Multi-dimensional analysis-based phishing mail detection method, apparatus and device, and medium

Abstract

The invention provides a phishing mail detection method and device based on multi-dimensional analysis, equipment and a medium. The method comprises the following steps: receiving a to-be-detected mail; performing keyword feature matching on the mail content, and if a threat keyword in a preset keyword library is matched, executing a secure forwarding operation; if the threat keyword in the preset keyword library is not matched, executing a threat library joint detection operation, and comprehensively outputting a first risk score; carrying out multi-modal semantic understanding analysis on the mail; generating a comprehensive threat judgment based on the first risk score and a semantic understanding analysis result; if the mail is judged to be a phishing mail, triggering an automatic response mechanism; otherwise, continuing to monitor the subsequent mails. The method has the beneficial effects that the problem of single feature dimension of a traditional method is solved by simultaneously extracting three types of core features of texts, URLs and attachments, and the recognition rate of phishing mails is obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of email security technology, and in particular to a phishing email detection method, device, equipment and medium based on multi-dimensional analysis. Background Art

[0002] With the popularization of corporate email systems, phishing email attacks are becoming more intelligent and covert, and have become the primary threat to corporate network security. Traditional detection methods mainly rely on static rule matching (such as keyword filtering and blacklist interception), which has two major technical defects: first, single-dimensional analysis makes it difficult to identify new phishing attacks (such as semantic deception and image phishing), and the false negative rate is high; second, the response mechanism relies on manual processing, with a long average processing time, which cannot meet the real-time blocking requirements. The existing improvement plan uses a single AI model to analyze text, but it still cannot solve the problem of collaborative detection of multimodal attacks (such as malicious QR codes and attachment Trojans), and lacks a closed-loop response mechanism. Therefore, there is an urgent need for a technical solution that integrates multi-dimensional dynamic analysis, automated semantic deception recognition, and intelligent response to cope with increasingly complex email security threats. Summary of the Invention

[0003] The technical problem to be solved by the present invention is: the collaborative detection problem of multimodal attacks in emails.

[0004] In order to solve the above technical problems, the present invention adopts a technical solution: a phishing email detection method based on multi-dimensional analysis, comprising the following steps:

[0005] S10, receiving the email to be tested;

[0006] S20: Perform keyword feature matching on the email content. If the email content matches a threat keyword in a preset keyword library, perform a safe forwarding operation.

[0007] S30: If no threat keyword in the preset keyword library is matched, a threat library joint detection operation is performed, wherein the threat library joint detection operation includes login behavior status verification, URL threat intelligence matching, and file malicious code scanning, and a first risk score is comprehensively outputted;

[0008] S40: Perform multimodal semantic understanding and analysis of emails, including parsing the contextual semantic associations of email text and identifying deceptive language patterns; detecting threat characteristics of embedded multimedia content; and verifying the logical consistency of attachment content with the main text statement.

[0009] S50: Generate a comprehensive threat assessment based on the first risk score and the semantic understanding analysis result;

[0010] S60: If it is determined to be a phishing email, trigger the automated response mechanism; otherwise, continue to monitor subsequent emails.

[0011] Furthermore, step S30 specifically includes:

[0012] S31. Verify abnormal behavior of the sender's login status through the identity authentication protocol;

[0013] S32. Match the URL in the email with the threat intelligence database that is updated in real time.

[0014] S33. Perform a multi-engine dynamic scan of malicious code on the attachment file.

[0015] Furthermore, step S40 specifically includes:

[0016] S41. Analyze the semantic dependencies of the email body using a semantic deception feature recognition model to extract dynamically updated phishing tactics features.

[0017] S42. Identify the characteristics of emotional manipulation in texts, including expressions of urgency, pretense of authority, and fear-inducing patterns;

[0018] S43. Detect malicious domain names associated with embedded images and QR codes using computer vision technology;

[0019] S44. Analyze the conflicting features between the attachment content and the declared functions of the email body.

[0020] Furthermore, step S41 further includes:

[0021] A new phishing script template is automatically generated based on the semantic analysis results, and the preset keyword library is updated in real time.

[0022] Furthermore, step S50 further includes:

[0023] Receive user feedback on the threat determination result, and optimize the semantic deception feature recognition model based on the feedback information.

[0024] Furthermore, step S60 specifically includes:

[0025] S61. Send real-time alarm information to the security operation and maintenance end;

[0026] S62. Push risk alert to the recipient's terminal;

[0027] S63: Block the communication resources associated with the sender.

[0028] Furthermore, step S63 specifically includes:

[0029] Add the sender's domain name to the real-time ban list and synchronize it to the enterprise email gateway policy library.

[0030] The present invention also provides a phishing email detection device based on multi-dimensional analysis, comprising:

[0031] Mail receiving module, used for receiving mails to be tested;

[0032] The feature matching module is used to match the keyword features of the email content: if it matches the threat keywords in the preset keyword library, it will perform a safe forwarding operation;

[0033] a static detection module configured to perform a threat library joint detection operation if no threat keyword in a preset keyword library is matched, the threat library joint detection operation including login behavior status verification, URL threat intelligence matching, file malicious code scanning, and comprehensively output a first risk score;

[0034] Semantic analysis module, used to perform multimodal semantic understanding and analysis of emails, including parsing the contextual semantic associations of email text and identifying deceptive language patterns; detecting threat characteristics of embedded multimedia content; and verifying the logical consistency of attachment content with the body of the email.

[0035] A threat assessment module, configured to generate a comprehensive threat assessment based on the first risk score and the semantic understanding analysis result;

[0036] The threat handling module is used to trigger the automated response mechanism if it is determined to be a phishing email; otherwise, it continues to monitor subsequent emails.

[0037] The present invention also provides a computer device, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the phishing email detection method based on multi-dimensional analysis as described above is implemented.

[0038] The present invention also provides a storage medium storing a computer program, which, when executed by a processor, can implement the phishing email detection method based on multi-dimensional analysis as described above.

[0039] The beneficial effects of the present invention are: by simultaneously extracting three core features of text, URL, and attachment, the problem of single feature dimension of traditional methods is solved, and the recognition rate of phishing emails is significantly improved; through the cascade mechanism of static threat matching and dynamic threat analysis, the blocking speed of phishing emails is improved, and the security risks of corporate emails are effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The specific structure of the present invention is described in detail below with reference to the accompanying drawings.

[0041] Figure 1 This is a flow chart of a phishing email detection method based on multi-dimensional analysis according to an embodiment of the present invention;

[0042] Figure 2This is a flowchart of the threat library joint detection operation according to an embodiment of the present invention;

[0043] Figure 3 This is a flow chart of performing multimodal semantic understanding and analysis on emails according to an embodiment of the present invention;

[0044] Figure 4 This is a flowchart of a phishing email response process according to an embodiment of the present invention;

[0045] Figure 5 This is a block diagram of a phishing email detection device based on multi-dimensional analysis according to an embodiment of the present invention;

[0046] Figure 6 A schematic block diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0048] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0049] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0050] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0051] like Figure 1 As shown, an embodiment of the present invention is: a phishing email detection method based on multi-dimensional analysis, comprising the following steps:

[0052] S10: Receive the email to be tested.

[0053] S20: Perform keyword feature matching on the email content. If a threat keyword in a preset keyword library is matched, a safe forwarding operation is performed.

[0054] In this embodiment, the preset keyword library adopts a three-level dynamic word list structure:

[0055] Basic vocabulary: Contains 500 high-frequency phishing terms such as "password reset" and "account abnormality".

[0056] Industry vocabulary: Customize exclusive keywords for industries such as finance and healthcare, such as U-Shield upgrade and credit limit in banking scenarios.

[0057] Derivative word list: Automatically record conflicting feature expressions found, such as the main text calls it salary details but the attachment contains a hyperlink.

[0058] Compared with the traditional single word library, this solution significantly reduces the missed detection rate of phishing emails.

[0059] S30: If no threat keyword in the preset keyword library is matched, a threat library joint detection operation is performed, wherein the threat library joint detection operation includes login behavior status verification, URL threat intelligence matching, file malicious code scanning, and a first risk score is comprehensively output.

[0060] like Figure 2 As shown, in a specific embodiment, step S30 specifically includes:

[0061] S31. Verify abnormal behavior of the sender's login status through the identity authentication protocol;

[0062] In this step, the sender's behavior profile analysis is performed in multiple dimensions, including:

[0063] Temporal anomaly detection: When the country of the sending IP address is inconsistent with the employee's usual login location, for example, a Chinese employee sends from a Brazilian IP address in the early morning, a high-risk flag is triggered;

[0064] Device fingerprint comparison: Verify whether the sending device ID is in the enterprise's registered device database. For example, if a "password reset" email is sent from an unregistered device, it will be directly intercepted.

[0065] S32. Match the URL in the email with the threat intelligence database that is updated in real time.

[0066] In this step, deep threat intelligence correlation is achieved, including three-level jump tracking of short links until the final URL is obtained; "system upgrade" emails are sent to track new domain names registered less than 48 hours ago; and emails containing domain name holder information that does not match the declared company name are directly blocked.

[0067] S33. Perform a multi-engine dynamic scan of malicious code on the attachment file.

[0068] In this embodiment, scanning of attachment files includes dynamic feature detection and dynamic behavior monitoring, wherein static feature detection includes identifying abnormal VBA macro commands (such as Shell calls) in Office documents; detecting JavaScript execution requests in PDF files. Dynamic behavior monitoring includes: monitoring the behavior of documents releasing temporary files (such as releasing .bat scripts); capturing PowerShell code injection traces in memory. S40, multimodal semantic understanding and analysis of emails, including parsing the contextual semantic associations of email text, identifying deceptive language patterns; detecting threat characteristics of embedded multimedia content; and verifying the logical consistency of the attachment content with the body statement.

[0069] like Figure 3 As shown, in a specific embodiment, step S40 specifically includes:

[0070] S41. Analyze the semantic dependencies of the email body using a semantic deception feature recognition model to extract dynamically updated phishing tactics features.

[0071] S42. Identify the characteristics of emotional manipulation in texts, including expressions of urgency, pretense of authority, and fear-inducing patterns;

[0072] S43. Detect malicious domain names associated with embedded images and QR codes using computer vision technology;

[0073] S44. Analyze the conflicting features between the attachment content and the declared functions of the email body.

[0074] Among them, step S41 also includes: automatically generating a new fishing speech template based on the semantic analysis result, and updating the preset keyword library in real time.

[0075] In this embodiment, cross-modal deception feature collaborative analysis is implemented, including text semantic trap detection, visual deception cracking, and attachment consistency verification. Text semantic trap detection includes: using the BiLSTM-CRF model to identify false urgent statements such as "Your account will be frozen in 24 hours"; and using dependency syntax analysis to detect permission conflicts in "The Finance Department's notice requires clicking on the link" (the actual sender is not a finance domain name). Visual deception cracking includes: virtually scanning the QR code in the email to intercept short links that jump to the counterfeit login page; using GAN-generated adversarial samples to train the OCR model and identify visually obfuscated domain names. Attachment consistency verification includes: when the text claims to be a "quarterly report", detecting whether the attachment contains unconventional hyperlinks or macro commands. This solution is the first to implement three-dimensional cross-validation of text, image, and attachment, improving the recognition accuracy of AI-generated phishing emails.

[0076] S50: Generate a comprehensive threat judgment based on the first risk score and the semantic understanding analysis result.

[0077] In a specific embodiment, step S50 further includes:

[0078] Receive user feedback on the threat determination result, and optimize the semantic deception feature recognition model based on the feedback information.

[0079] In this embodiment, a decision-making mechanism based on weighted self-learning is adopted, including a dynamic scoring model and context-enhanced rules; the dynamic scoring model is:

[0080] Comprehensive threat value = α * URL risk + β * attachment risk + γ * semantic risk. α, β, and γ are dynamically adjusted based on the company's historical attack data.

[0081] The context enhancement rule is as follows: if the domain name registration time of the sending email is less than 48 hours and contains the keyword "urgent update", the threat weight is automatically increased by 1.8; if the attachment scan is safe but the body contains an image with a fake executive signature, a secondary deep detection is triggered.

[0082] This embodiment can significantly reduce the missed reporting rate of phishing emails.

[0083] S60: If it is determined to be a phishing email, trigger the automated response mechanism; otherwise, continue to monitor subsequent emails.

[0084] like Figure 4 As shown, in a specific embodiment, step S60 specifically includes:

[0085] S61. Send real-time alarm information to the security operation and maintenance end;

[0086] S62. Push risk alert to the recipient's terminal;

[0087] S63: Block the communication resources associated with the sender.

[0088] Wherein, step S63 specifically includes:

[0089] Add the sender's domain name to the real-time ban list and synchronize it to the enterprise email gateway policy library.

[0090] In this embodiment, threat levels are divided into high, medium, and low risks. Measures taken for high-risk levels include: real-time freezing of email delivery; blocking of sending domains across the entire network; pushing voice alerts to recipients' mobile phones; and achieving millisecond-level blocking through the email gateway API.

[0091] Measures taken for medium-risk levels include: pop-up window reminders of risks; isolation of attachments; and reporting to the security center.

[0092] Measures taken for low-risk levels include: adding threat labels to email subjects and marking them as suspicious for users to judge.

[0093] like Figure 5 As shown, a phishing email detection device based on multi-dimensional analysis is also provided, including:

[0094] The mail receiving module 10 is used to receive mails to be tested;

[0095] The feature matching module 20 is used to perform keyword feature matching on the email content: if it matches a threat keyword in a preset keyword library, a safe forwarding operation is performed;

[0096] A static detection module 30 is configured to perform a threat library joint detection operation if no threat keyword in the preset keyword library is matched, wherein the threat library joint detection operation includes login behavior status verification, URL threat intelligence matching, file malicious code scanning, and comprehensively output a first risk score;

[0097] Semantic analysis module 40 is used to perform multimodal semantic understanding and analysis on emails, including parsing the contextual semantic associations of email text and identifying deceptive language patterns; detecting threat characteristics of embedded multimedia content; and verifying the logical consistency of attachment content with the main text statement;

[0098] A threat determination module 50 is configured to generate a comprehensive threat determination based on the first risk score and the semantic understanding analysis result;

[0099] The threat processing module 60 is used to trigger an automated response mechanism if the email is determined to be a phishing email; otherwise, continue to monitor subsequent emails.

[0100] In a specific embodiment, the static detection module 30 is specifically configured to:

[0101] Verify the sender's login status through the identity authentication protocol;

[0102] Match the URL in the email with the threat intelligence database updated in real time;

[0103] Perform dynamic multi-engine malicious code scanning on attachment files.

[0104] In a specific embodiment, the semantic analysis module 40 is specifically configured to:

[0105] Use the semantic deception feature recognition model to parse the semantic dependencies of the email body and extract dynamically updated phishing tactics features;

[0106] Identify potentially evocative emotional manipulation patterns in text, including expressions of urgency, pretenses of authority, and fear-inducing patterns;

[0107] Detect malicious domain names associated with embedded images and QR codes using computer vision technology;

[0108] Analyze the conflict characteristics between the attachment content and the declared functions of the email body.

[0109] In a specific embodiment, after parsing the semantic dependency relationship of the email body using a semantic deception feature recognition model and extracting dynamically updated phishing speech features, the following steps are further included:

[0110] A new phishing script template is automatically generated based on the semantic analysis results, and the preset keyword library is updated in real time.

[0111] In a specific embodiment, the threat determination module 50 is further configured to:

[0112] Receive user feedback on the threat determination result, and optimize the semantic deception feature recognition model based on the feedback information.

[0113] In one embodiment, the threat processing module 60 is specifically configured to:

[0114] Send real-time warning information to the security operation and maintenance end;

[0115] Push risk alerts to recipient terminals;

[0116] Blocks communication resources associated with the sender.

[0117] In a specific embodiment, blocking communication resources associated with the sender specifically includes:

[0118] Add the sender's domain name to the real-time ban list and synchronize it to the enterprise email gateway policy library.

[0119] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned phishing email detection device based on multi-dimensional analysis can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, it will not be repeated here.

[0120] The above-mentioned phishing email detection device based on multi-dimensional analysis can be implemented in the form of a computer program. The computer program can be used in Figure 6 Runs on the computer equipment shown.

[0121] See also Figure 6 , Figure 6 This is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 can be a terminal or a server. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, personal digital assistant, wearable device, or other electronic device with communication capabilities. The server can be a standalone server or a server cluster consisting of multiple servers.

[0122] See Figure 6The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0123] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can enable the processor 502 to execute a phishing email detection method based on multi-dimensional analysis.

[0124] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0125] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a phishing email detection method based on multi-dimensional analysis.

[0126] The network interface 505 is used to communicate with other devices through the network. Figure 6 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0127] The processor 502 is configured to execute a computer program 5032 stored in the memory to implement the phishing email detection method based on multi-dimensional analysis as described above.

[0128] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0129] Those skilled in the art will appreciate that all or part of the steps in the method of the above-described embodiment can be implemented by instructing the relevant hardware through a computer program. The computer program includes program instructions, which can be stored in a storage medium that is computer-readable. The program instructions are executed by at least one processor in the computer system to implement the steps in the method of the above-described embodiment.

[0130] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When executed by a processor, the program instructions cause the processor to execute the above-described method for detecting phishing emails based on multi-dimensional analysis.

[0131] The storage medium may be any computer-readable storage medium that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0132] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0133] In the several embodiments provided herein, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the various units is merely a logical functional division, and actual implementation may employ other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0134] The steps in the methods of the embodiments of the present invention may be adjusted in order, combined, or deleted as needed. The units in the devices of the embodiments of the present invention may be combined, divided, or deleted as needed. Furthermore, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0135] If this integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, terminal, or network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present invention.

[0136] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A phishing email detection method based on multi-dimensional analysis, characterized in that: The following steps are involved: S10, receiving the email to be tested; S20: Perform keyword feature matching on the email content. If the email content matches a threat keyword in a preset keyword library, perform a safe forwarding operation. S30: If no threat keyword in the preset keyword library is matched, a threat library joint detection operation is performed, wherein the threat library joint detection operation includes login behavior status verification, URL threat intelligence matching, and file malicious code scanning, and a first risk score is comprehensively outputted; S40. Perform multimodal semantic understanding and analysis of emails, including parsing the contextual semantic associations of email text, identifying deceptive language patterns, and detecting threat characteristics of embedded multimedia content. Verify the logical consistency between the contents of the attachment and the statement in the main text; S50: Generate a comprehensive threat assessment based on the first risk score and the semantic understanding analysis result; S60: If it is determined to be a phishing email, trigger the automated response mechanism; otherwise, continue to monitor subsequent emails.

2. The phishing email detection method based on multi-dimensional analysis according to claim 1, characterized in that: Step S30 specifically includes: S31. Verify abnormal behavior of the sender's login status through the identity authentication protocol; S32. Match the URL in the email with the threat intelligence database that is updated in real time. S33. Perform a multi-engine dynamic scan of malicious code on the attachment file.

3. The phishing email detection method based on multi-dimensional analysis according to claim 1, characterized in that: Step S40 specifically includes: S41. Analyze the semantic dependencies of the email body using a semantic deception feature recognition model to extract dynamically updated phishing tactics features. S42. Identify the characteristics of emotional manipulation in texts, including expressions of urgency, pretense of authority, and fear-inducing patterns; S43. Detect malicious domain names associated with embedded images and QR codes using computer vision technology; S44. Analyze the conflicting features between the attachment content and the declared functions of the email body.

4. The phishing email detection method based on multi-dimensional analysis according to claim 3, characterized in that: Step S41 further includes: A new phishing script template is automatically generated based on the semantic analysis results, and the preset keyword library is updated in real time.

5. The phishing email detection method based on multi-dimensional analysis according to claim 3, characterized in that: Step S50 further includes: Receive user feedback on the threat determination result, and optimize the semantic deception feature recognition model based on the feedback information.

6. The phishing email detection method based on multi-dimensional analysis according to claim 1, characterized in that: Step S60 specifically includes: S61. Send real-time alarm information to the security operation and maintenance end; S62. Push risk alert to the recipient's terminal; S63: Block the communication resources associated with the sender.

7. The phishing email detection method based on multi-dimensional analysis according to claim 6, characterized in that: Step S63 specifically includes: Add the sender's domain name to the real-time ban list and synchronize it to the enterprise email gateway policy library.

8. A phishing email detection device based on multi-dimensional analysis, characterized in that: include: Mail receiving module, used for receiving mails to be tested; The feature matching module is used to match the keyword features of the email content: if it matches the threat keywords in the preset keyword library, it will perform a safe forwarding operation; a static detection module configured to perform a threat library joint detection operation if no threat keyword in a preset keyword library is matched, the threat library joint detection operation including login behavior status verification, URL threat intelligence matching, file malicious code scanning, and comprehensively output a first risk score; Semantic analysis module, used to perform multimodal semantic understanding and analysis of emails, including parsing the contextual semantic associations of email text and identifying deceptive language patterns; detecting threat characteristics of embedded multimedia content; and verifying the logical consistency of attachment content with the body of the email. A threat assessment module, configured to generate a comprehensive threat assessment based on the first risk score and the semantic understanding analysis result; The threat handling module is used to trigger the automated response mechanism if it is determined to be a phishing email; otherwise, it continues to monitor subsequent emails.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the phishing email detection method based on multi-dimensional analysis according to any one of claims 1 to 7 when executing the computer program.

10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the phishing email detection method based on multi-dimensional analysis according to any one of claims 1 to 7 can be implemented.

Images