AUTOMATED SYSTEM FOR ANALYZING THE ACTIONS OF A USER REMOTELY CONNECTED TO A SERVER

Abstract

The invention relates to an automated analysis device (60) for the actions of a user remotely connected to a server (14), comprising a capture tool (61) for capturing at least one image of a session of said user, said capture tool (61) being controlled asynchronously by the detection of the use of at least one predefined command; said analysis device (60) comprising: - a transcription tool (62) for transcribing into text the at least one image captured by the capture tool (61), - an analysis tool (63) for detecting at least one predetermined string of characters within the text captured by the transcription tool (62); and - a characterization tool (64) for at least one action performed by the user based on said at least one detected string of characters. Figure 1.

Description

Title of the invention: SYSTEM FOR AUTOMATED ANALYSIS OF THE ACTIONS OF A REMOTELY CONNECTED USER ON A SERVER Field of invention

[0001] The invention relates to a system for automated analysis of the actions of a user connected remotely to a server. The invention makes it possible, for example, to characterize the actions of a hacker connected to a server.

[0002] The invention finds a particularly advantageous application for improving the speed of analysis of actions perpetrated by computer hackers and for example recorded by a computer intrusion recording device.

[0003] Thus, the invention can be used mainly in the technical field of computer security and more particularly in the analysis of computer attacks with a view to activating effective countermeasures to these attacks and possibly prosecuting those responsible. State of the art

[0004] The Applicant is developing particularly relevant solutions for capturing the actions of a hacker without their knowledge. To this end, patent FR3079642 describes the use of a decoy server with an IP address referenced on a domain name system to attract hackers to connect to this server while believing that they can perpetuate illegal activities with impunity. In addition to this first innovation, the Applicant has also filed patent EP 3 644 146 which describes the recording of a user's actions on a server making it possible to capture a video of a hacker's actions and possibly to record the user's keyboard keystrokes.

[0005] These innovations of the Applicant are so effective that in just a few years, and with less than ten decoy servers, the Applicant was able to capture millions of hours of recordings of hacker actions.

[0006] However, hackers commit very heterogeneous crimes and it is important to distinguish the nature of these crimes in order to act quickly, particularly when the safety of people is at risk.

[0007] Indeed, when a hacker is connected to a decoy server, he can carry out a large number of malicious actions and the Applicant is faced with a problem of analysis and characterization of the actions carried out by these hackers to inform the right people depending on the misdeeds committed.

[0008] Typically, when a hacker attempts to deploy a crypto virus on a company server, you should contact the company's IT administrator. For another example, when a hacker attempts phishing attacks on the inboxes of university students, you should contact the university's IT administrator.

[0009] To characterize the actions of hackers and quickly contact the right people, it is now necessary to ask operators to view recordings representing the periods in which a hacker connected to a decoy server. This manual work is particularly long and tedious, so much so that it may be necessary to wait several hours or several days before a recording can be analyzed and processed by an operator, particularly when numerous recordings are captured simultaneously. However, certain political tensions lead to occasional increases in the number of computer intrusions on decoy servers, for example in times of digital warfare.

[0010] To solve this problem of characterizing the actions of a hacker, or even of any user connected to a server, it would be possible to transcribe all the text present on each image of the recordings using OCR tools. However, the data generated by this type of method would be too large and this solution would present a problem of interpretation and storage of the information generated.

[0011] It would also be possible to sample the captured video stream in order to transcribe the image into text every minute or every 10 minutes, for example. This solution would limit the volume of data generated but would risk providing an analysis for which certain misdeeds by hackers escape analysis, when they are committed between two moments of image transcription.

[0012] The technical problem of the invention is therefore to determine how to automate the analysis of actions carried out by a user on a server, for example to automatically analyze the actions of a hacker on a decoy server. Presentation of the invention

[0013] To address this technical problem, the invention proposes detecting specific commands carried out by the user and transcribing the images into text only when a specific predefined command has been detected.

[0014] For example, it is possible to define these predefined commands as the user pressing the "enter" or "tab" keys on the keyboard or a mouse click. Thus, each time the user presses one of these keys or a mouse click, an image of the user's session is captured and transcribed to the text format using a transcription tool, for example OCR.

[0015] OCR allows all the character strings present in an image to be transcribed into text format and it is therefore possible to capture URLs entered in a browser, lines used in a command prompt or even the entire content of an email written by a user.

[0016] For example, if a hacker uses stolen bank cards to make fraudulent orders on a merchant site, he must write or copy / paste all the bank card information and, when he presses the "enter" or "tab" keys to change fields, the information written or copied by the hacker is captured and transcribed into text.

[0017] Following this asynchronously generated transcription, i.e. following the detection of the use of a predefined command by the user, the entire transcribed text can be analyzed to detect predetermined character strings. This detection of predetermined character strings can be carried out using an expression of the “preg_match” type.

[0018] For example, character strings similar to a URL, credit card numbers, postal codes, internet addresses, email addresses or even bank account numbers can be searched for. The detection of a URL can be carried out by searching for a character string containing the character sequences "uri", " / / " or "www".

[0019] The discovery of a bank card number can be conditioned by the detection of a character string of 16 digits while the discovery of a postal code can result from the detection of a character string of exactly 5 digits. To detect an internet address, or IP address, 4 character strings of 3 digits linked by "." can be searched for an IPv4 address and a set of 8 character strings linked by ":" can be associated for an IPv6 address. An email address can be detected by a character string containing a "." and an "@". In the same way, to detect a French bank account number in the IB AN format, a character string containing 2 letters followed by 23 digits is searched.

[0020] When these predetermined character strings are detected, it is possible to create scenarios for analyzing user actions based on the identified character strings.

[0021] For example, when it is identified that the user has downloaded software in ".exe" format and launches the execution of this software in a command prompt, a scenario can be created in which the name of the executed computer program is searched in a database.

[0022] If this computer program name corresponds to ransomware or software cryptocurrency mining, the user's action can be characterized in a category corresponding to a category of "direct hacking".

[0023] Furthermore, if the name of the software used is associated with brute force or DDOS attacks, the user's actions can be characterized as "indirect hacking" actions.

[0024] For another example, if bank card numbers or bank account numbers are detected, "fraud actions" can be analyzed and the name of the merchant website can be searched to automatically contact the known IT administrator for that merchant site.

[0025] In another example, if a large number of emails are detected, phishing-type "fraud actions" can be characterized and an informational email can be automatically transmitted to all targets of the attack.

[0026] In addition, the texts resulting from the OCR of the various images of the user's session can be used as a means of proof of the misdeeds committed by a hacker and can feed a search engine. Furthermore, the texts resulting from the OCR can be automatically translated, for example by identifying the keyboard language used by the user.

[0027] Furthermore, in the entire captured video stream, a part of the video stream may correspond to a “fraudulent action” while another part of the video stream may correspond to attempts at “direct piracy” or “indirect piracy”. Thus, for the same video, several characterizations may be detected for distinct moments of the video and the latter may be cut to associate each part with the associated characterization.

[0028] To conclude, the invention proposes to use several tools: - a tool for capturing an image of a user's session controlled asynchronously by detecting the pressing of a predefined command, for example the enter command or the tab command on the keyboard or a mouse click; - a tool for transcribing into text the image captured by the capture tool; - a tool for analyzing predetermined character strings within the text captured by the transcription tool; and - a tool for characterizing actions performed by the user based on the character strings detected.

[0029] To conclude, the invention makes it possible to automate the detection of the actions of a user connected to a server, in particular the actions of hackers, so as to be able to inform more quickly and more effectively the victims of fraud or attempted hacking and the competent authorities. Summary description of the figures

[0030] The manner of carrying out the invention as well as the advantages which result therefrom will emerge clearly from the following embodiments, given for informational but non-limiting purposes, with the support of the figures in which:

[0031] [Fig-1] [Fig.l] is a schematic representation of an information system equipped with a device for automated analysis of the actions of a user connected remotely to a server according to one embodiment of the invention;

[0032] [Fig.2] [Fig.2] is a flowchart of the steps involved in creating the computer intrusion recording device of [Fig.l]; and

[0033] [Fig.3] [Fig.3] is a schematic representation of an information system provided with a device for automated analysis of the actions of a user connected remotely to a server according to another embodiment of the invention. Detailed description of the invention

[0034] In the following description, the Internet addresses are presented in a form corresponding to the IPv4 protocol, that is to say the fourth version of the Internet protocol with four series of numbers connected by periods. Alternatively, other protocols can be used without changing the invention, in particular the IPv6 protocol.

[0035] [Fig.l] illustrates a computer system of a company 23 integrating a computer intrusion recording device 10. The computer system comprises a server 20 hosting a website of the company 23 and a server 21 managing the electronic messages of the company 23. These two servers 20-21 are hosted by service providers of the company 23 and they are not located in the premises of the company 23

[0036] The company 23 also includes a file server 22 hosted and managed internally by the company 23. Using the Internet network 13, the server 20, hosting the website, is accessible from the Internet address 24 zz.zz.zz.zz. The server 21, managing electronic messages, is accessible from the Internet address 25 yz.yz.yz.yz and the file server 22 is accessible from the Internet address 26 xx.xx.xx.xx.

[0037] These actors are referenced in a domain name system 12 in which a line L1 concerns the definition of the file server 22, a line L2 concerns the definition of the messaging server 21 and a line L3 concerns the definition of the server hosting the Internet site 22.

[0038] This conventional structure is described solely by way of example. In this example, the invention is presented in the context of the digital security of a company 23. Alternatively, such computer security can be implemented to protect all types of computer systems, for example computer systems present in communities.

[0039] In addition to these conventional elements of a computer system, the computer system of [Fig.l] comprises a computer intrusion recording device 10 comprising an application server 14 serving as a decoy accessible from an Internet address 11 yx.yx.yx.yx and associated with a recording server 40 configured to record computer intrusions on the application server 14, for example a device as described in patent EP 3 644 146.

[0040] The method for creating this computer intrusion recording device 10 is described with reference to [Fig. 2]. In a first step 50, the application server 14 is created to be accessible from an Internet address 11. Preferably, a Microsoft® server is used. Furthermore, the Internet address 11 is chosen so as to correspond to a geographical location in the same country, or even in the same region as the company 23.

[0041] When the application server 14 is created, it is configured in a step 51 by activating services 15 which are often targets of hacking.

[0042] To create an effective decoy server, at least one activated service 15 is a service 16 allowing remote control of the application server 14 to be taken, such as the “RDP” service. By activating this remote control service 16, an access code is requested. It is preferable to take a particularly weak access code for this remote control service 16, for example a default code of the “admin / admin” type.

[0043] When the remote control service 16 is activated, it must be configured. For this purpose, in a step 52, the default access port to this remote control service 16 can be modified so that the remote control service 16 is associated with a listening port 30, for example by using the listening port 30 TCP 3390 instead of the default port TCP 3389.

[0044] Then, it is possible to modify the functionalities of the remote control service 16 to constrain the actions of the hacker, for example by removing the possibility of performing copy / paste and local drive uploads via the “remote desktop” protocol in the interface of the remote control service 16.

[0045] The purpose of this system, the subject of patent EP 3 644 146, is to record the actions carried out by the hacker on the application server 14. To do this, a recording server 40 is implemented in a step 53. This recording server 40 is associated with a database 41 so as to store the actions carried out by the hacker on a server independent of the application server 14.

[0046] To carry out this recording, a service is activated on the recording server 40 and the recording can be carried out in the form of a hacker activity log. computer integrating all the commands used by the hacker.

[0047] Preferably, the recording server 40 makes a video recording of the actions performed on an interface of the remote control service 16 of the application server 14.

[0048] In addition to recording, the recording server 40 may implement an identification of the actions of the hacker or the connection information used by the hacker.

[0049] When the recording server 40 is operational, the application server 14 can be modified to create a virtual port 31 in a step 54. Preferably, this virtual port 31 corresponds to the default port of the remote control service 16, for example the TCP port 3389. A phantom service 17 is then created on the application server 14 to make the link between this application server 14 and the recording server 40. This phantom service 17 listens on the TCP port 3389, sends the video stream and the keystrokes to the recording server 40 and redirects the initial stream to the TCP port 3390 of the application server 14.In addition to the video stream and keystrokes, the ghost service 17 can send to the recording server 40 the contents of the clipboard, in particular text or an image, and / or the files and folders exchanged between the user's terminal and the application server 14, and / or the URLs of Internet streams leaving the application server 14. This service 17 is called a ghost service because it must not be detected by the hacker. To do this, it can be hidden or have a generic name.

[0050] The phantom service 17 does not modify the content of the information arriving on the virtual port 31 before retransmitting it on the listening port 30 so that the hacker finds a traditional user experience.

[0051] [Fig. 3] illustrates a computer system of a company 23 integrating a computer intrusion recording device 10, an alternative to the system illustrated in [Fig. 1]. The computer system illustrated in [Fig. 2] is similar to that of [Fig. 1], from which it differs in that the recording server 40 is positioned as a proxy on the network, in isolation from the application server 14. In this system, the default access port to the remote control service 16 of the application server 14 is not modified, the listening port 30 remains the default TCP port, port 3389. There is not necessarily a phantom service implemented on the application server 14. The recording server 40 listens on TCP port 3389, records the video stream and keystrokes, and redirects the initial stream to TCP port 3390 of the application server 14.In addition to the video stream and keystrokes, the recording server 40 can record the contents of the clipboard, in particular text or an image, and / or the files and folders exchanged between the user's terminal and the application server 14, and / or the URLs of Internet streams leaving the application server 14. The absence of a virtual port and a phantom service makes it more difficult for the user to detect the fact that their actions on the application server 14 are recorded.

[0052] In order for this application server 14 serving as a decoy to be easily detectable by a hacker, a step 55 consists of modifying the domain name system 12 to indicate the presence of the application server 14 on the information system. To do this, a line L4 is added to the domain name system 12 by referencing the Internet address 11 of the application server 14 serving as a decoy.

[0053] In the description of the application server 14 serving as a decoy, it can be defined that the application server 14 corresponds to a Microsoft® server and that the application server 14 is used with remote control services 15.

[0054] In the example of [Fig. 1], line L4 is defined using the description "crm" to describe the activity of the application server 14. This description "crm" corresponds to a customer relationship management server. This type of server centralizes a large amount of information on a company's customers and products in order to create a personalized offer for each customer based on their needs. A customer relationship management server is often implemented on a Microsoft® server with a number of important services, including services allowing remote access. Thus, a hacker who detects this description "crm" in the domain name system 12 should have a strong incentive to attempt an intrusion on the server associated with this description "crm".

[0055] Furthermore, in the definition of the domain name system 12, it is possible to associate the access ports with each service 15 of the application server 14. By indicating that the access port to the remote control service 16 corresponds to the virtual port 31, the hacker will attempt to access the remote control service 16 only through the virtual port 31.

[0056] Thus, only the virtual port 31 is exposed on the Internet for the remote control service 16 and a remote analysis of this service with Telnet type tools returns a response identical to the default port of the remote control service 16. The listening port 30 of the remote control service 16 is therefore not exposed on the Internet, which makes the decoy undetectable from the Internet.

[0057] The retransmission of the video stream on the recording server 40 by the phantom service 17 therefore makes it possible to record the actions of the hacker on the recording server 40 without the hacker's knowledge.

[0058] The present invention proposes a device 60 for automated analysis of the actions of a user connected remotely to a server. The automated analysis device 60 can be integrated into the computer system of [Fig.l], and described above, by example implemented on the recording server 40, or on an analysis server separate from the recording server 40.

[0059] The automated analysis device 60 can also be integrated into any other computer system comprising at least one server to which a user, malicious or not, could connect, for whom it is desired to characterize the actions.

[0060] According to the invention, the automated analysis device 60 comprises a tool 61 for capturing at least one image of a session of a user connected remotely to a server, in particular an image of the graphical interface of this remote access tool. The capture tool 61 is controlled asynchronously, by detecting the use of a predefined command such as a keyboard command “Enter” or “Tab”, or even a mouse click.

[0061] Preferably, the capture tool 61 is hosted on a server separate from the server to which the user is connected. The capture tool 61 operates from the video stream of the graphical interface of the user's session, and from the stream of commands performed by the user, such as keyboard and mouse commands, temporally associated with the video stream. The video and command stream may, for example, be retrieved by a phantom service 17, typically a Microsoft® Windows® service or a Linux daemon installed on a recording server system 40. The capture tool 61 may process this information in real time, i.e. immediately after it has access to it, or it may process it with a certain delay, for example if it does not have computing resources available to process it immediately.Furthermore, the capture tool 61 can be configured to process all video streams captured by one or more application servers 14 serving as decoys.

[0062] From the video streams and the detection of the predefined commands, the capture tool 61 therefore extracts images from the video stream, these images corresponding to the times at which the predefined commands in the capture tool 61 were used by the user.

[0063] When at least one image is extracted by the capture tool 61, this image is processed by a transcription tool 62, which detects the text present in the image and extracts it by one of the known OCR methods.

[0064] This transcription tool 62 can be implemented in the same program as the capture tool 61 or in an independent program, typically a Microsoft® Windows® service or a Linux daemon installed on a system of the recording server 40. Furthermore, the capture tool 61 and the transcription tool 62 can be implemented on two separate servers.

[0065] As for the transcription carried out, it can implement an optical character recognition algorithm such as Tesseract, Google® Cloud Vision or still Amazon Textract®.

[0066] The texts extracted by the transcription tool 62 can be translated by an automatic translation tool, such as Google® Translate or Deepl®. The original language can be automatically detected by the transcription tool 62, or it can be determined by the language of the keyboard used by the user.

[0067] Furthermore, an image description algorithm can also be implemented at the same time as character recognition to enable participation in the characterization of the user's actions. Such an algorithm generates, from the image, a set of keywords listing the elements that it has identified there, or for the most sophisticated, sentences describing the image, describing for example the arrangement of these elements in the image. This image description can for example make it possible to detect whether the user is using a browser, and in this case what type of site he is browsing, for example the Internet site of a bank, or a merchant site. It can also be detected that the user is using a command prompt.

[0068] Microsoft® Seeing AI software can, for example, be used to generate a text description of a graphic image.

[0069] The extracted text is then analyzed by an analysis tool 63, which compares it to character strings of predetermined types, in order to detect particular information such as bank account numbers, bank card numbers, postal codes, telephone numbers, e-mail addresses, IP addresses, etc. To search for these character strings, the analysis tool 63 can use an expression of the “preg_match” type.

[0070] The analysis tool 63 is preferably associated with a management interface allowing an administrator to define the information sought and the search strategies used. For example, when the administrator configures the analysis tool 63 to search URLs, he can set up a search strategy for a character string containing the character sequences “url”, “ / / ” or “www”. In addition, a lot of information can be searched simultaneously and the administrator can also set up a search strategy for one or more of the following elements: - a 16-digit character string to detect bank card numbers, - a string of exactly five digits to detect a postal code, - a set of four strings of three digits linked by "." to detect an IPv4 internet address, - a set of eight character strings linked by “.” to detect an IPv6 internet address, - a character string containing a “.” and an “@” to detect an email address - a character string containing 2 letters followed by 23 digits to detect a French account number in IB AN format, and / or - a string of characters starting with a “+” and followed by 11 digits or with a “0” and followed by 9 digits to detect a telephone number.

[0071] The analysis tool 63 can be configured to take into account the results of an image description algorithm generated by the transcription tool 62. This allows the analysis tool 63 to operate according to the most relevant search strategy possible, for example by directing the detection as a priority towards certain types of character strings. For example, if a bank site is open, an account or bank card number can be searched for as a priority. This orientation of the search strategy can be automated, or it can be a recommendation subject to validation by a human administrator, for example on the management interface mentioned above.

[0072] Depending on the types of character strings detected, a characterization tool 64 then determines the type of action that the user is probably performing: fraud, phishing, ransomware, launching of cryptocurrency mining software, brute force attack, DDOS, etc.

[0073] For example, if it is identified that the user has downloaded software in “.exe” format and launches the execution of this software in a command prompt, the characterization tool 64 can search for the name of the executed computer program in a database. If the name of the executed computer program corresponds to ransomware or cryptocurrency mining software, the user's action can then be characterized in a category corresponding to a “direct hacking” category. In other cases, if the name of the software used is associated with brute force or DDOS attacks, the user's action can be characterized as an “indirect hacking” action.

[0074] The characterization tool 64 can also be configured so that if a bank card number or a bank account number and a merchant website are detected, the user's action can be characterized as a "fraud" action. The name of the merchant website can then be searched to automatically contact the IT administrator known for this merchant site and send them a report.

[0075] The characterization tool 64 can further be configured so that when the number of detected emails is greater than a threshold, for example 20 email addresses for an image, the user's action can be characterized as being a phishing-type “fraud” action. An information email can then be transmitted to the automatically to all targets of the attack.

[0076] After characterizing a user's attack, a report may be sent to certain key people, for example the administrator of a website, or the IT manager of a company or institution, or in some cases to the relevant law enforcement agencies. In some cases, the report may be sent automatically, while in other cases, an administrator may decide whether or not to send a report on the management interface.

[0077] All of the texts from the transcription tool 62, or a portion of them, can be stored in a database that can be consulted by a search engine. Thus, it is possible for presumed victims of attacks, administrators of merchant sites, police officers, or even judges to verify the actions carried out during a computer intrusion. This database is preferably capable of associating a time stamp as well as images or even a video sequence with the texts. These provisions are particularly useful when an attack has been perpetrated but has not been correctly characterized by the system, or when the report has not been properly sent, received, or processed. Using the database, it is then possible to find the evidence and possibly identify the hacker behind the attack.

[0078] The database can also be used to trigger alerts when certain keywords are captured by the capture tool 61.

[0079] Once the images have been extracted from the video stream by the capture tool 61, the video stream from which they originate can be deleted, in order to optimize storage space, or it can be retained, in order to preserve possible opposable evidence in the event of legal proceedings or for any other reason. In a preferred embodiment of the invention, the decision whether or not to retain the video stream is only taken after the characterization tool 64 has been able to characterize or not the user's actions. Thus, in the absence of characterization, or for example if the characterization tool 64 considers that it is a benign attack, the analysis device 60 can be configured to delete the video stream. On the contrary, in the event of characterization of a serious attack, the video stream can be retained in order to be able to serve as a means of proof.This conservation may be conditioned by a manual verification step, involving a human operator using, for example, the management interface used to configure the analysis tool 63.

[0080] The invention thus makes it possible to induce a hacker to penetrate an application server 14 serving as a decoy in order to record these actions, and to characterize them automatically. This approach is the opposite of existing approaches which aim to limit the possibilities of actions of hackers. Indeed, in the approach of the invention, the hacker is encouraged to perpetrate acts of hacking in a controlled context conducive to unmasking him. The invention also helps to build a knowledge base on cyber threats.

Claims

Claims

1. Device for automated analysis (60) of the actions of a user connected remotely to a server (14) serving as a decoy comprising a tool for capturing (61) at least one image of a session of said user, characterized in that said capturing tool (61) is controlled asynchronously by detecting the use of at least one predefined command; in that said analysis device (60) comprises: - a transcription tool (62) into text of at least one image captured by the capture tool (61), - an analysis tool (63) for detecting at least one predetermined character string within the text captured by the transcription tool (62); and - a characterization tool (64) for at least one action performed by the user based on said at least one detected character string, and in that the characterization tool is configured so that: - when it is identified that the user has downloaded software in “.exe” format and launches the execution of this software in a command prompt, the characterization tool (64) searches for the name of the computer program executed in a database and . if the name of the executed computer program corresponds to ransomware or cryptocurrency mining software, the user's action can be characterized in a category corresponding to a category of "direct hacking", and . if the name of the software used is associated with brute force or DDOS attacks, the user's action can be characterized as an "indirect hacking" action, - when a bank card number or a bank account number and a merchant website are detected, the user's action can be characterized as a "fraud" action, and - when the number of emails detected is greater than a threshold, the user's action can be characterized as a "fraud" action of the phishing type.

2. An analysis device according to claim 1, wherein said predefined command corresponds to the input command and / or the keyboard tab command and / or mouse click.

3. Analysis device according to one of claims 1 to 2, in which said analysis tool (63) uses an expression of type “preg_match”.

4. Analysis device according to one of claims 1 to 3, in which the texts from the transcription tool (62) are translated automatically, for example by identifying the keyboard language used by the user.

5. Analysis device according to one of claims 1 to 4, in which the analysis tool (63) makes it possible to detect: - a URL, for example by searching for a character string containing the character sequences "url", " / / " or "www", and / or - a bank card number, for example by searching for a character string of 16 digits, and / or - a postal code, for example by searching for a character string of exactly five digits, and / or - an IPv4 internet address, for example by a set of four character strings of three digits linked by ".", and / or - an IPv6 internet address, for example by a set of eight character strings linked by ".", and / or - an email address, for example by a character string including a ".» and an “@”, and / or - a bank account number, for example a French account number in the IB AN format, by a character string containing 2 letters followed by 23 numbers.

6. Analysis device according to one of claims 1 to 5, in which the characterization tool (64) is configured so that, when a bank card number or a bank account number and a merchant website are detected, the name of the merchant website can be searched to automatically contact the IT administrator known for this merchant site.

7. Analysis device according to one of claims 1 to 6, in which the characterization tool (64) is configured so that, when the number of detected emails is greater than a threshold, an information email can be automatically transmitted to all the targets of the attack.

8. Analysis device according to one of claims 1 to 7, configured so that the texts from the transcription tool (62) can feed a search engine.

Images