Mail detection method and computing device
By separately detecting the header information and body information of the email and using a combination of small and large models, the problem of slow email detection is solved, and efficient and low-resource-consuming malicious email detection is achieved.
Patent Information
- Application Number
- CN202510724196.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-30
- Publication Date
- 2025-09-16
AI Technical Summary
In the existing technology, the email detection speed is slow, resulting in low detection efficiency.
A method of separating the header information and the body information is adopted. A small model is used to perform preliminary detection on the header information of the email. If it fails, it is determined to be a malicious email. If it passes, a large model is used to further detect the body information, combined with the update and optimization of the model training data set.
It improves the speed and efficiency of email detection, reduces detection resource consumption, and improves detection accuracy and efficiency.
Smart Images
Figure CN120658433A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present application relate to the field of email detection technology, and in particular, to an email detection method and a computing device. Background Art
[0002] With the rapid development of information technology, malicious emails have become a major threat to information security. Malicious emails may carry fraudulent information, malware, or viruses.
[0003] Currently, large-scale graphics processing unit (GPU) models can be used to detect emails to determine whether the emails are malicious. However, the above methods have a slow detection speed, resulting in low detection efficiency. Summary of the Invention
[0004] The embodiments of the present application provide an email detection method and a computing device for solving the technical problem of low detection efficiency.
[0005] In a first aspect, an embodiment of the present application provides an email detection method, applied to a computing device, the method comprising:
[0006] receiving a target email, wherein the target email includes header information and body information;
[0007] Obtaining a first detection result corresponding to the header information, where the first detection result is a detection pass or a detection fail;
[0008] If the first detection result is failure, determining that the target email is a malicious email;
[0009] If the first detection result is that the detection passes, it is determined whether the target email is a malicious email based on the body information.
[0010] In the above scheme, the computing device can receive the target email and obtain the first detection result corresponding to the header information of the target email. If the first detection result is that the detection fails, the computing device can determine that the target email is a malicious email; if the first detection result is that the detection passes, the computing device can determine whether the target email is a malicious email based on the main body information. In the above method, it is possible to first determine whether the target email is a malicious email based on the first detection result corresponding to the header information, that is, the header information of the target email can be detected first to determine whether the target email is a malicious email. If the target email can be determined to be a malicious email based on the header information, there is no need to perform other tests on the target email. The amount of data in the header information is relatively small. Through the above method, the amount of data for detection can be reduced, the detection speed is improved, and the detection efficiency is further improved, and it can quickly determine whether the email is a malicious email.
[0011] In one possible implementation, obtaining the first detection result corresponding to the header information includes:
[0012] The header information is detected and processed using a first model to obtain a first detection result, wherein the total amount of model parameters of the first model is less than or equal to a first threshold.
[0013] In the above solution, the first detection result can be obtained through the first model, thereby achieving the purpose of obtaining the first detection result.
[0014] In one possible implementation, determining whether the target email is a malicious email based on the body information includes:
[0015] Performing detection processing on the ontology information using a second model to obtain a second detection result, where the second detection result is a detection pass or a detection fail, and a total amount of model parameters of the second model is greater than a second threshold;
[0016] According to the second detection result, determine whether the target email is a malicious email.
[0017] In the above solution, whether the target email is a malicious email can be determined based on the body information, thereby achieving the purpose of determining whether the target email is a malicious email.
[0018] In one possible implementation, the detecting and processing the header information using the first model and obtaining a first detection result includes:
[0019] Extracting the header information from the target email;
[0020] The header information is input into a first model, and a first detection result is obtained from the first model.
[0021] In the above solution, the header information can be detected by the first model, thereby achieving the purpose of detecting the header information.
[0022] In a possible implementation, extracting the header information from the target email includes:
[0023] Searching for a first preset field in the target email, where the first preset field includes at least one of the following: subject, sending address, receiving address, timestamp, and attribute;
[0024] Extracting content corresponding to the first preset field;
[0025] The header information includes the content corresponding to the first preset field.
[0026] In the above solution, header information can be extracted from the target email, thereby achieving the purpose of extracting header information.
[0027] In one possible implementation, the detecting and processing the ontology information using the second model and obtaining the second detection result includes:
[0028] Extracting the entity information from the target email;
[0029] The ontology information is input into a second model, and a second detection result is obtained from the second model.
[0030] In the above solution, the ontology information can be detected by the second model, thereby achieving the purpose of detecting the ontology information.
[0031] In a possible implementation, extracting the entity information from the target email includes:
[0032] Searching for a second preset field in the target email, where the second preset field includes at least one of the following: text, attachment information, picture, and video;
[0033] Extracting content corresponding to the second preset field;
[0034] The ontology information includes the content corresponding to the second preset field.
[0035] In the above solution, the ontological information can be extracted from the target email, thereby achieving the purpose of extracting the ontological information.
[0036] In one possible implementation, the first detection result is a detection failure, or the second detection result is a detection failure, and the method further includes:
[0037] Based on the header information, updating a first training data set of the first model;
[0038] The first model is trained according to the first training data set to obtain an updated first model.
[0039] In the above solution, the first model can be trained according to the header information to obtain an updated first model, thereby achieving the purpose of continuously updating and optimizing the first model.
[0040] In a possible implementation, the second test result is a test failure, and the method further includes:
[0041] Based on the ontology information, updating a second training data set of the second model;
[0042] The second model is trained according to the second training data set to obtain an updated second model.
[0043] In the above solution, the second model can be trained according to the ontology information to obtain an updated second model, thereby achieving the purpose of continuously updating and optimizing the second model.
[0044] In a second aspect, an embodiment of the present application provides an email detection device, which is applied to a computing device. The device includes: a receiving module, an acquisition module, and a determination module, wherein:
[0045] The receiving module is used to receive a target email, wherein the target email includes header information and body information;
[0046] The acquisition module is used to acquire a first detection result corresponding to the header information, where the first detection result is a detection pass or a detection fail;
[0047] If the first detection result is detection failure, the determination module is used to determine that the target email is a malicious email;
[0048] If the first detection result is detection passed, the determination module is configured to determine whether the target email is a malicious email based on the body information.
[0049] In a possible implementation, the acquisition module is specifically configured to:
[0050] The header information is detected and processed using a first model to obtain a first detection result, wherein the total amount of model parameters of the first model is less than or equal to a first threshold.
[0051] In the above solution, the first detection result can be obtained through the first model, thereby achieving the purpose of obtaining the first detection result.
[0052] In a possible implementation, the determining module is specifically configured to:
[0053] Performing detection processing on the ontology information using a second model to obtain a second detection result, where the second detection result is a detection pass or a detection fail, and a total amount of model parameters of the second model is greater than a second threshold;
[0054] According to the second detection result, determine whether the target email is a malicious email.
[0055] In the above solution, whether the target email is a malicious email can be determined based on the body information, thereby achieving the purpose of determining whether the target email is a malicious email.
[0056] In a possible implementation, the acquisition module is specifically configured to:
[0057] Extracting the header information from the target email;
[0058] The header information is input into a first model, and a first detection result is obtained from the first model.
[0059] In the above solution, the header information can be detected by the first model, thereby achieving the purpose of detecting the header information.
[0060] In a possible implementation, the acquisition module is specifically configured to:
[0061] Searching for a first preset field in the target email, where the first preset field includes at least one of the following: subject, sending address, receiving address, timestamp, and attribute;
[0062] Extracting content corresponding to the first preset field;
[0063] The header information includes the content corresponding to the first preset field.
[0064] In the above solution, header information can be extracted from the target email, thereby achieving the purpose of extracting header information.
[0065] In a possible implementation, the determining module is specifically configured to:
[0066] Extracting the entity information from the target email;
[0067] The ontology information is input into a second model, and a second detection result is obtained from the second model.
[0068] In the above solution, the ontology information can be detected by the second model, thereby achieving the purpose of detecting the ontology information.
[0069] In a possible implementation, the determining module is specifically configured to:
[0070] Searching for a second preset field in the target email, where the second preset field includes at least one of the following: text, attachment information, picture, and video;
[0071] Extracting content corresponding to the second preset field;
[0072] The ontology information includes the content corresponding to the second preset field.
[0073] In the above solution, the ontological information can be extracted from the target email, thereby achieving the purpose of extracting the ontological information.
[0074] In a possible implementation, the apparatus further includes an updating module, wherein the updating module is configured to:
[0075] Based on the header information, updating a first training data set of the first model;
[0076] The first model is trained according to the first training data set to obtain an updated first model.
[0077] In the above solution, the first model can be trained according to the header information to obtain an updated first model, thereby achieving the purpose of continuously updating and optimizing the first model.
[0078] In a possible implementation, the update module is further configured to:
[0079] Based on the ontology information, updating a second training data set of the second model;
[0080] The second model is trained according to the second training data set to obtain an updated second model.
[0081] In the above solution, the second model can be trained according to the ontology information to obtain an updated second model, thereby achieving the purpose of continuously updating and optimizing the second model.
[0082] In a third aspect, an embodiment of the present application provides a computing device, including: a memory, a processor;
[0083] The memory stores computer-executable instructions;
[0084] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.
[0085] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.
[0086] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS
[0087] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0088] Figure 1 A schematic diagram of the architecture of an email detection system provided in an embodiment of the present application;
[0089] Figure 2 A flowchart of an email detection method provided in an embodiment of the present application;
[0090] Figure 3 A flowchart of another mail image detection method provided in an embodiment of the present application;
[0091] Figure 4 A flowchart of another mail image detection method provided in an embodiment of the present application;
[0092] Figure 5 A flowchart of another email detection method provided in an embodiment of the present application;
[0093] Figure 6 A flowchart of another email detection method provided in an embodiment of the present application;
[0094] Figure 7 A flowchart of another email detection method provided in an embodiment of the present application;
[0095] Figure 8 A schematic diagram of the structure of a mail detection device provided in an embodiment of the present application;
[0096] Figure 9 A schematic diagram of the structure of another mail detection device provided in an embodiment of the present application;
[0097] Figure 10 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0098] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numbers in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible implementations consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present invention, as detailed in the appended claims.
[0099] The embodiments of the present application provide an email detection method and a computing device to solve the technical problem of low detection efficiency.
[0100] To facilitate understanding, first combine Figure 1 , the architecture of the email detection system involved in the embodiment of the present application is described.
[0101] Figure 1 This is a schematic diagram of the architecture of an email detection system provided in an embodiment of the present application. Figure 1The mail detection system may include a computing device, a first processor, and a second processor. The computing device may be connected to the first processor and the second processor in communication. It should be noted that the number of the computing device, the first processor, and the second processor in the mail detection system may be one or more. Figure 1 The example in which the number of computing devices, the first processor, and the second processor in the email detection system is 1 is used for illustration only, and does not constitute a limitation on the technical solution provided in the embodiment of the present application.
[0102] In some embodiments, the first processor may also be communicatively connected to the second processor (not shown in the figure).
[0103] The computing device may be a server, a laptop computer, a desktop computer, a tablet computer, or an artificial intelligence device, etc. The computing device may be used to receive emails.
[0104] Emails can include header information and body information.
[0105] For example, the header information of an email may include the subject, sending address, receiving address, sending timestamp, etc., and the body information of an email may include the text, attachment information, pictures or videos, etc.
[0106] The first processor may be a general server, or a central processing unit (CPU) or a processing chip in a general server.
[0107] A first model can be run on the first processor, and the first model can detect the header information of the email. The first model can be a small model with fewer model parameters. For example, the first model can be a decision tree model, a naive Bayes model, or a support vector machine model.
[0108] The second processor may be a graphics processing unit (GPU) server, or a processing chip in a GPU server.
[0109] The second processor may run a second model, which may detect the email's body information. The second model may be a large model with a large number of model parameters, for example, a multimodal deep learning model.
[0110] In the aforementioned email detection system, after receiving an email, the computing device can obtain the detection result of the email's header information using the first model on the first processor. If the detection result of the email's header information is a failure, the computing device can determine that the email is malicious. If the detection result of the email's header information is a success, the computing device can obtain the detection result of the email's body information using the second model on the second processor. If the detection result of the email's body information is a success, the computing device can determine that the email is non-malicious. If the detection result of the email's body information is a failure, the computing device can determine that the email is malicious.
[0111] It's important to note that header information is relatively small, while body information is relatively large. By first testing the header information, if the header information can be used to determine whether an email is malicious, there's no need to test the body information. This speeds up email detection, thereby increasing detection efficiency and enabling a quicker determination of whether an email is malicious.
[0112] In addition, by detecting the header information and the body information separately, the detection overhead of the second processor can be reduced, thereby reducing the resource consumption of the second processor.
[0113] The following specific embodiments are used to describe the technical solutions of the embodiments of the present application in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.
[0114] Figure 2 This is a flow chart of an email detection method provided in an embodiment of the present application. The execution subject of the method can be a computing device, or a processor or processing chip set in the computing device. The computing device can be, for example, Figure 1 For ease of understanding, the following description will be based on the example of a computing device as the execution subject. Figure 2 , the method may include:
[0115] S201: Receive a target email, which includes header information and body information.
[0116] The target email can be any email received by the computing device.
[0117] The computing device may receive a target email sent by a sender, such as a server that sends emails.
[0118] S202: Obtain a first detection result corresponding to the header information, where the first detection result is detection pass or detection fail.
[0119] If the first detection result is failure, execute S203;
[0120] If the first detection result is passed, execute S204.
[0121] In this embodiment, the computing device may use the first model to obtain the first detection result. The first model is used to detect and process the header information and obtain the first detection result.
[0122] Specifically, the computing device may send the target email to the first processor. The first processor may perform a first detection process on the header information of the target email using the first model to obtain a first detection result, and may send the first detection result to the computing device.
[0123] S203: Determine that the target email is a malicious email.
[0124] If the first detection result is that the detection fails, the computing device may determine that the target email is a malicious email.
[0125] S204: Determine whether the target email is a malicious email based on the body information.
[0126] In this embodiment, the computing device can use the second model to obtain a second detection result corresponding to the ontology information, and can determine whether the target email is a malicious email based on the second detection result. The second model is used to detect and process the ontology information and obtain the second detection result.
[0127] Specifically, the computing device may send the target email to the second processor, which may perform a second detection process on the target email's body information using the second model to obtain a second detection result, and may send the second detection result to the computing device.
[0128] If the second detection result is a detection failure, the computing device may determine that the target email is a malicious email. If the second detection result is a detection pass, the computing device may determine that the target email is a non-malicious email.
[0129] In this embodiment, if the computing device determines that the target email is malicious, it can also intercept the target email. If the computing device determines that the target email is not malicious, it can also release the target email. For example, when intercepting, the computing device may not send the email to the user device that received the email; when releasing, the computing device may send the email to the user device that received the email.
[0130] In the email detection method provided in this embodiment, the computing device can receive the target email and obtain the first detection result corresponding to the header information of the target email. If the first detection result is that the detection fails, the computing device can determine that the target email is a malicious email; if the first detection result is that the detection passes, the computing device can determine whether the target email is a malicious email based on the main body information. In the above method, it is possible to first determine whether the target email is a malicious email based on the first detection result corresponding to the header information, that is, the header information of the target email can be detected first to determine whether the target email is a malicious email. If the target email can be determined to be a malicious email based on the header information, there is no need to perform other tests on the target email. The amount of data in the header information is relatively small. Through the above method, the amount of data for detection can be reduced, the detection speed is improved, and the detection efficiency is further improved, and it can quickly determine whether the email is a malicious email.
[0131] In some embodiments, the method provided by the embodiments of the present application can quickly determine whether an email is a malicious email, so that the delay in sending the email is low.
[0132] In some embodiments, if the computing device receives the target email at a high frequency, the method provided in the embodiments of the present application can quickly detect whether the target email is a malicious email, thereby improving detection efficiency.
[0133] Based on the above embodiments, Figure 3 , further explains the email detection method provided in the embodiment of the present application.
[0134] Figure 3 This is a flow chart of another email detection method provided in an embodiment of the present application. The execution subject of this method can be a computing device, or a processor or processing chip set in the computing device. The computing device can be, for example, Figure 1 For ease of understanding, the following description will be based on the example of a computing device as the execution subject. Figure 3 , the method may include:
[0135] S301: Receive a target email, which includes header information and body information.
[0136] It should be noted that the specific implementation of S301 can be found in S201 and will not be repeated here.
[0137] S302: Send the target email to the first processor.
[0138] In this embodiment, after receiving the target email, the computing device may send the target email to the first processor.
[0139] S303: Receive a first detection result sent by the first processor, where the first detection result is detection pass or detection fail.
[0140] If the first detection result is failure, execute S304;
[0141] If the first detection result is passed, execute S305.
[0142] In this embodiment, the first processor can use the first model to obtain the first detection result corresponding to the header information and can send the first detection result to the computing device. In other words, the computing device can use the first processor and the first model to obtain the first detection result corresponding to the header information.
[0143] S304: Determine that the target email is a malicious email.
[0144] It should be noted that the specific implementation of S304 can be found in S203 and will not be repeated here.
[0145] S305: Send the target email to the second processor.
[0146] In this embodiment, if the first detection result is that the detection is passed, the computing device may send the target email to the second processor.
[0147] S306: Receive a second detection result sent by the second processor.
[0148] If the second detection result is failure, execute S307;
[0149] If the second detection result is passed, execute S308.
[0150] In this embodiment, the second processor can use the second model to obtain the second detection result corresponding to the ontology information and can send the second detection result to the computing device. In other words, the computing device can use the second processor and the second model to obtain the second detection result corresponding to the ontology information.
[0151] S307: Determine that the target email is a malicious email.
[0152] S308: Determine that the target email is a non-malicious email.
[0153] In the email detection method provided in this embodiment, the computing device can receive a target email, send the target email to a processor, and receive a first detection result corresponding to the header information sent by the first processor. If the first detection result is that the detection fails, the computing device can determine that the target email is a malicious email. If the first detection result is that the detection passes, the computing device can send the target email to the second processor and receive a second detection result corresponding to the body information sent by the second processor. If the second detection result is that the detection fails, the computing device can determine that the target email is a malicious email; if the second detection result is that the detection passes, the computing device can determine that the target email is a non-malicious email. In the above method, the computing device can first determine whether the target email is a malicious email based on the first detection result corresponding to the header information. If it cannot be determined whether the target email is a malicious email based on the first detection result, the computing device can determine whether the target email is a malicious email based on the second detection result corresponding to the body information. Through the above method, the header information and body information of the target email can be detected separately, so that the detection overhead of the second processor is small, thereby reducing the resource consumption of the second processor and the hardware cost of the second processor. Furthermore, if the first detection result can be used to determine whether the target email is malicious, there is no need to further inspect the body information, further reducing resource consumption and hardware costs of the second processor. Furthermore, by first inspecting the header information, which has a smaller data volume, detection efficiency can be improved. Furthermore, combining the first and second detection processes can increase the detection rate of malicious emails, thereby improving detection accuracy.
[0154] Based on any of the above embodiments, Figure 4 , describes the process of the first processor performing the first detection processing on the header information.
[0155] Figure 4 This is a flow chart of another mail detection method provided in an embodiment of the present application. The execution subject of the method may be a first processor, or a processing chip set in the first processor. The first processor may be, for example, Figure 1 For ease of understanding, the following description will be based on the example of the first processor as the execution subject. Figure 4 , the method may include:
[0156] S401: Receive a target email sent by a computing device, where the target email includes header information and body information.
[0157] S402: Extract header information from the target email.
[0158] The first processor can search for a first preset field in the target email, where the first preset field includes at least one of the following: subject, sending address, receiving address, timestamp, and attribute; extract content corresponding to the first preset field; wherein the header information includes the content corresponding to the first preset field.
[0159] For example, the subject can be the subject of the email, the sending address can be the sender address of the email, the receiving address can be the recipient address of the email, the timestamp can be the sending timestamp or receiving timestamp of the email, and the attributes can be the sender name, recipient name, forwarding route, return address, client information, or encoding type, etc.
[0160] Specifically, the target email may include multiple fields and content corresponding to each field. The multiple fields may include a first preset field. The first processor may search the target email for the first preset field and extract the content corresponding to the first preset field. The content corresponding to the first preset field may be header information.
[0161] S403: Input header information to the first model, and obtain a first detection result from the first model.
[0162] The first model runs on a first processor, which may be a CPU or the like.
[0163] The first model may be a pre-trained small machine learning model. The total number of model parameters of the first model is less than or equal to a first threshold. The first threshold may be determined based on the number of model parameters of the model running on the CPU. Alternatively, the first threshold may be equal to the number of model parameters of the largest model that can be run by the CPU.
[0164] For example, the first model may be a decision tree model, a naive Bayes model, or a support vector machine model.
[0165] It should be noted that the computing resource consumption of the first model is relatively small, so that the resource consumption of the first detection process of the header information is relatively small. S404: Send the first detection result to the computing device.
[0166] S405: If the first detection result is failure, update the first training data set of the first model based on the header information.
[0167] The first training dataset may be a dataset used to train a first model.
[0168] In this embodiment, if the first detection result is that the detection fails, the first processor may further update the first training data set based on the header information, thereby achieving the purpose of updating the training data set of the first model.
[0169] It should be noted that S405 may be executed simultaneously with S404, or S405 may be executed before S404, or S405 may be executed after S404.
[0170] S406: Train the first model according to the first training data set to obtain an updated first model.
[0171] In this embodiment, the first model can be further trained based on the updated first training data set to obtain an updated first model. Through the above method, the purpose of continuously updating and optimizing the first model is achieved.
[0172] It should be noted that if the first detection result is a pass, S405 to S406 may not be executed.
[0173] In the email detection method provided in this embodiment, a first processor can receive a target email sent by a computing device, extract header information from the target email, input the header information into a first model, obtain a first detection result from the first model, and transmit the first detection result to the computing device. In this method, the first processor can detect and process the header information of the target email, thereby achieving the purpose of detecting and processing the target email. Furthermore, the first model consumes relatively few computing resources, resulting in low resource overhead for detecting the target email, and thus low detection costs.
[0174] Based on any of the above embodiments, Figure 5 , describes the process of the second processor performing the second detection processing on the main body information.
[0175] Figure 5 This is a flow chart of another mail detection method provided in an embodiment of the present application. The execution subject of the method can be a second processor, or a processing chip set in the second processor. The second processor can be, for example, Figure 2 For ease of understanding, the following description will be based on the example of the second processor as the execution subject. Figure 5 , the method may include:
[0176] S501: Receive a target email sent by a computing device, where the target email includes header information and body information.
[0177] S502: Extracting the body information from the target email.
[0178] The second processor can search for a second preset field in the target email, where the second preset field includes at least one of the following: text, attachment information, picture, and video; extract content corresponding to the second preset field; wherein the body information includes the content corresponding to the second preset field.
[0179] For example, the body text may be the body text of the email, the attachment information may be the attachment of the email, the picture may be the picture contained in the email, and the video may be the video contained in the email.
[0180] Specifically, the target email may include multiple fields and content corresponding to each field. The multiple fields may include a second preset field. The second processor may search the target email for the second preset field and extract the content corresponding to the second preset field. The content corresponding to the second preset field may be body information.
[0181] S503: Input ontology information into the second model, and obtain a second detection result from the second model.
[0182] The second model runs on a second processor. The second processor can be a GPU, etc. It should be understood that a larger model can run on a GPU.
[0183] The second model can be a pre-trained large-scale deep learning model. The total number of model parameters of the second model is greater than a second threshold. The second threshold can be determined based on the number of model parameters of the model running on the CPU. Optionally, the second threshold can be equal to the number of model parameters of the largest model that can be run by the CPU.
[0184] For example, the second model can be a multimodal deep learning model.
[0185] It should be noted that the second model can process complex data, so that the detection accuracy of malicious emails is higher.
[0186] S504: Send the second detection result to the computing device.
[0187] S505: If the second detection result is failure, update the second training data set of the second model based on the ontology information.
[0188] The second training data set may be a data set used to train the second model.
[0189] In this embodiment, if the second detection result is failure, the second processor may further update the second training data set based on the ontology information, thereby achieving the purpose of updating the training data set of the second model.
[0190] It should be noted that S505 may be executed simultaneously with S504, or S505 may be executed before S504, or S505 may be executed after S504.
[0191] S506: Train a second model according to the second training data set to obtain an updated second model.
[0192] In this embodiment, the second model can be further trained based on the updated second training data set to obtain an updated second model. Through the above method, the purpose of continuously updating and optimizing the second model is achieved.
[0193] S507: Notify the first processor to update the first model based on the header information.
[0194] The first model runs on the first processor.
[0195] In some embodiments, the second processor may communicate directly with the first processor, and the second processor may directly notify the first processor to update the first model based on the header information.
[0196] In some embodiments, the second processor cannot communicate with the first processor, and the second processor may notify the first processor through the computing device to update the first model based on the header information.
[0197] It should be noted that the specific method for the first processor to update the first model based on the header information can be found in S405-S406, which will not be repeated here.
[0198] It should be noted that S507 may be executed simultaneously with S504, or S507 may be executed before S504, or S507 may be executed after S504.
[0199] It should be noted that if the second detection result is a pass, S505 to S507 may not be executed.
[0200] In the email detection method provided in this embodiment, the second processor can receive a target email sent by a computing device, extract entity information from the target email, input the entity information into a second model, obtain a second detection result from the second model, and send the second detection result to the computing device. In this method, the second processor can detect and process the entity information of the target email, thereby achieving the purpose of detecting and processing the target email. In addition, the second model has a high detection accuracy rate, thereby increasing the accuracy of detecting malicious emails.
[0201] Based on any of the above embodiments, Figure 6 , the email detection method provided in the embodiment of the present application is further described in detail.
[0202] Figure 6 This is a flowchart of another email detection method provided in the embodiment of the present application. Figure 6 , the method may include:
[0203] S601: The computing device receives the target email.
[0204] S602: The computing device sends a target email to the first processor.
[0205] It should be noted that the specific implementation of S601-S602 can be found in S301-S302 and will not be repeated here.
[0206] S603: The first processor extracts header information from the target email.
[0207] S604: The first processor inputs header information to the first model and obtains a first detection result from the first model.
[0208] S605: The first processor sends a first detection result to the computing device, where the first detection result is detection pass or detection fail.
[0209] Correspondingly, the computing device receives the first detection result sent by the first processor.
[0210] If the first test result is failure, execute S606a and S606b;
[0211] If the first detection result is passed, execute S607.
[0212] It should be noted that the specific implementation of S603-S605 can be found in S402-S404 and will not be repeated here.
[0213] S606a: The computing device determines that the target email is a malicious email.
[0214] S606b: The first processor updates the first model.
[0215] It should be noted that the specific implementation of S606b can be found in S405-S406 and will not be repeated here.
[0216] S607: The computing device sends the target email to the second processor.
[0217] It should be noted that the specific implementation of S606a and S607 can be found in S304-S305 and will not be repeated here.
[0218] S608: The second processor extracts the body information from the target email.
[0219] S609: The second processor inputs the ontology information into the second model, and obtains a second detection result from the second model.
[0220] S610: The second processor sends a second detection result to the computing device, where the second detection result is detection pass or detection fail.
[0221] Correspondingly, the computing device receives the second detection result sent by the second processor.
[0222] If the second test result is failure, execute S611a, S611b and S611c;
[0223] If the second detection result is passed, execute S612.
[0224] It should be noted that the specific implementation of S608-S6010 can be found in S502-S504 and will not be repeated here.
[0225] S611a: The computing device determines that the target email is a malicious email.
[0226] S611b: The first processor updates the first model.
[0227] It should be noted that the specific implementation of S611b can be found in S405-S406 and will not be repeated here.
[0228] S611c: The second processor updates the second model.
[0229] It should be noted that the specific implementation of S611c can be found in S505-S506 and will not be repeated here.
[0230] S612: The computing device determines that the target email is a non-malicious email.
[0231] It should be noted that the specific implementation of S611a and S612 can be found in S307-S308 and will not be repeated here.
[0232] Based on any of the above embodiments, Figure 7 , the email detection method provided in the embodiment of the present application is further described in detail.
[0233] Figure 7 This is a flowchart of another email detection method provided in the embodiment of the present application. Figure 7 The first model may be a model trained based on a first training data set of the first model, and the first model is deployed on a first processor. The second model may be a model trained based on a second training data set of the second model, and the second model is deployed on a second processor.
[0234] A target email may be input into a first processor, which may then detect header information of the target email using a first model to obtain a first detection result. If the first detection result indicates that the target email is malicious, the first processor may update a first training dataset based on the header information and may also update the first model based on the first training dataset to obtain an updated first model.
[0235] If the first detection result indicates that the target email is non-malicious, the target email can be input into a second processor, which can then use the second model to detect the target email's underlying information and obtain a second detection result. If the second detection result indicates that the target email is non-malicious, the second processor can release the target email. If the second detection result indicates that the target email is malicious, the second processor can update the second training dataset based on the underlying information and the second model based on the second training dataset to obtain an updated second model. The first processor can also update the first training dataset based on the header information and the first model based on the first training dataset to obtain an updated first model.
[0236] Figure 8 This is a schematic diagram of the structure of an email detection device provided in an embodiment of the present application. The email detection device 10 can be applied to a computing device. Figure 8 The mail detection device 10 may include: a receiving module 11, an obtaining module 12, and a determining module 13, wherein:
[0237] The receiving module 11 is used to receive a target email, wherein the target email includes header information and body information;
[0238] The acquisition module 12 is used to obtain a first detection result corresponding to the header information, where the first detection result is a detection pass or a detection fail;
[0239] If the first detection result is failure, the determination module 13 is configured to determine that the target email is a malicious email;
[0240] If the first detection result is detection passed, the determination module 13 is configured to determine whether the target email is a malicious email based on the body information.
[0241] In a possible implementation, the acquisition module 12 is specifically configured to:
[0242] The header information is detected and processed using a first model to obtain a first detection result, wherein the total amount of model parameters of the first model is less than or equal to a first threshold.
[0243] In a possible implementation, the determining module 13 is specifically configured to:
[0244] Performing detection processing on the ontology information using a second model to obtain a second detection result, where the second detection result is a detection pass or a detection fail, and a total amount of model parameters of the second model is greater than a second threshold;
[0245] According to the second detection result, determine whether the target email is a malicious email.
[0246] In a possible implementation, the acquisition module 12 is specifically configured to:
[0247] Extracting the header information from the target email;
[0248] The header information is input into a first model, and a first detection result is obtained from the first model.
[0249] In a possible implementation, the acquisition module 12 is specifically configured to:
[0250] Searching for a first preset field in the target email, where the first preset field includes at least one of the following: subject, sending address, receiving address, timestamp, and attribute;
[0251] Extracting content corresponding to the first preset field;
[0252] The header information includes the content corresponding to the first preset field.
[0253] In a possible implementation, the determining module 13 is specifically configured to:
[0254] Extracting the entity information from the target email;
[0255] The ontology information is input into a second model, and a second detection result is obtained from the second model.
[0256] In a possible implementation, the determining module 13 is specifically configured to:
[0257] Searching for a second preset field in the target email, where the second preset field includes at least one of the following: text, attachment information, picture, and video;
[0258] Extracting content corresponding to the second preset field;
[0259] The ontology information includes the content corresponding to the second preset field.
[0260] Figure 9 This is a schematic diagram of the structure of another mail detection device provided in an embodiment of the present application. Figure 8 On the basis of, the mail detection device 10 further includes an updating module 14, the updating module 14 is used to,
[0261] Based on the header information, updating a first training data set of the first model;
[0262] The first model is trained according to the first training data set to obtain an updated first model.
[0263] In a possible implementation, the update module 14 is further configured to:
[0264] Based on the ontology information, updating a second training data set of the second model;
[0265] The second model is trained according to the second training data set to obtain an updated second model.
[0266] The email detection device provided in this embodiment can implement the technical solution executed by the computing device in any of the above method embodiments. Its implementation principles and beneficial effects are similar and will not be described in detail here.
[0267] Figure 10 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. Figure 10 As shown, the computing device 20 may include: a processor 21 and a memory 22, wherein the processor 21 and the memory 22 can communicate; illustratively, the processor 21 and the memory 22 communicate via a communication bus 23, the memory 22 is used to store computer execution instructions, and the processor 21 is used to call the computer execution instructions in the memory to execute the email detection method shown in any of the above method embodiments.
[0268] Optionally, the computing device 20 may further include a communication interface, which may include a transmitter and / or a receiver.
[0269] The computing device 20 may be the computing device shown in any of the above method embodiments, and may execute the email detection method shown in any of the above method embodiments.
[0270] Optionally, the processor may be a CPU, a GPU, a baseboard management controller (BMC), other general-purpose processors, a digital signal processor (DSP), or an application-specific integrated circuit (ASIC). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.
[0271] An embodiment of the present application provides a computer-readable storage medium having computer-executable instructions stored thereon; the computer-executable instructions are used to implement the email detection method as described in any of the above embodiments.
[0272] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, it enables a computer to execute the above-mentioned email detection method.
[0273] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above-mentioned method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disc, and any combination thereof.
[0274] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable terminal device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0275] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0276] These computer program instructions can also be loaded onto a computer or other programmable terminal device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0277] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the embodiments of the present application are intended to include such modifications and variations.
[0278] In the embodiments of the present application, the terms "include", "comprise" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. The term "or" and its variations may refer to "and / or". In the embodiments of the present application, the terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the embodiments of the present application, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.
[0279] Those skilled in the art will readily conceive of other embodiments of the present application after considering the invention disclosed in the specification and practice. The embodiments of the present application are intended to cover any variations, uses, or adaptations of the embodiments of the present application, which follow the general principles of the embodiments of the present application and include common knowledge or customary technical means in the art that are not disclosed in the embodiments of the present application.
Claims
1. A mail detection method, characterized in that: Applied to a computing device, the method includes: receiving a target email, wherein the target email includes header information and body information; Obtaining a first detection result corresponding to the header information, where the first detection result is a detection pass or a detection fail; If the first detection result is failure, determining that the target email is a malicious email; If the first detection result is that the detection passes, it is determined whether the target email is a malicious email based on the body information.
2. The method according to claim 1, characterized in that The obtaining of the first detection result corresponding to the header information includes: The header information is detected and processed using a first model to obtain a first detection result, wherein the total amount of model parameters of the first model is less than or equal to a first threshold.
3. The method according to claim 1 or 2, characterized in that The determining whether the target email is a malicious email according to the body information includes: Performing detection processing on the ontology information using a second model to obtain a second detection result, where the second detection result is a detection pass or a detection fail, and a total amount of model parameters of the second model is greater than a second threshold; According to the second detection result, determine whether the target email is a malicious email.
4. The method according to claim 2 or 3, characterized in that The detecting and processing the header information using the first model and obtaining a first detection result includes: Extracting the header information from the target email; The header information is input into a first model, and a first detection result is obtained from the first model.
5. The method according to claim 4, characterized in that The extracting the header information from the target email includes: Searching for a first preset field in the target email, where the first preset field includes at least one of the following: subject, sending address, receiving address, timestamp, and attribute; Extracting content corresponding to the first preset field; The header information includes the content corresponding to the first preset field.
6. The method according to any one of claims 3 to 5, characterized in that: The detecting and processing the ontology information using the second model and obtaining a second detection result includes: Extracting the entity information from the target email; The ontology information is input into a second model, and a second detection result is obtained from the second model.
7. The method according to claim 6, characterized in that The extracting the body information from the target email includes: Searching for a second preset field in the target email, where the second preset field includes at least one of the following: text, attachment information, picture, and video; Extracting content corresponding to the second preset field; The ontology information includes the content corresponding to the second preset field.
8. The method according to any one of claims 2 to 7, characterized in that: The first detection result is a detection failure, or the second detection result is a detection failure, the method further includes: Based on the header information, updating a first training data set of the first model; The first model is trained according to the first training data set to obtain an updated first model.
9. The method according to any one of claims 3 to 7, characterized in that: The second detection result is that the detection fails, and the method further includes: Based on the ontology information, updating a second training data set of the second model; The second model is trained according to the second training data set to obtain an updated second model.
10. A computing device, characterized in that include: memory and processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 9.