Malicious mail detection method and device and computing equipment

Abstract

The embodiment of the invention provides a malicious mail detection method, a malicious mail detection device and computing equipment, which are used for improving the detection accuracy of malicious mails. The method comprises the steps that prompt information including a to-be-detected mail is acquired, the prompt information is used for indicating that a detection task is executed on the to-be-detected mail, and the detection task is used for determining whether the to-be-detected mail is a malicious mail or not; the prompt information is input into a large model, the large model executes a detection task based on a judgment rule stored in a retrieval enhancement generation (RAG) knowledge base, and a detection result of the to-be-detected mail is obtained; the detection result is used for representing whether the to-be-detected mail is a malicious mail.

Description

Technical Field

[0001] This application relates to the field of server technology, and in particular to a method, apparatus and computing device for detecting malicious emails. Background Technology

[0002] With the rapid development of internet technology, email has become a core tool for personal communication, business collaboration, and global information dissemination. However, the problem of malicious emails accompanying the widespread use of email is becoming increasingly serious, posing a major challenge to network security and information efficiency. Malicious emails not only consume network bandwidth and server resources, but also pose a serious threat to user privacy, user security, corporate security, and social stability.

[0003] To enable users to efficiently handle important emails and effectively protect them from spam, phishing emails, and potential cyber threats, email systems must quickly and accurately determine whether each new email is malicious and precisely block it. This process not only improves user experience but is also a crucial line of defense in building a secure email environment. Summary of the Invention

[0004] This application provides a method, apparatus, and computing device for detecting malicious emails, which improves the accuracy of malicious email detection.

[0005] In a first aspect, embodiments of this application provide a method for detecting malicious emails, comprising: acquiring prompt information including an email to be detected, the prompt information indicating that a detection task will be performed on the email to be detected, the detection task being used to determine whether the email to be detected is malicious; inputting the prompt information into a large model, the large model performing the detection task based on judgment rules stored in a Retrieval-Augmented Generation (RAG) knowledge base, and obtaining a detection result for the email to be detected; the detection result being used to indicate whether the email to be detected is malicious.

[0006] The malicious email detection method provided in this application embodiment inputs the prompt information of the email to be detected into a large-scale model. The large-scale model, combined with the RAG knowledge base, determines whether the email to be detected is malicious. It can be understood that the large-scale model has a high semantic understanding capability and can accurately identify malicious emails disguised as normal communication through contextual understanding, intent recognition, and semantic association analysis. Furthermore, the large-scale model can dynamically retrieve contextual information related to the email content through the judgment rules stored in the RAG knowledge base. Thus, the large-scale model can perform various malicious email detection tasks based on the retrieved information, more accurately determining whether an email is malicious. In other words, the method provided in this application embodiment, through dual semantic and rule-based verification, can accurately detect malicious emails, reduce the probability of legitimate emails being misjudged as malicious, and thereby improve the accuracy of malicious email detection.

[0007] In one possible implementation, the RAG knowledge base also stores historical email detection data; this historical email detection data represents the detection results of the large model on historical emails; a prompt message is input into the large model, which performs a detection task based on the judgment rules stored in the RAG knowledge base to obtain the detection result of the email to be detected, including: retrieving target historical email detection data related to the email to be detected from the RAG knowledge base; inputting the prompt message and the target historical email detection data into the large model, which combines the target historical email detection data and the judgment rules stored in the RAG knowledge base to analyze the detection task in the email to be detected and the prompt message to obtain the detection result of the email to be detected.

[0008] In one possible implementation, the method further includes: generating email detection data based on the detection results of the email to be detected and the email to be detected, wherein the email detection data consists of the email content of the email to be detected and the detection results described in natural language; and storing the email detection data in the RAG knowledge base.

[0009] In one possible implementation, obtaining prompt information including the email to be detected includes: inputting the email to be detected into a pre-trained random forest model, determining the probability that the email to be detected is malicious through the trained random forest model; and obtaining prompt information when the probability that the email to be detected is malicious is within a preset probability range.

[0010] In one possible implementation, the method further includes: when the probability that the email to be detected is a malicious email is outside a preset probability range, determining the detection result of the email to be detected based on the probability that the email to be detected is a malicious email.

[0011] In one possible implementation, the RAG knowledge base also stores historical email detection data; the trained random forest model is obtained as follows: acquire multiple historical email detection data stored in the RAG knowledge base; extract text features and email tags from the historical email detection data; email tags are used to indicate whether the email corresponding to the historical email detection data is malicious; based on the text features and email tags of the historical email detection data, train the initial random forest model to obtain the trained random forest model.

[0012] In one possible implementation, the RAG knowledge base also stores historical email detection data; the method further includes: if the number of newly added historical email detection data exceeds a preset threshold, retraining the trained random forest model based on the historical email detection data; the newly added historical email detection data refers to the historical email detection data added after the most recent training of the random forest model.

[0013] In one possible implementation, the detection task includes at least one of the following sub-tasks: detecting malicious emails based on the sender's address; determining whether the email subject is misleading; determining whether the email content contains deceptive language; determining whether the Uniform Resource Locator (URL) link in the email content is valid and legitimate; determining whether the destination address of the URL link matches the email content, or whether the destination address is a malicious website; determining whether the URL link contains hidden parameters; and determining whether the email intent is reasonable.

[0014] Secondly, embodiments of this application provide a malicious email detection device, which is used to execute any of the malicious email detection methods provided in the first aspect above.

[0015] Thirdly, embodiments of this application provide a computing device including a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computing device to implement the method described in the first aspect.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium comprising: computer software instructions; when the computer software instructions are executed in a computing device, they cause the computing device to implement the method described in the first aspect.

[0017] Fifthly, embodiments of this application provide a computer program product that, when run on a computing device, causes the computing device to execute the steps of the relevant method described in the first aspect above, so as to implement the method of the first aspect above.

[0018] The beneficial effects of the second to fifth aspects mentioned above can be referred to the corresponding description of the first aspect, and will not be repeated here. Attached Figure Description

[0019] Figure 1 A schematic diagram of a server system architecture provided in this application embodiment;

[0020] Figure 2 A method flow for detecting malicious emails provided in this application embodiment Figure 1 ;

[0021] Figure 3 A flowchart illustrating a method for detecting malicious emails provided in this application embodiment. Figure 1 ;

[0022] Figure 4 A method flow for detecting malicious emails provided in this application embodiment Figure 2 ;

[0023] Figure 5 A method flow for detecting malicious emails provided in this application embodiment Figure 3 ;

[0024] Figure 6 A flowchart illustrating a method for detecting malicious emails provided in this application embodiment. Figure 2 ;

[0025] Figure 7 This is a schematic diagram of a malicious email detection device provided in an embodiment of this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0028] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0029] With the explosive growth in email volume, users' inboxes are facing unprecedented pressure and challenges. The massive influx of emails daily includes not only important information users expect but also spam, phishing emails, and potential cyber threats. To help users efficiently sift through this complex sea of ​​emails and build a robust security defense, email systems must initiate a series of sophisticated discrimination mechanisms the moment they receive each new email to identify whether it is malicious and should be blocked. This discrimination process is not only a key step in optimizing user experience but also a crucial safeguard for email security.

[0030] When identifying malicious emails, related technologies often rely on simple statistical features, such as checking whether the sender's address is on a blacklist, which makes it difficult to capture deep semantic information.

[0031] Based on this, this application provides a method for detecting malicious emails. The method involves inputting the prompt information of the email to be detected into a large-scale model, which then uses the large-scale model in conjunction with the RAG knowledge base to determine whether the email is malicious. It can be understood that the large-scale model has a high semantic understanding capability and can accurately identify malicious emails disguised as normal communication through contextual understanding, intent recognition, and semantic association analysis. Furthermore, the large-scale model can dynamically retrieve contextual information related to the email content using the judgment rules stored in the RAG knowledge base. This allows the large-scale model to perform various malicious email detection tasks based on the retrieved information, more accurately determining whether an email is malicious. In other words, the method provided in this application, through dual semantic and rule-based verification, can accurately detect malicious emails, reducing the probability of legitimate emails being misjudged as malicious, thereby improving the accuracy of malicious email detection.

[0032] It should be understood that the malicious email detection method provided in this application can be applied to computing devices, such as personal computers (PCs), laptops, mobile devices, tablets, and other electronic devices. This application does not limit the specific form of the computing device. Alternatively, the computing device can be a single server or a server cluster consisting of multiple servers. In some implementations, the server cluster can be a distributed cluster server. This application does not impose any limitations in this regard.

[0033] The following section uses a computing device as a server as an example to introduce its system architecture. Figure 1 A schematic diagram of the server's system architecture, such as Figure 1 As shown, the server's hardware includes a processor, an out-of-band controller, external storage, and RAM. The software includes an out-of-band management module and an operating system (OS).

[0034] The out-of-band management module runs within the out-of-band controller, while the OS runs on the processor (e.g., ...). Figure 1 (As shown).

[0035] The out-of-band management module can be a management unit for non-business modules. For example, the out-of-band management module can remotely maintain and manage the server through a dedicated data channel. This out-of-band management module is completely independent of the server's operating system and can communicate with the basic input output system (BIOS) and the operating system through the server's out-of-band management interface.

[0036] For example, the out-of-band management module may include a management unit for managing the server's operating status, a management system in the management chip, a system management mode (SMM), etc. It should be noted that the specific form of the out-of-band management module is not limited in the embodiments of this application; the above is merely an illustrative example.

[0037] Memory, also known as internal memory or main memory, is installed in memory slots on the server's motherboard. The memory communicates with the memory controller through memory channels.

[0038] External storage devices can be hard drives, smart media cards (SMC), secure digital cards (SD), flash cards, etc., provided on servers, or external storage devices such as USB flash drives.

[0039] The malicious email detection method provided in this application embodiment can be applied to... Figure 2 In the processor shown.

[0040] It should be noted that the system architecture and application scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0041] Figure 2 This is a flowchart illustrating a method for detecting malicious emails provided in an embodiment of this application. For example, the method for detecting malicious emails provided in this embodiment can be applied to a computing device; in other words, the method can be executed by a computing device, specifically, by the processor of the computing device.

[0042] like Figure 2 As shown, the malicious email detection method provided in this application embodiment may include the following steps:

[0043] S101. Obtain prompt information including the email to be detected.

[0044] The prompt message indicates that a detection task will be performed on the email to be detected, and the detection task is used to determine whether the email to be detected is malicious.

[0045] Large models typically require prompts to guide their output when processing tasks. The design of these prompts directly impacts model performance and result quality. Prompts provide the model with specific task requirements, helping it understand the type of content to be generated. With clear prompts, the model can generate more accurate and expected results, avoiding the generation of irrelevant content.

[0046] Therefore, when it is necessary to use a large model to identify whether an email to be detected is malicious, a prompt message needs to be generated based on the email to be detected. Furthermore, the prompt message needs to clearly state that the large model needs to perform a detection task on the email to be detected in order to determine whether the email is malicious.

[0047] As a feasible implementation method, in order to improve the accuracy of the large model in detecting malicious emails, the detection task in the prompt message includes at least one of the following subtasks 1-7:

[0048] Subtask 1: Detect malicious emails based on the sender's address.

[0049] Understandably, attackers often use fake domains or impersonate domains of well-known organizations to deceive users. Therefore, when detecting malicious emails, it is necessary to conduct a detailed analysis of the sender's address in order to accurately identify malicious emails with forged addresses.

[0050] Subtask 2: Determine if the email subject is leading.

[0051] Attackers also use urgency (such as "your account will be frozen"), reward inducements (such as "you've won a million"), or threatening language (such as "legal proceedings") to coerce users into clicking links. Therefore, when detecting malicious emails, it is necessary to analyze the email subject to determine whether it is leading and whether it will induce users to take action without sufficient thought.

[0052] Subtask 3: Determine if the email content contains deceptive language.

[0053] Attackers may also enhance credibility by using formal language, forging signatures, or mimicking official templates (such as bank statements). However, their emails may contain contradictory information (such as "Your account has been frozen, but you can unfreeze it by clicking the link"). Therefore, determining whether an email is malicious can be done by examining its content for deceptive language.

[0054] Subtask 4: Determine whether the Uniform Resource Locator (URL) links in the email content are valid and legal.

[0055] URLs in emails are one of the most common entry points for attackers. Attackers can register domains similar to legitimate ones or use internationalized domain names to disguise themselves as legitimate websites. Alternatively, they can shorten links to hide the real ones, making it impossible for users to assess security before clicking. Furthermore, clicking links in emails is faster than manually entering a URL, making it easier for users to access the site directly without verification.

[0056] Therefore, when email content contains URL links, these links need to be analyzed in detail. First, it's necessary to determine if the URL is valid and legitimate, ensuring that the link is both accessible (validity) and poses no security risks (legitimacy).

[0057] Subtask 5: Determine whether the destination address of the URL link matches the email content, or whether the destination address is a malicious website.

[0058] Attackers often use spoofed links (such as fake bank or social media platform domains) to lure users into clicking and stealing sensitive information. For example, an email with the subject "Product Update" might link to a "Lottery Winning" page. Clicking this link could directly download viruses, ransomware, or infect the user's device through exploits. Therefore, determining whether an email is malicious can be done by checking if the URL matches the email content.

[0059] Furthermore, it's possible to directly analyze whether the destination address of a URL link is a malicious website. It should be understood that malicious websites often reuse the same domain name or IP address, and security organizations can identify patterns through historical records. If a URL is associated with known malicious activities (such as phishing attacks or malware distribution), its destination address is directly marked as a malicious website.

[0060] Subtask 6: Determine if the URL link contains hidden parameters.

[0061] Hidden parameters are parameters embedded in the URL but not visually displayed. They may be used to track user behavior, transmit sensitive information, or perform malicious operations. Therefore, determining whether an email is malicious can be done by checking if a URL contains hidden parameters.

[0062] Subtask 7: Determine if the email's intent is reasonable.

[0063] Normal email content aligns with business processes or user profiles, such as payment requests requiring finance department approval or tasks assigned by senior management. If an email's intent is unreasonable, such as excessively requesting information or demanding suspicious actions, it can be identified as malicious.

[0064] For example, as one implementation method, the prompt message can be set as follows:

[0065] "As a professional cybersecurity expert, you bear the important responsibility of rigorously inspecting emails to accurately determine whether they are legitimate or suspicious. To complete this task efficiently and accurately, please be sure to perform the following detailed sub-tasks:"

[0066] 1. Conduct a comprehensive analysis of suspicious factors:

[0067] In-depth sender address verification: Thoroughly verify the sender's address. Check if it matches the commonly used address format of known legitimate organizations or individuals. Be especially wary of addresses that appear similar to legitimate organizations but have subtle differences, as well as completely unfamiliar sender addresses from unknown sources. Also, look for any indication that the address may be spoofed or maliciously impersonating a legitimate organization.

[0068] In-depth analysis of the subject line: Carefully analyze the email's subject line. Determine if it uses highly suggestive language, such as expressions of urgency or enticement. Such language may trigger panic, curiosity, or other strong emotional responses in the recipient, prompting them to take action without sufficient thought.

[0069] Strictly review the email body: Carefully examine the email body for deceptive language. For example, look for exaggerated promises, false warnings, or seemingly reasonable but actually trapping statements. Also, pay close attention to whether the email attempts to induce users to provide sensitive information, such as passwords, credit card numbers, ID card numbers, or other important personal data.

[0070] 2. Precise URL analysis:

[0071] If the email body contains a URL link, the following steps are required:

[0072] URL Extraction and Organization: Carefully extract all URLs and list them one by one for subsequent detailed analysis.

[0073] Domain validity and legitimacy checks: Conduct a thorough check of the domain name for each URL. Confirm that the domain name is legitimate and common, and that it is associated with well-known and legitimate websites. At the same time, be wary of domain names with unusual spellings, uncommon names, or those clearly irrelevant to the email subject.

[0074] Purpose consistency verification: Determine whether the URL points to a known malicious website or is significantly inconsistent with the claimed purpose of the email. For example, if an email claims to be a notification from a bank, but the URL points to an unfamiliar website unrelated to the bank, this may pose a risk.

[0075] Check for hidden parameters and redirection mechanisms: Look for hidden parameters in the URL, as these may transmit sensitive information or perform malicious operations without the user's knowledge. Additionally, check for redirection mechanisms; whether clicking the URL automatically redirects the user to other unknown or suspicious websites.

[0076] If the email body does not contain a URL link, be sure to explicitly indicate "None" in the results.

[0077] 3. Accurately identify email intent:

[0078] Contextual and keyword analysis: By combining the context of the email with key words and phrases, a comprehensive and in-depth inference can be made about the sender's true intentions. For example, by analyzing the word choice, tone, and specific matters mentioned in the email, it can be determined whether the sender is simply conveying information or has other potential purposes.

[0079] Pay close attention to information requests and action instructions: Be mindful of emails requesting sensitive information such as personal or financial details. Also, be wary of emails instructing users to take specific actions, such as clicking links, downloading attachments, or replying to specific emails. These actions may pose potential security risks to users.

[0080] Judging the reasonableness of intent and potential malice: A rigorous assessment of the inferred sender's intent is required. This involves determining whether the intent is reasonable and conforms to normal business processes or interpersonal logic. If the intent is found to be unreasonable, such as excessive requests for information or demands for suspicious actions, further consideration of potential malice is needed.

[0081] It can be seen that by accurately setting the prompts for the large model, the large model can analyze the emails to be detected accurately and in detail, thereby obtaining more accurate email detection results.

[0082] As a feasible approach, in order to further constrain the analysis process of the large model, the output of the large model can be restricted so that the large model generates clear conclusions.

[0083] For example, as one implementation method, the prompt message may also include the following:

[0084] 4. Draw rigorous conclusions and explain the reasons in detail:

[0085] Clearly state your conclusion: Based on the comprehensive analysis above, clearly and unambiguously state your final conclusion as to whether the email is abnormal or normal.

[0086] Provide sufficient and compelling reasons to support your judgment. Explain in detail any suspicious factors discovered during the analysis, including anomalies in the sender's address, leading language in the subject line, deceptive wording in the body text, suspicious URL characteristics, and inconsistencies in the email's intent. For each suspicious point, provide a thorough explanation and analysis so that others can understand the basis of your judgment.

[0087] Handling Unknown Situations: If there is insufficient evidence to make a clear judgment during the analysis, honestly answer "unknown." At the same time, explain in what aspects the uncertainty exists and what further information is needed to make an accurate judgment.

[0088] As a feasible implementation method, in order to facilitate the storage and analysis of the output results of large models, the prompt information is also used to indicate that the large model outputs structured detection results.

[0089] It should be understood that because the JSON format uses key-value pairs and nested structures, it can clearly and intuitively display the data hierarchy. Furthermore, its syntax is close to natural language, allowing developers to quickly understand it without complex tools. Therefore, large models can output detection results in JSON format.

[0090] For example, as a feasible implementation, in order to output JSON format data from a large model, the prompt message may also include the following:

[0091] 5. Output the judgment result in a standard JSON format, where the judgment result should contain the following keywords:

[0092] {

[0093] "score":int, / / phishing_score is used to represent suspected risk, int represents the risk level, and the level ranges from 0 to 10 from low to high.

[0094] "suspicious_url": boolean, / / Indicates whether the URL link in the email is suspicious. If it is malicious, boolean is True; otherwise, boolean is False.

[0095] "label":boolean, / / Indicates whether the email is malicious or legitimate. boolean is True if it is malicious, and False if it is legitimate.

[0096] "analysis":{

[0097] "sender_address":"Analysis Results",

[0098] "subject_line":"Analysis Results",

[0099] "body_content":"Analysis Results",

[0100] "urls":[

[0101] {

[0102] "url":"Specific URL",

[0103] "analysis": "URL analysis results"

[0104] }

[0105] / / If there are multiple URLs, repeat this structure.

[0106] [or "none"]

[0107] "intent": "Intent analysis result"

[0108] },

[0109] "conclusion": "Final conclusion and reasons"

[0110] }

[0111] S102. Input the prompt information into the large model. The large model performs the detection task based on the judgment rules stored in the RAG knowledge base and obtains the detection result of the email to be detected.

[0112] The detection result is used to indicate whether the email to be detected is malicious.

[0113] Understandably, the RAG knowledge base is a dynamic, search-optimized knowledge collection that integrates malicious email-related knowledge from multiple authoritative external sources (such as industry reports, security agency databases, and public threat intelligence platforms). This knowledge has been carefully processed, including vectorizing text fragments related to malicious emails and extracting and organizing metadata related to these texts (such as sender information, email subject characteristics, and malware associations). This knowledge base not only serves as the basis for malicious email judgment rules but also as an index for the retrieval module (which is tightly integrated with the RAG knowledge base). When email detection is required, the retrieval module can quickly and accurately match the corresponding judgment rules in the RAG knowledge base based on the email content and send these rules to the large model, thereby enhancing the large model's ability to understand the email context and improving the accuracy and efficiency of malicious email detection.

[0114] For example, as a feasible implementation, the RAG knowledge base may include the following:

[0115] Sensitive word list: such as "winning a prize", "tax refund", "password reset", "emergency transfer", etc.

[0116] Characteristics of malicious links: such as shortened links, IP address domains, and URLs disguised as legitimate websites;

[0117] Attachment characteristics: such as executable file extensions like .exe, .bat, and .zip containing embedded malicious scripts;

[0118] Sender impersonation: such as impersonating the domain names of banks, government agencies, or well-known companies;

[0119] Email subject characteristics: such as all capital letters, urgency symbols, and persuasive language;

[0120] The text format is abnormal, such as garbled characters, spelling errors, or grammatical errors.

[0121] Sender IP address blacklist and domain reputation score;

[0122] Malware information.

[0123] In this way, the large model can retrieve relevant judgment rules from the RAG knowledge base based on the content of the email to be detected and the detection task, and then use these rules to more accurately determine whether the email to be detected is malicious.

[0124] It should be understood that the judgment rules stored in the RAG knowledge base are usually derived from external knowledge bases. External knowledge bases are pre-built collections of knowledge independent of the RAG system, typically composed of authoritative data sources (such as legal provisions, industry standards, encyclopedic databases, etc.). External knowledge bases provide an original, authoritative, and static knowledge foundation to ensure the accuracy and timeliness of the detection rules.

[0125] In other words, the raw data from the external knowledge base needs to be cleaned, segmented, and vectorized before being stored in the RAG knowledge base to form a searchable index. Then, the RAG knowledge base can query and retrieve relevant rule fragments based on the content of the prompts, using this as context input to the large model to assist it in detecting malicious emails and improve detection accuracy.

[0126] As a feasible approach, to facilitate learning for large models, knowledge from external knowledge bases can be converted into JSON files and stored in the RAG knowledge base.

[0127] For example, the content in the RAG knowledge base can be as follows:

[0128]

[0129]

[0130] It should be noted that malicious email attack methods evolve rapidly; attackers constantly register new domains, change keywords (e.g., changing "winning a prize" to "receiving benefits"), and use new variants of malware. If the knowledge base is not updated in a timely manner, the detection system will be unable to identify newly emerging malicious domains, IP addresses, or keywords. Therefore, it is necessary to continuously update the external knowledge base to ensure the accuracy and timeliness of the detection rules in the RAG knowledge base.

[0131] As can be seen, the malicious email detection method provided in this application embodiment inputs the prompt information of the email to be detected into a large model, which then uses the large model in conjunction with the RAG knowledge base to determine whether the email is malicious. This means the large model has a high semantic understanding capability and can accurately identify malicious emails disguised as normal communication through contextual understanding, intent recognition, and semantic association analysis. Furthermore, the large model can dynamically retrieve contextual information related to the email content using the judgment rules stored in the RAG knowledge base. This allows the large model to perform various malicious email detection tasks based on the retrieved information, more accurately determining whether an email is malicious. In other words, the method provided in this application embodiment, through dual semantic and rule-based verification, can accurately detect malicious emails, reducing the probability of legitimate emails being misjudged as malicious, thereby improving the accuracy of malicious email detection.

[0132] In some embodiments, to improve the efficiency and accuracy of large models in malicious email detection tasks, an optimization mechanism based on the reuse of historical detection results can be introduced. Specifically, a structured historical data storage and reuse framework can be designed to persistently store the detection results of past historical emails by the large model in an indexable and associative format. This historical email detection data not only includes the final judgment label of the email (such as "malicious" or "normal"), but also covers intermediate features extracted by the model during the judgment process (such as keywords, semantic vectors, attachment risk scores) and contextual information (such as sender's historical behavior patterns and email subject relevance), providing rich prior knowledge for subsequent email detection.

[0133] As a feasible implementation method, the RAG knowledge base also stores historical email detection data; the historical email detection data is used to represent the detection results of the large model on historical emails.

[0134] In other words, the historical detection results of the large model and the corresponding emails can be stored in the RAG knowledge base as historical email detection data.

[0135] It should be understood that this application does not restrict the specific format of the email detection data. One implementation approach is to store the JSON format data output by the large model in relation to the email content, using this as the email detection data. Another implementation approach is to store the email content and the malicious detection results in a natural language description format.

[0136] Specifically, as a feasible implementation method, the method also includes: generating email detection data based on the detection results of the email to be detected and the email to be detected, wherein the email detection data consists of the email content of the email to be detected and the detection results described in natural language; and storing the email detection data in the RAG knowledge base.

[0137] The emails to be detected include the subject, body, and attachment information (such as filename and type). The detection results from the large model include: classification labels (e.g., "phishing email," "normal email"), risk level (e.g., "high," "medium," "low"), and key evidence (e.g., "attachment contains executable file," "link points to malicious domain"). Natural language is then used to describe the email content and detection results. Understandably, natural language can flexibly explain the basis of the model's judgment, the reasoning process, and potential ambiguities, helping users better understand the detection results. Although natural language itself is unstructured, the large model can effectively extract valuable information from natural language descriptions, supporting subsequent data analysis and mining.

[0138] As one implementation method, the format of historical email detection data can be: At [specific time], the sender [sender's email address or name] sent an email to the recipient [recipient's email address or name] with a [clearly defined email nature: malicious or non-malicious]. The email subject is "[email subject]", and the content includes a [brief summary of the key points or purpose of the email body]. In addition, this email contains an attachment named "[attachment name]", with a size approximately [attachment size, e.g., 2MB].

[0139] For example, historical email detection data could be as follows: On Thursday, December 5, 2024, at 3:27 PM, the sender Tome@123.com sent a malicious email to the recipient xiaoming@123.com. The email's subject was "Urgent: Account Verification Required," and it claimed that the recipient's online service account would soon be suspended unless they clicked a provided link and provided personal information. Furthermore, this email contained an attachment named "Account_Update.pdf," which was approximately 1.5 MB in size.

[0140] It should be noted that historical email detection data can also include other content in the email, such as images and documents attached to the email. Through image recognition, document parsing and background information association technologies, a deep understanding of the email content, attachments and context can be achieved, and this information can be used as email content to generate historical email detection data and stored in the RAG knowledge base.

[0141] In some embodiments, due to the uncertainty of the output of large models, especially in complex scenarios (such as email intent judgment and multimodal data parsing), the results may be biased due to training data bias, semantic ambiguity, or boundary cases.

[0142] Therefore, as a feasible approach, the detection results of the emails to be detected, output by the large model, can be displayed on the interface of the computing device, allowing staff to manually modify the model's output results. Staff can manually modify the results according to the actual situation, especially for emails with blurred boundaries or special backgrounds. The modified detection results can then be stored as email detection data in the RAG knowledge base.

[0143] Combination Figure 3 As shown, after obtaining the output of the large model, staff can judge whether the output of the large model is accurate, and if it is accurate, it can be stored in the RAG knowledge base.

[0144] Understandably, by combining the automation capabilities of large models with the flexibility and experience of human agents, the system can not only improve the accuracy of email intent judgment, but also form a closed loop of "model-human-data" through continuous feedback and optimization, ultimately achieving more accurate intent judgment, lower false positive rate, and more efficient human-machine collaboration.

[0145] In some embodiments, during the actual detection process, when the large model needs to detect emails to be detected, the system can first use a fast retrieval mechanism to extract historical email detection data related to the current email from the historical knowledge base to assist the large model in detecting malicious emails.

[0146] Specifically, as a feasible implementation method, S102 can be implemented as follows:

[0147] S1021. Retrieve target historical email detection data related to the email to be detected from the RAG knowledge base.

[0148] Retrieving target historical email detection data related to the email to be detected in the RAG knowledge base can be understood as retrieving historical emails related to the email to be detected and using the email detection data corresponding to the historical emails as the target historical email detection data.

[0149] Combination Figure 3 As shown, during retrieval, the emails to be detected can first be converted into vectors through data vectorization, that is, the process of converting unstructured email text into numerical vectors, so that machine learning models or retrieval systems can process them. Then, by calculating the similarity between the vector of the email to be detected and the vectors in the knowledge base, the most relevant historical emails can be found.

[0150] It should be understood that this application does not restrict the specific implementation method for determining whether two emails are related. In practical applications, analysis can be performed from multiple dimensions such as the text content, metadata, and context of the emails, and similarity calculation methods can be combined to determine the target historical email detection data related to the email to be detected.

[0151] For example, as one implementation method, it is possible to determine whether two emails contain the same keywords or phrases (such as "refund," "invoice," or "account abnormality"), whether the subject or intent of the two emails is consistent (such as both involving "account security"), or whether there are similar sentence patterns (such as "please click the link to confirm identity"). If the keywords, email intent, or sentence structure are highly similar, then the corresponding historical email detection data can be used as the target historical email detection data.

[0152] S1022. Input the prompt message and target historical email detection data into the large model. The large model combines the target historical email detection data and the judgment rules stored in the RAG knowledge base to analyze the detection tasks in the email to be detected and the prompt message, and obtain the detection results of the email to be detected.

[0153] Combination Figure 3 As shown, the target historical email detection data retrieved from the RAG knowledge base is combined with the prompt information and input into the large model. The large model generates response information and then outputs the detection results of the email to be detected.

[0154] Understandably, the large-scale model possesses powerful semantic understanding capabilities, enabling it to delve into the semantic relationships between the email and historical email detection data when processing emails to be inspected. For example, when the email to be inspected involves contract negotiations in a specific business scenario, the large-scale model can refer to historical data features such as the semantic expression habits and clause description methods of contract emails in similar business scenarios. If the email to be inspected contains expressions that are inconsistent with the semantic logic of normal historical contract emails, such as vague definitions of breach of contract liability or unreasonable price terms, the large-scale model can keenly detect these anomalies and accurately determine that the email may pose a risk.

[0155] Furthermore, the large model can combine the characteristics of emails in the target historical email detection data with the corresponding judgment results, while referring to the judgment rules in the RAG knowledge base, such as specific grammatical structures and vocabulary usage habits, to conduct a comprehensive analysis of the emails to be detected. It examines the email content sentence by sentence and paragraph by paragraph, compares it with similar cases in historical data, and uses the rules in the knowledge base to perform logical reasoning and judgment on the detection task.

[0156] Through in-depth and detailed analysis using a large-scale model, detection results can be obtained for the emails to be inspected. These results not only provide a clear judgment on whether the emails have problems, but may also provide detailed explanations and evidence to help users better understand the rationality of the detection results. This email detection method, based on a large-scale model and combining historical data and knowledge base rules, can significantly improve the accuracy and efficiency of email detection, providing strong support for ensuring the security and reliability of email communication.

[0157] In some embodiments, large models typically consume considerable computing resources during runtime, but in real-world applications, accurately distinguishing between malicious and simple emails is not particularly difficult. Therefore, before employing large models for comprehensive and in-depth detection, other types of models can be used to perform preliminary classification of these emails.

[0158] As one feasible approach, please refer to Figure 4 S101 can be specifically implemented as follows:

[0159] S1011. Input the email to be detected into a pre-trained random forest model, and determine the probability that the email to be detected is malicious through the trained random forest model.

[0160] It should be understood that Random Forest is an ensemble learning method. Its core idea is to improve the accuracy and stability of classification by constructing multiple decision trees and combining their predictions. In other words, a Random Forest consists of multiple decision trees, each independently classifying the input sample. For each class, all decision trees output their "vote" (or probability). The final probability is the average of the votes from all decision trees.

[0161] It should be understood that the original random forest output may be a "voting ratio", but it can also be converted into a true probability through probability calibration. For ease of description, this application uses the output probability of the random forest model as an example for illustration.

[0162] The random forest model in this embodiment is "pre-trained" and already has a certain judgment ability. Therefore, the email to be detected can be directly input into the pre-trained random forest model, and the probability that the email to be detected is malicious can be determined by the trained random forest model.

[0163] Random forest is an ensemble learning method based on decision trees, whose core advantage lies in its ability to efficiently process structured data. Random forest models require a fixed-length feature vector as input, where each feature corresponds to a specific value or category. For example, a feature vector might contain [sender domain, email length, number of links, keyword frequency, attachment type].

[0164] However, email content (such as email body and subject) is usually unstructured text, so it is necessary to first convert the email into a structured input that can be accepted by the random forest model.

[0165] As one approach, the emails to be detected can be preprocessed sequentially, including text feature extraction and text feature quantification, so that the original emails to be detected can be transformed into an input format acceptable to the random forest model.

[0166] It should be understood that preprocessing is used to clean and parse the original email data and extract structured or semi-structured information. It includes but is not limited to: text cleaning (removing HTML tags, special characters, etc.), word segmentation (for example, using the Chinese word segmentation tool "Jieba" to split continuous text into meaningful lexical units), and removing stop words (such as common but less meaningful words like "de", "shi", "zai", etc.). The embodiments of this application do not limit this.

[0167] Text feature extraction is used to extract features related to malicious email detection from the text part of the email (such as the subject and body), and construct feature vectors based on these fields. In addition, it is necessary to consider how to handle missing values or outliers to ensure that all data meets the requirements of the model. The extracted feature values can include but are not limited to the following:

[0168] Keyword features: Count the occurrence frequency of specific keywords (such as "urgent", "winning", "transfer", "click on the link", etc.). A predefined keyword list can be used, or high-frequency malicious words can be statistically counted through training data.

[0169] Text length features: Calculate the number of characters or words in the subject and body.

[0170] Special character ratio: Count the ratio of special characters (such as exclamation marks, question marks, currency symbols, etc.).

[0171] Link features: Extract all links in the email and count the number of links.

[0172] Text feature numericalization is used to convert the extracted text features into numerical features acceptable to the random forest model. For example, for the above keyword features, the number of occurrences of the keyword can be directly used as the feature value; another example is that for the above text length features, the number of characters or words can be directly used as the feature value.

[0173] As an implementation, text feature numericalization can be achieved through Term Frequency-Inverse Document Frequency (TF-IDF). It should be understood that TF-IDF is a statistical technique aimed at measuring the relative importance of a certain vocabulary in a document collection or corpus. This process not only completes the numerical conversion of text data, but also enhances the model's recognition ability of the core keywords of the document by quantifying the product of the term frequency and inverse document frequency of each vocabulary, generating a more discriminative and accurate feature expression for the classification task. In addition, extended configurations such as n-gram can be combined to mine the combined features between vocabulary, thereby further enhancing the richness and expressiveness of text features.

[0174] S1012. If the probability that the email to be detected is malicious is within a preset probability range, obtain a prompt message.

[0175] Understandably, the probability output by a random forest model indicates the model's confidence in the email category; the higher the probability value, the higher the model's confidence in that category.

[0176] Random forest is a classification model. In binary classification problems (such as determining whether an email is malicious), the model outputs two probabilities for each input sample: the probability of a malicious email, which represents the likelihood that the model considers the email to be malicious; and the probability of a normal email, which represents the likelihood that the model considers the email to be normal.

[0177] Therefore, the random forest model can be considered accurate when either the probability of a malicious email or the probability of a legitimate email is above a certain threshold. Conversely, if both the probability of a malicious email and the probability of a legitimate email are below a certain threshold, the random forest model is considered inaccurate.

[0178] In binary classification tasks (such as "malicious email" vs. "normal email"), a sample can only belong to one of the two categories. The model needs to assign a probability to each category, and the sum of these two probabilities is 1. Therefore, if the probability of the email being detected as malicious (or normal) falls within a preset probability range, it can be determined that the random forest model's classification is inaccurate. Because large models possess powerful language understanding capabilities, large-scale data training, and contextual association properties, they can be used to detect malicious emails even when the random forest model's accuracy is insufficient.

[0179] For example, when the probability of a malicious email is within the range of [0.9, 0.1], that is, when the probability of a malicious email is less than or equal to 0.9 and the probability of a normal email is less than or equal to 0.9, a prompt message can be obtained, that is, malicious emails can be detected through a large model.

[0180] As one feasible approach, please continue reading. Figure 4 The malicious email detection method provided in this application embodiment further includes:

[0181] S1013. When the probability that the email to be detected is a malicious email is outside the preset probability range, the detection result of the email to be detected is determined based on the probability that the email to be detected is a malicious email.

[0182] For example, as one implementation, if the probability that the email to be detected is a malicious email is higher than the upper limit of the preset probability range, the email to be detected is determined to be a malicious email; if the probability that the email to be detected is a malicious email is lower than the lower limit of the preset probability range (that is, the probability that the email to be detected is a normal email is higher than 1-a), the email to be detected is determined to be a normal email.

[0183] Understandably, after obtaining the detection results of the emails to be detected through the random forest model, these results can also be stored in the RAG knowledge base as historical email detection data to facilitate subsequent analysis and learning by the model.

[0184] As can be seen, the solution provided in this embodiment uses a random forest model to perform preliminary classification of emails before utilizing a large model for malicious email detection. Since random forest is a lightweight model with low computational cost, it can quickly process large numbers of emails and initially filter out suspicious emails. For example, assuming 1 million emails are received daily, random forest can filter out 90% of the emails, requiring only the remaining 10% to be passed to the large model for in-depth analysis. This allows the large model to avoid performing in-depth analysis on all emails, saving its computational resources.

[0185] Furthermore, random forests excel at handling structured data (such as email headers), while large models excel at handling unstructured data (such as email bodies). Combining the two can cover a wider attack surface, thereby improving the accuracy of malicious email detection.

[0186] In some embodiments, since the random forest model needs to obtain the email tag corresponding to each sample email during training, i.e., whether the sample email is a normal email or a malicious email, the random forest model can be trained using the malicious email detection results of a large model for the emails to be detected. That is, historical email detection data stored in the RAG knowledge base can be used as the model training data for the random forest model.

[0187] It should be noted that the device used to train the random forest model can be the aforementioned computing device, or it can be other model training devices. Other model training devices can be electronic devices or servers, and this application embodiment does not impose any restrictions on this.

[0188] As one feasible approach, please refer to Figure 5 The trained random forest model is obtained in the following way:

[0189] S501. Obtain multiple historical email detection data stored in the RAG knowledge base.

[0190] Obtain multiple historical email detection data stored in the RAG knowledge base and use the historical email detection data as training samples for the random forest model.

[0191] S502. Extract text features and email tags from historical email detection data.

[0192] Among them, email tags are used to indicate whether the emails corresponding to historical email detection data are malicious emails.

[0193] Since the historical email detection data is obtained by a large model to detect malicious activity in historical emails, it accurately indicates whether the historical emails are normal or malicious. Therefore, email tags can be determined based on the historical email detection data.

[0194] Furthermore, the historical email detection data also includes the content of historical emails, so the text features of historical emails can be determined based on the historical email detection data.

[0195] S503. Based on the text features and email tags of historical email detection data, train the initial random forest model to obtain a trained random forest model.

[0196] It should be understood that when training the initial random forest model, it can first be converted into numerical features by quantifying the text features, and this application embodiment does not limit this.

[0197] Specifically, you can first import the necessary databases (such as RandomForestClassifier, dataset splitting tools, and evaluation metrics), then load or generate the dataset and split it into feature matrices X and label vectors y. The dataset can be split into training and test sets to evaluate model performance.

[0198] You can then create a RandomForestClassifier instance and set its hyperparameters (optional) to obtain an initialized random forest model. This model can then be trained using the training set data. During training, the random forest model continuously adjusts its internal parameters based on the provided training data to find the optimal configuration, allowing the model to perform best on a given task.

[0199] It should be understood that, in order to ensure the performance of the model, cross-validation, hyperparameter tuning, and other operations can be performed on the random forest model to ensure that the model not only performs well on the training set, but also can generalize to unseen data.

[0200] As can be seen from S501-S503 above, the solution provided in this embodiment uses historical email detection data to train the random forest model, that is, it uses the detection results of malicious emails from a large model to train the random forest model. Using the malicious email detection results of the large model as features or labels to train the random forest model can indirectly improve the training speed and optimize the overall detection efficiency. In related technologies, training the random forest model requires manually extracting email metadata (such as sender, subject, keywords), text features (such as word frequency, grammatical structure), etc., and determining email tags, which is time-consuming and relies on expert experience.

[0201] Large-scale models can automatically extract high-dimensional semantic features (such as contextual relationships and implicit intent) from emails when detecting malicious emails, and then determine whether an email is malicious. Therefore, using historical email detection data to generate training data for random forest models can not only reduce the training complexity of random forests but also reduce the cost of manual annotation and improve the training speed of the model.

[0202] In some embodiments, due to the continuous evolution of attack methods, techniques, and propagation mechanisms of malicious emails (such as phishing emails, spam, APT attacks, etc.), the performance of the random forest model, as a classifier trained on historical data, gradually declines over time. Therefore, the random forest model can be updated periodically.

[0203] Based on this, as a feasible implementation method, if historical email detection data is still stored in the RAG knowledge base, the method also includes: if the number of newly added historical email detection data exceeds a preset threshold, retraining the trained random forest model based on the historical email detection data.

[0204] The newly added historical email detection data refers to the historical email detection data added after the most recent training of the random forest model.

[0205] In other words, whenever a certain amount of new data is added to the RAG knowledge base, a model update process can be triggered. The historical email detection data in the RAG knowledge base is extracted to form the feature columns and label columns required for model training, such as "email subject" and "sender's email address or name". These feature columns are then combined with label columns that are clearly marked as "malicious" or "non-malicious", and the complete process of training the random forest model is re-executed. This ensures that the updated random forest model can include the latest data features, thereby improving the accuracy of the random forest model's judgment.

[0206] Specifically, as one implementation method, when the amount of new data added to the RAG knowledge base exceeds a set threshold (e.g., 50%) of the data volume at the time of the last update, the pre-trained random forest model is retrained based on historical email detection data. It should be understood that setting a threshold avoids frequently triggering energy-intensive training tasks while ensuring the timeliness of the knowledge base.

[0207] By setting an incremental threshold (a preset quantity threshold), it is possible to ensure that the knowledge base can quickly incorporate new attack samples (such as newly emerging phishing email templates and malicious domains). Furthermore, with each update, the random forest model can introduce new features (such as hyperlink structures and attachment types in emails), improving the model's ability to detect complex attacks.

[0208] It should be understood that retraining a pre-trained random forest model can employ continuous optimization strategies, such as online learning and incremental learning, allowing the model to dynamically adjust parameters without affecting service, thereby further improving the system's response speed and protection effectiveness.

[0209] In some embodiments, please refer to Figure 6 The malicious email detection method provided in this application includes the following steps during execution:

[0210] The email to be detected is input into a random forest model. If both probability values ​​output by the random forest model are lower than a preset threshold, the email is detected using a large model combined with known security rules stored in the RAG knowledge base, yielding a detection result. The detection result is then manually reviewed, and if it passes the review, it is stored in the RAG knowledge base. If either of the two probability values ​​output by the random forest model is higher than a preset threshold, the detection result of the random forest model is stored in the RAG knowledge base.

[0211] Furthermore, the random forest model can be updated regularly based on the detection results stored in the RAG knowledge base to ensure its timeliness and accuracy.

[0212] like Figure 6 As shown, the establishment and training of the random forest model relies on feature engineering, which is crucial to model performance and directly affects the model's ability to model historical email data. The core objective of feature engineering is to transform raw email data (such as text and metadata) into numerical features for use by the machine learning model. The initial training of the random forest model can be based on historical email data and established through feature engineering; this embodiment does not impose any restrictions on this.

[0213] In an exemplary embodiment, this application also provides a malicious email detection device. This malicious email detection device can be the aforementioned computing device, or it can be a processor within the computing device. The malicious email detection device may include one or more functional modules for implementing the malicious email detection method of the above method embodiments.

[0214] For example, Figure 7 This is a schematic diagram of a malicious email detection device provided in an embodiment of this application. Figure 7 As shown, the malicious email detection device 110 includes an acquisition module 111 and an input module 112.

[0215] The acquisition module 111 is used to acquire prompt information including the email to be detected. The prompt information indicates that a detection task will be performed on the email to be detected. The detection task is used to determine whether the email to be detected is malicious.

[0216] The input module 112 is used to input the prompt information into the large model. The large model performs the detection task based on the judgment rules stored in the Retrieval-Augmented Generation (RAG) knowledge base to obtain the detection result of the email to be detected. The detection result is used to indicate whether the email to be detected is malicious.

[0217] In one possible implementation, the RAG knowledge base also stores historical email detection data; the historical email detection data is used to represent the detection results of the large model on historical emails; the input module is specifically used to retrieve target historical email detection data related to the email to be detected from the RAG knowledge base; input the prompt information and target historical email detection data into the large model, and the large model combines the target historical email detection data and the judgment rules stored in the RAG knowledge base to analyze the detection task in the email to be detected and the prompt information to obtain the detection result of the email to be detected.

[0218] In one possible implementation, the malicious email detection device 110 further includes: a generation module, used to generate email detection data based on the detection results of the email to be detected and the email to be detected, wherein the email detection data is the email content of the email to be detected and the detection results described in natural language; and to store the email detection data in the RAG knowledge base.

[0219] In one possible implementation, the acquisition module is specifically used to: input the email to be detected into a pre-trained random forest model, determine the probability that the email to be detected is malicious through the trained random forest model; and obtain a prompt message when the probability that the email to be detected is malicious is within a preset probability range.

[0220] In one possible implementation, the malicious email detection device 110 further includes a determination module, used to determine the detection result of the email to be detected based on the probability that the email to be detected is malicious when the probability that the email to be detected is malicious is outside a preset probability range.

[0221] In one possible implementation, the detection task includes at least one of the following sub-tasks: detecting malicious emails based on the sender's address; determining whether the email subject is misleading; determining whether the email content contains deceptive language; determining whether the Uniform Resource Locator (URL) link in the email content is valid and legitimate; determining whether the destination address of the URL link matches the email content, or whether the destination address is a malicious website; determining whether the URL link contains hidden parameters; and determining whether the email intent is reasonable.

[0222] In an exemplary embodiment, this application also provides a training apparatus for a random forest model. This training apparatus for the random forest model can be the aforementioned computing device, or it can be a processor within the computing device; this application does not limit the scope of the embodiments.

[0223] The training apparatus for the random forest model includes: an acquisition module for acquiring multiple historical email detection data stored in the RAG knowledge base; an extraction module for extracting text features and email tags from the historical email detection data; email tags are used to indicate whether the emails corresponding to the historical email detection data are malicious emails; and a training module for training the initial random forest model based on the text features and email tags of the historical email detection data to obtain the trained random forest model.

[0224] In one possible implementation, the RAG knowledge base also stores historical email detection data; the training module is further used to: retrain the trained random forest model based on the historical email detection data when the number of newly added historical email detection data exceeds a preset threshold; the newly added historical email detection data refers to the historical email detection data added after the most recent training of the random forest model.

[0225] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the above-provided devices and the description of their beneficial effects can be found in the corresponding method embodiments, which will not be repeated here.

[0226] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; for example, the related hardware can be a processor of a computing device. The program instructions can be stored in the above-mentioned computer-readable storage medium, and when executed, the processes of the above method embodiments can be implemented. The computer-readable storage medium can be memory. The above-mentioned computer-readable storage medium can also be an external storage device, such as a hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. Further, the above-mentioned computer-readable storage medium can include both memory and external storage devices. The above-mentioned computer-readable storage medium is used to store the above-mentioned computer program instructions and other programs and data required by the above-mentioned malicious email detection method.

[0227] This application also provides a computer program product comprising a computer program that, when run on a computing device, causes the computing device to execute any of the malicious email detection methods provided in the above embodiments.

[0228] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0229] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0230] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting malicious emails, characterized in that, The method includes: Obtain a prompt message including the email to be detected, the prompt message being used to indicate that a detection task will be performed on the email to be detected, the detection task being used to determine whether the email to be detected is a malicious email; The prompt information is input into the large model, which executes the detection task based on the judgment rules stored in the retrieval enhancement generation RAG knowledge base to obtain the detection result of the email to be detected; the detection result is used to indicate whether the email to be detected is malicious.

2. The method according to claim 1, characterized in that, The RAG knowledge base also stores historical email detection data; the historical email detection data is used to represent the detection results of the large model on historical emails; The step involves inputting the prompt information into a large model, which then executes the detection task based on the judgment rules stored in the RAG knowledge base to obtain the detection result of the email to be detected, including: Retrieve target historical email detection data related to the email to be detected from the RAG knowledge base; The prompt information and the target historical email detection data are input into the large model. The large model combines the target historical email detection data and the judgment rules stored in the RAG knowledge base to analyze the detection task in the email to be detected and the prompt information, and obtain the detection result of the email to be detected.

3. The method according to claim 2, characterized in that, The method further includes: Based on the detection results of the email to be detected and the email to be detected, email detection data is generated. The email detection data consists of the email content and detection results of the email to be detected, described in natural language. The email detection data is stored in the RAG knowledge base.

4. The method according to claim 1, characterized in that, The process of obtaining the prompt information for the email to be detected includes: The email to be detected is input into a pre-trained random forest model, and the probability that the email to be detected is malicious is determined by the pre-trained random forest model. If the probability that the email to be detected is malicious is within a preset probability range, the prompt information is obtained.

5. The method according to claim 4, characterized in that, The method further includes: If the probability that the email to be detected is malicious is outside a preset probability range, the detection result of the email to be detected is determined based on the probability that the email to be detected is malicious.

6. The method according to claim 4, characterized in that, The RAG knowledge base also stores historical email detection data; the trained random forest model was obtained in the following way: Obtain detection data from multiple historical emails stored in the RAG knowledge base; Extract text features and email tags from the historical email detection data; The email tag is used to indicate whether the email corresponding to the historical email detection data is a malicious email; Based on the text features and email tags of the historical email detection data, the initial random forest model is trained to obtain the trained random forest model.

7. The method according to claim 4, characterized in that, The RAG knowledge base also stores historical email detection data; the method further includes: If the number of newly added historical email detection data exceeds a preset threshold, the trained random forest model is retrained based on the historical email detection data; the newly added historical email detection data refers to the historical email detection data added after the most recent training of the random forest model.

8. The method according to claim 1, characterized in that, The detection task includes at least one of the following sub-tasks: Detect malicious emails based on sender addresses; Determine if the email subject is leading; Determine if the email content contains deceptive language; Determine whether the Uniform Resource Locator (URL) links in the email content are valid and legal; Determine whether the destination address of the URL link matches the email content, or whether the destination address is a malicious website; Determine whether the URL link contains hidden parameters; Determine if the email's intent is reasonable.

9. A malicious email detection device, characterized in that, include: The acquisition module is used to acquire prompt information including the email to be detected, the prompt information being used to indicate that a detection task is to be performed on the email to be detected, and the detection task being used to determine whether the email to be detected is a malicious email; An input module is used to input the prompt information into a large model, which executes the detection task based on the judgment rules stored in the retrieval enhancement generation RAG knowledge base to obtain the detection result of the email to be detected; the detection result is used to indicate whether the email to be detected is a malicious email.

10. A computing device, characterized in that, The computing device includes a processor and a memory; the processor is coupled to the memory. The memory is used to store computer instructions; The computer instructions are loaded and executed by the processor to enable the computing device to perform the method as described in any one of claims 1-8.

Images