Methods, devices, computer equipment, and storage media for identifying phishing emails

Abstract

This application relates to a method, apparatus, computer device, and storage medium for identifying phishing emails. The method includes: responding to an identification request for a current email, extracting key information from the current email, including email content, sender information, and email links; determining prompts to determine whether the current email is a phishing email based on the key information and pre-defined business scenario information, including the enterprise email domain, the email domains of enterprise partners, and the domains of third-party systems of the enterprise; inputting the prompts into a pre-trained phishing email identification model; and verifying the key information based on the prompts using the phishing email identification model to obtain an identification result indicating whether the current email is a phishing email. This method can be adapted to the enterprise's business information, improving the accuracy of identifying whether enterprise emails are phishing emails.

Description

Technical Field

[0001] This application relates to the field of phishing email detection technology, and in particular to a method, apparatus, computer device, and storage medium for identifying phishing emails. Background Technology

[0002] As email has become one of the world's most important tools for business communication and information exchange, cyberattacks against email systems, especially phishing attacks, are showing a surge in numbers and increasingly sophisticated and covert techniques. Phishing emails, as a primary vehicle for social engineering attacks, not only directly lead to the leakage of personal information and financial losses, but are also frequently used as the initial entry point for advanced persistent threat attacks, posing a serious threat to the core data assets and critical infrastructure of enterprises and institutions.

[0003] Currently, phishing email detection techniques primarily rely on static detection methods based on rules and blacklists, which depend on predefined keyword rule bases. The limitation is that these rule bases require continuous manual maintenance and updates, making them unable to adapt to rapidly changing attack methods and leading to inaccurate identification results. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, device, computer equipment, and storage medium for identifying phishing emails that can be adapted to the business information of enterprises and improve the accuracy of identification, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for identifying phishing emails, the method comprising: In response to the current email identification request, extract key information from the current email, including email content, sender information, and email link; Based on key information and pre-set business scenario information, determine the prompt words to identify whether the current email is a phishing email. Business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system. The prompt words are input into a pre-trained phishing email identification model. The phishing email identification model verifies key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

[0006] In one embodiment, based on key information and pre-defined business scenario information, prompts are obtained to identify whether the current email is a phishing email, including: By merging key information with business scenario information, we can obtain prompts for identifying phishing emails.

[0007] In one embodiment, the prompt word is input into a pre-trained phishing email identification model. The phishing email identification model verifies key information based on the prompt word to obtain an identification result as to whether the current email is a phishing email, including: The phishing email identification model is used to analyze the prompt words to extract feature information such as the sender's email domain, email link domain, and email content corresponding to the current email. The sender's email domain is compared with the enterprise email domain and the partner's email domain in the prompt to obtain the sender verification result; The email link domain name is compared with the domain name of the enterprise's third-party system in the prompt to obtain the verification result of the email link. The characteristic information of the email content is compared with the pre-set sensitive words to obtain the verification result of the email content. Based on the pre-trained weight allocation rules, the sender verification results, email link verification results, and email content verification results are weighted and fused to obtain the overall risk value of the current email. The overall risk value is compared with the preset phishing email judgment threshold to obtain the identification result of whether the current email is a phishing email.

[0008] In one embodiment, before obtaining the prompt words for identifying phishing emails based on key information and pre-defined business scenario information, the method further includes: The sender information is identified as being in the sender blacklist, thus obtaining a preliminary identification result of the sender; The system identifies whether the domain name of the email link is on the website domain blacklist, thus obtaining a preliminary identification result of the email link; The prompt words are input into a pre-trained phishing email identification model. The model verifies key information based on the prompt words to obtain an identification result as to whether the current email is a phishing email, including: The initial identification results of the sender, the initial identification results of the email link, and the prompt words are input into the identification model. The phishing email identification model verifies the key information based on the prompt words, and obtains the identification result of whether the current email is a phishing email based on the initial identification results of the sender, the initial identification results of the email link, and the verification results.

[0009] In one embodiment, the method for identifying phishing emails further includes: Update the sender blacklist and website domain blacklist based on the identification results of whether the current email is a phishing email.

[0010] In one embodiment, the method for identifying phishing emails further includes: Construct a phishing email training dataset, which includes normal email samples and phishing email samples labeled with sample tags; Build an initial model for identifying phishing emails; The training dataset is input into the initial model, and the model prediction results are obtained through forward propagation. The loss value is calculated based on the difference between the model prediction result and the corresponding sample label in each round. The parameters of the corresponding model in each round are updated based on the loss value until the loss value converges to a preset threshold or the number of training times reaches a preset number, thus obtaining a pre-trained phishing email identification model.

[0011] In one embodiment, when the current email is in the form of a screenshot, in response to a request to identify the current email, key information in the current email is extracted, including: Use the OCR recognition engine to recognize the text information in the screenshot of the current email; Identify the key information in the current email based on the text information.

[0012] In a second aspect, this application provides a device for identifying phishing emails, the device comprising: The extraction module is used to extract key information from the current email in response to the current email identification request. The key information includes the email content, sender information, and email link. The determination module is used to determine whether the current email is a phishing email based on key information and pre-set business scenario information. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system. The identification module is used to input the prompt words into a pre-trained phishing email identification model. The phishing email identification model verifies key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

[0013] In a third aspect, this application provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the phishing email identification method provided in any embodiment of the first aspect of this application.

[0014] In a fourth aspect, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the phishing email identification method provided in any embodiment of the first aspect of this application.

[0015] The aforementioned methods, devices, computer equipment, and storage media for identifying phishing emails integrate proprietary business scenario information, such as the enterprise's email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party systems, into the prompt word generation process. This achieves the fusion of key email information with enterprise business scenario information, enabling the phishing email identification model to identify based on the enterprise's actual business transactions. It can accurately identify phishing emails that impersonate the enterprise, partners, or third-party systems, adapting to the characteristics of the enterprise's business transactions, improving the targeting of the model's identification, and thus enhancing the accuracy of the model's identification. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a method for identifying phishing emails in some embodiments; Figure 2 This is a flowchart illustrating the steps of a phishing email identification model in some embodiments to determine whether a current email is a phishing email. Figure 3 This is a flowchart illustrating a method for displaying phishing emails in some embodiments; Figure 4 This is a schematic diagram of the interactive interface for identifying phishing emails in some embodiments; Figure 5 This is a structural block diagram of a phishing email identification device in some embodiments; Figure 6 This is a diagram showing the internal structure of a computer device in some embodiments. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] In the first aspect, this application provides a method for identifying phishing emails, such as... Figure 1 As shown, the method is applied to a server as an example, and includes the following steps: Step S11: In response to the current email identification request, extract the key information of the current email, including email content, sender information and email link.

[0019] Here, "current email" refers to the target email to be identified as a phishing email. The "identification request for the current email" is the instruction signal that triggers this method's execution. It can be generated by user-uploaded emails, automatic system detection of suspicious emails, or manual initiation of the identification operation, and is used to request the system to perform the phishing identification process on the current email.

[0020] Key information refers to the core feature information extracted from the current email for phishing email identification; it is the basic data for determining the phishing nature of an email. Key information may also include recipient information, email attachments, etc. Email content refers to the body text of the current email, including the email subject, body text, pop-up notifications, and all other textual content.

[0021] Sender information refers to the information of the current email sender, such as the sender's email address.

[0022] Email links refer to strings containing all accessible network addresses within the current email, including embedded links in the body of the email, links associated with attachments, and links to images, and include elements such as the link domain and access path.

[0023] Specifically, when an employee receives a suspicious email, they can upload it to the server via their terminal. The server receives the email identification request, which carries the email to be identified. This request can be in the form of the original email file, a screenshot, or an email data interface transmission packet. Based on the email's format, the server selects the appropriate information extraction method. If it's the original email file, the server directly extracts the email's metadata and content data using an email parsing program. From the parsed email data, the server selectively extracts sender information, email links, and email content. The extracted sender information, email links, and email content are then integrated into a key information set.

[0024] Step S12: Based on key information and pre-set business scenario information, determine the prompt words to identify whether the current email is a phishing email. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system.

[0025] Among them, business scenario information refers to a set of benchmark information pre-configured based on the target enterprise and related to the identification of phishing emails from that enterprise. It serves as a reference standard for determining whether key information in emails is compliant. Business scenario information may also include information such as the types of emails exchanged between the enterprise and its business correspondence, the enterprise's email address suffix, and the format of enterprise notification emails.

[0026] Prompt words refer to text formed by structuring and organizing key information from the current email with preset business scenario information. These texts are used to guide phishing email identification models to identify phishing emails based on a benchmark information set specific to the target company.

[0027] A corporate email domain refers to the domain used by a target company to build a corporate email system for its employees, and it serves as the basis for determining sender information within the company.

[0028] The email domain of a business partner refers to a trusted email domain that is certified by the business and used by an external entity with which the target business has a formal business relationship. It serves as a reliable benchmark for determining the credibility of sender information from external business partners.

[0029] The domain name of a third-party system refers to the official and trusted domain name of the third-party service system that the target enterprise has partnered with and accessed. It serves as the benchmark for determining the trustworthiness of links related to third-party systems in enterprise emails.

[0030] Specifically, this application can retrieve business scenario information pre-stored in the system database and organize it into categories such as enterprise email domain name database, enterprise partner email domain name database, and enterprise third-party system domain name database. Key information is then structurally decomposed, and the structured key information and business scenario information are pre-processed according to preset rules to generate prompts.

[0031] Step S13: Input the prompt words into the pre-trained phishing email identification model. The phishing email identification model verifies the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

[0032] Among them, the phishing email identification model refers to an intelligent model trained based on machine learning algorithms to determine whether an email is a phishing email. This model is trained using enterprise-specific business scenario information and email samples as training data to identify whether an email is a phishing email.

[0033] The identification result refers to the final judgment output by the phishing email identification model after performing multi-dimensional verification of the key information of the current email based on the input prompt words. It includes binary classification results of phishing emails and legitimate emails.

[0034] Specifically, this application can input the generated prompt words into a pre-trained phishing email identification model. The model performs structured parsing of the prompt words, separating key information and business scenario information. Based on the business scenario information, the model conducts multi-dimensional compliance verification of the key information to obtain the identification result of whether the current email is a phishing email.

[0035] In one embodiment, based on key information and pre-set business scenario information, a prompt word is obtained to identify whether the current email is a phishing email, including: merging the key information and business scenario information to obtain the prompt word to identify phishing emails.

[0036] Specifically, this application can retrieve key information from the current email and organize it into standardized text to be identified, in the form of sender information, email links, and email content.

[0037] Based on business scenario information, standardized baseline information text is compiled according to the formats of enterprise email domains, enterprise partner email domains, and enterprise third-party system domains. Furthermore, these two types of standardized text are merged, and a unified phishing email identification command is added to form a complete phishing email identification prompt.

[0038] The advantage of this embodiment is that it eliminates the need for complex feature extraction and dimension matching of key information and business scenario information. Prompt words can be generated simply by merging and splicing them together, thus achieving rapid generation of prompt words.

[0039] In one embodiment, such as Figure 2 As shown, the prompt words are input into a pre-trained phishing email identification model. The model verifies key information based on the prompt words to obtain the identification result of whether the current email is a phishing email, including: Step S21: The prompt words are parsed using a phishing email identification model to extract feature information of the sender's email domain, email link domain, and email content corresponding to the current email.

[0040] Step S22: Compare the sender's email domain with the enterprise email domain and the partner's email domain in the prompt to obtain the sender verification result.

[0041] Step S23: Compare the domain name of the email link with the domain name of the enterprise's third-party system in the prompt to obtain the verification result of the email link.

[0042] Step S24: Compare the feature information of the email content with the pre-set sensitive words to obtain the verification result of the email content.

[0043] Step S25: Based on the pre-trained weight allocation rules, the sender verification result, email link verification result, and email content verification result are weighted and fused to obtain the comprehensive risk value of the current email.

[0044] Step S26: Compare the comprehensive risk value with the preset phishing email judgment threshold to obtain the identification result of whether the current email is a phishing email.

[0045] The sender's email domain refers to the complete network domain name extracted from the current email sender information.

[0046] The email link domain refers to the complete network domain name that is resolved and extracted from all the network links contained in the current email.

[0047] The feature information of email content refers to the core text features extracted from the current email content for risk assessment, including keywords, semantic expressions, sentence structure features, etc., which are the basic data for determining whether the content is phishing or misleading.

[0048] Sender verification results refer to the judgment results obtained by comparing the sender's email domain with the enterprise email domain and the partner's email domain. These results can be binary classification results, quantitative scores, or risk levels, and are used to characterize the credibility of the sender's identity.

[0049] The verification result of an email link refers to the judgment result obtained by comparing the domain name of the email link with the domain name of the enterprise's third-party system, which is used to characterize the security level of the email link.

[0050] The verification result of email content refers to the matching judgment result obtained by comparing the feature information of email content with preset sensitive words, which is used to characterize the phishing risk of email content.

[0051] Sensitive words refer to a pre-defined set of characteristic words that are highly relevant to phishing emails, including words related to fraud and deceptive business, and serve as a benchmark for judging the risk of email content.

[0052] The weighting rules are pre-defined rules for allocating the importance of each dimension's verification results based on the actual business needs of phishing email identification. They are expressed in the form of weight coefficients and are used to characterize the contribution of each verification result to the overall risk assessment.

[0053] Weighted fusion refers to the process of merging the verification results of sender, email link, and email content according to a preset weighting rule.

[0054] The comprehensive risk value is a quantitative value obtained by weighting and integrating the verification results of various dimensions. It is a comprehensive quantitative representation of the current email phishing risk level. The higher the value, the higher the phishing risk.

[0055] Specifically, this application can receive input prompt words through a phishing email identification model, perform structured parsing on them, separate the current email features to be identified and the preset business scenario benchmark information from the prompt words, and extract the feature information of the sender's email domain, email link domain, and email content in a targeted manner. At the same time, it can extract the preset enterprise email domain, partner email domain, and enterprise third-party system domain from the prompt words.

[0056] The phishing email detection model extracts the sender's email domain and compares it sequentially with the enterprise email domain and partner email domain in the prompt, generating a sender verification result based on the comparison results. The phishing email detection model also extracts the email link domain and compares it with the domain of the enterprise's third-party system in the prompt, generating a verification result for the email link based on the comparison results.

[0057] The phishing email identification model extracts the feature information of the email content and compares it with the sensitive word database pre-set by the system. It counts the number of sensitive words and the degree of matching, and generates the verification result of the email content based on the matching result.

[0058] Furthermore, the pre-trained weight allocation rules are retrieved, and the sender verification results, email link verification results, and email content verification results are converted into unified quantitative scores. These scores are then weighted and fused according to weight coefficients to obtain the overall risk value of the current email. The calculated overall risk value is compared with the system's preset phishing email detection threshold. If the overall risk value is greater than or equal to the phishing email detection threshold, the current email is determined to be a phishing email; if the overall risk value is less than the threshold, the current email is determined to be a legitimate email, and the corresponding identification result is finally output.

[0059] The beneficial effect of this embodiment is that it breaks down phishing identification into three independent dimensions: sender, email link, and email content, and verifies them separately. Each dimension corresponds to exclusive credible benchmark information, enabling targeted judgment of different fraudulent features of phishing emails and solving the problems of missed judgment and false judgment in single-dimensional judgment.

[0060] In one embodiment, before obtaining the prompt words for identifying phishing emails based on key information and pre-set business scenario information, the phishing email identification method further includes: identifying whether the sender information is in a sender blacklist to obtain a preliminary identification result of the sender; identifying whether the domain name of the email link is in a website domain blacklist to obtain a preliminary identification result of the email link; inputting the prompt words into a pre-trained phishing email identification model; and verifying the key information based on the prompt words through the phishing email identification model to obtain an identification result of whether the current email is a phishing email. This includes: inputting the preliminary identification result of the sender, the preliminary identification result of the email link, and the prompt words into the identification model; verifying the key information based on the prompt words through the phishing email identification model; and obtaining an identification result of whether the current email is a phishing email based on the preliminary identification result of the sender, the preliminary identification result of the email link, and the verification result.

[0061] The sender blacklist refers to a pre-configured collection of sender information that has phishing or fraudulent sending characteristics. Its core includes verified phishing sender email addresses, sender email domains, and other information, serving as a benchmark database for rapid risk screening of sender identities.

[0062] Preliminary identification results refer to the risk assessment results obtained after blacklisting and screening sender information and email link domains. These are preliminary risk characteristics for phishing email identification.

[0063] A website domain blacklist is a pre-configured collection of network domains with phishing and malicious access characteristics. It includes verified phishing link domains, malicious website domains, and other information, serving as a benchmark for rapid risk screening of email link security.

[0064] Specifically, this application can extract key information from the current email, retrieve pre-stored sender blacklists and website domain blacklists, and perform consistency matching between the extracted sender information and the sender blacklists. If the match is successful, it is determined that the sender poses a phishing risk, and a preliminary identification result at the sender level is generated; if the match is not successful, it is determined that the sender does not pose a blacklist risk, and a preliminary identification result at the sender level is generated.

[0065] The extracted email links are resolved to obtain the email link domain name. This domain name is then matched against a blacklist of website domain names. If a match is found, the email link is determined to pose a phishing risk, and a preliminary identification result at the email link level is generated. If no match is found, the email link is determined not to pose a blacklist risk, and a preliminary identification result at the email link level is generated.

[0066] Furthermore, the preliminary identification results of the sender, the preliminary identification results of the email link, and the prompt words are integrated and input into a pre-trained phishing email identification model. The model performs structured analysis on the comprehensive input data and makes a comprehensive judgment based on the preliminary identification results of the sender, the preliminary identification results of the email link, and the information in the prompt words, and outputs the final identification result of whether the current email is a phishing email.

[0067] The beneficial effect of this embodiment is that by completing the initial risk assessment of the sender and email link through blacklist matching, high-confidence phishing emails can be quickly identified before in-depth model verification, thereby improving the accuracy of identification.

[0068] In one embodiment, the method for identifying phishing emails may further include updating the sender blacklist and the website domain blacklist based on the identification result of whether the current email is a phishing email.

[0069] Specifically, when the phishing email identification model outputs the final identification result that the current email is a phishing email, it automatically triggers a blacklist update instruction. The server extracts the core risk information corresponding to the phishing email, specifically extracts the sender information and email link domain name, and performs consistency matching verification with the existing sender blacklist. If the sender information is not in the blacklist, it is added to the sender blacklist and marked with the update time and associated phishing email sample identifier. If it already exists, the risk association count and latest hit time of the information are updated.

[0070] Furthermore, the server performs a consistency check between the extracted email link domain and the existing website domain blacklist. If the link domain is not in the blacklist, it is added to the website domain blacklist, along with the update time and associated phishing email sample identifier. If the blacklist already exists, the risk association count and latest hit time for that domain are updated. If the identification result indicates that the current email is a legitimate email, the blacklist update process is not triggered.

[0071] This embodiment drives the dynamic updating of the blacklist through the recognition results, automatically updating the blacklist to quickly adapt to the constantly updated fraud methods of phishing, and avoids the problem of the blacklist failing to screen due to information lag.

[0072] In one embodiment, the method for identifying phishing emails may further include: constructing a phishing email training dataset, the training dataset containing normal email samples and phishing email samples labeled with sample tags; constructing an initial model for identifying phishing emails; inputting the training dataset into the initial model; obtaining the model prediction result through forward propagation; calculating the loss value based on the difference between the model prediction result and the corresponding sample tag in each round; updating the parameters of the initial model based on the loss value; until the loss value converges to a preset threshold or the number of training iterations reaches a preset number, thereby obtaining a pre-trained phishing email identification model.

[0073] Among them, normal email samples refer to email samples collected from actual business transactions of enterprises that are not phishing emails.

[0074] Phishing email samples refer to collected email data with phishing attributes, including emails with phishing characteristics such as impersonating senders, malicious links, and misleading content.

[0075] Sample labels refer to the binary classification category identifiers assigned to each email sample in the training dataset, and serve as a benchmark for the model to determine whether the prediction results are accurate.

[0076] The initial model was an untrained basic network model built to achieve phishing email identification.

[0077] The model prediction result refers to the result of determining the fishing attribute of the sample after the model to be trained performs forward propagation calculation on the input training sample.

[0078] The loss value is a numerical value that quantifies the difference between the model's prediction and the sample's true label. The larger the loss value, the greater the model's prediction bias; the smaller the loss value, the closer the model's prediction is to the true result. It is a core indicator for measuring the model's training effectiveness.

[0079] The parameters of the initial model refer to the various learnable numerical parameters that constitute the network structure of the initial model, including weights, biases, convolutional kernel parameters, fully connected layer coefficients, etc. The loss value is reduced by continuously updating these parameters during training.

[0080] Specifically, this application can collect normal emails and various phishing emails from actual business operations of enterprises, build a phishing email training dataset according to a preset ratio, and match corresponding sample labels for each email sample in the dataset.

[0081] Based on the business requirement of phishing email identification, an initial model was built, including a feature extraction layer, a fusion layer, and a classification output layer. The model's network structure, forward propagation calculation rules, loss calculation method, and parameter update logic were defined, forming a basic model that can accept training dataset input. The labeled phishing email training dataset was input into the built initial model in batches to start the model training process. The model performed forward propagation calculations on each batch of input samples, extracting the core features of the email samples through the feature extraction layer. After processing by the fusion layer, the classification output layer outputs the model prediction result for each sample. According to the preset loss calculation algorithm, such as cross-entropy loss and mean squared error loss, the difference between the model prediction result and the true label of the sample in each round of training was calculated to obtain the loss value for that round of training.

[0082] Furthermore, based on the backpropagation algorithm, the parameters of the initial model are adjusted according to the calculated loss value and preset optimization rules, so that the model is optimized in the direction of reducing the loss value and making the prediction results more consistent with the real labels. The above training steps are repeated to perform multiple rounds of model training, with each round calculated based on the parameters updated in the previous round. After each round of training, it is checked whether the current loss value has converged to the preset threshold or whether the current number of training iterations has reached the preset number of iterations. If the convergence criteria are met, the model training is terminated. The model that has been trained at this time is the pre-trained phishing email identification model.

[0083] The beneficial effects of this embodiment are that the training dataset consists of normal emails and phishing emails from the actual business of the enterprise. The samples are close to the real identification needs of the enterprise, and the trained model can accurately adapt to the business scenario characteristics of the enterprise, greatly reducing the probability of misjudgment in actual application.

[0084] In one embodiment, when the current email is in the form of a screenshot, in response to a request to identify the current email, key information in the current email is extracted, including: The OCR recognition engine is invoked to identify the text information in the screenshot of the current email, and the key information in the current email is determined based on the text information.

[0085] Among them, the OCR (Optical Character Recognition) recognition engine refers to a recognition system that integrates optical character recognition algorithms. It can convert printed / handwritten text information in images into digital text information that can be parsed and edited by computers, and has the functions of image preprocessing, character detection, feature extraction, character matching and recognition.

[0086] Specifically, this application receives a phishing email identification request carrying a screenshot of the current email, confirming that the current email's carrier format is an image screenshot. A preset OCR recognition engine is invoked, and the screenshot image data of the current email is input into the OCR recognition engine. The OCR recognition engine preprocesses the screenshot image, locating the valid areas containing text such as the email subject, sender, body, and links within the email, and removing irrelevant background information from the screenshot. The OCR recognition engine extracts character features from the preprocessed text areas, outputting complete digitized text information corresponding to the screenshot, and determining key information based on the text information.

[0087] Secondly, this application provides a method for displaying phishing emails, such as... Figure 3 As shown, taking the application of this method to a terminal as an example, the steps include: Step S31: In response to the trigger command to identify the current email, submit an identification request for the current email to the server.

[0088] Step S32: The receiving server extracts key information of the current email based on the current email identification request. Based on the key information and the pre-set business scenario information, it obtains prompt words for identifying phishing emails and inputs the prompt words into the pre-trained identification model. After obtaining the identification result of whether the current email is a phishing email, it feeds back the identification result of the current email. The key information includes the email content, sender information and email link. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners and the domain of the enterprise's third-party system.

[0089] Step S33: Display the identification result of whether the current email is a phishing email.

[0090] Specifically, when an employee has received an email that traditional gateway-layer phishing email identification technology cannot identify, the employee can upload a screenshot of the email to the server through the self-service portal on the employee terminal. The server will then automatically run the steps of the phishing email identification method in the various embodiments of the first aspect to obtain the identification result of whether the email is a phishing email, and feed back the identification result to the employee terminal for display.

[0091] In one embodiment, please refer to Figure 4 , Figure 4 This is a screenshot showing the interface of the self-service entry point on the terminal. Figure 4 In the self-service portal, a security Q&A robot provides guiding prompts, allowing employees to upload screenshots of the current email and initiate a request to identify whether the email is a phishing email.

[0092] In another embodiment, this application can also feed back the identification result of whether the current email is a phishing email to the terminal of the enterprise information security personnel, so that the security personnel can perform secondary verification based on the identification result, and can also synchronize with the employees immediately if there is a false alarm.

[0093] In this application, traditional phishing email identification methods or email gateway-based phishing email identification often suffer from missed detections. However, when these missed detections occur, information security personnel or the phishing email identification system maintenance team cannot detect them, nor can they perform feature analysis or optimize detection rules for phishing emails that bypass detection mechanisms. However, the phishing email identification method proposed in this application can upload these missed phishing emails to the server through the terminal's self-service entry point. The server then further identifies the emails and provides feedback on the identification results, forming a comprehensive fallback solution for phishing email protection.

[0094] Secondly, this application provides a device for identifying phishing emails, such as... Figure 5 As shown, the phishing email identification device includes: an extraction module 51, a determination module 52, and an identification module 53, wherein: The extraction module 51 is used to extract key information of the current email in response to the identification request of the current email. The key information includes email content, sender information and email link. The determination module 52 is used to determine whether the current email is a phishing email based on key information and pre-set business scenario information. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system. The identification module 53 is used to input the prompt words into a pre-trained phishing email identification model. The phishing email identification model verifies the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

[0095] In some embodiments, the determination module 52 described above can merge key information with business scenario information to obtain prompts for identifying phishing emails.

[0096] In some embodiments, the aforementioned identification module 53 can parse the prompt words using a phishing email identification model to extract feature information of the sender's email domain, email link domain, and email content corresponding to the current email. The sender's email domain is compared with the enterprise email domain and the partner's email domain in the prompt words to obtain the sender verification result. The email link domain is compared with the domain of the enterprise's third-party system in the prompt words to obtain the email link verification result. The feature information of the email content is compared with pre-set sensitive words to obtain the email content verification result. Based on pre-trained weight allocation rules, the sender verification result, email link verification result, and email content verification result are weighted and fused to obtain the comprehensive risk value of the current email. The comprehensive risk value is compared with a preset phishing email judgment threshold to obtain the identification result of whether the current email is a phishing email.

[0097] In some embodiments, the aforementioned identification module 53 can identify whether the sender information is in the sender blacklist, obtain a preliminary identification result of the sender, identify whether the domain name of the email link is in the website domain blacklist, obtain a preliminary identification result of the email link, input the preliminary identification result of the sender, the preliminary identification result of the email link and the prompt words into the identification model, verify the key information according to the prompt words through the phishing email identification model, and obtain the identification result of whether the current email is a phishing email based on the preliminary identification result of the sender, the preliminary identification result of the email link and the verification result.

[0098] In some embodiments, the identification module 53 described above can also update the sender blacklist and the website domain blacklist based on the identification result of whether the current email is a phishing email.

[0099] In some embodiments, the identification module 53 described above may further: construct a phishing email training dataset, the training dataset containing normal email samples and phishing email samples labeled with sample tags, construct an initial model for identifying phishing emails, input the training dataset into the initial model, obtain the model prediction result through forward propagation, calculate the loss value based on the difference between the model prediction result and the corresponding sample tag in each round, update the parameters of the corresponding model in each round based on the loss value, until the loss value converges to a preset threshold or the number of training iterations reaches a preset number, thereby obtaining a pre-trained phishing email identification model.

[0100] In some embodiments, the extraction module 51 described above can call the OCR recognition engine to recognize the text information in the screenshot of the current email and determine the key information in the current email based on the text information.

[0101] In a third aspect, this application provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the phishing email identification method provided in any embodiment of the first aspect of this application.

[0102] In one embodiment, the computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a method for identifying phishing emails.

[0103] In a fourth aspect, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the phishing email identification method provided in any embodiment of the first aspect of this application.

[0104] The computer-readable storage medium may be Figure 4 The computer-readable storage medium in the computer device shown.

[0105] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0106] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0107] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for identifying phishing emails, characterized in that, The method includes: In response to the current email identification request, the key information of the current email is extracted, including the email content, sender information and email link; Based on the key information and pre-set business scenario information, determine the prompt words to identify whether the current email is a phishing email. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system. The prompt words are input into a pre-trained phishing email identification model. The phishing email identification model verifies the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

2. The method according to claim 1, characterized in that, The step of obtaining prompts to identify whether the current email is a phishing email based on the key information and pre-set business scenario information includes: The key information is combined with the business scenario information to obtain the prompt words for identifying phishing emails.

3. The method according to claim 1, characterized in that, The step of inputting the prompt words into a pre-trained phishing email identification model, and using the phishing email identification model to verify the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email, includes: The phishing email identification model is used to parse the prompt words to extract feature information of the sender's email domain, email link domain, and email content corresponding to the current email. The sender's email domain is compared with the enterprise email domain and the partner's email domain in the prompt word to obtain the sender verification result; The domain name of the email link is compared with the domain name of the enterprise's third-party system in the prompt to obtain the verification result of the email link; The feature information of the email content is compared with pre-set sensitive words to obtain the verification result of the email content; Based on the pre-trained weight allocation rules, the sender verification result, the email link verification result, and the email content verification result are weighted and fused to obtain the comprehensive risk value of the current email. The overall risk value is compared with a preset phishing email determination threshold to obtain the identification result of whether the current email is a phishing email.

4. The method according to claim 2, characterized in that, Before obtaining the prompt words for identifying phishing emails based on the key information and pre-set business scenario information, the method further includes: Identify whether the sender information is in the sender blacklist to obtain a preliminary identification result of the sender; The system identifies whether the domain name of the email link is in the URL domain blacklist, thus obtaining a preliminary identification result of the email link. The step of inputting the prompt words into a pre-trained phishing email identification model, and using the phishing email identification model to verify the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email, includes: The preliminary identification results of the sender, the preliminary identification results of the email link, and the prompt words are input into the identification model. The phishing email identification model verifies the key information based on the prompt words, and obtains the identification result of whether the current email is a phishing email based on the preliminary identification results of the sender, the preliminary identification results of the email link, and the verification results.

5. The method according to claim 4, characterized in that, The method further includes: The sender blacklist and the website domain blacklist are updated based on the identification result of whether the current email is a phishing email.

6. The method according to claim 1, characterized in that, The method further includes: Construct a phishing email training dataset, which includes normal email samples and phishing email samples labeled with sample tags; Build an initial model for identifying phishing emails; The training dataset is input into the initial model, and the model prediction result is obtained through forward propagation. The loss value is calculated based on the difference between the model prediction result and the corresponding sample label in each round. The parameters of the corresponding model in each round are updated based on the loss value until the loss value converges to a preset threshold or the number of training times reaches a preset number, thereby obtaining the pre-trained phishing email identification model.

7. The method according to claim 1, characterized in that, When the current email is in the form of a screenshot, the step of extracting key information from the current email in response to the current email recognition request includes: The OCR recognition engine is invoked to recognize the text information in the screenshot of the current email; The key information in the current email is determined based on the text information.

8. A device for identifying phishing emails, characterized in that, The device includes: The extraction module is used to extract key information of the current email in response to the identification request of the current email. The key information includes email content, sender information and email link. The determination module is used to determine whether the current email is a phishing email based on the key information and pre-set business scenario information. The business scenario information includes the enterprise email domain, the email domain of the enterprise's partners, and the domain of the enterprise's third-party system. The identification module is used to input the prompt words into a pre-trained phishing email identification model, and the phishing email identification model verifies the key information based on the prompt words to obtain the identification result of whether the current email is a phishing email.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images