Target mail detection method, device, equipment, medium and product

Abstract

This application discloses a method, apparatus, device, medium, and product for detecting target emails. The method involves extracting email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include language type and geographic location. Based on the subject of the email to be detected, a semantic vector is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and derived features, behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which indicates whether the language type matches the official common language corresponding to the geographic location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result. The target features include the semantic vector, anomaly degree, and behavioral features. The target email detection model is trained using the target features of multiple sample emails and the category labels of each sample email.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, and in particular relates to a method, apparatus, device, medium and product for detecting target emails. Background Technology

[0002] Email, with its advantages of convenient transmission, low cost, and suitability for office scenarios, has become a core tool for internal and external communication in organizations such as governments, financial institutions, universities, and large and medium-sized enterprises. Because these organizations handle highly sensitive data, have stringent privacy protection requirements, and strong business continuity requirements, their internally circulated official documents, classified documents, financial data, student records, trade secrets, and financial information are all key protected items. Malicious email attacks on these organizations could have serious consequences.

[0003] Current methods for detecting malicious emails typically rely on analyzing the complete email body and attachments. However, in scenarios with strict privacy and compliance requirements, the email body and attachments are often not directly accessible due to security policy restrictions, with only the email header information remaining. Consequently, the accuracy and stability of traditional detection methods significantly decrease under these conditions. Summary of the Invention

[0004] This application provides a method, apparatus, device, medium, and product for detecting target emails, which can improve the effectiveness of malicious email identification.

[0005] In a first aspect, embodiments of this application provide a method for detecting a target email, the method comprising: Extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. Based on the subject of the email to be detected, a semantic vector of the email to be detected is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and the derived features, the behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language of the geographical location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, the anomaly degree and the behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

[0006] Secondly, embodiments of this application provide a target email detection device, the device comprising: The first extraction module is used to extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. The generation module is used to generate a semantic vector of the email to be detected based on the subject of the email to be detected, and to determine the cluster affiliation and anomaly degree of the email to be detected. The second extraction module is used to extract the behavioral features of the email to be detected based on the email header features and the derived features. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographical location. The detection module is used to input the target features of the email to be detected into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, the anomaly degree and the behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

[0007] Thirdly, embodiments of this application provide an electronic device, the device including: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the target email detection method as described above.

[0008] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the target email detection method as described in any of the above claims.

[0009] Fifthly, embodiments of this application provide a computer program product, wherein instructions in the computer program product, when executed by a processor of an electronic device, cause the electronic device to perform the target email detection method as described in any of the above claims.

[0010] The target email detection method, apparatus, device, medium, and product of this application embodiment can extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include language type and geographic location. Based on the subject of the email to be detected, a semantic vector of the email to be detected is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and derived features, behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographic location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result of the email to be detected. The target features include semantic vector, anomaly degree, and behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes detection probability and detection category. The detection probability is used to indicate the probability that the email to be detected is a target email. Thus, in this embodiment, detection is completed using only the email header information, without needing to obtain the email body and attachments, which meets privacy and compliance control requirements. By extracting email header features and derived features from the email header, constructing complete target features and combining them with the model for detection, the problem of decreased detection accuracy and stability of traditional methods in compliant scenarios is effectively solved, and the effect of malicious email identification is improved. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart illustrating a method for detecting target emails provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of the detection system based on semantic clustering and behavioral feature fusion provided in the embodiments of this application; Figure 3 This is a flowchart illustrating another method for detecting target emails provided in an embodiment of this application; Figure 4 This is a schematic diagram of the target email detection device provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0013] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0014] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0015] Email, with its advantages of convenient transmission, low cost, and suitability for office scenarios, has become a core tool for internal and external communication in organizations such as governments, financial institutions, universities, and large and medium-sized enterprises. Because these organizations handle highly sensitive data, have stringent privacy protection requirements, and strong business continuity requirements, their internally circulated official documents, classified documents, financial data, student records, trade secrets, and financial information are all key protected items. Malicious email attacks on these organizations could have serious consequences.

[0016] Current methods for detecting malicious emails typically rely on analyzing the complete email body and attachments. However, in scenarios with strict privacy and compliance requirements, the email body and attachments are often not directly accessible due to security policy restrictions, with only the email header information remaining. Consequently, the accuracy and stability of traditional detection methods significantly decrease under these conditions.

[0017] The acquisition, storage, use, and processing of data in this application comply with relevant national laws and regulations. It should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0018] To address the problems of the prior art, embodiments of this application provide a method, apparatus, device, medium, and product for detecting target emails. The method for detecting target emails provided in this application embodiment will be described first below.

[0019] Figure 1 A flowchart illustrating a target email detection method according to an embodiment of this application is shown. Figure 1 As shown, a method for detecting a target email may include the following steps S101 to S104: S101. Extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. S102. Based on the subject of the email to be detected, generate the semantic vector of the email to be detected, and determine the cluster affiliation and anomaly degree of the email to be detected. S103. Based on the email header features and derived features, extract the behavioral features of the email to be detected. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language of the geographical location. S104. Input the target features of the email to be detected into the preset target email detection model to obtain the detection result of the email to be detected. The target features include semantic vectors, anomalies and behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes detection probability and detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

[0020] The target email detection method of this application embodiment can extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. Based on the subject of the email to be detected, a semantic vector of the email to be detected is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and derived features, behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographical location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, anomaly degree, and behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email. Thus, in this embodiment, detection is completed using only the email header information, without needing to obtain the email body and attachments, which meets privacy and compliance control requirements. By extracting email header features and derived features from the email header, constructing complete target features and combining them with the model for detection, the problem of decreased detection accuracy and stability of traditional methods in compliant scenarios is effectively solved, and the effect of malicious email identification is improved.

[0021] In S101, the aforementioned email header information, referred to as the email header, is a standard metadata area defined by the email transmission protocol. It accompanies the entire process of email transmission, routing, and delivery, independent of the email body and attachments, and records basic email attributes, transmission routes, sender and receiver identifiers, and other information. In privacy compliance management scenarios, this data belongs to publicly available metadata that can be legally collected and retained, and is not subject to access restrictions from the email body and attachments.

[0022] The aforementioned email header features can include Subject, From, To, Send Time, Mail Server, and IP address. The Subject refers to the email title text, used to extract semantics, logical coherence, special characters, and reply / forward identifiers. The From email address is the sender's email address, which can be resolved to the originating domain. The To email address is the recipient's email address. The Send Time can refer to the email delivery timestamp, used to statistically analyze sending frequency, sending intervals, and whether the email was sent at night or on holidays. The Mail Server can contain the addresses and domains of servers involved in the transmission process. The IP address is the originating IP address, used for threat intelligence scoring and geographic location resolution.

[0023] The aforementioned derived features may include the first-time sender identifier. Sending frequency Language type and geographical territory Let 'i' represent the i-th email. The first-time sender identifier is based on the sender information in the email header, compared with historical email records to determine if the sender is appearing for the first time. The sending frequency can be the total number of emails from the same sender as the current email within a past N hours. Language type. It can be based on the character, vocabulary, and sentence structure features of the email subject text to identify the language of the text. Geographical location This could be the geographic information matched after resolving the IP address of the email sender from a database. .

[0024] In some embodiments of this application, email header features and derived features are extracted from the email header information of the email to be detected. For example, this can be done by extracting email header features and derived features from the email header information of the email to be detected based on email system or gateway logs.

[0025] In S102, the aforementioned semantic vector can be a numerical sequence obtained by vectorizing the email subject text, which transforms the subject content described in natural language into structured numerical values, fully preserving the semantic features of the subject, and facilitating computer calculation, comparison and analysis.

[0026] The cluster affiliation mentioned above serves as a unique identifier for the group to which an email belongs after clustering. Based on the email's semantic vector and multi-dimensional features, emails with similar features are grouped into the same cluster. The cluster affiliation is used to label the cluster group corresponding to the current email, reflecting the similarity and association between the email and other samples.

[0027] The aforementioned anomaly score can be used as a quantitative value to characterize how much an email deviates from the normal email feature system. It is calculated by combining the email's semantics, the overall characteristics of its cluster, and the baseline patterns of normal emails, to intuitively reflect the degree of anomaly in the current email's content, behavior, etc.

[0028] In some embodiments of this application, a semantic vector of the email to be detected is generated based on the subject of the email to be detected, and the cluster affiliation and anomaly degree of the email to be detected are determined. For example, the semantic vector of the email to be detected is generated based on the subject of the email to be detected; the semantic vector is clustered to determine the cluster affiliation and confidence degree of the email to be detected; and the anomaly degree of the email to be detected is calculated based on the confidence degree of the email to be detected.

[0029] In S103, the aforementioned behavioral characteristics may include language consistency. Language consistency can be used to indicate whether the language type matches the official common language of the geographical location. In some embodiments of this application, the behavioral characteristics may also include sending behavior information, time-based behavior information, logical coherence, target character detection information, reply / forwarding identifier, and threat intelligence score.

[0030] In some embodiments of this application, behavioral features of the email to be detected are extracted based on the email header features and derived features. For example, if the language type does not match the official language of the geographical location, the language consistency is determined as a first value; if the language type matches the official language of the geographical location, the language consistency is determined as a second value.

[0031] In S104, the above target features This can include semantic vectors, anomaly scores, and behavioral features. In some embodiments of this application, the aforementioned target features can also be weighted with anomaly scores.

[0032] The aforementioned targeted email detection model can be trained using the target features of multiple sample emails and the category labels of each sample email. For example, the targeted email detection model can be trained using an interpretable machine learning model (XGBoost or Random Forest) using the target features of multiple sample emails and the category labels of each sample email. The above detection results may include detection probability and detection category. Detection probability... Used to indicate the probability that the email to be detected is the target email, i.e. .

[0033] Detection categories It can be used to indicate the email to be detected. i For target email Suspicious emails Or normal email In this embodiment, the target email can be malicious. The detection category can classify emails based on a set threshold: It should be noted that the above thresholds are not limited to 0.4 and 0.7, and can be set according to the user's actual needs. No specific limit is set here.

[0034] In some embodiments, the above-described S102 may specifically include: Generate a semantic vector for the email to be detected based on its subject. Cluster the semantic vectors to determine the cluster affiliation and confidence level of the emails to be detected; The anomaly score of the email to be tested is calculated based on the confidence score of the email to be tested.

[0035] In some embodiments of this application, a semantic vector of the email to be detected is generated based on the subject of the email to be detected. For example, the semantic vector of the subject of the i-th email can be generated using a lightweight pre-trained model, SimCSE, based on the subject of the email to be detected. : Where d is the semantic vector dimension (the fixed dimension of the output vector, which is a model hyperparameter, and can be selected as 128 / 256 / 768. The higher the dimension, the more refined the semantic expression, but the greater the computational cost; the lower the dimension, the more lightweight, which is suitable for real-time processing of email security gateways).

[0036] In some embodiments of this application, semantic vectors are clustered to determine the cluster affiliation and confidence level of the email to be detected. For example, this can be done by clustering the entire set of topic semantic vectors. Perform density clustering (such as HDBSCAN) to obtain the cluster affiliation of emails. : The confidence level for cluster affiliation of the email to be detected is 1. .

[0037] In some embodiments of this application, the anomaly score of the email to be detected is calculated based on the confidence score of the email to be detected. For example, the anomaly score of the email to be detected can be calculated according to a preset calculation formula based on the confidence score of the email to be detected. The calculation formula is as follows: .

[0038] In this embodiment, the email subject is first converted into a semantic vector. Cluster analysis is then performed based on the semantic vector. While determining the email cluster affiliation, the cluster confidence score is output simultaneously. Anomaly score is then calculated based on the confidence score. On one hand, using semantic vectors as the basis for clustering accurately mines the semantic similarity of email subjects, making the clustering grouping results more consistent with the actual content characteristics of the emails, resulting in a more reasonable cluster affiliation. On the other hand, introducing cluster confidence score as an intermediate calculation basis quantifies the degree of matching between the email and its respective cluster, thereby deriving the anomaly score. This provides objective data support for the anomaly score calculation, effectively improving the accuracy and reliability of the anomaly quantification results.

[0039] As one implementation of this application, in order to improve the rationality and accuracy of high-risk email anomaly scoring, after calculating the anomaly level of the email to be detected based on the confidence level of the email to be detected, the above method may further include: If the anomaly score is greater than or equal to the preset anomaly score threshold, the weighted anomaly score of the email to be detected is calculated based on the anomaly score, the number of clusters, and the preset adjustment coefficient. The semantic vector, weighted anomaly degree, and behavioral features are concatenated to obtain the target features of the email to be detected.

[0040] The above-mentioned anomaly threshold can be set according to actual application needs, and no specific limitation is made here.

[0041] In some embodiments of this application, the weighted anomaly score of the email to be detected is calculated based on the anomaly score, the number of clusters, and a preset adjustment coefficient. For example, the weighted anomaly score of the email to be detected can be calculated according to a preset calculation formula based on the anomaly score, the number of clusters, and the preset adjustment coefficient. The calculation formula is as follows: in, The cluster size is the number of clusters, and α is an adjustment coefficient (default 0.5 - 1.0).

[0042] In this embodiment, highly anomalous emails are weighted and corrected using the number of clusters and a preset adjustment coefficient to generate a weighted anomaly score. Simultaneously, the weighted anomaly score, topic semantic vector, and multi-dimensional behavioral features are concatenated to construct the final target feature for model detection. Compared to a single basic anomaly score index, this application combines the group distribution characteristics of clusters to perform a secondary correction of the anomaly score, effectively adapting to the sample distribution differences of different cluster groups and avoiding misjudgments and missed judgments caused by a single threshold judgment. This makes the email anomaly quantification results more closely reflect real-world risk scenarios. Furthermore, by fusing features from semantic dimensions, weighted anomaly dimensions, and header behavior-derived dimensions, the deep value of the only obtainable email header information is fully explored, compensating for the lack of feature dimensions caused by the inability to obtain the body text and attachments in compliant scenarios. The target feature after multi-feature fusion has a wider coverage and stronger discriminative power, significantly improving the subsequent model's accuracy in distinguishing between malicious and normal emails, and further enhancing the accuracy and operational stability of email detection in privacy-constrained scenarios.

[0043] In some embodiments, the above-described S103 may specifically include: When the language type does not match the official language of the geographical location, the language consistency is determined as the first value. If the language type matches the official language of the geographical location, the language consistency is determined as the second value.

[0044] The first value mentioned above can be 1, and the second value mentioned above can be 0, for example. In the embodiments of this application, the first and second values ​​are not limited to the above examples, and can also be set according to actual application needs, which are not specifically limited here.

[0045] In some embodiments of this application, when the language type does not match the official common language corresponding to the geographical location, the language consistency is determined as a first value. For example, it could be... .

[0046] In this application, language consistency is quantified by matching language type with geographical location, thus achieving logical consistency verification between the origin of the email and the subject language. This effectively identifies abnormal email sending behavior with language-region mismatch, compensates for the insufficient discrimination capability of a single header feature, supplements the dimension of implicit risk identification, and enhances the feature differentiation of malicious emails in scenarios without a body text.

[0047] In some embodiments, the above-mentioned email header features may further include the sender, mail server, and network protocol address. Specifically, S103 may include: Based on the sender, determine the first-time sender identifier, which is used to indicate whether the sender is appearing for the first time; Based on the sender, the sending frequency is calculated. The sending frequency is used to indicate the total number of emails with the same sender in all emails within a historical period. Based on the sender, mail server, and network protocol address, the number of domain name changes was calculated. The number of domain name changes was one less than the total number of deduplicated domain names. The total number of deduplicated domain names was obtained by analyzing historical emails using the sender's body identifier, which is a combination of the sender's, mail server, and network protocol address. The aforementioned behavioral characteristics may also include sending behavior information, which may include the first sending identifier, sending frequency, and number of domain name changes.

[0048] The aforementioned first-time sender identifier can be used to indicate whether the sender is appearing for the first time, as shown below: .

[0049] The above sending frequency can be used to indicate the total number of emails with the same sender within a historical period, as shown below: .

[0050] The number of domain name changes mentioned above is the total number of deduplicated domain names minus one. The total number of deduplicated domain names is obtained by statistically analyzing historical emails based on the sender's identifier, which is a combination of the sender, mail server, and network protocol address.

[0051] In this embodiment, multi-dimensional sending behavior information is constructed based on the sender, mail server, and network protocol address in the email header. Specifically, the first-time sender identifier identifies risks from unknown new senders, the sending frequency identifies abnormal bulk sending behavior, and the number of domain name changes identifies spoofing behavior by the sender who frequently changes domain names. These multi-dimensional sending behavior features complement each other, effectively enriching the dimensions of sending behavior characterization without relying on the body or attachments for compliance. This overcomes the shortcomings of traditional detection methods, which rely on single features and struggle to identify covert and disguised delivery behaviors, thus improving the accuracy and stability of malicious email detection.

[0052] In some embodiments, the above-mentioned email header features may further include the recipient and the sending time. Specifically, S103 may include: Based on the sender, receiver, and sending time, we statistically obtain nighttime sending identifiers, holiday sending identifiers, and sending interval variance. The nighttime sending identifier indicates whether the sending time falls within the nighttime period, the holiday sending identifier indicates whether the sending time falls on a holiday, and the sending interval variance is calculated by taking the variance of the sending time intervals between multiple historical emails between the sender and receiver. The aforementioned behavioral characteristics may also include time-related behavioral information, which may include nighttime transmission identifiers, holiday transmission identifiers, and transmission interval variance.

[0053] The aforementioned nighttime transmission indicator can be used to indicate whether the transmission time is during the nighttime period.

[0054] The aforementioned holiday sending indicator can be used to indicate whether the sending time is a holiday.

[0055] The above transmission interval variance The variance can be calculated by taking the time intervals between the sending of multiple historical emails between the sender and the receiver, as shown below: .

[0056] In this embodiment, time-based behavioral information is generated using the sender, receiver, and sending time. Off-peak delivery behavior is identified by identifying nighttime and holiday periods, and the sending interval variance characterizes the email sending rhythm. This type of feature expands the detection perspective in the time dimension and, in conjunction with existing sending behavior features, improves the behavioral feature system and enhances the identification effect of various types of malicious emails with time anomalies, all while using only email header information.

[0057] In some embodiments, the above-described S103 may specifically include: Threat intelligence scores are generated by scoring mail servers and network protocol addresses based on a pre-defined threat intelligence database. The threat intelligence database includes mail server and network protocol addresses of multiple historical target emails. The aforementioned behavioral characteristics may also include threat intelligence scoring.

[0058] The aforementioned threat intelligence database may include the mail server and network protocol addresses of multiple historical target emails.

[0059] The threat intelligence score mentioned above directly reflects the overall malicious risk level of the IP address and mail server. Specifically, it indicates... .

[0060] In some embodiments of this application, a threat intelligence score is obtained by scoring mail server and network protocol addresses based on a preset threat intelligence database. For example, this may involve extracting the mail server and network protocol address IP of the email to be detected, performing a search and comparison in the threat intelligence database to determine whether the network asset contains known malicious records; and comprehensively calculating the threat score by combining factors such as whether it hits a blacklist, the number of malicious records, the threat type, and the frequency of historical attacks. Simultaneous hits in both the public database and local malicious records result in the highest risk score; hits from only a single data source result in a score according to the corresponding level; and no malicious matching records result in a basic low-risk score. The final threat intelligence score is then obtained. .

[0061] In this embodiment, a threat intelligence score is calculated from the email server and network protocol address using a threat intelligence database. By incorporating network asset risk attributes into behavioral characteristics, it can efficiently identify historically marked malicious sending nodes, supplement the risk identification dimension, and improve the identification effect of malicious emails in scenarios that only use email header information.

[0062] In some embodiments, the above-described S103 may specifically include: The perplexity of the subject is calculated to obtain the logical coherence of the email to be tested. The theme is converted into a standard theme based on a preset homograph mapping table, which includes mapping relationships between various visually similar characters and standard characters. According to the preset symbol weighting mechanism, weights are assigned to each symbol in the standard subject, and the target characters of the email to be detected are determined. The target characters are symbols with a weight greater than or equal to the preset weight threshold. The symbol weighting mechanism includes the risk level of multiple symbols, and different risk levels correspond to different weights. Based on the number and weight of each symbol in the standard subject, the symbol anomaly score of the email to be detected is calculated. The target character detection information includes the target character and the symbol anomaly score. If the subject includes preset reply characters and / or forwarding characters, the reply forwarding identifier is determined to be a third value; If the subject does not contain reply or forward characters, the reply / forward flag is determined to be the fourth value. The aforementioned behavioral characteristics may also include logical coherence, target character detection information, and reply / forward identifiers.

[0063] The above logical coherence is specifically represented as follows: ,in, Let be the logical coherence of the subject text of the i-th email, and let be a quantitative indicator. : ...

[0064] The aforementioned homograph mapping table can include mapping relationships between various visually similar characters and standard characters. Therefore, by converting a topic to a standard topic according to the preset homograph mapping table, spoofing behaviors such as Cyrillic, Greek, full-width, and zero-width characters can be identified and quantified. Common spoofing examples include А (Cyrillic) → A, 0 (full-width zero) → 0, and U+200B zero-width characters.

[0065] The aforementioned target character detection information may include target character and symbol anomaly scores. The target character can be a symbol with a weight greater than or equal to a preset weight threshold, i.e., an abnormal symbol (such as currency symbols, warning symbols, or consecutive exclamation marks). It should be noted that the weight threshold can be set according to actual needs and is not limited to a fixed value; therefore, no specific limitation is made here.

[0066] The aforementioned symbol weighting mechanism can include risk levels for multiple symbols, with different risk levels corresponding to different weights. Therefore, by using the symbol weighting mechanism to calculate abnormal scores for abnormal symbols, it can be used to reflect potential fraudulent or misleading intentions.

[0067] The above reply forwarding identifier, for example, can be represented as: Among them, 1 is the third value and 0 is the fourth value.

[0068] In this embodiment, logical coherence is obtained through perplexity calculation, and anomaly scores for target characters and symbols are obtained by combining character mapping and symbol weighting mechanisms. A reply forwarding identifier is then generated based on the subject content. This multi-dimensional analysis of hidden abnormal features in the subject effectively identifies malicious situations such as grammatical errors, substitution of similar-looking characters, abuse of high-risk symbols, and spoofed forwarding replies. The entire processing relies solely on the subject data in the email header, adapting to compliance control scenarios, enriching feature dimensions, and strengthening the ability to identify malicious emails.

[0069] As another implementation of this application, for ease of operation and maintenance analysis, after S104 above, the method may further include: Based on the cluster affiliation, anomaly degree, target features, and detection results of multiple emails to be detected, a visualization is generated and output to the display interface for presentation.

[0070] The aforementioned visualizations can, for example, be a traffic distribution map or an anomaly topic heat map. The email traffic distribution map can display email traffic trends and risk distribution using time and cluster affiliation as dimensions; the anomaly topic heat map can display the distribution and popularity of high-risk topics based on semantic clustering and anomaly statistics.

[0071] In some embodiments of this application, the output is displayed on a display interface. For example, it may be displayed on a display interface via a web interface or on the display interface of a security console.

[0072] In this embodiment, after email detection is completed, a visual chart is generated based on the cluster affiliation, anomaly degree, target feature vector, and detection results of multiple emails, and displayed on the interface. By aggregating multi-dimensional detection data to form a visual view, the overall security status of emails, the distribution patterns of similar emails, and the differences in risk levels can be presented intuitively, making it easier for operations and maintenance personnel to quickly locate high-risk emails and trace the source of malicious senders.

[0073] To facilitate understanding of the target email detection method in the embodiments of this application, the actual application process of this target email detection method is described as follows: This application proposes a detection system based on semantic clustering and behavioral feature fusion, applicable to the aforementioned target email detection methods, such as... Figure 2 As shown, the system mainly consists of four modules: email header information parsing module, topic semantic modeling and clustering module, behavioral feature extraction module, and feature fusion and classification determination module.

[0074] The email header parsing module is used to extract and generate structured email header features from the original email header information. The topic semantic modeling and clustering module is used to perform semantic representation, cluster analysis, and calculate semantic anomaly degree of email topics; The behavioral feature extraction module is used to extract multi-dimensional behavioral features from sending behavior, time features, language consistency, special characters, and threat intelligence. The feature fusion and classification module is used to fuse semantic features and behavioral features and output the probability of malicious emails and classification results.

[0075] The specific process is as follows: Figure 3 As shown, its process can be represented as follows: in: This is the final feature vector of the email, equivalent to the target features mentioned above; The probability score for malicious emails is equivalent to the detection probability mentioned above.

[0076] 1. Email header information parsing module Obtain the email header information of the raw email from the email system or gateway logs, and extract the structured email header features: in, Let i represent the set of header features of the i-th email, where i is the email sample number; This represents the subject content of the i-th email; This represents the sender's account and email address for the i-th email. This represents the recipient's email address for the i-th email; This represents the system record sending time of the i-th email; This represents the identifier of the mail service node through which the i-th email originates and to which it belongs; This represents the network IP address corresponding to the sender of the i-th email.

[0077] And the following features are derived: 1.1 First Sending Identifier (Zero-Day Feature): ; 1.2 Sending frequency statistics (past N hours): ; 1.3 Language Information and Geographic Information (i.e., the language type and geographic attributes mentioned above): 2. Topic Semantic Modeling and Clustering Module 2.1 Semantic Vector Generation The lightweight pre-trained model SimCSE is used to generate the topic semantic vector of the i-th email. : Where: d is the semantic vector dimension (the fixed dimension of the output vector, which is a model hyperparameter, and can be selected as 128 / 256 / 768. The higher the dimension, the more refined the semantic expression, but the greater the computational cost; the lower the dimension, the more lightweight, which is suitable for real-time processing of email security gateways).

[0078] 2.2 Semantic Clustering and Anomaly Calculation For the full set of topic semantic vectors Density-based clustering (HDBSCAN) is performed to determine the cluster affiliation of emails. : The confidence level for cluster affiliation of each email is: semantic anomaly Defined as: Email subjects with high anomalousness are more likely to be novel or isolated topics. For short texts or emails with rare topics, the anomalousness can be further weighted to obtain a weighted anomalousness score: in Where α is the cluster size, and α is the adjustment coefficient (default 0.5 - 1.0).

[0079] 3. Behavioral Feature Extraction Module Extracting multidimensional behavioral features from email header features ,include: 3.1 Sending behavior: First shipment identifier Historical frequency Domain stability (number of times the domain name has been changed).

[0080] 3.2 Temporal Behavior: Nighttime transmission indicator, holiday transmission indicator, transmission interval variance ,in: 3.3 Language Consistency: 3.4 Logical coherence: in, The logical coherence of the subject text of the i-th email is a quantitative indicator. : Perplexity, a classic evaluation metric in the field of natural language processing, is used in this application to characterize the fluency and semantic logical rationality of text sentences.

[0081] 3.5 Special Characters Detection: By mapping homographs, we can identify and quantify spoofing behaviors such as Cyrillic, Greek, full-width, and zero-width characters. We can also calculate abnormal scores for anomalous symbols (such as currency symbols, warning symbols, and consecutive exclamation marks) through a symbol weighting mechanism to reflect potential fraud or misleading intentions.

[0082] Common spoofing techniques include А (Cyrillic) → A, 0 (full-width zero) → 0, and U+200B zero-width characters.

[0083] For reply / forward identifiers, define as follows: 3.6 Threat Intelligence Score The sending IP and domain are scored using a threat intelligence database (which may include public databases and historical malicious email records): This score can be used as a weighted factor for behavioral characteristics, dynamically enhancing the ability to identify known attack sources. Threat intelligence can be easily implemented as threshold matching or counting statistics, without the need for complex external integration.

[0084] 4. Feature Fusion and Classification Module The semantic, anomaly, and behavioral features are concatenated to form the final feature vector: Training and prediction are performed using interpretable machine learning models (XGBoost or Random Forest): in: The probability of email malice, i.e., the detection probability mentioned above, is used to classify emails based on a set threshold: in, Indicates the detection category. Indicates malicious email. Indicates suspicious emails. This indicates a normal email.

[0085] 4.1 Model Training and Parameter Description Clustering algorithm: HDBSCAN, min_cluster_size: 5 - 10, min_samples: 1 - 3.

[0086] Classification model: XGBoost, max_depth: 5 - 7, learning_rate: 0.1, n_estimators: 100 - 200.

[0087] Hierarchical cross-validation was employed, and the results were optimized based on F1-score and AUC.

[0088] 4.2 Visualization and Log Output Each email can record cluster ID, anomaly level, feature value, and final malicious probability. It can generate email traffic distribution map and abnormal topic heat map. The output results can be displayed through web interface or security console for easy operation and maintenance analysis.

[0089] In this embodiment, the semantic clustering anomaly of email topics is fused with behavioral features. HDBSCAN clustering is used to discover isolated or novel topics, and the XGBoost classification model, combined with behavioral features such as sending frequency and time distribution, enables effective identification of low-frequency, zero-day, or distributed attack emails. Using the "first-time sender identifier of the day" as a key feature, and comparing sending time series statistics with historical senders, early detection of zero-day attack emails is achieved, improving the ability to identify malicious emails sent by new senders. By performing difference analysis on topic language recognition and sender IP geographic language matching, combined with semantic vector features, cross-language spoofed emails and APT emails targeting specific organizations are effectively identified. A language model is used to quantify the logical coherence of email topics, and combined with short text semantic vector features, anomaly identification is performed on spliced ​​or automatically generated phishing topics, improving the detection rate of semantically anomalous emails. By constructing a homograph mapping table and special symbol weight scoring, visual homographs, zero-width characters, warning symbols, currency symbols, and consecutive exclamation marks are graded and processed, and combined with the classification model output, anomaly identification of spoofed characters or symbols is achieved, reducing false positives. By incorporating the "Re:" or "Fw:" identifiers in email subjects into feature fusion and adjusting the weights of semantic anomalies and behavioral features, false positives for reply / forwarded emails are suppressed, improving overall detection accuracy. Statistical analysis of email sending time distribution identifies patterns of attackers sending emails at night, on holidays, or during specific time periods. Combining time features with semantic anomalies and behavioral features improves the identification rate of malicious emails that circumvent detection rules.

[0090] Based on the target email detection method provided in the above embodiments, this application also provides specific implementations of the target email detection device. Please refer to the following embodiments.

[0091] like Figure 4 As shown, the target email detection device 400 provided in this application embodiment may include the following modules: a first extraction module 401, a generation module 402, a second extraction module 403, and a detection module 404.

[0092] The first extraction module 401 is used to extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. The generation module 402 is used to generate a semantic vector of the email to be detected based on the subject of the email to be detected, and to determine the cluster affiliation and anomaly degree of the email to be detected. The second extraction module 403 is used to extract the behavioral features of the email to be detected based on the email header features and derived features. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographical location. The detection module 404 is used to input the target features of the email to be detected into a preset target email detection model to obtain the detection result of the email to be detected. The target features include semantic vectors, anomalies and behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes detection probability and detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

[0093] The target email detection device of this application embodiment can extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. Based on the subject of the email to be detected, a semantic vector of the email to be detected is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and derived features, behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographical location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, anomaly degree, and behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email. Thus, in this embodiment, detection is completed using only the email header information, without needing to obtain the email body and attachments, which meets privacy and compliance control requirements. By extracting email header features and derived features from the email header, constructing complete target features and combining them with the model for detection, the problem of decreased detection accuracy and stability of traditional methods in compliant scenarios is effectively solved, and the effect of malicious email identification is improved.

[0094] In some embodiments, the generation module 402 described above may specifically include: The generation unit is used to generate a semantic vector of the email to be detected based on the subject of the email to be detected. Clustering units are used to cluster semantic vectors to determine the cluster affiliation and confidence level of emails to be detected. The first calculation unit is used to calculate the anomaly degree of the email to be detected based on the confidence level of the email to be detected.

[0095] As one implementation of this application, in order to improve the rationality and accuracy of high-risk email anomaly scoring, the aforementioned device 400 may further include: The aforementioned first calculation unit is also used to calculate the weighted anomaly of the email to be detected based on the anomaly, the number of clusters, and a preset adjustment coefficient when the anomaly is greater than or equal to a preset anomaly threshold. The concatenation module is used to concatenate semantic vectors, weighted anomalies, and behavioral features to obtain the target features of the email to be detected.

[0096] In some embodiments, the second extraction module 403 described above may specifically include: The first determining unit is used to determine the language consistency as the first value when the language type does not match the official common language corresponding to the geographical location. The aforementioned first determining unit is also used to determine the language consistency as a second value when the language type matches the official common language corresponding to the geographical location.

[0097] In some embodiments, the above-mentioned email header features may further include the sender, mail server, and network protocol address, and the second extraction module 403 may further include: The second determining unit is used to determine the first sending identifier based on the sender. The first sending identifier is used to indicate whether the sender is appearing for the first time. The first statistical unit is used to calculate the sending frequency based on the sender. The sending frequency is used to indicate the total number of emails with the same sender in all emails within a historical period. The second statistical unit is used to count the number of domain name changes based on the sender, mail server, and network protocol address. The number of domain name changes is one less than the total number of deduplicated domain names. The total number of deduplicated domain names is obtained by statistically analyzing historical emails using the sender's body identifier, which is a combination of the sender's, mail server, and network protocol address. The aforementioned behavioral characteristics may also include sending behavior information, which may include the first sending identifier, sending frequency, and number of domain name changes.

[0098] In some embodiments, the above-mentioned email header features may further include the recipient and the sending time, and the second extraction module 403 may include: The third statistical unit is used to calculate the nighttime sending identifier, holiday sending identifier, and sending interval variance based on the sender, receiver, and sending time. The nighttime sending identifier indicates whether the sending time is during nighttime hours, the holiday sending identifier indicates whether the sending time is on a holiday, and the sending interval variance is calculated by taking the variance of the sending time intervals between multiple historical emails between the sender and receiver. The aforementioned behavioral characteristics also include time-related behavioral information, which includes nighttime transmission identifiers, holiday transmission identifiers, and transmission interval variance.

[0099] In some embodiments, the second extraction module 403 may specifically include: The scoring unit is used to score mail servers and network protocol addresses based on a preset threat intelligence database to obtain a threat intelligence score. The threat intelligence database includes mail servers and network protocol addresses of multiple historical target emails, and behavioral characteristics also include threat intelligence scores.

[0100] In some embodiments, the second extraction module 403 may specifically include: The second calculation unit is used to calculate the perplexity of the subject and obtain the logical coherence of the email to be tested. The conversion unit is used to convert the theme into a standard theme according to a preset homograph mapping table, which includes the mapping relationship between various visually similar characters and standard characters; The third determining unit is used to assign weights to each symbol in the standard topic according to the preset symbol weighting mechanism, and to determine the target character of the email to be detected. The target character is a symbol whose weight is greater than or equal to the preset weight threshold. The symbol weighting mechanism includes the risk level of multiple symbols, and different risk levels correspond to different weights. The third calculation unit is used to calculate the symbol anomaly score of the email to be detected based on the number and weight of each symbol in the standard subject. The target character detection information includes the target character and the symbol anomaly score. The fourth determining unit is used to determine the reply forwarding identifier as the third value when the topic includes preset reply characters and / or forwarding characters; The aforementioned fourth determining unit is used to determine the reply-forwarding identifier as the fourth value when the topic does not include reply characters and forwarding characters. The behavioral characteristics also include logical coherence, target character detection information, and reply-forwarding identifier.

[0101] As another implementation of this application, for ease of operation and maintenance analysis, the above-mentioned device 400 further includes: The visualization module is used to generate visualization charts based on the cluster affiliation, anomaly degree, target features, and detection results of multiple emails to be detected, and output them to the display interface for display.

[0102] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0103] An electronic device may include a processor 501 and a memory 502 storing computer program instructions.

[0104] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0105] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 502 is non-volatile solid-state memory.

[0106] In a particular embodiment, memory 502 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0107] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any of the target email detection methods in the above embodiments.

[0108] In one example, the electronic device may also include a communication interface 503 and a bus 510. Wherein, as... Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0109] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0110] Bus 510 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0111] This electronic device can execute the target email detection method described in the embodiments of this application, thereby achieving a combination of Figure 1 and Figure 4 The method and apparatus for detecting target emails are described.

[0112] Furthermore, in conjunction with the target email detection methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the target email detection methods in the above embodiments.

[0113] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the target email detection methods described in the above embodiments.

[0114] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0115] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0116] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0117] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0118] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting target emails, characterized in that, include: Extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. Based on the subject of the email to be detected, a semantic vector of the email to be detected is generated, and the cluster affiliation and anomaly degree of the email to be detected are determined. Based on the email header features and the derived features, the behavioral features of the email to be detected are extracted. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language of the geographical location. The target features of the email to be detected are input into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, the anomaly degree and the behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

2. The method according to claim 1, characterized in that, The step of generating a semantic vector for the email to be detected based on its subject, and determining the cluster affiliation and anomaly degree of the email to be detected, includes: Generate a semantic vector for the email to be detected based on its subject. Cluster the semantic vectors to determine the cluster affiliation and confidence level of the emails to be detected; The anomaly level of the email to be detected is calculated based on the confidence level of the email to be detected.

3. The method according to claim 2, characterized in that, After calculating the anomaly degree of the email to be detected based on the confidence degree of the email to be detected, the method further includes: If the anomaly degree is greater than or equal to a preset anomaly degree threshold, the weighted anomaly degree of the email to be detected is calculated based on the anomaly degree, the number of clusters, and a preset adjustment coefficient. The semantic vector, the weighted anomaly degree, and the behavioral features are concatenated to obtain the target features of the email to be detected.

4. The method according to claim 1, characterized in that, The step of extracting behavioral features of the email to be detected based on the email header features and the derived features includes: If the language type does not match the official language of the geographical location, the language consistency is determined to be a first value. If the language type matches the official language of the geographical location, the language consistency is determined as a second value.

5. The method according to claim 1, characterized in that, The email header features also include the sender, mail server, and network protocol address. The step of extracting behavioral features of the email to be detected based on the email header features and the derived features includes: Based on the sender, a first-time sender identifier is determined, which is used to indicate whether the sender is appearing for the first time; Based on the sender, the sending frequency is calculated, and the sending frequency is used to indicate the total number of emails with the same sender in all emails within a historical period. Based on the sender, the mail server, and the network protocol address, the number of domain name changes is calculated. This number of changes is the total number of deduplicated domain names minus one. The total number of deduplicated domain names is obtained by statistically analyzing historical emails using the sender's body identifier, which is a combination of the sender's name, the mail server, and the network protocol address. The behavioral characteristics also include sending behavior information, which includes the first sending identifier, the sending frequency, and the number of times the domain name has been changed.

6. The method according to claim 5, characterized in that, The email header features also include the recipient and the sending time. The step of extracting behavioral features of the email to be detected based on the email header features and the derived features includes: Based on the sender, the receiver, and the sending time, a nighttime sending identifier, a holiday sending identifier, and a sending interval variance are statistically obtained. The nighttime sending identifier indicates whether the sending time is during nighttime, the holiday sending identifier indicates whether the sending time is a holiday, and the sending interval variance is calculated by taking the variance of the sending time intervals of multiple historical emails between the sender and the receiver. The behavioral characteristics also include time-based behavioral information, which includes the nighttime sending identifier, the holiday sending identifier, and the sending interval variance.

7. The method according to claim 5, characterized in that, The step of extracting behavioral features of the email to be detected based on the email header features and the derived features includes: The mail server and the network protocol address are scored according to a preset threat intelligence database to obtain a threat intelligence score. The threat intelligence database includes the mail server and network protocol addresses of multiple historical target emails, and the behavioral characteristics also include the threat intelligence score.

8. The method according to claim 1, characterized in that, The step of extracting behavioral features of the email to be detected based on the email header features and the derived features includes: The perplexity of the topic is calculated to obtain the logical coherence of the email to be tested. The topic is converted into a standard topic according to a preset homograph mapping table, which includes mapping relationships between various visually similar characters and standard characters; According to a preset symbol weighting mechanism, weights are assigned to each symbol in the standard topic, and the target character of the email to be detected is determined. The target character is a symbol with a weight greater than or equal to a preset weight threshold. The symbol weighting mechanism includes multiple risk levels of symbols, and different risk levels correspond to different weights. Based on the number and weight of each symbol in the standard topic, the symbol anomaly score of the email to be detected is calculated, and the target character detection information includes the target character and the symbol anomaly score; If the topic includes preset reply characters and / or forwarding characters, the reply forwarding identifier is determined to be a third value; If the topic does not include the reply character and the forwarding character, the reply forwarding identifier is determined to be the fourth value. The behavioral characteristics also include the logical coherence, the target character detection information, and the reply forwarding identifier.

9. The method according to claim 1, characterized in that, After inputting the target features of the email to be detected into a preset target email detection model to obtain the detection result of the email to be detected, the method further includes: Based on the cluster affiliation, anomaly degree, target features, and detection results of multiple emails to be detected, a visualization graph is generated and output to the display interface for display.

10. A device for detecting target emails, characterized in that, The device includes: The first extraction module is used to extract email header features and derived features from the email header information of the email to be detected. The email header features include the subject, and the derived features include the language type and geographical location. The generation module is used to generate a semantic vector of the email to be detected based on the subject of the email to be detected, and to determine the cluster affiliation and anomaly degree of the email to be detected. The second extraction module is used to extract the behavioral features of the email to be detected based on the email header features and the derived features. The behavioral features include language consistency, which is used to indicate whether the language type matches the official common language corresponding to the geographical location. The detection module is used to input the target features of the email to be detected into a preset target email detection model to obtain the detection result of the email to be detected. The target features include the semantic vector, the anomaly degree and the behavioral features. The target email detection model is trained by the target features of multiple sample emails and the category labels of each sample email. The detection result includes the detection probability and the detection category. The detection probability is used to indicate the probability that the email to be detected is the target email.

11. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the target email detection method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the target email detection method as described in any one of claims 1-9.

13. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the target email detection method as described in any one of claims 1-9.

Images