the present application is as Figure 11 shown, and the method further includes steps 1110 to 1150.

[0178] Step 1110, in the case of determining that the email data is inferior data, delete the email data from the first data set to obtain a second data set.

[0179] In some embodiments, after determining the inferior training data in the first data set, the inferior training data can be deleted from the first data set, so as to retain the high-quality training data and obtain a second data set.

[0180] Step 1120, train a preset model based on the second data set to obtain a trained second preset model.

[0181] In some embodiments, before training a preset model based on the first data set, the parameters of the preset model can be exported and saved first. Thus, if the first data set causes the model performance of the preset model to decline, the pre-saved model parameters, that is, the model parameters of the preset model before deterioration (hereinafter referred to as the preset model parameters), can be obtained and imported into the current preset model (such as the first preset model), so that the preset model before deterioration can be trained based on the second data set. In this way, the model performance of the preset model (hereinafter referred to as the second preset model) obtained after training based on the second data set can be compared with the preset performance to determine whether the performance of the second preset model has declined.

[0182] In some embodiments, after determining the inferior training data in the first dataset, the comprehensive detection result corresponding to the first dataset may be determined based on the detection results corresponding to each email data in the first dataset, and a detection report (such as a visualization chart) may be generated. The comprehensive detection result may include the number of email data corresponding to high source credibility, medium source credibility, and low source credibility in the first dataset, and the average score of each detection dimension of multiple email data corresponding to low source credibility.

[0183] Step 1130: Perform a performance test on the second preset model and determine the second test score corresponding to the second preset model.

[0184] In some embodiments, the performance of the second preset model may be tested by inputting a test dataset. After the second preset model finishes processing the test dataset, the processing result of the second preset model may be scored to obtain the second test score, so as to evaluate the model performance of the second preset model based on the second test score. It can be understood that the method for determining the second test score corresponding to the second preset model may refer to the description in step 230 and will not be elaborated here.

[0185] Step 1140: When the second test score is greater than the preset test score, determine the second dataset as the processed target dataset.

[0186] In some embodiments, after obtaining the second test score corresponding to the second preset model, the test score corresponding to the second preset model may be compared with the preset test score, and it may be determined whether the second test score is less than or equal to the preset test score. If the second test score is greater than the preset test score, it means that the second dataset does not contain inferior training data, so the second dataset can be determined as the target dataset that has been successfully processed. And the training of the second preset model may continue based on the next training dataset.

[0187] Step 1150: When the second test score is less than or equal to the preset test score, re-determine the inferior data in the first dataset.

[0188] In some embodiments, if the second test score of the second preset model is less than or equal to the preset test score, that is, the model performance of the second preset model is less than or equal to the preset performance, it means that the second dataset still contains inferior training data, so the first dataset can be re-processed to determine the inferior training data therein. When re-determining the inferior training data in the first dataset, the weights corresponding to the source credibility and each detection dimension may be adaptively adjusted, or the inferior training data may be determined by means of manual intervention.

[0189] Through the above technical solution, after determining the low-quality training data in the first data set, the low-quality training data can be deleted from the first data set to obtain a second data set, and the preset model can be trained and performance-tested again based on the second data set to ensure that the low-quality training data has been effectively identified.

[0190] Figure 12 The flowchart of a mail recognition method provided by an embodiment of the present application is as Figure 12 shown, and this method includes step 1210 to step 1230.

[0191] Step 1210, obtain a target training data set determined after processing a training data set based on a mail data processing method.

[0192] In some embodiments, the mail data processing method provided in the above embodiments can be applied to a mail security system, which is deployed on a computing device (i.e., the first computing device). After the first computing device processes the training data set based on the mail data processing method provided in the above embodiments, the low-quality training data and high-quality training data in the training data set can be determined. Among them, the training data set includes multiple mail data, and the multiple mail data includes high-quality training data. It can be understood that the manner of determining the low-quality training data and high-quality training data in the training data set can refer to the relevant steps of the embodiments of the above mail data processing method, which will not be elaborated here.

[0193] In some embodiments, after determining the high-quality training data and low-quality training data, a target training data set can be determined based on the high-quality training data, that is, the mail data in the target training data set are all high-quality training data. Exemplarily, the low-quality training data can be deleted from the training data set, so as to obtain a target training data set that does not include low-quality training data.

[0194] Step 1220, train a mail recognition model to be trained based on the target training data set to obtain a trained mail recognition model.

[0195] In some embodiments, the first computing device can send the determined target training data set to a computing device (such as the second computing device) on which a mail recognition model is deployed, so that the second computing device can train the mail recognition model to be trained based on the target training data set and obtain a trained mail recognition model. Exemplarily, a computing device (such as the third computing device) with a mail gateway can intercept the mail data sent to the internal network and send the mail data to the second computing device, so that the mail recognition model on the second computing device can process the mail data.

[0196] Step 1230: Process the email data to be recognized based on the trained email recognition model to determine whether the email data to be recognized is malicious email data or non-malicious email data.

[0197] In some embodiments, after receiving the email data, the email recognition model processes the email data to be recognized to determine whether the email data is malicious email data, and obtains an email recognition result. Additionally, the email recognition model can send the email recognition result to the email security system in the first computing device. If the email recognition result indicates that the email is malicious, the email security system can filter the email (such as storing it in an isolation area) and can generate a malicious email processing log for the administrator to view; if the email recognition result indicates that the email is non-malicious, the email security system can send the email to the client for the user to receive and view the non-malicious email through the client, thereby avoiding the risk of the client being attacked by malicious emails.

[0198] Figure 13 The flowchart of another email data processing method provided by the embodiments of the present application is as Figure 13 shown, and the method includes Step 1301 to Step 1315.

[0199] Step 1301: Train a preset model based on a first data set to obtain a trained first preset model.

[0200] It can be understood that the implementation manner of Step 1301 can refer to the description of Step 210 and will not be elaborated here.

[0201] Step 1302: Determine whether the model performance of the first preset model is improved.

[0202] It can be understood that the implementation manner of Step 1302 can refer to the descriptions of Step 220 and Step 230 and will not be elaborated here.

[0203] Step 1303: If the model performance of the first preset model is not improved, train the first preset model based on the next training data set.

[0204] It can be understood that the implementation manner of Step 1303 can refer to the description of Step 240 and will not be elaborated here.

[0205] Step 1304: If the model performance of the first preset model is improved, obtain the email data to be processed in the first data set, and determine the source credibility corresponding to the email data based on the sender address corresponding to the email data.

[0206] It can be understood that the implementation manner of Step 1304 can refer to the descriptions of Step 110 and Step 120 and will not be elaborated here.

[0207] Step 1305: When the source credibility corresponding to the mail data is equal to the first preset value, release the mail data.

[0208] It can be understood that the implementation manner of Step 1305 can refer to the descriptions of Step 130 and Step 310, which will not be elaborated here.

[0209] Step 1306: When the source credibility corresponding to the mail data is equal to the second preset value, perform natural language processing on the mail body corresponding to the mail data.

[0210] It can be understood that the implementation manner of Step 1306 can refer to the descriptions of Step 130 and Step 320, which will not be elaborated here.

[0211] Step 1307: Determine whether there is incorrect content in the mail body corresponding to the mail data.

[0212] Exemplarily, if there is no incorrect content in the mail body corresponding to the mail data, execute Step 1311; if there is incorrect content in the mail body corresponding to the mail data, execute Step 1312. It can be understood that the implementation manner of Step 1307 can refer to the descriptions from Step 410 to Step 430, which will not be elaborated here.

[0213] Step 1308: When the source credibility corresponding to the mail data is equal to the third preset value, detect the mail data based on the authenticity of the mail, the timeliness of the mail, and the legality of the sending scope, and obtain the detection scores of each detection dimension corresponding to the mail data.

[0214] It can be understood that the implementation manner of Step 1308 can refer to the descriptions of Step 510, Step 610 to Step 630, Step 710 to Step 730, Step 810 to Step 820, and Step 910 to Step 920, which will not be elaborated here.

[0215] Step 1309: Based on the detection scores of each detection dimension corresponding to the mail data and the source credibility, determine the target detection score corresponding to the mail data.

[0216] It can be understood that the implementation manner of Step 1309 can refer to the descriptions of Step 520 and Step 1010 to Step 1020, which will not be elaborated here.

[0217] Step 13: Judge whether the target detection score is less than the preset score.

[0218] Exemplarily, if the target detection score is greater than or equal to the preset score, then step 1311 is executed; if the target detection score is less than the preset score, then step 1312 is executed. It can be understood that the implementation manner of step 1310 can refer to the descriptions of step 530 and step 540, which will not be elaborated here.

[0219] Step 1311: Determine that the mail data is high-quality training data.

[0220] It can be understood that the implementation manner of step 1311 can refer to the description of step 140, which will not be elaborated here.

[0221] Step 1312: Determine that the mail data is low-quality training data, and delete the mail data from the first data set to obtain a second data set.

[0222] It can be understood that the implementation manner of step 1312 can refer to the descriptions of step 140 and step 1110, which will not be elaborated here.

[0223] Step 1313: Train a preset model based on the second data set to obtain a trained second preset model.

[0224] It can be understood that the implementation manner of step 1313 can refer to the description of step 1120, which will not be elaborated here.

[0225] Step 1314: Determine whether the model performance of the second preset model is improved.

[0226] Exemplarily, if the model performance of the second preset model is not improved, then step 1315 is executed; if the model performance of the second preset model is improved, then step 1304 is executed. It can be understood that the implementation manner of step 1314 can refer to the descriptions of step 1130 to step 1150, which will not be elaborated here.

[0227] Step 1315: If the model performance of the second preset model is not improved, then determine the second data set as the processed target data set, and train the second preset model based on the next training data set.

[0228] It can be understood that the implementation manner of step 1315 can refer to the description of step 1150, which will not be elaborated here.

[0229] Applying the technical solution of the present application, by performing source credibility grading and dynamic detection strategies, it is possible to efficiently identify low-quality training data. For example, high-credibility email data is exempted from inspection to reduce a large amount of computing resources, medium-credibility email data is simply detected to quickly screen out obvious errors, and low-credibility email data is deeply detected to comprehensively evaluate data quality. Moreover, by detecting email data through multiple detection dimensions, it is possible to avoid the detection result deviation caused by only performing a single detection dimension. In addition, through the closed-loop process of "detection - deletion - retraining - verification", it is possible to ensure the successful deletion of low-quality training data in the training dataset. Further, by removing the low-quality training data in the training dataset and training the model based on high-quality training data, logical contradictions in model training can be avoided and the performance of the model can be improved. In addition, the email data processing method provided by the present application can not only be applied to process email data, but also can perform quality detection on other types of data by adaptively changing the corresponding detection strategies.

[0230] Figure 14 It is a schematic diagram of an email data processing device provided by an embodiment of the present application. As Figure 14 shown, the email data processing device 1400 includes an acquisition module 1410, a first determination module 1420, a second determination module 1430, and a detection module 1440.

[0231] The acquisition module 1410 is configured to acquire the email data to be processed.

[0232] The first determination module 1420 is configured to determine the source credibility corresponding to the email data based on the sender address corresponding to the email data.

[0233] The second determination module 1430 is configured to determine the target detection strategy corresponding to the email data from multiple candidate detection strategies based on the source credibility corresponding to the email data.

[0234] Among them, the detection intensities of the candidate detection strategies in the multiple candidate detection strategies are different; the source credibility corresponding to the sender address is negatively correlated with the detection intensity of the target detection strategy.

[0235] The detection module 1440 is configured to detect the email data based on the target detection strategy to determine whether the email data is high-quality data or low-quality data.

[0236] In some embodiments, the second determination module 1430 is specifically configured to: when the source credibility corresponding to the mail data is equal to the first preset value, determine that the target detection policy corresponding to the mail data is empty; when the source credibility corresponding to the mail data is equal to the second preset value, determine that the target detection policy corresponding to the mail data is the first detection policy; when the source credibility corresponding to the mail data is equal to the third preset value, determine that the target detection policy corresponding to the mail data is the second detection policy; wherein, the first preset value is greater than the second preset value, the second preset value is greater than the third preset value, and the detection intensity of the second detection policy is greater than the detection intensity of the first detection policy.

[0237] In some embodiments, the detection module 1440 is specifically configured to: when the target detection policy is the first detection policy, perform natural language processing on the mail body corresponding to the mail data to determine whether there is incorrect content in the mail body corresponding to the mail data; wherein, the incorrect content includes grammar errors and / or spelling errors; when there is incorrect content in the mail body corresponding to the mail data, determine that the mail data is inferior data; when there is no incorrect content in the mail body corresponding to the mail data, determine that the mail data is high-quality data.

[0238] In some embodiments, the detection module 1440 is specifically configured to: when the target detection policy is the second detection policy, detect the mail data based on each detection dimension in a plurality of detection dimensions to obtain the detection scores of each detection dimension corresponding to the mail data; wherein, the plurality of detection dimensions include mail authenticity, mail timeliness, and sending range legality; based on the detection scores of each detection dimension corresponding to the mail data and the source credibility, determine the target detection score corresponding to the mail data; when the target detection score is less than the preset score, determine that the mail data is inferior data; when the target detection score is greater than or equal to the preset score, determine that the mail data is high-quality data.

[0239] In some embodiments, the detection module 1440 is specifically configured to: based on the mail body corresponding to the mail data, determine the first detection score corresponding to the mail data; wherein, the first detection score is used to represent the authenticity of the mail data; based on the mail body and the sending time corresponding to the mail data, determine the second detection score corresponding to the mail data; wherein, the second detection score is used to represent the timeliness of the mail data; based on the mail body and the recipient address corresponding to the mail data, determine the third detection score corresponding to the mail data; wherein, the third detection score is used to represent the legality of the sending range of the mail data.

[0240] In some embodiments, the detection module 1440 is specifically configured to: perform semantic recognition on the email body corresponding to the email data to obtain a semantic recognition result of the email body corresponding to the email data; perform logical analysis processing on the email body corresponding to the email data to obtain a logical analysis result of the email body corresponding to the email data; and determine a first detection score corresponding to the email data based on the semantic recognition result and the logical analysis result of the email body corresponding to the email data.

[0241] In some embodiments, the detection module 1440 is specifically configured to: determine keywords in the email body corresponding to the email data, and determine target keywords that are not within the detection time limit among the keywords; and determine a second detection score corresponding to the email data according to the sending time corresponding to the email data and the number of target keywords.

[0242] In some embodiments, the detection module 1440 is specifically configured to: determine whether the number of recipient addresses corresponding to the email data exceeds a preset number, and whether the email data includes email body or attachment information, and obtain a sending range detection result; and determine a third detection score corresponding to the email data based on the sending range detection result.

[0243] In some embodiments, the detection module 1440 is specifically configured to: determine a first weight corresponding to the source credibility and second weights corresponding to each detection dimension; and determine a target detection score based on the product between the source credibility and the first weight, and the product between the detection score of each detection dimension and the corresponding second weight.

[0244] In some embodiments, the acquisition module 1410 is specifically configured to: train a preset model based on a first data set to obtain a trained first preset model; wherein, the first data set includes multiple email data; acquire a test data set, and process the test data set based on the first preset model to obtain a processing result; wherein, the test data set includes multiple email data for model testing; score the processing result to obtain a first test score corresponding to the first preset model; and in the case where the first test score is less than or equal to a preset test score, acquire the email data to be processed in the first data set; wherein, all the email data in the first data set are email data to be processed.

[0245] As Figure 14 shown, the email data processing device 1400 further includes a deletion module 1450, a training module 1460, a testing module 1470, and a third determination module 1480.

[0246] In some embodiments, the deletion module 1450 is configured to delete the mail data from the first data set to obtain a second data set when it is determined that the mail data is inferior data; the training module 1460 is configured to train a preset model based on the second data set to obtain a trained second preset model; the testing module 1470 is configured to perform a performance test on the second preset model and determine a second test score corresponding to the second preset model; the third determination module 1480 is configured to determine the second data set as the processed target data set when the second test score is greater than a preset test score; the first determination module 1420 is further configured to re-determine the inferior data in the first data set when the second test score is less than or equal to the preset test score.

[0247] Figure 15 Schematic diagram of a mail recognition device provided by an embodiment of the present application. As Figure 15 shown, the mail recognition device 1500 includes a third determination module 1510, a training module 1520, and a processing module 1530.

[0248] The third determination module 1510 is configured to obtain a target training data set determined after processing a training data set based on a mail data processing method.

[0249] Among them, the target training data set includes multiple mail data, and the multiple mail data are high-quality training data.

[0250] The training module 1520 is configured to train a mail recognition model to be trained based on the target training data set to obtain a trained mail recognition model.

[0251] The processing module 1530 is configured to process the mail data to be recognized based on the trained mail recognition model to determine whether the mail data to be recognized is malicious mail data or non-malicious mail data.

[0252] Figure 16 Schematic diagram of a computing device provided by some embodiments of the present application. In some embodiments, the computing device may be a server, a terminal device, etc. The computing device includes one or more processors and a memory. The memory is configured to store one or more programs. Among them, when the one or more programs are executed by the one or more processors, the one or more processors implement the mail data processing method or the mail recognition method in the above embodiments.

[0253] As Figure 16As shown, the computing device 1600 includes a processor 1601 and a memory 1602. Exemplarily, the computing device 1600 may further include a communications interface 1603 and a communication bus 1604.

[0254] Among them, the processor 1601, the memory 1602, and the communications interface 1603 communicate with each other through the communication bus 1604. The communications interface 1603 is used to communicate with network elements of other devices such as clients or other servers.

[0255] In some embodiments, the processor 1601 is used to execute the program 1605, and specifically may execute the relevant steps in the above-described embodiments of the email data processing method or the email recognition method. Specifically, the program 1605 may include program code, and the program code includes computer-executable instructions.

[0256] Exemplarily, the processor 1601 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement some embodiments of the present application. The computing device 1600 may include one or more processors, which may be of the same type of processor, such as one or more CPUs; or may be of different types of processors, such as one or more CPUs and one or more ASICs.

[0257] In some embodiments, the memory 1602 is used to store the program 1605. The memory 1602 may include high-speed RAM memory, and may also include non-volatile memory (NVM), such as at least one disk memory.

[0258] The program 1605 can specifically be called by the processor 1601 to cause the computing device 1600 to perform operations of the email data processing method or the email recognition method.

[0259] Some embodiments of the present application provide a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction runs on the computing device 1600, it causes the computing device 1600 to execute the email data processing method or the email recognition method in the above embodiments.

[0260] The executable instruction can specifically be used to cause the computing device 1600 to perform operations of the email data processing method or the email recognition method.

[0261] For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0262] The beneficial effects that can be achieved by the readable storage media provided in some embodiments of the present application can refer to the beneficial effects in the corresponding email data processing method or email recognition method provided above, and will not be elaborated here.

[0263] It should be noted that in the application, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or device comprising the element.

[0264] Each embodiment in this specification is described in a related manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments.

[0265] The logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus or device), or in combination with these instruction execution systems, apparatus or devices.

[0266] For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0267] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection (electronic device) having one or more wirings, a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM).

[0268] Additionally, the computer-readable medium can even be paper or other suitable media on which a program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other suitable processing as necessary, and then stored in a computer memory. It should be understood that the various parts of the present application can be implemented in hardware, software, firmware, or a combination thereof.

[0269] In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or a combination of the following techniques well-known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having suitable combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), and the like.

[0270] The above-described embodiments are only specific embodiments of the present application and are not used to limit the protection scope of the present application. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the present application shall be included within the protection scope of the present application.

Claims

1. A method for processing email data, characterized in that, Including: Obtain the mail data to be processed; Based on the sender address corresponding to the mail data, determine the source credibility corresponding to the mail data; Based on the source credibility corresponding to the mail data, determine the target detection strategy corresponding to the mail data among multiple candidate detection strategies; wherein, the detection intensities of the candidate detection strategies in the multiple candidate detection strategies are different; the source credibility corresponding to the sender address is negatively correlated with the detection intensity of the target detection strategy; Detect the mail data based on the target detection strategy to determine whether the mail data is high-quality data or low-quality data.

2. The method according to claim 1, characterized in that The determining the target detection strategy corresponding to the mail data among multiple candidate detection strategies based on the source credibility corresponding to the mail data includes: When the source credibility corresponding to the mail data is equal to the first preset value, determine that the target detection strategy corresponding to the mail data is empty; When the source credibility corresponding to the mail data is equal to the second preset value, determine that the target detection strategy corresponding to the mail data is the first detection strategy; When the source credibility corresponding to the mail data is equal to the third preset value, determine that the target detection strategy corresponding to the mail data is the second detection strategy; wherein, the first preset value is greater than the second preset value, the second preset value is greater than the third preset value, and the detection intensity of the second detection strategy is greater than the detection intensity of the first detection strategy.

3. The method according to claim 2, wherein The detecting the mail data based on the target detection strategy to determine whether the mail data is high-quality data or low-quality data includes: When the target detection strategy is the first detection strategy, perform natural language processing on the mail body corresponding to the mail data to determine whether there is incorrect content in the mail body corresponding to the mail data; wherein, the incorrect content includes grammar errors and / or spelling errors; When there is the incorrect content in the mail body corresponding to the mail data, determine that the mail data is low-quality data; When there is no such incorrect content in the mail body corresponding to the mail data, determine that the mail data is high-quality data.

4. The method according to claim 2, characterized in that The detecting the mail data based on the target detection strategy to determine whether the mail data is high-quality data or low-quality data includes: When the target detection strategy is the second detection strategy, detect the mail data based on each of the multiple detection dimensions to obtain the detection scores of each of the detection dimensions corresponding to the mail data; wherein, the multiple detection dimensions include mail authenticity, mail timeliness, and the legality of the sending range; Based on the detection scores of each of the detection dimensions corresponding to the mail data and the source credibility, determine the target detection score corresponding to the mail data; When the target detection score is less than the preset score, determine that the mail data is low-quality data; When the target detection score is greater than or equal to the preset score, determine that the mail data is high-quality data.

5. The method according to claim 4, wherein When the target detection strategy is the second detection strategy, detecting the email data based on each of the multiple detection dimensions to obtain the detection scores of each of the detection dimensions corresponding to the email data, including: Determining a first detection score corresponding to the email data based on the email body corresponding to the email data; wherein, the first detection score is used to characterize the authenticity of the email data; Determining a second detection score corresponding to the email data based on the email body and the sending time corresponding to the email data; wherein, the second detection score is used to characterize the timeliness of the email data; Determining a third detection score corresponding to the email data based on the email body and the recipient address corresponding to the email data; wherein, the third detection score is used to characterize the legality of the sending range of the email data.

6. The method according to claim 5, wherein The determining a first detection score corresponding to the email data based on the email body corresponding to the email data includes: Performing semantic recognition on the email body corresponding to the email data to obtain a semantic recognition result of the email body corresponding to the email data; Performing logical analysis processing on the email body corresponding to the email data to obtain a logical analysis result of the email body corresponding to the email data; Determining a first detection score corresponding to the email data based on the semantic recognition result and the logical analysis result of the email body corresponding to the email data.

7. The method according to claim 5, characterized in that, The determining a second detection score corresponding to the email data based on the email body and the sending time corresponding to the email data includes: Determining keywords in the email body corresponding to the email data, and determining target keywords that are not within the detection timeliness among the keywords; Determining a second detection score corresponding to the email data according to the sending time corresponding to the email data and the number of the target keywords.

8. The method according to claim 5, characterized in that The determining a third detection score corresponding to the email data based on the email body and the recipient address corresponding to the email data includes: Determining whether the number of recipient addresses corresponding to the email data exceeds a preset number, and whether the email data includes email body or attachment information, and obtaining a sending range detection result; Determining the third detection score corresponding to the email data based on the sending range detection result.

9. A method for email recognition, characterized in that, Including: Obtaining a target training dataset determined after processing a training dataset by using the email data processing method according to any one of claims 1-8; wherein, the target training dataset includes multiple email data, and the multiple email data are high-quality training data; Training a to-be-trained email recognition model based on the target training dataset to obtain a trained email recognition model; Processing the to-be-recognized email data based on the trained email recognition model to determine whether the to-be-recognized email data is malicious email data or non-malicious email data.

10. A computing device, characterized in that, Including: One or more processors; And A memory configured to store one or more programs; Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the mail data processing method according to any one of claims 1-8, or implement the mail recognition method according to claim 9.

Images