Attack detection method and device, equipment and medium

Abstract

The invention discloses an attack detection method and device, equipment and a medium, and the method comprises the steps: extracting target key information of a to-be-detected mail, the target key information comprises at least two types of mail text key information, attachment key information and link key information, the mail text key information comprises key information extracted from a mail header and / or a mail text; performing analysis based on the target key information by using a target large model to obtain an analysis result including intention information corresponding to the to-be-detected mail; constructing prompt information based on the target key information and the analysis result; and inputting the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information, and an attack detection result corresponding to the to-be-detected mail is obtained. In this way, the accuracy of attack detection on the mail can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to an attack detection method and device, equipment and a medium. BACKGROUND

[0002] At present, the traditional attack detection for phishing emails usually relies on methods such as email header information analysis, keyword matching, black and white list, etc. Although these methods can identify some phishing emails to some extent, the understanding of the email content is relatively shallow, which leads to misjudgment and missed judgment of phishing emails, and the accuracy is insufficient.

[0003] Therefore, how to improve the accuracy of attack detection on emails is a technical problem to be solved by those skilled in the art. SUMMARY

[0004] Therefore, the purpose of the present application is to provide an attack detection method, device, equipment and medium, which can improve the accuracy of attack detection on emails. The specific scheme is as follows:

[0005] In a first aspect, the present application provides an attack detection method, comprising:

[0006] extracting target key information of a to-be-detected email, wherein the target key information includes at least two types of email text key information, attachment key information and link key information, and the email text key information includes key information extracted from the email header and / or email body;

[0007] using a target large model to analyze the target key information to obtain an analysis result including intent information corresponding to the to-be-detected email;

[0008] constructing prompt information based on the target key information and the analysis result;

[0009] inputting the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information to obtain an attack detection result corresponding to the to-be-detected email.

[0010] Optionally, using a target large model to analyze the target key information respectively to obtain an analysis result including intent information corresponding to the to-be-detected email, includes at least two of the following analysis strategies:

[0011] using a target large model to analyze the email text key information to obtain body intent information and identity information;

[0012] using a target large model to analyze the attachment key information to obtain attachment intent information and file abnormal point conditions;

[0013] The target large model is used to analyze the link key information to obtain link intention information and link forgery information.

[0014] Optionally, the target large model is used to analyze the attachment key information to obtain attachment intention information and file abnormal point information, including:

[0015] The attachment content in the attachment key information is scanned by using a preset killing strategy to obtain attack behavior data.

[0016] The file features of the attachment key information are analyzed, wherein the file features include one or more of a file header analysis result, an attachment content structure analysis result, and a file size analysis result.

[0017] The target large model is used to analyze the attachment name, the attack behavior data, and the file features to obtain the attachment intention information and the file abnormal point information.

[0018] Optionally, the preset killing strategy includes one or more of a malicious code scanning strategy, a heuristic analysis strategy, and a sandbox behavior simulation analysis strategy.

[0019] Optionally, the prompt information is constructed based on the target key information and the analysis result, including:

[0020] Identity representation data corresponding to the to-be-detected email is searched from a preset knowledge base, wherein the identity representation data is used to compare with the identity information to determine an identity forgery situation.

[0021] The prompt information is constructed based on the target key information, the analysis result, and the identity representation data.

[0022] Optionally, the method further includes:

[0023] If the identity representation data corresponding to the to-be-detected email cannot be searched from the preset knowledge base, the identity representation data corresponding to the to-be-detected email is queried from the Internet.

[0024] Optionally, the link key information of the to-be-detected email is extracted, including:

[0025] The link address and the page information pointed by the link are extracted from the link extracted from the non-explicit link information in the email body and the attachment and the explicit link carried in the email body and the attachment to obtain the link key information.

[0026] In a second aspect, the application provides an attack detection device, including:

[0027] extract a target key information of the mail to be detected, wherein the target key information comprises at least two of mail text key information, attachment key information and link key information, and the mail text key information comprises key information extracted from a mail header and / or a mail body;

[0028] analyze the target key information based on a target large model to obtain an analysis result of the mail to be detected, wherein the analysis result comprises intent information;

[0029] construct prompt information based on the target key information and the analysis result;

[0030] input the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information to obtain an attack detection result corresponding to the mail to be detected.

[0031] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, wherein:

[0032] the memory is configured to store a computer program;

[0033] the processor is configured to execute the computer program to implement the attack detection method.

[0034] In a fourth aspect, the present application provides a computer readable storage medium configured to store a computer program, wherein the computer program is executed by a processor to implement the attack detection method.

[0035] In a fifth aspect, the present application provides a computer program product comprising computer programs / instructions, which are executed by a processor to implement the attack detection method.

[0036] According to the above scheme, the present application provides an attack detection method, comprising: extracting a target key information of the mail to be detected, wherein the target key information comprises at least two of mail text key information, attachment key information and link key information, and the mail text key information comprises key information extracted from a mail header and / or a mail body; analyzing the target key information based on a target large model to obtain an analysis result of the mail to be detected, wherein the analysis result comprises intent information; constructing prompt information based on the target key information and the analysis result; inputting the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information to obtain an attack detection result corresponding to the mail to be detected.

[0037] It can be seen that the beneficial effects of the present application are: the present application extracts at least two types of information from the mail header and / or the mail body corresponding to the mail text key information, the attachment key information and the link key information, analyzes the target large model to obtain the analysis result including the intention information, in this way, through the semantic analysis of the multi-dimensional information of the to-be-detected mail by the large model, the intention and content meaning of the to-be-detected mail can be accurately obtained, more hidden malicious information can be identified, and then the analysis result and the multi-dimensional information are reconstructed to obtain prompt information, and the large model is used for reasoning, so that the large model can be based on more rich knowledge reasoning, thereby improving the accuracy of attack detection of the mail.

[0038] Correspondingly, the attack detection device, equipment, readable storage medium and product provided by the present application also have the above technical effects. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only a part of the embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0040] Figure 1 A flow chart of an attack detection method is provided for the embodiments of the present application.

[0041] Figure 2 An attack detection schematic diagram is provided for the embodiments of the present application.

[0042] Figure 3 A structure schematic diagram of an attack detection device is provided for the embodiments of the present application.

[0043] Figure 4 A structure diagram of an electronic device is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0045] Firstly, the technical terms involved in the present application are explained:

[0046] Large Model: A deep learning model with a large number of parameters, capable of processing and understanding various forms of data such as natural language text, with strong language understanding and generation capabilities.

[0047] Phishing Email: A fraudulent email that disguises as a legitimate organization or individual to trick recipients into providing sensitive information (such as account numbers, passwords, bank information, etc.) or performing malicious operations.

[0048] Targeted Attack: A targeted attack against specific individuals, organizations, or groups, distinguished from the widespread net-casting attack method, attackers will carefully collect target-related information to improve the success rate of attacks.

[0049] RAG (Retrieval-Augmented Generation): Retrieval-Augmented Generation, an artificial intelligence technology that combines information retrieval technology and language generation model, retrieves relevant information from external knowledge base to enhance the generation ability and accuracy of the model.

[0050] Currently, traditional phishing email detection techniques and targeted attack determination mainly rely on email header information analysis, keyword matching, black and white list methods. Although these methods can identify some phishing emails to some extent, they have many shortcomings and deficiencies. Traditional methods have a shallow understanding of email content and cannot accurately grasp the semantic information of the email. For example, for some carefully constructed phishing emails, their subject and body may contain complex inducible language, and traditional techniques are difficult to identify the malicious intent. Traditional techniques have limitations in detecting fake types. Attackers can evade detection by forging sender identities, simulating link corresponding pages, and confusing attachments, while traditional methods can only detect some obvious fake features, and are powerless against highly simulated fake methods. Traditional techniques are also weak in attack behavior analysis. Usually only rely on simple sandbox detection or local kill results, cannot comprehensively summarize attack behavior and characteristics, leading to misjudgment and missed judgment of phishing emails.

[0051] In summary, the existing technology cannot accurately detect attacks in phishing email detection, including the inability to determine whether it is a targeted attack, which allows many targeted and highly dangerous phishing emails to easily break through security defenses, causing serious losses to users. Therefore, a new technical solution is needed to overcome the shortcomings of existing technology and improve the accuracy and reliability of phishing email attack detection.

[0052] Referring to Figure 1 The embodiments of the present application disclose an attack detection method, comprising:

[0053] Step S11: Extract the target key information of the email to be detected, wherein the target key information includes at least two of the following: email text key information, attachment key information, and link key information. The email text key information includes key information extracted from the email header and / or email body.

[0054] In an optional implementation, the target key information may include key information of the email text, key information of the attachments, and key information of the links. The key information of the email text includes key information extracted from the email header and the email body.

[0055] In optional implementations, sender, recipient, subject, and validation fields can be extracted from the email header information, and text content other than interference information can be extracted from the email body to obtain key information of the email text; attachment name, file type, file size, and file content can be extracted from attachments to obtain key information of the attachments; and for links extracted from non-explicit link information in the email body and attachments, as well as explicit links carried in the email body and attachments, the link address and the page information to which the link points can be extracted to obtain key information of the links.

[0056] The interference information may include HTML tags. Non-explicit link information may include implicit links, such as QR codes in images, while explicit links are those directly contained within the text or attachments. Furthermore, embodiments of this application can extract link addresses, crawl the page information pointed to by the links, and compress the data. Moreover, the target key information is processed into structured data.

[0057] Step S12: Analyze the target key information using the target big model to obtain the analysis results, including intent information, corresponding to the email to be detected.

[0058] In this embodiment, the target large model is a large model obtained by training and fine-tuning a large model based on three training sub-tasks. The first training sub-task is to train using training samples with key information from email text; the second training sub-task is to train using training samples with key information from attachments; and the third training sub-task is to train using training samples with key information from links. The training annotation information can be corresponding intent tags, etc. The training order of the above three training sub-tasks is not limited. The large model is a deep learning model with more than a certain number of parameters.

[0059] Specifically, a target-based large-scale model can be used to analyze the email to be detected based on the key information of the target, obtaining analysis results including intent information. This includes at least two of the following analysis strategies: using the target-based large-scale model to analyze the key information of the email text to obtain the body intent information and identity information; using the target-based large-scale model to analyze the key information of the attachment to obtain the attachment intent information and file anomalies; and using the target-based large-scale model to analyze the key information of the link to obtain the link intent information and link forgery. That is, using the target-based large-scale model to analyze the key information of the email text to obtain the body intent information and identity information is one analysis strategy; using the target-based large-scale model to analyze the key information of the attachment to obtain the attachment intent information and file anomalies is another analysis strategy; and using the target-based large-scale model to analyze the key information of the link to obtain the link intent information and link forgery is yet another analysis strategy.

[0060] In optional implementations, a target big model can be used to analyze the target key information (email text key information), the attachment key information, and the link key information respectively to obtain analysis results corresponding to the email to be detected, including intent information. This application embodiment can use the target big model to analyze the email text key information to obtain the body intent information and identity information; use the target big model to analyze the attachment key information to obtain the attachment intent information and file anomaly information; and use the target big model to analyze the link key information to obtain the link intent information and link forgery information. That is, the email text key information, attachment key information, and link key information can be input into the target big model respectively to obtain the corresponding analysis results.

[0061] The email body's intent information represents the intent of the email, such as whether the email was sent under the guise of an internal company notification or business cooperation. Identity information represents the sender's identity. In the first training subtask, the training annotation information can be intent tags and identity tags corresponding to the training samples of key information in the email text. Identity information can include the claimed identity of the email analyzed by the model. In an optional implementation, the analysis results corresponding to the key information in the email text can also include identity association information, including whether the identity is related to the recipient's company or whether there is any communication between the identity and the recipient. In an optional implementation, the analysis results corresponding to the key information in the email text can also include identity forgery information, i.e., whether the sender's identity has been forged. Furthermore, in an optional implementation, identity representation data corresponding to the email to be detected can be retrieved from a preset knowledge base. The target large model analyzes the identity representation data and the key information in the email text to obtain the identity forgery information.

[0062] In this embodiment, the attachment intent information refers to the intent information represented by the attachment. The target large model trained on file anomaly detection can output the file anomaly detection results. These can include file forgery (whether the file is forged) and attachment name anomaly detection. Attachment name anomaly detection can include whether the attachment name is related to the email subject, whether there are suspicious filenames or file extensions, whether there is obfuscation using double file extensions, and whether the file extension does not match the filename, such as an .exe resume document. During training, the labels can include intent labels and labels corresponding to each file anomaly.

[0063] In an optional implementation, the target large model is used to analyze the attachment's key information to obtain attachment intent information and file anomaly information. This may include: scanning the attachment content in the attachment's key information using a preset detection strategy to obtain attack behavior data; analyzing the file characteristics of the attachment's key information, wherein the file characteristics include one or more of the following: file header analysis results, attachment content structure analysis results, and file size analysis results; and using the target large model to analyze the attachment name, the attack behavior data, and the file characteristics to obtain attachment intent information and file anomaly information.

[0064] The preset detection and removal strategy includes one or more of the following strategies: malicious code scanning strategy, heuristic analysis strategy, and sandbox behavior simulation analysis strategy.

[0065] This application embodiment combines static and dynamic analysis. Malicious code scanning: Multiple detection techniques are used to scan attachments to detect the presence of known malicious code. Simultaneously, heuristic analysis techniques (such as rule matching) are employed to determine the presence of potential malicious behavior based on code behavior patterns, instruction sequences, and other characteristics. Behavioral simulation analysis: To more comprehensively assess attachment security, the attachment is simulated and run in an isolated sandbox environment. Within the sandbox, all behaviors during attachment execution are monitored, including file read / write operations, network connection attempts, and system calls. Furthermore, this application embodiment performs file header and structure checks: Based on key attachment information, the file header information is analyzed first. Different file types have specific file header identifiers; by checking whether the file header matches the file extension, a preliminary judgment is made as to whether the file has been tampered with or disguised. Simultaneously, the internal structure of the file is parsed to check for abnormal structural layouts, such as hidden macro code areas in the document or malicious scripts embedded in images. Furthermore, attack behavior data and file characteristics are summarized. This involves organizing and summarizing attack behavior data obtained through various methods such as sandbox detection and local scanning, including target IPs of network connections and abnormal system call functions, as well as file characteristics such as file size changes and abnormal markers in the file's internal structure. This information is then processed into a structured format.

[0066] In this embodiment, the link intent information refers to the intent corresponding to the link, and the link forgery status indicates whether the link is a forged link. The target large model can analyze the layout, style, and content of a webpage based on its content to determine whether page forgery, i.e., website imitation, exists. Furthermore, it can extract the page intent to determine whether the webpage intends to induce users to input sensitive information or perform malicious operations.

[0067] Step S13: Construct prompt information based on the target key information and the analysis results.

[0068] In this embodiment, prompt information can be constructed using a preset format based on key target information and the analysis results.

[0069] In an optional implementation, constructing a prompt message based on the target key information and the analysis results may include: searching for identity representation data corresponding to the email to be detected from a preset knowledge base, wherein the identity representation data is used to compare with the identity information to determine identity forgery; and constructing a prompt message based on the target key information, the analysis results, and the identity representation data.

[0070] In this way, by introducing a pre-set knowledge base, the target large model can acquire more knowledge, thereby identifying whether identity forgery has occurred and improving the accuracy of attack detection.

[0071] Specifically, specific information about the email to be detected can be used for searching, such as searching for identity data based on the sender's email address suffix. Identity data can include the sender's organization and their role within that organization.

[0072] Furthermore, embodiments of this application may also include: if the identity representation data corresponding to the email to be detected cannot be found in the preset knowledge base, then the identity representation data corresponding to the email to be detected is queried from the Internet.

[0073] Specifically, the system can utilize specific information from the email to be detected, such as searching for identity data based on the sender's email address suffix. Network connectivity ensures that the large-scale model receives more comprehensive information, improving the accuracy of attack detection. Information obtained from network queries can be added to the preset knowledge base. Furthermore, the information obtained from network queries can be verified before being added to the preset knowledge base to ensure accuracy. For example, by retrieving external knowledge such as organizational information and identity investigation information related to the email, the large-scale model's knowledge base can be enriched. For instance, retrieving information such as the sender's company's official website and industry background, and comparing it with the email content, can detect fake websites targeting the company and false department information in the body of the email; retrieving the sender's identity information and historical email records can verify the authenticity of the identity claimed in the email. The introduction of external knowledge enables the large-scale model to more comprehensively and accurately understand the background and characteristics of the email, improving the accuracy and reliability of the analysis and providing a basis for determining whether there is a targeted attack.

[0074] Step S14: Input the prompt information into the target big model so that the target big model can perform inference based on the prompt information and obtain the attack detection result corresponding to the email to be detected.

[0075] The attack detection results can include whether it is a targeted attack and the type of targeted attack. Targeted attack types can include identity forgery, website spoofing, body text manipulation, and attachment deception. This application embodiment can use email information training samples to train a large model to obtain a target large model. The annotation information can include labels indicating whether it is a targeted attack and the type of targeted attack. The email information training samples can be constructed based on the target key information, email text key information, attachment key information, and link key information of the email samples to build corresponding analysis results. The analysis results can be output based on the target large model after completing the training sub-task, or they can be constructed manually. The email information training samples can also include identity representation information from a preset knowledge base or searched online, or manually added identity representation information. That is, by constructing data to fine-tune the large model, the model learns these types of targeted attack patterns: identity forgery, website spoofing, body text manipulation, and attachment deception.

[0076] In this way, by combining key target information, analysis results, and external knowledge, a targeted attack is qualitatively identified, and the attack methods and email intent are described. The model comprehensively considers factors such as the semantic information of the email, identity information, webpage information, and the degree of matching between the attack behavior and external knowledge, allowing it to determine whether it is a targeted attack. For example, if the email's subject and body content are highly relevant to the sender's sensitive personal information, and the linked page is highly similar to the sender's company's official website, and the claimed identity in the email does not match the actual identity, and attack behavior is present, then the email can be determined to be a targeted attack.

[0077] As can be seen, this application embodiment extracts key information from the email header and body, as well as key information from attachments and links. These are then analyzed using a target big model to obtain analysis results including intent information. In this way, by performing semantic analysis on the multidimensional information of the email to be detected using the big model, the intent and content meaning of the email to be detected can be accurately obtained, and more concealed malicious information can be identified. Then, the analysis results and multidimensional information are used to construct prompt information. Using the big model for reasoning enables the big model to reason based on richer knowledge, thereby improving the accuracy of attack detection on emails.

[0078] Further, see Figure 2 As shown, Figure 2This diagram illustrates an attack detection method provided in this application embodiment. It utilizes a large-scale model for targeted phishing email attack detection, comprising four modules: a preprocessing module to parse the email, an external knowledge module employing RAG technology, an attachment analysis module responsible for analyzing and detecting attachments, and a large-scale model module using information extraction capabilities to extract key information from the other three modules for final analysis and judgment to determine whether it is a targeted attack. Specifically, the preprocessing module uses an engineering approach to parse the email, performing preliminary processing on the input email, including parsing the email header, extracting the email body text, extracting attachment information, and extracting link information. For the email header, it extracts key fields such as sender, recipient, subject, and validation fields; for the email body, it removes HTML tags and other interfering information, extracting plain text content; for attachments, it extracts information such as attachment name, file type, file size, and file content; for links, it extracts the link address, crawls the page information pointed to by the link, and compresses it; and it renders and extracts links from images and QR codes in the body and attachments, reusing the link processing method. The preprocessed email information is passed to the large-scale model module in the form of structured data. The external knowledge module further enhances the analytical capabilities of the large model by incorporating external knowledge using the RAG method. By retrieving organizational information and identity verification data related to the email, the module enriches the model's knowledge base. For example, by retrieving information such as the sender's company's official website and industry background, and comparing this information with the email content, it can detect fake websites targeting the company and false departmental information in the email body. It can also retrieve the sender's identity information and historical email records to verify the authenticity of the claimed identity in the email. The introduction of external knowledge enables the large model to more comprehensively and accurately understand the background and characteristics of the email, improving the accuracy and reliability of the analysis and providing a basis for determining whether targeted constructs exist.

[0079] Furthermore, the attachment analysis module is used for file header and structure checks: After receiving attachment information from the preprocessing module, it first analyzes the file header information. Different types of files have specific file header identifiers. By checking whether the file header matches the file extension, it initially determines whether the file has been tampered with or disguised. Simultaneously, it parses the internal structure of the file, checking for abnormal structural layouts, such as hidden macro code areas in the document or malicious scripts embedded in images. This combines static and dynamic analysis. Malicious code scanning: Multiple detection techniques are used to scan attachments for known malicious code. Heuristic analysis techniques are also employed to determine potential malicious behavior based on code behavior patterns, instruction sequences, and other characteristics. Behavioral simulation analysis: To more comprehensively test the security of attachments, they are simulated and run in an isolated sandbox environment. In the sandbox, all behaviors during attachment execution are monitored, including file read / write operations, network connection attempts, and system calls. Attack Behavior and File Feature Summary: Attack behavior data obtained through various methods such as sandbox detection and local scanning, including target IPs of network connections and abnormal system call functions, as well as file features such as file size changes and abnormal markers in the file's internal structure, are organized and summarized. This information is then passed to the large model module in a structured format.

[0080] Large Model Module: Various information is input into the large model. The large model performs sub-tasks to extract and analyze information from the email subject, body content, attachment analysis results, and linked webpage content. After integrating this information, a final analysis and judgment are made. The specific process is as follows: Subject and Body Content Analysis: Using natural language processing technology, the semantics of the email subject and body are understood, and key information, such as the intent of the text and the claimed identity, is extracted. For example, it determines whether the email was sent under the guise of internal company notification or business cooperation, and whether the identity is related to the recipient's company or whether there is any communication with the recipient. Attachment Content and Behavior Analysis: The attachment name is analyzed to determine whether it is related to the email subject, whether there are suspicious filenames or file extensions, whether there is confusion or deception using double file extensions, and whether the filename and extension do not match, such as an EXE resume document. Attack behaviors of the attachment analysis module are summarized and analyzed to describe the malicious intent of the email. Linked Webpage Content Analysis: The layout, style, and content of the webpages corresponding to the links crawled by the preprocessing module are analyzed to determine whether there is page forgery, i.e., website spoofing. Extract page intent to determine if the webpage intends to induce users to input sensitive information or perform malicious operations. Comprehensive analysis and judgment: Combine the information extracted from the above subtasks for comprehensive analysis to qualitatively identify targeted attacks and describe the attack methods and email intent. Fine-tune the large-scale model by constructing data, allowing the model to learn these types of targeted attack patterns (identity forgery, website spoofing, body text inducement, attachment deception, etc.). Consider factors such as the semantic information of the email, identity information, the degree of matching between the webpage information attack behavior and external knowledge, and let the large-scale model determine whether it is a targeted attack. For example, if the email subject and body content are highly relevant to the sender's sensitive personal information, and the linked page is highly similar to the sender's company's official website, and the claimed identity in the email does not match the actual identity, and there is attack behavior, then the email can be determined to be a targeted attack.

[0081] This application provides a method for detecting targeted phishing email attacks based on a large-scale model, including email preprocessing, attachment analysis, external knowledge enhancement, and comprehensive large-scale model analysis. It provides a system architecture for implementing the above detection method, comprising an email preprocessing module, a large-scale model module, an attachment analysis module, and an external knowledge module. Furthermore, it utilizes the RAG method to introduce external knowledge to enhance the large-scale model, including retrieving organizational information and identity verification information related to the email, and fusing this external knowledge with the large-scale model analysis results. This allows for multi-dimensional comprehensive analysis, comprehensively analyzing phishing emails from multiple dimensions such as semantics, forgery type, and attack behavior, overcoming the limitations of traditional single-dimensional analysis techniques and enabling a more comprehensive identification of phishing email characteristics and attack intent. By employing a large-scale model and external knowledge fusion approach, combining large-scale model analysis with the introduction of external knowledge, and enhancing the analytical capabilities of the large-scale model through the RAG method, the model can better understand the background and characteristics of the email, improving the accuracy and reliability of the analysis. This application ensures accurate identification of targeted attacks. It can accurately identify whether a phishing email is a targeted attack, effectively distinguishing between targeted attacks and broad-based phishing, providing users with more targeted security protection measures, and making up for the shortcomings of existing technologies in the detection of targeted attacks.

[0082] The solution provided in this application uses a large-scale model to perform semantic analysis on the subject, body, attachment names, and linked webpage content of emails. This allows for the initial identification of email forgery types, including sender identity forgery, linked page forgery, and file forgery. The large-scale model further enhances its analytical capabilities and improves accuracy by incorporating key features such as the extracted sender domain, link domain, and claimed identity, and by introducing external knowledge organization information and identity investigation information. The RAG method is used to summarize and generalize attack behaviors and file characteristics obtained through various methods such as sandbox detection and local scanning. Finally, a comprehensive analysis is conducted to qualitatively identify targeted attacks. This application achieves accurate detection of targeted phishing email attacks through the content recognition, content extraction, and analysis functions of the large-scale model, effectively improving the accuracy and reliability of detection, providing strong support for network security protection, and compensating for the shortcomings of existing technologies. Regarding the depth of semantic analysis: the large-scale model performs in-depth semantic analysis on the subject, body, attachment names, and linked webpage content of emails, accurately grasping the intent and meaning of the email content and identifying more concealed malicious information. This application enhances the breadth of forgery type identification by identifying various types of forgery, including sender identity forgery, link-corresponding page forgery, and document forgery, thus broadening the coverage and effectively improving the accuracy of forgery detection. It also improves the comprehensiveness of attack behavior analysis by combining sandbox detection, local scanning, and other methods to obtain attack behavior source information and conducting comprehensive analysis through a large model. This allows for a more comprehensive understanding of the characteristics and sources of attack behavior, reducing false positives and false negatives. Furthermore, it incorporates external knowledge enhancement capabilities by utilizing the RAG method to introduce external knowledge such as email-related organizational information and identity investigation information, enriching the knowledge base of the large model and making the analysis results more authoritative and reliable. Any method or architecture similar to this application but using other external knowledge enhancements, such as social network information or personal information from terminal devices, is within the scope of protection of this application. Similarly, any method or architecture similar to this application but using other models, such as targeted fine-tuning of models, is within the scope of protection of this application.

[0083] This application addresses the critical challenge of effectively identifying targeted attacks against specific individuals or organizations in current phishing email detection. By leveraging a large-scale model to deeply analyze the semantics, forgery types, and attack behaviors of emails, it accurately identifies targeted attacks. The solution utilizes RAG technology to incorporate external knowledge such as identity and organizational relationships to strengthen the large-scale model, improving the accuracy and comprehensiveness of detection. This solution is adaptable to different customer business scenarios, helping customers quickly locate high-threat targeted phishing emails aimed at them.

[0084] See Figure 3 As shown, this application provides an attack detection device, including:

[0085] Extraction module 11 is used to extract target key information of the email to be detected, wherein the target key information includes at least two types of email text key information, attachment key information and link key information, and the email text key information includes key information extracted from the email header and / or email body.

[0086] Analysis module 12 uses the target big model to analyze the key information of the target and obtains the analysis results, including intent information, of the email to be detected.

[0087] Module 13 is used to construct prompt information based on the target key information and the analysis results;

[0088] The reasoning module 14 is used to input the prompt information into the target large model so that the target large model can perform reasoning based on the prompt information to obtain the attack detection result corresponding to the email to be detected.

[0089] In an optional implementation, the analysis module 12 may specifically include at least two of the following sub-modules:

[0090] The text analysis submodule is used to analyze the key information of the email text using the target large model to obtain the intent information and identity information of the body text;

[0091] The attachment analysis submodule is used to analyze the attachment based on the key information of the attachment using the target large model to obtain the attachment intent information and the file anomaly situation;

[0092] The link analysis submodule is used to analyze the key link information based on the target large model to obtain link intent information and link forgery status.

[0093] In an optional implementation, the attachment analysis submodule can be specifically used to: scan the attachment content in the key information of the attachment using a preset detection strategy to obtain attack behavior data; analyze the file characteristics of the key information of the attachment, wherein the file characteristics include one or more of the following: file header analysis results, attachment content structure analysis results, and file size analysis results; and use a target large model to analyze the attachment name, the attack behavior data, and the file characteristics to obtain attachment intent information and file anomaly information.

[0094] In an optional implementation, the preset detection strategy includes one or more of the following strategies: malicious code scanning strategy, heuristic analysis strategy, and sandbox behavior simulation analysis strategy.

[0095] In an optional implementation, the construction module 13 is specifically used to: search for the identity representation data corresponding to the email to be detected from a preset knowledge base, wherein the identity representation data is used to compare with the identity information to determine the identity forgery situation; and construct prompt information based on the target key information, the analysis results, and the identity representation data.

[0096] In an optional implementation, the construction module 13 can also be used to: if the identity representation data corresponding to the email to be detected cannot be found in the preset knowledge base, then query the identity representation data corresponding to the email to be detected from the Internet.

[0097] In an optional implementation, the extraction module 11 can be specifically used to: extract the link address and the page information to which the link points from the links extracted from the non-explicit link information in the email body and attachments, as well as the explicit links carried in the email body and attachments, to obtain key link information.

[0098] As can be seen, this application embodiment extracts key information from the email header and body, as well as key information from attachments and links. These are then analyzed using a target big model to obtain analysis results including intent information. In this way, by performing semantic analysis on the multidimensional information of the email to be detected using the big model, the intent and content meaning of the email to be detected can be accurately obtained, and more concealed malicious information can be identified. Then, the analysis results and multidimensional information are used to construct prompt information. Using the big model for reasoning enables the big model to reason based on richer knowledge, thereby improving the accuracy of attack detection on emails.

[0099] See Figure 4 As shown in the figure, this application discloses an electronic device 20, including a processor 21 and a memory 22; wherein, the memory 22 is used to store a computer program; the processor 21 is used to execute the computer program, the attack detection method disclosed in the foregoing embodiment.

[0100] For details regarding the specific process of the attack detection method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0101] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, and the storage method can be temporary storage or permanent storage.

[0102] In addition, the electronic device 20 also includes a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26; wherein, the power supply 23 is used to provide operating voltage for the various hardware devices on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0103] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the attack detection method disclosed in the foregoing embodiments.

[0104] For details regarding the specific process of the attack detection method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0105] Furthermore, this application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implements the attack detection method disclosed in the foregoing embodiments.

[0106] For details regarding the specific process of the attack detection method described above, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0107] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0108] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0109] The above provides a detailed description of the attack detection method, apparatus, device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An attack detection method characterized by, The method comprises the following steps: extracting target key information of a to-be-detected email, wherein the target key information comprises at least two of email text key information, attachment key information and link key information, the email text key information comprises key information extracted from a mail header and / or a mail body; analyzing the target key information based on a target large model to obtain an analysis result corresponding to the to-be-detected email and comprising intent information; constructing prompt information based on the target key information and the analysis result; inputting the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information to obtain an attack detection result corresponding to the to-be-detected email.

2. The attack detection method of claim 1, wherein, The analysis result corresponding to the to-be-detected email and comprising intent information is obtained by analyzing the target key information based on a target large model, and the analysis strategy comprises at least two of the following analysis strategies: analyzing the email text key information based on a target large model to obtain text intent information and identity information; analyzing the attachment key information based on a target large model to obtain attachment intent information and file abnormal point information; analyzing the link key information based on a target large model to obtain link intent information and link forgery information.

3. The attack detection method of claim 2, wherein, The analysis result corresponding to the to-be-detected email and comprising intent information is obtained by analyzing the target key information based on a target large model, and the analysis strategy comprises at least two of the following analysis strategies: analyzing the attachment key information based on a target large model to obtain attachment intent information and file abnormal point information, comprising: scanning the attachment content in the attachment key information based on a preset detection strategy to obtain attack behavior data; analyzing file features of the attachment key information, wherein the file features comprise one or more of file header analysis results, attachment content structure analysis results and file size analysis results; 4. The attack detection method of claim 3, wherein, analyzing the attachment name, the attack behavior data and the file features based on a target large model to obtain attachment intent information and file abnormal point information.

5. The attack detection method of claim 2, wherein, The preset detection strategy comprises one or more of a malicious code scanning strategy, a heuristic analysis strategy and a sandbox behavior simulation analysis strategy. The prompt information is constructed based on the target key information and the analysis result, comprising: finding identity representation data corresponding to the to-be-detected email from a preset knowledge base, wherein the identity representation data is used to compare with the identity information to determine identity forgery information; 6. The attack detection method of claim 5, wherein, constructing prompt information based on the target key information, the analysis result and the identity representation data. The method further comprises the following steps:

7. The attack detection method according to any one of claims 1 to 6, characterized by, if the identity representation data corresponding to the to-be-detected email cannot be found from the preset knowledge base, querying the identity representation data corresponding to the to-be-detected email from the Internet. The link key information of the to-be-detected email is extracted, comprising:

8. An attack detection apparatus characterized by comprising: extracting link addresses and page information pointed by links from non-explicit link information in a mail body and attachments, and explicit links carried in the mail body and the attachments to obtain link key information. The method comprises the following steps: An extraction module is configured to extract target key information of a mail to be detected, wherein the target key information includes at least two of mail text key information, attachment key information, and link key information, and the mail text key information includes key information extracted from a mail header and / or a mail body; An analysis module is configured to analyze the target key information based on a target large model to obtain an analysis result including intent information corresponding to the mail to be detected; A construction module is configured to construct prompt information based on the target key information and the analysis result; A reasoning module is configured to input the prompt information into the target large model, so that the target large model performs reasoning based on the prompt information to obtain an attack detection result corresponding to the mail to be detected.

9. An electronic device, comprising: comprising a memory and a processor, wherein: the memory is configured to save a computer program; the processor is configured to execute the computer program to implement the attack detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, configured to save a computer program, wherein the computer program is executed by a processor to implement the attack detection method according to any one of claims 1 to 7.

Images