E-mail security system for blocking and responding to targeted e-mail attacks and method of operation thereof

Abstract

An operation method of the email security system includes the steps of: synchronizing information on targeted email security threats constructed by inspecting incoming emails for targeted email security threats with information on targeted email security threats constructed by inspecting outgoing emails for targeted email security threats to construct synchronized data for security threat information; inspecting targeted email security threats corresponding to newly incoming emails or newly outgoing emails using the synchronized data for security threat information; and performing response processing for the targeted email security threats associated with the inspection of the targeted email security threats of the newly incoming emails or the newly outgoing emails.

Description

[Technical field]

[0001] The present invention relates to an email security system and method of operation for blocking and responding to targeted email attacks. [Background technology]

[0002] Recent advances in network attack technology have been remarkable, and cyber attacks using emails in modern society are rapidly evolving accordingly. Active Internet users and companies around the world are being victimized by the increase in malicious email activity, known as targeted email attacks, which use complex cyber attack tactics that use malware and social engineering.

[0003] Such targeted email attacks are different from spam phishing attacks, which are aimed at the general public, and include attacks that are set up to target individuals or companies and then targeted at specific people in order to damage or destroy the information assets of the targets.

[0004] To carry out a targeted email attack, threat actors collect information and create realistic-looking personalized email messages to convince targets to respond, ultimately creating security holes.

[0005] Furthermore, targeted attacks on inbound and outbound emails use sophisticated and unknown methods, such as header forgery, look-alike email addresses, or account takeover (ATO), to attach unknown intelligent malicious code or pose as a legitimate sender that the target trusts. As a result, victims respond to emails by mistakenly clicking on attachments intended by the attacker to transfer money, leak data, or cause computer system failure, or by sending replies containing personal information.

[0006] This may pose a serious risk to the information assets of the victims. However, compared to the seriousness of these targeted email attacks, the email security solutions proposed so far have been limited to fragmented technologies such as simply blocking inbound spam or blocking inbound domains, and it is still not possible to propose a solution that effectively prevents or blocks targeted email attacks by comprehensively utilizing existing technologies.

[0007] In particular, targeted e-mail attacks on the receiving (inbound) side ultimately lead to security issues for sending (outbound) e-mail, and issues with outbound security also lead to security issues for receiving e-mail. Therefore, there is a need for a systematic security system that takes this all into consideration and blocks targeted e-mail attacks, but the current situation is that an appropriate solution has not yet been proposed. Summary of the Invention [Problem to be solved by the invention]

[0008] The present invention has been devised to solve the problems described above, and has an object to provide an email security system device and an operating method thereof for blocking and responding to targeted email attacks, which can effectively block targeted email attacks using a step-by-step process of inspecting inbound and outbound emails for the threat of targeted email attacks and provide an appropriate response process and diagnostic reporting for the same. [Means for solving the problem]

[0009] In order to achieve the above-mentioned object, an operating method of an email security system according to an embodiment of the present invention includes the steps of: synchronizing information on targeted email security threats formed by inspecting incoming emails for targeted email security threats with information on targeted email security threats formed by inspecting outgoing emails for targeted email security threats to form synchronized data of security threat information; inspecting targeted email security threats corresponding to newly incoming emails or newly outgoing emails using the synchronized data of security threat information; and performing response processing for targeted email security threats associated with the inspection of the targeted email security threats of the newly incoming emails or the newly outgoing emails, wherein the inspection of targeted email security threats corresponding to the newly incoming emails or the newly outgoing emails includes at least one of inspection of a spam attack threat targeting a specific email account, inspection of a malicious code email attack threat, inspection of a social engineering email attack threat, and inspection of an email information leakage threat, using the synchronized data of security threat information.

[0010] In order to achieve the above-mentioned object, a service providing device using an email security system according to an embodiment of the present invention includes a security threat information synchronization processing unit that synchronizes information on targeted email security threats constructed by inspecting incoming emails for targeted email security threats with information on targeted email security threats constructed by inspecting outgoing emails for targeted email security threats to construct synchronized data of security threat information, a targeted email security threat inspection unit that uses the synchronized data of security threat information to inspect targeted email security threats corresponding to newly incoming emails or newly outgoing emails, and an email processing unit that performs response processing to targeted email security threats associated with the inspection of the targeted email security threats of the newly incoming emails or the newly outgoing emails, wherein the inspection of targeted email security threats corresponding to the newly incoming emails or the newly outgoing emails includes at least one of an inspection of a spam attack threat targeting a specific email account, an inspection of a malicious code email attack threat, an inspection of a social engineering email attack threat, and an inspection of an email information leakage threat, using the synchronized data of security threat information.

[0011] Meanwhile, the method according to an embodiment of the present invention for achieving the above-mentioned object may be realized by a computer-readable recording medium for executing the method on a computer and a computer program stored in the recording medium. Effect of the Invention

[0012] According to an embodiment of the present invention, information on targeted email security threats constructed by inspecting incoming emails for targeted email security threats and information on targeted email security threats constructed by inspecting outgoing emails for targeted email security threats are synchronized to construct synchronized data of security threat information, and the synchronized data of security threat information is used to gradually inspect targeted email security threats corresponding to newly incoming emails or newly outgoing emails, thereby enabling an effective process of inspecting targeted email attack threats.

[0013] As a result, the present invention can provide an email security system device and an operating method thereof for blocking and responding to targeted email attacks, which can effectively block targeted email attacks using a step-by-step targeted email attack threat inspection process for inbound and outbound emails, and provide appropriate diagnostic reporting and response processes corresponding thereto. [Brief description of the drawings]

[0014] [Figure 1] 1 is a conceptual diagram illustrating an overall system according to an embodiment of the present invention. [Diagram 2] 1 is a block diagram for explaining a service providing device according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram for more specifically illustrating a configuration of a portion of a service providing device according to an embodiment of the present invention. [Figure 4] FIG. 2 is a block diagram for more specifically illustrating a configuration of a portion of a service providing device according to an embodiment of the present invention. [Diagram 5] 1 is a flowchart illustrating a service process using a system according to an embodiment of the present invention. [Figure 6] 1 is a flowchart illustrating a service process using a system according to an embodiment of the present invention. [Figure 7]FIG. 2 is a diagram for explaining a process for inspecting the leakage of large-capacity files according to an embodiment of the present invention. [Figure 8] FIG. 2 is a ladder diagram illustrating a policy-based approval process for large files according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] The following merely illustrates the principles of the present invention. Therefore, those skilled in the art can invent various devices and methods that embody the principles of the present invention and are included in the concept and scope of the present invention, even if not explicitly described or illustrated in the present specification. It should be understood that all conditional terms and embodiments listed in the present specification are, in principle, clearly intended only for the purpose of making the concept of the present invention understandable, and are not limited to the embodiments and conditions specifically listed in this specification.

[0016] Moreover, all detailed descriptions reciting specific embodiments as well as principles, aspects, and embodiments of the present invention are intended to include structural and functional equivalents of such items, which should be understood to encompass not only currently known equivalents, but also equivalents developed in the future, i.e., any elements invented that perform the same function, regardless of structure.

[0017] Thus, for example, the block diagrams herein should be understood to illustrate a conceptual view of illustrative circuitry embodying the principles of the invention. Similarly, all flow charts, state transition diagrams, pseudocode, and the like, may be substantially represented on a computer readable medium and should be understood to illustrate various processes performed by a computer or processor, whether or not a computer or processor is explicitly shown.

[0018] Additionally, the explicit use of terms such as processor, control, or similar concepts should not be construed as exclusively referring to hardware capable of executing software, but should be understood to implicitly include, without limitation, digital signal processor (DSP) hardware, read only memory (ROM), random access memory (RAM), and non-volatile memory for storing software. Other hardware commonly known and commonly used may also be included.

[0019] The above-mentioned objects, features and advantages will become more apparent from the following detailed description in conjunction with the accompanying drawings, so that those skilled in the art will be able to easily implement the technical ideas of the present invention. Note that, in implementing the present invention, if it is deemed that a detailed description of known technologies related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

[0020] The terms used in this application are merely used to describe certain embodiments and are not intended to limit the present invention. Singular expressions include plural terms unless the context clearly indicates otherwise. In this application, terms such as "comprise" or "have" are merely used to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should be understood not to preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0021] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate overall understanding, the same components in the drawings are given the same reference numerals, and duplicate descriptions of the same components are omitted.

[0022] The term "mail" as used herein can collectively refer to electronic mail, webmail, electronic mail, electronic mail, and other terms that are exchanged by users using a computer communication network via a terminal device and a client program or website installed thereon.

[0023] FIG. 1 is a conceptual diagram showing an entire system according to one embodiment of the present invention.

[0024] Referring to FIG. 1, the system according to an embodiment of the present invention includes a service providing device 100, a user terminal 200, and a mail server 300.

[0025] More specifically, the service providing device 100, the user terminal 200, and the mail server 300 are connected to a public network, and can transmit and receive data by being connected by either wired or wireless means. The public network is a communication network constructed and managed by the state or a communications carrier, and generally includes telephone networks, data networks, CATV networks, mobile communication networks, etc., and provides connection services so that an unspecified number of ordinary people can connect to other communication networks and the Internet. In the present invention, the public network is rewritten as a network.

[0026] Furthermore, the service providing device 100, the user terminal 200, and the mail server 300 may each include a communication module for communicating using a protocol corresponding to each communication network.

[0027] The service providing device 100 may be connected to each user terminal 200 and a mail server 300 via a wired / wireless network to provide mail security and diagnostic services, and devices or terminals connected to each network can communicate with each other via a pre-established network channel.

[0028] Here, each of the networks may be realized by any type of wired / wireless network, such as a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN), a mobile radio communication network, or a satellite communication network.

[0029] The service providing device 100 described in this specification can provide an email security service that can detect and block attacks that cause unintended program execution via email, degradation of the data processing capabilities of email-related systems, phishing scams, etc.

[0030] Furthermore, the service providing device 100 can provide an email security service that synchronizes information on targeted email security threats constructed by inspecting incoming emails for targeted email security threats with information on targeted email security threats constructed by inspecting outgoing emails for targeted email security threats to construct synchronized data for security threat information, and uses the synchronized data for security threat information to inspect targeted email security threats corresponding to newly incoming emails or newly outgoing emails, thereby performing response processing for targeted email security threats associated with the inspection of the targeted email security threats of the newly incoming emails or the newly outgoing emails.

[0031] Here, the inspection of targeted email security threats corresponding to the newly received email or the newly outgoing email may include at least one of inspecting a spam attack threat targeting a specific email account, inspecting a malicious code email attack threat, inspecting a social engineering email attack threat, and inspecting an email information leakage threat using the synchronization data of the security threat information, and the inspection of the targeted email is processed according to a predefined step-by-step inspection process corresponding to a security level, and the processed inspection data can be used to update the synchronization data of the security threat information.

[0032] In addition, the service providing device 100 can provide an email diagnostic service that uses synchronized data of security threat information and inspection processing information of targeted email to perform an email diagnostic process based on a quantitative analysis of email security threat elements corresponding to targeted email attacks, and provides each email system user terminal 200 with a diagnostic report based on the diagnostic process.

[0033] The user terminal 200 described in this specification includes personal computers (PCs), laptop computers, mobile phones, tablet PCs, personal digital assistants (PDAs), portable multimedia players (PMPs), etc., but the present invention is not limited to these and may be a device that can be connected to the service providing device 100 and mail server 300, etc., via a public network or a private network, etc.

[0034] In addition, each device may be a variety of devices capable of inputting and outputting information using an application or web browsing. In particular, in general, the user terminal 200 may be connected to the service providing device 100 through an individual security network.

[0035] Meanwhile, the mail server 300 is a system that relays and stores the contents of electronic mail so that a user can send mail created through the user terminal 200 and the other party can receive mail created through the user terminal 200. The mail server 300 can communicate with each other using a preset protocol according to the purpose of use, that is, receiving and sending mail.

[0036] Generally, the protocols that can be used for receiving mail include Post Office Protocol 3 (POP3) and Internet Message Access Protocol (IMAP). Also, the protocols that can be used for sending mail include Simple Mail Transfer Protocol (SMTP). In this way, the mail server 300 can be configured and operated as a server system for sending and receiving mail. The mail server 300 can be divided into a mail receiving server and a mail sending server to provide the respective functions.

[0037] FIG. 2 is a block diagram for explaining a service providing device according to an embodiment of the present invention, and FIG. 3 and FIG. 4 are block diagrams for more specifically explaining a configuration of a part of the service providing device according to an embodiment of the present invention.

[0038] First, referring to FIG. 2, a service providing device 100 according to one embodiment of the present invention includes a control unit 110, an inspection data collection unit 120, a targeted email security threat inspection unit 130, a security threat information synchronization processing unit 140, an incoming email processing unit 150, an outgoing email processing unit 160, a record management unit 170, a diagnostic reporting unit 180 and a communication unit 125.

[0039] The control unit 110 may be realized by one or more hardware processors for controlling the overall operation of each component of the service providing apparatus 100 .

[0040] The communication unit 125 may include one or more communication modules for communicating with the network in which the user terminal 200 or the mail server 300 is located.

[0041] The test data collection unit 120 can collect email information transmitted and received between one or more user terminals 200 via the mail server 300. The email information may include email header information, email titles, email content bodies, and the number of times an email has been received in a certain period of time.

[0042] Specifically, the email header information may include the mail sending server IP address, mail sending server host name information, sender mail domain information, sender email address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient email address, mail protocol information, mail reception time information, mail sending time information, etc.

[0043] The email header may also include network route information required in the process of sending and receiving emails, and protocol information used between email service systems for exchanging emails.

[0044] Additionally, the mail information may include an attachment extension, hash information of the attachment, an attachment name, a body of the attachment content, Uniform Resource Locator (URL) information, etc. The attachment may include further content for transferring additional information or requesting a reply in addition to the content of the mail body that the sender intends to forward to the recipient.

[0045] The content may include text, images, videos, etc. The recipient can execute an application corresponding to the file attached to the email to check the content. The recipient can also download the file attached to the email to a local storage device for storage and management.

[0046] The file extension of the attached file can distinguish the format or type of the file. The file extension of the attached file may generally be distinguished by a character string indicating the file attribute or the application that generated the file. For example, a text file may be distinguished by an extension such as [filename].txt, an MS Word file may be distinguished by an extension such as [filename].doc (docx), and a Hangul file may be distinguished by an extension such as [filename].hwp. Also, an image file may be distinguished by an extension such as gif, jpg, png, tif, etc.

[0047] Additionally, executable files, which are computer files that perform designated tasks according to coded instructions, may be identified as [filename].com, [filename].exe, [filename].bat, [filename].dll, [filename].sys, [filename].scr, etc.

[0048] The hash information of the attachment can check for forgery of information and ensure the integrity of the information. The hash information or hash value may be mapped to a bit string of a certain length for any data of any length using a hash function.

[0049] As a result, the hash information output through the hash function for the initially generated attachment has a unique value. The output hash information or hash value is one-way, meaning that data input to the function cannot be extracted. In addition, the hash function can guarantee collision avoidance, which means that it is computationally impossible for other input data to provide the same output as the output hash information or hash value for one given input data. Thus, if data is modified or added to the attachment, the output value of the hash function is returned differently.

[0050] In this way, the unique hash information of the attachment can be used to check whether the file has been modified, forged, or altered by comparing the hash information or hash value of the file exchanged via email. In addition, since the hash information is fixed to a unique value, it is possible to take preventive measures by utilizing reputation information, which is a database of past history of files created with malicious intent. Additionally, the hash function can be used as a technology and version that can guarantee one-way and collision avoidance.

[0051] For example, the hash information can be used as search information for the presence or absence of malicious code in a file via the Virus Total website or the Malwares website. Information such as the file provider and the file hash value can be provided via a website that provides an analysis of the file hash information. In addition, the results of a search for file hash information can be cross-checked with reputation information determined by a number of global companies that provide IT information security solutions, making it possible to make a judgment based on more reliable information.

[0052] The targeted email security threat inspection unit 130 processes stage-by-stage matching of the email security inspection process corresponding to the email information according to a preset targeted email security threat inspection process, inspects the email information using the matching processed email security process, and stores and manages email security inspection information associated with the inspection results.

[0053] Here, the targeted email security threat inspection process may include at least one of inspecting a spam attack threat targeting a specific email account, inspecting a malicious code email attack threat, inspecting a social engineering email attack threat, and inspecting an email information leakage threat, using the synchronized data of the security threat information in response to a newly received email or a newly outgoing email.

[0054] In addition, the inspection of the threat of spam attacks, the inspection of the threat of malicious code email attacks, the inspection of the threat of social engineering email attacks, and the inspection of the threat of email information leakage may be processed sequentially with preset hierarchical priorities set according to each security threat type.

[0055] In addition, the targeted email security threat inspection process may be determined to be a different email security process corresponding to a newly received email or a newly sent email, and the inspection target, inspection order, or inspection method of the email security process may be predetermined based on the synchronized data of the synchronized security threat information.

[0056] The targeted e-mail security threat inspection process allocates independently divided processes as resources when inbound or outbound e-mail information is transmitted from the user terminal 200, and can be immediately executed in the inspection area allocated to the e-mail information. The dynamic resource allocation method can be explained as a concept of virtual space. In the method of allocating resources to virtual space, the e-mail security process can immediately process work in the inspection area allocated to the sequentially incoming e-mail information when processing is completed.

[0057] In contrast, in a virtual environment, such as a virtual machine, where a certain number of processes are assigned to a resource with limited processing capacity, other processes may have idle time to wait for a particular process to complete processing a requested task. Thus, in an analysis method using processes, floating resources can have an advantage in terms of processing speed and performance when compared to fixed resources.

[0058] The targeted e-mail security threat inspection unit 130 can distinguish e-mails according to the purpose of receiving or sending based on the e-mail information collected by the inspection data collection unit 120. Then, the targeted e-mail security threat inspection unit 130 can obtain targeted e-mail security inspection information for each e-mail by matching and analyzing the e-mail security process sequentially or based on a set priority.

[0059] Here, the targeted e-mail security threat inspection unit 130 can process inspections for not only e-mail threat types using malicious code but also attack types without malicious code. Specific types of targeted e-mail attacks include not only malicious code attacks but also social engineering attacks such as spoofing and account hijacking, which may result in unintentional or intentional information leakage.

[0060] As a result, the targeted email security threat inspection unit 130 includes a spam attack threat inspection unit 131, a malicious code attack threat inspection unit 133, a social engineering attack threat inspection unit 135, and an information leakage inspection unit 137 in order to detect attacks of each type in a step-by-step manner.

[0061] Here, the targeted e-mail security threat inspection unit 130 can use synchronization data of security threat information that is preconfigured in the security threat information synchronization processing unit 140 .

[0062] For this purpose, the security threat information synchronization processing unit 140 can synchronize information on targeted e-mail security threats constructed by inspecting incoming e-mails for targeted e-mail security threats and information on targeted e-mail security threats constructed by inspecting outgoing e-mails for targeted e-mail security threats, thereby constructing synchronized data for security threat information.

[0063] Here, the synchronized data of security threat information may include identification information regarding malicious files and malicious accounts collected from each inspection process and an external security server, and may be configured by synchronizing information on targeted email security threats configured by inspecting incoming emails for targeted email security threats and information on targeted email security threats configured by inspecting outgoing emails for targeted email security threats.

[0064] For example, the synchronized security threat information data may include file information that has been detected as having a high malicious threat level when inspecting a particular incoming email for targeted email security threats, and sender account information that has been detected as having a high probability of impersonation or account takeover.

[0065] In addition, the synchronized data of security threat information may include file information that has been inspected to have a high threat level of information leakage when inspecting targeted email security threats of a particular outgoing email, and recipient account information that has been inspected to have a high possibility of impersonation or account hijacking.

[0066] The synchronized security threat information data may include similar domain inspection information including email accounts and domain information detected as being associated with similar domain attacks.

[0067] The synchronized security threat information data may also include account takeover attack screening information including email account and domain information detected as being associated with account takeover attacks.

[0068] The security threat synchronization data may include zero-day URL attack inspection information that changes the redirect path information of a URL link after the date of receipt of the email, and zero-day malware inspection information that handles malicious code or hacking attacks that use system security vulnerabilities after they are discovered but before a patch that can prevent them is released.

[0069] The security threat synchronization data may further include delivery routing information, including email server information, transit point information, and sender information.

[0070] Furthermore, the synchronized data of the security threat information can be continuously updated using the inspection data processed in each processing unit of the targeted e-mail security threat inspection unit 130, thereby enabling integrated security management of the sending and receiving security systems and effectively preventing damage to internal systems and the leakage of information to the outside due to targeted e-mail attacks.

[0071] Such synchronized data on security threat information includes information inspected in each security inspection process described below, such as unknown malicious code information, malicious code attachment information, malicious code URL information, header forgery information, similar domain information, account hijacking information, URL phishing information, intentional information leak information, unintentional information leak information, and unauthorized email server access information.

[0072] In order to carry out such an inspection process and to construct synchronized data of security threat information, the targeted e-mail security threat inspection unit 130 may first include a spam mail inspection unit 131 .

[0073] When the mail security process is a spam mail security process, the spam mail inspection unit 131 can match the mail information including mail header information, mail title, mail content body, number of times received within a certain period of time, etc. with a pre-set spam index in stages.

[0074] Here, the security threat of spam mail (also called junk mail, junk mail, or bulk mail) may include a type of mail that is unilaterally and indiscriminately distributed to an unspecified number of people in large quantities with the aim of announcements and public relations between unrelated senders and recipients. In addition, a large amount of spam mail puts a strain on the data processing capacity of the mail system, which may result in a decrease in the processing capacity of the system. In addition, spam mail may cause users to unintentionally connect to indiscreet information contained in the content body, etc., and there is a risk that the information may be disguised as information for potential phishing scams.

[0075] Therefore, the spam mail inspection unit 131 performs a certain pattern inspection for distinguishing mail as spam mail on mail information including mail header information, mail title, mail body, etc., and can use it as an inspection item in the spam index. Through this, the spam mail inspection unit 131 can obtain, store, and manage spam mail inspection information by matching the spam index step by step.

[0076] The targeted e-mail security threat inspection unit 130 may further include a malicious code attack threat inspection unit 132 .

[0077] Malicious code has the potential to access memory in the victim's computer system and damage or delete files and programs. Malicious code attacks, which are the subject of targeted email security threat inspection, can be broadly divided into three types of attack log types. The malicious code attack threat inspection unit 133 can check synchronization data of synchronized security threat information to perform an inspection process for each attack type, and can transfer inspection data accompanying the inspection results to the security threat information synchronization processing unit 140 and process it so as to update the synchronization data of the security threat information again.

[0078] First, the attack type for unknown malicious code refers to attacks using new unknown malicious code that is difficult to detect in vaccine tests because it is not registered in big data databases. For example, attackers can exploit zero-day vulnerabilities that deliver malicious code by redirecting the connection path of URL links or attachments in emails after a certain time other than the day of delivery, and send emails that embed attachments with new malicious code that cannot be detected by security solutions, inviting users to click on them.

[0079] In addition, in a malicious code attachment attack, a malicious email attachment is a threat type in which an attacker hides malicious code inside a file that is typically sent by email, and such a malicious email attachment may be disguised as a document, compiled or executable file, or even an image or video file, or may be an encrypted file with another extension. Furthermore, an attack using an executable file may include forging the sender's address to trick the recipient into opening an email containing a malicious document, or may include an attack in which malicious code is embedded in an image and attached to the body of the email.

[0080] On the other hand, a URL-based malicious code attack may be a type of attack that embeds a clickable link with malicious code in an email in order to lure the user to a malicious website. The malicious URL may be embedded in a large file attachment or in the body of the email, so that it may also include attacks that cause the malicious code to be executed only when the email is forwarded, not just when the user clicks on the URL in the email or regular attachment.

[0081] In order to perform the security inspection process for each type described above, the malicious code attack threat inspection unit 132 can match the email information, which further includes hash information of the attachment, the attachment file name, the body of the attachment content, URL (Uniform Resource Locator) information, etc., with a pre-set malicious code index in stages.

[0082] The malicious code threat inspection unit 132 can use the attachment file extension, hash information of the attachment file, attachment file name, etc., which can be confirmed from the attribute value of the attachment file, as well as the body of the attachment file and URL (Uniform Resource Locator) information embedded in the body of the attachment file, as the inspection items of the malicious code index. Through this, the malicious code threat inspection unit 132 can obtain malicious code inspection information by matching the malicious code index step by step according to each type and item, store and manage it using the record management unit 170, and provide it to the security threat information synchronization processing unit 140 to process the update of synchronization data of security threat information.

[0083] The malicious code index may be set with a level value using inspection items and inspections based on items included in the email information in stages, and each inspection level value can be updated based on the synchronization data of the security threat information described above.

[0084] For example, the malicious code index Level 1 can match the attachment file name and the attachment file extension included in the mail information based on the big data and reputation information obtained from the synchronized data of the security threat information. Through this, the malicious code index Level 1 can obtain the evaluated level value as the inspection information of the malicious code index Level 1. For example, when the inspection information of the malicious code index Level 1 includes the inspection item of the attachment file name "Trojan" and the attachment file extension "exe", if it matches the information defined as malicious code in the big data and reputation information, it can be evaluated as "1" in the level value distinguished between 0 and 1. Through this, the inspection information of the malicious code index Level 1 can be obtained as "1".

[0085] Additionally, the malicious code index Level 2 may match hash information of email attachments based on big data and reputation information obtained from synchronized data of security threat information. Through this, an evaluated level value may be obtained as the inspection information of the malicious code index Level 2. For example, when the inspection information of the malicious code index Level 2 is analyzed as an inspection item, attachment hash information "a1b2c3d4" and matches information defined as malicious code in the reputation information, the inspection information of the malicious code index Level 2 may be evaluated as "1" in a level value distinguished between 0 and 1. Through this, the inspection information of the malicious code index Level 2 may be obtained as "1".

[0086] As a next step, the malicious code index Level 3 can match URL (Uniform Resource Locator) information embedded in an attachment or the body of the mail content based on URL reputation information acquired from the synchronized data of security threat information. Through this, an evaluated level value can be acquired as the inspection information of the malicious code index Level 3. For example, when the URL information, which is an inspection item, is confirmed to be "www.malicious-code.com", if it matches information defined as a harmful site including a malicious code file in the URL reputation information, the inspection information of the malicious code index Level 3 can be evaluated as "1" in a level value distinguished between 0 and 1. Through this, the inspection information of the malicious code index Level 3 can be acquired as "1". And, the malicious code attack threat inspection unit 132 can respond to a zero-day attack that may be leaked from the URL reputation information. The malicious code attack threat inspection unit 132 can change a link IP address related to a URL without reputation information to an IP address of a specific system, and provide the changed IP address to the user terminal 200. When the user terminal 200 attempts to connect to the URL, it may connect to the IP address of the specific system changed by the malicious code attack threat inspection unit 132. Prior to this, the specific system changed to the link IP address for the URL may continuously check whether it contains malicious code up to the URL end point.

[0087] Meanwhile, the malicious code attack threat inspection unit 133 performs classification management of malicious code using synchronized data of security threat information in order to identify unknown malicious code, thereby enabling the administrator to classify and configure e-mails identified as malicious files, and thus prevents viruses and the like from being transmitted even if the user requests retransmission.

[0088] Furthermore, the malicious code attack threat inspection unit 133 can perform a multi-analysis inspection to inspect unknown malicious code, and the multi-analysis inspection can combine a static inspection and a dynamic inspection to inspect the behavior of the malicious code on the system and detect new viruses not detected in the first inspection. The behavior inspection results can be classified into, for example, "forgery", "memory access", "hooking warning", "file creation", "file deletion", and "process execution", and thus the malicious code attack threat inspection unit 133 can inspect the threat of a malicious code attack from the result information of the behavior inspection, and transfer the inspection result to the security threat information synchronization processing unit 140, and use it to update the synchronization data of the security threat information.

[0089] For example, the malicious code attack threat inspection unit 133 can perform a virus test consisting of three stages, and can process the first test (vaccine test), the second test (environmental operating system change test), and the third test (behavior-based analysis test) in stages to inspect the threat of a malicious code attack using the inspection results of each stage.

[0090] The malicious code attack threat inspection unit 133 can use a cloud service to periodically scan all of the user's inbound and outbound email data to extract malicious attachments that require additional inspection in order to perform inspections based on synchronized data and big data of security threat information.

[0091] The malicious code attack threat inspection unit 133 can determine whether there is a risk of a targeted e-mail attack based on the data constructed from the big data in the security threat information synchronization processing unit 140 using the synchronized data of the security threat information. The big data analysis function can identify and detect even forged extensions (e.g., doc, .docx, .ppt, .pptx, .pdf, .txt, .rtf, etc.) as targets for malicious code analysis.

[0092] Meanwhile, when malicious code in a URL is detected, the malicious code attack threat inspection unit 133 can convert the URL data of the mail information transferred to the received mail processing unit 150 into an image. This makes it possible to prevent the URL link from being opened in a dangerous environment where the attached malicious URL is recognized.

[0093] In addition, the malicious code attack threat inspection unit 133 can monitor potential dangers by performing the above-mentioned endpoint URL monitoring, and can continuously track the final destinations of all URLs in the email body or document file. Here, the malicious code attack threat inspection unit 133 can track all URLs as n-th URLs connected to each other. In addition, the malicious code attack threat inspection unit 133 checks the document file embedded in the email body by URL, and can track all URLs for the downloaded malicious attachment or document file, even for the large attachment downloaded by bypassing the URL in the email body, especially in the case of a large attachment.

[0094] And, when a user tries to click on a URL link after receiving an e-mail, the malicious code attack threat inspection unit 133 scans files and endpoints to re-check access to the URL in real time, and if a danger is detected, it can perform a post-test of the URL to restrict access. The associated URL post-test information can be updated in real time to the synchronized data of security threat information, and the received e-mail processing unit 150 and the outgoing e-mail processing unit 160 can perform processing such as blocking the targeted e-mail attack and notifying the user by referring to the result of the post-test of the URL confirmed by the synchronized data of such security threat information.

[0095] In addition, the malicious code attack threat inspection unit 133 can perform image-based filtering to inspect for malicious code attacks, which can detect text-based filtering or malicious graphic images configured to avoid filtering of malicious attachments.

[0096] In this way, the inspection information acquired by the malicious code index level unit using the malicious code security process can be finally summed ("3") and stored and managed as malicious code inspection information. The malicious code inspection information thus summed is provided to the security threat information synchronization processing unit 140 and can be used to update the synchronization data of the security threat information.

[0097] Meanwhile, the targeted email security threat inspection unit 130 may further include a social engineering attack threat inspection unit 133. The social engineering attack threat inspection unit 133 is executed when the email security inspection process is a social engineering attack threat security process, and can match social engineering attack analysis data acquired from email information by item based on synchronization data of security threat information and preset social engineering attack security threat items. The social engineering attack analysis data can be acquired by performing an analysis process for each attack type corresponding to the email information.

[0098] For example, the social engineering attack threat inspection unit 133 can use a receiving mail domain, a sending mail domain, a receiving mail address, a sending mail address, mail routing, and mail content body information that can be extracted from a mail determined to be normal as social engineering attack threat inspection items. Thus, the social engineering attack threat inspection unit 133 can perform a type inspection for each social engineering attack threat inspection item, and obtain, store, and manage social engineering attack threat inspection information.

[0099] More specifically, the social engineering attack threat inspection unit 135 can inspect header forgery, look-alike domains, account hijacking, and URL phishing when inspecting the type of attack for each inspection item of social engineering attack threats.

[0100] Header forgery checks may include checks to detect forged email headers that allow an attacker to bypass a user's reply destination. If headers are forged, there is a risk that an attacker could intercept a user's email, which may contain company credentials and personal information.

[0101] As a result, social engineering attack threat inspection unit 135 can detect and block such header forgery attacks in advance by inspecting for header forgery. Based on the inspection information from social engineering attack threat inspection unit 135, outgoing mail processing unit 160 can block in advance or warn the sending user if the email address to which the reply should be made is different when replying to an incoming email. For such processing, social engineering attack threat inspection unit 135 can check in advance whether the email communication protocol is authenticated.

[0102] When inspecting for header forgery, the social engineering attack threat inspection unit 135 can detect forged sender addresses in emails by checking whether the sender's email complies with the communication protocol (e.g., SPF (Sender Policy Framework), DKIM (Domain Keys Identified Mail), DMARC (Domain-based Authentication, Reporting, and Conformance)) in the case of email communication protocol authentication.

[0103] In addition to checking for header forgery, the social engineering threat inspection unit 135 can also manage the reputation of IP addresses and domain senders and check whether an email address has a trustworthy domain.

[0104] For example, to check for header forgery, the social engineering attack threat inspection unit 135 analyzes email header information and checks the sender header value (From:<id@domain> ) and the reply address header value (Reply-To:<id@domain> ) can be checked to see whether they are different.

[0105] The social engineering attack threat inspection unit 135 can determine which parts of each header value are different and output the filtering results for each step as the inspection result. For example, if the ID is forged, the sender's header value (From:<ABC@XYZ.com> ) and the reply address header value (Reply-To:<BAC@XYZ.com> In addition, in the case of domain forgery, the sender header value (From:<ABC@XYZ.com> ) and the reply address header value (Reply-To:<ABC@YXZ.com> In the case of forged addresses, this may correspond to cases where the sender addresses in the replies are different from each other, and in the case of forged signatures, this may correspond to cases where the signature parts of the contents of the emails are different from each other.

[0106] The lookalike domain check is a type of attack where an attacker sends malicious e-mails from an e-mail address, and may include cases where the domain is so similar that it cannot be distinguished from a normal sender by the human eye, but is a malicious domain of an attacker. For example, the capital letter "I" and the lowercase letter "l" have similar shapes and can be abused in attacks.

[0107] As a result, the social engineering attack threat inspection unit 135 can check whether the sender's email address or domain is a similar domain based on the accumulated email history, and the received email processing unit 150 can notify the user of the level of risk similarity and block the email.

[0108] Here, the social engineering attack threat inspection unit 135 can use information on the number of characters that are not identical and similar between the email address in the email history accumulated and managed in the synchronized data of security threat information and the email address included in the header information of the new email as a criterion for judging whether or not a new email is a similar email fraud attack and the possibility of a social engineering attack threat. For example, the social engineering attack threat inspection unit 135 can judge the possibility of a social engineering attack threat to be higher the fewer the number of characters that are not identical and similar, and calculate the judgment result as a danger level and output it as the inspection result.

[0109] In addition, email security administrators may register suspicious similar email addresses in the synchronized data of security threat information themselves, and if email addresses are similar but differ only in their top level domains (TLDs), they may be classified and managed separately.

[0110] More specifically, the social engineering attack threat inspection unit 135 calculates the similarity between the domain information contained in the header information of a new email and the cumulative domain information contained in the email history of the synchronized data of security threat information synchronized by the security threat information synchronization processing unit 140, and can detect emails from similar domains that contain a similar number of characters less than a specific number of characters that are generally difficult for users to distinguish (e.g., three characters) as social engineering attack threat emails.

[0111] As a result, the incoming mail processing unit 150 or the outgoing mail processing unit 160 can perform response processing to targeted email security threats, including blocking the receipt or transmission of email, delaying the receipt or transmission of email or deleting email, and sending a user warning message, based on the results of the inspection of social engineering attack threats corresponding to new email.

[0112] For example, the social engineering attack threat inspection unit 135 can detect the threat level of a social engineering attack when the top level domain (TLD) of the sender domain of a newly received mail is partially modified, or the arrangement of the character strings is partially rearranged, or one of the character strings is changed to a similar character or another character, compared with other existing mail history information included in the synchronization data of security threat information, and can output the detected threat level as an inspection result to the received mail processing unit 150. The received mail processing unit 150 can selectively block, delay or delete the reception of the newly received mail according to the threat level, and process a user warning message, in accordance with a preset processing policy for similar domains.

[0113] The threat level of similar domains for such social engineering attacks can be classified into five levels according to the degree of change in similar characters that are similar but not identical to other existing email history information included in the synchronized data of security threat information, as shown below.

[0114] That is, the social engineering attack threat inspection unit 135 can perform an inspection process of inspecting the similar domains in a step-by-step manner to inspect whether the sender domain included in the newly received email does not match and is similar to the domains included in the cumulative domain information by inspecting the similar domains, using the cumulative domain information obtained from the synchronization data of the security threat information, and can output the inspection result as the level of the risk level of the similar domain attack of the social engineering attack threat, which is classified into five levels as follows:

[0115] At the TLD level: When the last segment of an email domain (e.g., .com, .net, .org, etc.) is changed to a similar character, Low level: If the alphabet in the email address is changed to three or more distinct similar characters, Normal level: If the alphabet in the email address is changed to two similar but distinct characters, High level: If an alphabet in an email address is changed to a similar but distinct character, Risk level: If the alphabet of the email address consists of only similar characters that are difficult to distinguish (for example, l (lowercase letter ale) and I (uppercase letter i)), With this configuration, the social engineering attack threat inspection unit 135 can use the step-by-step inspection process to step-by-step calculate the character-number-based similarity of similar domains that are detected to be similar but do not match the domains included in the cumulative domain information, and determine the threat level of a similar domain-based social engineering email attack of the newly sent email or newly received email based on the character-number-based similarity.

[0116] Such similar domain-based social engineering email attack threat level information may be composed of targeted email security threat inspection data of new emails and forwarded to the incoming email processing unit 150 or the outgoing email processing unit 160, whereupon the corresponding aforementioned email blocking, delay or deletion and user warning process may be performed.

[0117] Meanwhile, the social engineering attack threat inspection unit 135 can perform an account takeover (ATO) inspection to detect the threat of a social engineering attack using an actual user's account.

[0118] Through an account takeover attack, an attacker can attempt to log into a stolen email account and then search the user's mail records to find sensitive information and potential secondary victims. For example, an attacker may use the account information stolen from a phishing site to send an email requesting a change in remittance account, or transfer sensitive information stored in the account to an external party.

[0119] To prevent this, the social engineering attack threat inspection unit 135 of an embodiment of the present invention can perform account takeover inspection to detect the threat of social engineering attacks using account takeover, using learning data for each account takeover inspection item obtained from the synchronized data of the security threat information of the security threat information synchronization processing unit 140.

[0120] For this purpose, the security threat information synchronization processing unit 140 can configure accumulated learning data for each check item of account hijacking, and can configure a learning model that outputs the possibility that the newly sent email or the newly received email is an email sent from a hijacked account according to a learning process of an artificial intelligence model between the configured learning data and email item data of an actual account hijacking case. Here, the learning process of the artificial intelligence model is a well-known artificial intelligence deep learning neural network technology, and various well-known learning technologies such as CNN (convolutional neural network), DNN (deep neural network), RNN (recurrent neural network), LSTM (long short-term memory), and regression analysis can be applied.

[0121] The social engineering attack threat inspection unit 135 can perform an inspection process to inspect whether the newly sent mail or the newly received mail is an email sent from a hijacked account by applying the account hijack inspection item data of the newly sent mail or the newly received mail to a learning model of the cumulative learning data for each inspection item of the account hijack.

[0122] For example, according to the above-mentioned learning model, the security threat information synchronization processing unit 140 can learn header structure information of email information for checking account hijacking, and the social engineering attack threat inspection unit 135 can input header structure information of newly received emails or newly sent emails to the configured header structure learning model to check the validity of the account hijacking inspection. Such an account hijacking inspection method includes a comparison analysis between an artificial intelligence-based learning record of past data related to emails and current new data.

[0123] In addition, the social engineering attack threat inspection unit 135 can use not only the learning model but also caller history information to inspect for account takeover in accordance with a preset inspection process.

[0124] More specifically, the cumulative learning data for each account hijacking inspection item may include sender history information obtained from the mail header of an incoming or outgoing email, and the account hijacking inspection by the social engineering attack threat inspection unit 135 may include an inspection process of comparing the cumulative learning data of the sender history information with the location information or sender IP information of the sender of the newly outgoing email or the newly received email to inspect whether the newly outgoing email or the newly received email is an email sent from a hijacked account.

[0125] Here, the sender history information includes initial destination information, waypoint information, and final destination information constructed based on a mail sending IP and a mail server IP, and the check for account hijacking may include a check process for checking whether the newly sent mail or the newly received mail is mail sent by a hijacked account by comparing the initial destination information, waypoint information, or final destination information obtained from the header of the newly sent mail or the newly received mail.

[0126] More specifically, if an account is hijacked, there is a high possibility that the sender's location or IP address will be changed. Thus, the security threat information synchronization processing unit 140 can map the sender's location information and IP history information to the synchronization data of the security threat information and accumulate and manage them, and the social engineering attack threat inspection unit 135 can analyze the header information of the mail information to check whether the sender's location information and IP history information have been changed in order to check for account hijacking.

[0127] Here, the sender's location information and IP history information may include sender's country information, sender's IP address information, and server IP address information. In particular, the header information of an email may include IP information from where the email was initially created and sent (initial destination information), server IP addresses to which the email was forwarded (waypoint information), and the IP of the server that ultimately sent the email (final destination information).

[0128] In other words, since email header information includes initial destination information, transit point information, and final destination information as the IP address history of the sending server for transmitting the email, the security threat information synchronization processing unit 140 can map and accumulate the sender's location information and IP history information, including the initial destination information, transit point information, and final destination information, into the synchronization data of the security threat information.

[0129] The social engineering attack threat inspection unit 135 can then compare the initial destination information, transit point information, and final destination information obtained from the location information and IP history information of each cumulatively managed sender with the header information of the new email to inspect whether the sender's account has been hijacked.

[0130] More specifically, for example, the following may be considered as reasons for determining that an account has been taken over: - In case of change of initial destination: When the location and IP initial destination of the email sender (the IP address of the mail server where the email delivery request was initially made) included in the header information of the new email is identified as a changed country different from the location information and IP history information of each cumulatively managed sender (for example, the cumulatively managed sender's initial destination is 1.1.1.1 (Country A) and the final destination is 2.2.2.2 (Country A), but the header of the new email has the initial destination 3.3.3.3 (Country B) and the final destination 2.2.2.2 (Country A)); - In case of change of final destination: When the location and IP final destination of the email sender (the IP address of the mail server that finally processed the email) included in the header information of the new email is identified as a changed country different from the location information and IP history information of each cumulatively managed sender (for example, the cumulatively managed sender's transit point is 1.1.1.1 (Country A) and the final destination is 2.2.2.2 (Country A), but the header of the new email has the transit point changed to 3.3.3.3 (Country B) and the final destination changed to 3.3.3.3 (Country B)), This allows the social engineering threat inspection unit 135 to inspect for account takeover attacks and transfer the inspection results to the incoming mail processing unit 150 and the outgoing mail processing unit 160.

[0131] For example, the outgoing mail processing unit 160 may warn the user of the result of the account hijacking check or block the outgoing mail if the sender's current location is different from that of a previously received email. Also, the incoming mail processing unit 150 may warn the user of the result of the account hijacking check or block the email if the IP address of the received email server is different from that of a previously received email. Furthermore, the incoming mail processing unit 150 may warn the user of the result of the account hijacking check or recommend blocking the email if the current email has a different delivery route from that of a previously received email. Also, the social engineering attack threat inspection unit 135 may perform an inbound management function to block emails according to a specific band or IP band.

[0132] Meanwhile, the social engineering attack threat inspection unit 135 can further inspect URL phishing. URL phishing refers to an attack to steal a victim's ID and password, in which an attacker creates a phishing page or website and uses a malicious URL or file embedded in an email to induce the victim to enter account information.

[0133] For example, for phishing inspection, the social engineering attack threat inspection unit 135 tracks the final destination of the URL when an email user connects to a phishing site and enters their ID and password, and can check whether the URL contains an embedded web page that induces the user to enter personal information.

[0134] In this way, using the social engineering threat inspection process, the inspection information may finally be added together ("3") and stored and managed as social engineering threat inspection information. The social engineering threat inspection information added together in this way is transferred to security threat information synchronization processing unit 140 and can be used to update, store and manage synchronization data for security threat information, and is transferred to incoming mail processing unit 150 and outgoing mail processing unit 160 and can be used as security threat discrimination information.

[0135] Meanwhile, the targeted e-mail security threat inspection unit 130 may include an information leakage inspection unit 137 to deal with security threats due to leakage of internal information. Here, the information leakage inspection unit may use synchronization data of security threat information and attribute information of mail information to inspect whether information leakage of outgoing mail has occurred, and transfer the inspection information to the outgoing mail processing unit 160 to block outgoing mail or to reject approval for transmission of the outgoing mail via the mail server 300.

[0136] The information leakage inspection unit 137 can inspect information leakage as a security threat, particularly, targeted e-mail attacks caused by users.

[0137] First, the information leakage inspection unit 137 can detect deliberate (intentional) information leakage. When a specific leakage condition corresponding to deliberate (intentional) information leakage set by a security manager for an outgoing mail is met, the information leakage inspection unit 137 can transfer the inspection information to the outgoing mail processing unit 160 to suspend or block the mail delivery. In addition, when a specific leakage condition is met, the outgoing mail processing unit 160 can transmit a notification message and a warning message to the user terminal 200 to make the sender set a transmission delay time for the outgoing e-mail.

[0138] The information leakage inspection unit 137 detects unintentional (unintended) information leakage and transfers the detected information to the outgoing mail processing unit 160, so that the unintentional information leakage can be blocked, warned about, or delayed.

[0139] The information leakage inspection unit 137 can detect when a user replies to or sends an email to an email address classified as a similar email address from malicious account data obtained from security threat synchronization data, compose unintentional information leakage information, and transfer it to the outgoing email processing unit 160. The outgoing email processing unit 160 can provide a warning for outgoing emails, automatically block them, or delay them based on the unintentional information leakage information.

[0140] In addition, in a security network where an internal network and an external network are separated from each other, when a large-capacity attachment of an e-mail is converted into a normal attachment and passed through a network-linked system in order to securely transmit the large-capacity attachment to an external network, the information leakage inspection unit 137 can inspect the security risk for detecting unintentional or intentional information leakage corresponding to the large-capacity attachment. This means that the large-capacity attachment is converted into a normal attachment so as to pass the approval of the network-linked system in accordance with a preset e-mail transmission policy, and in this case, the inspection of the malicious code, virus inspection, and internal information leakage risk of the large-capacity attachment that is converted into the normal attachment and inserted may be included. Here, the inspection of the internal information leakage risk may include an internal information leakage risk inspection that checks whether or not a specific security keyword or a specific security phrase is included and the frequency, etc., based on preset security policy data.

[0141] In a security network in which the internal network and the external network are separated from each other, when a large-capacity attachment that has been converted and transferred from an external network to an internal network is restored, the information leakage inspection unit 137 can perform an inspection for malicious code, a virus inspection, and an inspection for the risk of internal information leakage. In particular, this may correspond to a case where the encrypted external network path information of the large-capacity attachment is attached as URL information, or a web page file that can access the encrypted external network path information of the large-capacity attachment is attached as a normal attachment.

[0142] In addition, if the IP address that confirmed the email, the number of times the email was opened, etc., meet certain conditions, the information leakage inspection unit 137 can encrypt the contents of the outgoing email, and it is preferable that the retrieval of sent emails is processed so that individual users cannot access them.

[0143] Meanwhile, the incoming mail processing unit 150 and the outgoing mail processing unit 160 can process the mail status based on the mail security inspection information and the targeted e-mail security threat discrimination information obtained by analyzing the mail information.

[0144] When the targeted e-mail security threat discrimination information is determined to be an abnormal e-mail, the incoming e-mail processing unit 150 and the outgoing e-mail processing unit 160 can process the e-mail status by determining whether to interrupt the subsequent e-mail security process. Through this, the incoming e-mail processing unit 150 and the outgoing e-mail processing unit 160 can first perform only the processing required at the inspection stage when a problem is found in the inspection stage according to the priority, and can terminate the inspection stage without performing the subsequent inspection stage by determining whether the inspection has been completed. Through this, the efficiency of the e-mail security service can be ensured, the system complexity can be reduced, and the processing efficiency can be improved.

[0145] The email security inspection information may be information obtained by integrating the inspection information of the spam mail attack threat, the inspection information of the malicious code attack threat, the inspection information of the social engineering attack threat, and the inspection information of the information leakage, which are calculated by the targeted email security threat inspection unit 130. For example, when the targeted email security threat inspection unit 130 performs an inspection process on email information, the score calculated as the spam mail inspection information is "3", the score calculated as the malicious code attack threat is "2", the inspection information of the social engineering attack threat is "1", and the score calculated as the information leakage attack threat is "0", the total score of the targeted email attack threat inspection information may be "7". In this case, the email may be classified as a normal email when the total score is in the range of 0 to 3, as a gray email when the total score is in the range of 4 to 6, and as an abnormal email when the total score is in the range of 7 to 12, based on the predetermined security threat discrimination information. As a result, an email with the email security inspection information of "7" can be determined to be an abnormal email. The result value of each test information item included in the test information of the email information can be assigned an absolute priority depending on the item, or the priority can be determined based on information corresponding to a weighting value.

[0146] As shown in FIG. 4, the incoming mail processing unit 150 may be equipped with a mail sorting processing unit 151 that processes mail determined to be normal mail based on the security threat discrimination information into a receiving or sending state that can be processed by the user terminal.

[0147] In addition, the received email processing unit 150 may further include an email discarding processing unit 152 that processes emails that are determined to be abnormal emails based on the security threat discrimination information so that they are inaccessible to the user terminal.

[0148] Additionally, the received mail processing unit 150 may further include a mail neutralization processing unit 153 that converts mail determined to be graymail based on the security threat discrimination information into non-executable file content and provides the user terminal with the ability to selectively process the status of the mail.

[0149] Generally, the graymail may be classified as spam mail or junk mail, or may be classified as normal mail. In the present invention, the graymail may be defined as a mail type classified when the security threat discrimination information is calculated as an intermediate value within a certain range that cannot be determined as normal or abnormal. The mail sanitization processor 153 may convert the graymail including the body of a suspicious content into an image file and provide it in a mail state that the user terminal 200 can confirm. The mail sanitization processor 153 may also remove or modify a section suspected to be malicious code in an attachment and provide it to the user terminal 200.

[0150] Furthermore, the mail sorting processor 151 , the mail discard processor 152 and the mail sanitization processor 153 can also carry out the same process on outgoing mail processed in the outgoing mail processor 160 .

[0151] On the other hand, the outgoing mail processing unit 160 includes an outgoing mail approval system interlocking unit 161 and an outgoing mail filtering processing unit 162 .

[0152] When the outgoing email approval system linkage unit 161 determines a security threat such as a targeted email attack, such as information leakage, from the email information of the outgoing email, it can transmit a request message to the email approval system connected to the mail server 300 to reject email approval or process an alarm.

[0153] Here, the outgoing email approval system linkage unit 161 may be configured to transmit emails to inform the user of each processing status information when the security administrator approves, rejects, or postpones an approval request via the email approval system.

[0154] For example, in an email approval system, if a specific keyword and attachment format set by an administrator are included, approval can be determined based on the organizational chart. In this case, when a specific keyword that requires approval is detected among the title, attachment, and file extension, the outgoing email approval system linkage unit 161 can configure processing status information including whether the administrator has approved or rejected the transmission of the email as an email and send it to the sender's account.

[0155] Additionally, outgoing mail approval system linkage unit 161 may set a limit on the maximum number of emails that can be sent at one time by limiting the transmission of emails to the email approval system. Outgoing mail approval system linkage unit 161 can maintain email server health and account security by limiting the number of users that can send per day and the number of recipients per email.

[0156] If the outgoing mail filtering processing unit 161 determines from the mail information of the outgoing mail that there is a security threat of a targeted e-mail attack such as malicious code, it can perform filtering processing such as discarding the outgoing mail or neutralizing it.

[0157] For example, when the outgoing mail processing unit 160 determines that an outgoing mail for which a request for sending has a targeted email security threat, instead of sending an actual email to the email recipient, it can transmit a security email with an embedded link to view the sanitized filtered email in advance.

[0158] In addition, the outgoing mail processing unit 160 can process a post-management service to deal with security threats of targeted e-mail attacks against outgoing mail even after the user has sent the mail. The post-management service is restricted so that it can be processed by a special account such as an administrator, and the outgoing mail processing unit 160 can use the post-management service to check the recipient's access and inquiry for e-mail security, check the IP address of the recipient's access to security e-mail, check the date and time of the recipient's access to security e-mail, and control (allow / block) the recipient's access to security e-mail.

[0159] In addition, since the outgoing mail processing unit 160 can perform log monitoring and reporting of malicious account information obtained from security threat synchronization data, the monitored logs may include detailed log information such as ID, location (country), IP address, date, status (success or failure), etc.

[0160] The outgoing mail processing unit 160 can report the results of monitoring malicious accounts in the email server by identifying malicious login attempts to a user account, providing a notification to the user terminal, and displaying the notification on an email or dashboard interface.

[0161] Meanwhile, the outgoing mail processor 160 can process encryption of e-mails to prevent intentional leakage of information in e-mails. E-mail encryption encrypts or masquerades the contents of e-mails and attachments to protect sensitive information from being read by anyone other than the intended recipient.

[0162] In addition, the outgoing mail processing unit 160 can provide functions of delaying sending and checking and deleting outgoing mail to block intentional or unintentional information leakage. In order to prevent intentional or unintentional information leakage by users, the outgoing mail processing unit 160 can set a delay time between the sending time and the delivered time of the mail, and the delivery of the mail may be canceled within the delay time. The authority to cancel the e-mail within the delay time can be given to the administrator and the user, and the canceled outgoing e-mail cannot be sent and must be created again.

[0163] And, the outgoing mail processing unit 160 can implement country and IP restrictions corresponding to the account in order to block account hijacking attacks in advance. To set such restrictions, the outgoing mail processing unit 160 provides a function that allows security administrators and email users to register specific IP addresses and countries that can be accessed in the "security IP registration" or "allowed country registration". This allows users to send emails only from allowed IP addresses and countries.

[0164] Furthermore, the outgoing mail processing unit 160 controls access to the email server IP, thereby blocking access to the email server for sending unauthorized email in advance.

[0165] For example, an administrator can restrict access to webmail or mail clients and control whether links to emails in transmitted mail are permitted, etc. For example, the outgoing mail processing unit 160 can block outgoing webmail connections using a registered IP address, and can control communication access based on POP3 (Client Server Protocol) / SMTP (Simple Mail Transfer Protocol) to block outgoing mail client communication.

[0166] In addition, when sending an e-mail from a registered IP address and country, the outgoing e-mail processing unit 160 can configure, store and manage an access restriction log to the e-mail server, such as an IP address and date. This access restriction log to the e-mail server can be used to check whether a user's e-mail transmission is permitted the next time the user connects. To check whether a user's e-mail transmission is permitted, the outgoing e-mail processing unit 160 can check the e-mail server access restriction log, which includes user identification information, encrypted e-mail information, user encryption information, device identification information, access IP information, access time information, access location information and communication protocol identification information related to the e-mail engine.

[0167] Meanwhile, returning to Fig. 2, the record management unit 170 can store and manage the mail information processed based on the identification information of the security threat of the targeted e-mail attack as record information. When the mail is processed as a normal mail based on the identification information of the security threat of the targeted e-mail attack, the record management unit 170 can store and manage the record information including the receiving mail domain, sending mail domain, receiving mail address, sending mail address, mail routing, and body information of the mail content as trust authentication information, and when the mail is processed as an abnormal mail, the record information can be transferred to the security threat information synchronization processing unit 140 to update synchronization data of the security threat information.

[0168] In addition, the record management unit 170 is equipped with a learning data processing unit 171 so as to be able to construct a security threat information learning model for blocking targeted email attacks based on learning of the normal email and abnormal email information, and the security threat information learning model may be transferred to the security threat information synchronization processing unit 140 and included in the security threat information synchronization data.

[0169] Meanwhile, the diagnostic reporting unit 180 can collect information on the processing results of the targeted email security threat inspection unit 130, compose email security diagnostic service information from the processing result information, and provide it to the user terminal 200 for an email security diagnostic service.

[0170] More specifically, the diagnostic reporting unit 180 can collect matching result information for each stage of the email security process processed in the targeted email security threat inspection unit 130, and can determine threat level ratio elements for applying one or more quantitative classification conditions corresponding to the collected matching result information.

[0171] The diagnostic reporting unit 180 can then calculate quantitative analysis information corresponding to the threat level ratio elements from the matching results, and based on the quantitative analysis information, can determine the email system to be diagnosed and a score for each threat level stage classification for each email.

[0172] This enables the diagnostic reporting unit 180 to construct diagnostic analysis reporting of email security based on scores for each threat level stage classification, and information on the constructed diagnostic analysis reporting of email security can be provided to the user terminal 200.

[0173] As described above, the targeted e-mail security threat inspection unit 130 can distinguish and process security threats such as spam mail, malicious code, social engineering, and internal information leakage, and can set the type / level / process / priority / processing order of security threats according to the security threat architecture, and can perform corresponding processing processes in the received mail processing unit 150 and the outgoing mail processing unit 160, so that the number of matching cases of each threat level ratio element can be calculated by associating each matching processing result with various quantitative classification conditions. Such quantitative classification conditions can also be called classification criteria for threat level elements.

[0174] In addition, the diagnostic reporting unit 180 applies the quantitative analysis information of each threat level ratio element to a score calculation formula for a preset threat level stage classification, thereby making it possible to configure diagnostic analysis reporting information that can confirm the overall degree of security threat to the email system being diagnosed and provide corresponding response guides for users.

[0175] As a result, the user terminal 200 can receive the diagnostic analysis reporting information and accurately check the state of e-mail security threats based on the security threat architecture based on quantitative actual data, and by receiving corresponding guides and taking measures, it becomes possible to block increasingly diverse security threats such as targeted e-mail attacks in advance.

[0176] Also, the diagnostic reporting unit 180 can provide a warning message to the user terminal 200 based on the information of the diagnostic analysis reporting. The warning message displays the risk of targeted email attacks to the user with terms such as "spam", "similar domain" and "forged header" along with the title of the email in the mailbox, allowing the user to identify what type of email it is. Also, the security administrator can configure whether suspicious emails are forwarded or not forwarded to the user, and the words / syntax of the warning message can also be set and managed for each group.

[0177] Meanwhile, the diagnostic reporting unit 180 can compose advance e-mail security reporting information and provide it to the user terminal 200. The advance e-mail security reporting information can be provided as a warning before the user opens the e-mail, and can provide the user with information about the risk of the received e-mail.

[0178] Such proactive email security reporting information may be displayed, at a minimum, corresponding to the following information, respectively, or as an overall threat level: - Report of received email history: History of emails previously received to an email address to check for similar domains - Delivery route report: Current delivery route and history of changes to delivery route for email transmission - Report Header Forgery: Current status of sender header forgery - URL inspection report: number of malicious URLs detected - Similar Domains: Risk level of similar domains (e.g. TLD, low, medium, high and risk)

[0179] The diagnostic reporting unit 180 can then compose post-event email security reporting information and provide it to the user terminal 200. The post-event email security reporting information is a detailed summary report that allows a security manager or user to recognize the status of email security, and can include research and analysis information such as information on the current status of risky emails, including the following items: - Security risk assessment: daily number of fraudulent e-mails, number of attacks per user account, current situation of attack areas by country, current security grade of e-mail risk - Security risk analysis: Current status of email attacks by type of attack (e.g. spam, malicious code, malicious URLs and attachments, forged headers, lookalike domains) - Attack scenarios (e.g. malicious code, malicious URLs, suspicious sender addresses, forged headers and lookalike domains, etc.)

[0180] The diagnostic reporting unit 180 can also provide a status dashboard interface to the user terminal 200 that can provide an overview of real-time technology status of incoming and outgoing emails affecting operations for selected technology entities, such as operational status, configuration, and operating environment.

[0181] For example, the status dashboard interface configures a real-time information panel of the overall targeted email attack blocking functionality (e.g., total number and status of emails, inbound and outbound email failure reasons, number of targeted email attacks received) to provide internal security administrators with awareness and control.

[0182] As a result, the diagnostic reporting unit 180 can construct diagnostic analysis reporting of email security regarding targeted email attacks based on scores for each threat level stage classification, and information on the constructed diagnostic analysis reporting of email security can be provided to the user terminal 200.

[0183] In addition, the diagnostic reporting unit 180 applies the quantitative analysis information of each threat level ratio element to a score calculation formula for a preset threat level stage classification, thereby making it possible to configure diagnostic analysis reporting information that can confirm the overall degree of security threat of the email system and individual emails being diagnosed and provide corresponding response guides for users.

[0184] More specifically, the criteria for determining the overall security threat level of an individual email may be determined according to the classification criteria of the threat level elements.

[0185] The classification conditions of the classification criteria for the threat level elements can be set corresponding to the detection results of the risk of each targeted email attack, and may include, for example, at least one of detection of malicious code email, detection of malicious code behavior, detection of viruses, detection of ransomware, detection of malicious URLs, detection of URLs in the body of the email, detection of URLs in attachments, detection of header forgery, detection of address change when replying, detection of ID change, detection of domain change, detection of change in the order of ID and domain, detection of sender change, detection of similar domains, detection of emails warning about header forgery, detection of spam email (advertising, business-related), and detection of emails warning about trustworthiness.

[0186] In the case where each of these classification conditions is met, a score can be assigned to each classification condition, and a final score can be calculated by adding up, averaging, etc., the classification criteria for each threat level element. This allows the diagnostic reporting unit 180 to determine a score for each threat level stage classification of the email to be diagnosed.

[0187] More specifically, the classification conditions can be assigned to each threat level stage classification, and the quantitative analysis values ​​detected based on the classification conditions can be summed up corresponding to each threat level stage classification, and a score for each threat level stage classification can be determined according to the summed up values.

[0188] For example, the threat level can be classified into first, second, third, and fourth levels according to the degree of danger, and a score can be calculated for each level and then added up.

[0189] Furthermore, the diagnostic reporting unit 180 can set a risk weighting value corresponding to each threat level step, and the risk weighting value may be assigned as follows: 10% for the first level, 20% for the second level, 30% for the third level, 40% for the fourth level, and so on.

[0190] As a result, the diagnostic reporting unit 180 can calculate the security threat risk of a targeted email attack for the email being diagnosed by multiplying the score for each threat level stage by the weighting value for each level of risk and adding up the results.

[0191] The degree of security threat of such targeted e-mail attacks can be mapped to security grades such as A, B, C, D, and E according to a preset grade. With such mapping, the diagnostic reporting unit 180 can create threat level-based guide content that displays the overall security threat degree corresponding to a specific e-mail as a security grade, and provide it to the e-mail user terminal.

[0192] Here, the diagnostic reporting unit 180 can change and calculate the score in real time by reflecting the user's email history information and setting information that are updated in real time based on the synchronized data of security threat information.

[0193] For example, when a user sets tolerance management for a specific country of origin, emails received from that country may be excluded from risk determination or may be treated as having a risk level of 0.

[0194] This reflection of user settings is intended to diagnose the risk of targeted e-mail attacks when users at companies and other organizations have customized settings according to their e-mail sending and receiving environments.

[0195] In addition, since the results of the inspection of the risk of targeted e-mail attacks of already sent e-mail data are reflected using synchronized data of security threat information, the diagnostic reporting unit 180 can process the calculation of the risk score of targeted e-mail attacks for each received e-mail using the sender address, sender country, and detected malicious code that are determined to be dangerous in the outgoing e-mail.

[0196] In addition, when calculating the risk score of such targeted email attacks, the classification criteria for each threat level element can be classified according to category, and a scoring table for each classified category may be constructed in advance.

[0197] For example, classification criteria for threat level elements may include email protocol and advertising email category, and may be assigned scores such as advertising-related blocking history of 1 point, warning history of 1 point, and trust blocking history of 2 points.

[0198] Also, for example, the classification criteria for threat level elements may include a malicious code category and may be assigned scores such as 3 points for URL detection (including post-mortem risks such as zero-day URLs), 2 points for malicious links in documents, 1 point for viruses, 2 points for ransomware, and 3 points for behavior-based detection.

[0199] Also, for example, the classification criteria for the threat level elements may include a basic spoofing risk category related to social engineering attacks, and may be assigned scores such as 2 points for address forgery, 1 point for ID forgery, 1 point for domain forgery, and 3 points for other forgery.

[0200] Also, for example, the classification criteria for threat level elements may include an intelligent spoofing risk category related to social engineering attacks, and scores such as initial origin risk of 1 point, final origin risk of 2 points, other origin risk of 3 points, risk of 3 points according to similar domain risk, top 2 points, medium 1 point, bottom 1 point, and TLD (top level domain) 2 points may be specified.

[0201] The diagnostic reporting unit 180 may calculate a risk score of an email for blocking such a targeted email attack, map a security level for the targeted email attack, configure information on the mapped security level as guide content, and provide the guide content to a user terminal. For example, the diagnostic reporting unit 180 may configure the guide content as a text or image marker and embed the text adjacent to the email title or at the beginning of the email body.

[0202] Furthermore, the diagnostic reporting unit 180 determines whether the sum of the targeted attack risk scores by item is equal to or greater than a first threshold value, or whether the targeted attack risk score of a specific item is equal to or greater than a second threshold value, or whether the period during which the sum of the targeted attack risk scores by item is equal to or greater than a third threshold value continues for a certain period or more, or whether the number of emails in which the sum of the targeted attack risk scores by item is equal to or greater than the third threshold value is equal to or greater than a certain number within a certain period, and when each condition is determined, it can provide an alert to the incoming mail processing unit 150 or the outgoing mail processing unit 160. The incoming mail processing unit 150 or the outgoing mail processing unit 160 can process a notification to an administrator corresponding to the email for which the alert has been issued, or perform automatic blocking of emails, etc.

[0203] As a result, in the user terminal 200, the state of targeted e-mail security threats calculated based on synchronized data of security threat information obtained by synchronizing targeted e-mail security threat information obtained by inspecting targeted e-mail security threats of received e-mails with targeted e-mail security threat information obtained by inspecting targeted e-mail security threats of outgoing e-mails can be accurately confirmed based on quantitative actual data for each e-mail and system, and by taking measures based on the corresponding guide, it becomes possible to block the increasingly diverse security threats of targeted e-mail attacks in advance.

[0204] 5 and 6 are flowcharts for explaining a service process using the system according to the embodiment of the present invention.

[0205] Referring to FIG. 5 and FIG. 6, FIG. 5 first relates to a process of inspecting received mail for threats of targeted e-mail attacks, and the service providing device 100 collects received mail information (S101).

[0206] Then, the service providing device 100 uses the synchronized data of security threat information to inspect the targeted e-mail security threats corresponding to the newly received e-mail, and the inspection of the targeted e-mail security threats can be performed at multiple levels, such as an inspection of spam threats (S103), an inspection of malware attack threats (S105), and an inspection of social engineering threats (107).

[0207] Here, the inspection of malware attack threats may include inspection of targeted email attack threats such as unidentified malicious code, malicious attachment code, and malicious URL code, and the inspection of social engineering threats may include inspection of header forgery, lookalike domains, account hijacking, and URL phishing.

[0208] Thereafter, based on the inspection result, the service providing device 100 can perform user diagnostic reporting (S109), and based on the inspection result, decide to export or block the mail server (S111).

[0209] Furthermore, the service providing device 100 can compose and provide to the administrator's user terminal 200 or the recipient's terminal 20 a warning message corresponding to removal, blocking or delay.

[0210] In addition, each inspection result may be configured as synchronized data of security threat information configured by synchronizing information on targeted e-mail security threats configured by inspecting targeted e-mail security threats of received e-mails with information on targeted e-mail security threats configured by inspecting targeted e-mail security threats of outgoing e-mails (S113).

[0211] On the other hand, FIG. 6 relates to a process for inspecting an outgoing mail for a threat of a targeted e-mail attack, and the service providing device 100 collects outgoing mail information (S201).

[0212] After that, the service providing device 100 obtains the security threat information that has been synchronized so far from the synchronized data of security threat information in which each inspection result is synchronized information on targeted e-mail security threats constructed by inspecting targeted e-mail security threats of received e-mails and information on targeted e-mail security threats constructed by inspecting targeted e-mail security threats of outgoing e-mails (S203).

[0213] Then, the service providing device 100 uses the synchronized security threat information to check for threats of information leakage based on the transmission approval system (S205).

[0214] Thereafter, the service providing device 100 performs a filtering check process for outgoing e-mails using the synchronized security threat information.

[0215] Then, the service providing device 100 uses the inspection result of the outgoing mail to determine whether to send, block, or delay the outgoing mail to the mail server (S209).

[0216] In addition, the service providing device 100 can compose and provide to the administrator's user terminal 200 or the caller terminal 10 a warning message corresponding to removal, blocking or delay.

[0217] FIG. 7 is a diagram for explaining a process for checking the leakage of a large capacity file according to an embodiment of the present invention.

[0218] Referring to Figure 7, a system according to one embodiment of the present invention includes a sender terminal 10, a first mail management server device 300, a mail conversion processing device 30, a service providing device 100, a network-linked mail approval device 500, a mail restoration processing device 250, a second mail management server device 400 and a recipient terminal 20.

[0219] More specifically, the sender terminal 10, the first mail management server device 300, and the mail conversion processing device 30 can constitute an isolated security network as an internal network. The isolated security network is a network in which mail can be transmitted to an external network only after passing through the network-linked mail approval device 500, and for this purpose, a secured internal network and security device based on various network interface environments may be constructed.

[0220] For this purpose, the network-linked email approval device 500 receives an approval request for email data to be transmitted to an external network from a first email management server device 300 that establishes an email server in the internal network, and processes, via the service providing device 100, outflow inspection to block targeted email attacks, only for emails whose approval and security have been verified by comparing them with a preset approval policy, and can then export the email to a second email management server device 400, etc., via the external network.

[0221] Here, the preset approval policy may be to confirm approval by applying a combination of various policies, such as checking administrator authentication information, checking the approval of a superior in the organization corresponding to the sender, or inspecting whether the email data has security vulnerabilities.

[0222] Conversely, when an external email from an external user is received by the internal network via the second email management server device 400 in the external network, the network-linked email approval device 500 may perform a process of carrying out security checks of the external email's attachments and URLs, etc., via the service providing device 100, and only those emails that have been verified are allowed into the internal network.

[0223] Unlike the operation of the internal network system and the network-linked mail approval device 500, the mail recovery processing device 250, the second mail management server device 400, and the recipient terminal 20, which are located in an external network, can be connected to a public network by either wired or wireless connection to transmit and receive data. The public network is a communication network constructed and managed by the country or a communications carrier, and generally includes telephone networks, data networks, CATV networks, mobile communication networks, etc., and can provide connection services so that an unspecified number of ordinary people can connect to other communication networks or the Internet.

[0224] On the other hand, the sender terminal 10, the first mail management server device 300, the mail conversion processing device 30 and the network-linked mail approval device 500 may each be equipped with a communication module for communicating using a first protocol corresponding to an internal network.

[0225] In addition, the network-linked email approval device 500, the email recovery processing device 250, the second email management server device 400 and the recipient terminal 20 may each be equipped with a communication module for communicating using a second protocol corresponding to an external network.

[0226] In this way, each internal network separation security network and each device constituting the external network can be connected via a mutual wired / wireless network, and the devices or terminals connected to each network can communicate with each other via secured network channels.

[0227] Here, each of the networks may be realized by any type of wired / wireless network, such as a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN), a mobile radio communication network, or a satellite communication network.

[0228] The sender terminal 10 and the recipient terminal 20 include personal computers (PCs), laptop computers, mobile phones, tablet PCs, personal digital assistants (PDAs), portable multimedia players (PMPs), etc., but the present invention is not limited to these and may include a wide variety of devices that can be connected to the first mail management server device 300 or the second mail management server device 400 via a public network or private network. In addition to these, each of the sender terminal 10 and the recipient terminal 20 may be a wide variety of devices that can input and output information using application execution or web browsing.

[0229] Meanwhile, each of the first mail management server device 300 and the second mail management server device 400 is equipped with a system for relaying and storing the contents of electronic mail so that users can send mail created by themselves and receive mail created by the other party, and can communicate with each other using a pre-set protocol depending on the purpose of use, namely, processing the receiving and sending of mail.

[0230] Generally, the mail protocol can use Post Office Protocol 3 (POP3) and Internet Message Access Protocol (IMAP) when receiving mail. Also, the protocol can use Simple Mail Transfer Protocol (SMTP) when sending mail. In this way, each of the first mail management server device 300 and the second mail management server device 400 can be configured and operated as a server system for sending and receiving mail within each separate network.

[0231] In such a system configuration, the mail conversion processing device 30 according to an embodiment of the present invention can be located in an internal network of a security network separated from an external network, and can process the function of converting e-mails containing link information of large-capacity files located in the internal network, subjecting them to outflow inspection for blocking targeted e-mail attacks via the service providing device 100, and then transferring them to the mail restoration processing device 250 in the external network with the approval of the network-linked mail approval device 500.

[0232] To this end, first, the mail conversion processing device 30 can obtain a transmission mail requested for transmission from a sender terminal 10 located in the internal network via the first mail management server device 300, identify link information of a large-capacity file located in the internal network from the transmission mail, and obtain the large-capacity file located in the internal network based on the link information.

[0233] The mail conversion processing device 30 can generate a converted mail in which the large-capacity file is embedded so as to be distinguished as a normal attachment of the transmitted mail, and such a converted mail can be transmitted to the mail restoration processing device 250 located in the external network via the network-linked mail approval device 500.

[0234] In this case, the network-linked email approval device 500 can inspect the security risks of the large-capacity file embedded so as to be distinguished as the normal attachment in accordance with a preset email delivery policy, and can approve the delivery of the converted email after undergoing a leak inspection to block targeted email attacks via the service providing device 100, and the approved converted email can be received by the email restoration processing device 250 according to an embodiment of the present invention before being forwarded to the second email management server device 400.

[0235] The mail restoration processing device 250 can be located in an external network separated from the internal network of the security network, and when it receives a converted mail that has been converted and transmitted from the internal network via the network-linked mail approval device 500, it can perform a restoration and forwarding process in which it constructs a restored mail in which large files in the internal network are restored from the converted mail after undergoing an outflow inspection to block targeted email attacks via the service providing device 100, and forwards the constructed restored mail to the recipient terminal 20 via the second mail management server device 400.

[0236] More specifically, the mail restoration processing device 250 can obtain large files on the internal network from normal attachment data embedded in the converted mail, separate the large files on the internal network from the converted mail, and upload them to an encrypted route on any external network.

[0237] Then, the mail restoration processing device 250 constructs a restoration mail of the converted mail including the uploaded external network route information in the converted mail from which the large-capacity file has been separated, and the constructed restoration mail may be transferred to the second mail management server device 400 and transmitted to the recipient terminal.

[0238] With this system configuration, large files on an internal network that previously could not be sent to an external network can be processed so that they can be sent via a secured electronic mail system, and this process makes it possible to realize a mail service that makes it possible for mail recipients on an external network to easily check large files on the internal network while still utilizing the security system of the mail system.

[0239] For example, if a user at a sender terminal 10 on the internal network simply inputs a file to be exported as a mail as a large file attachment to a normal e-mail, the recipient terminal 20 can obtain the restored and uploaded large file from the external network route information contained in the received mail in the same way as a large file attachment to an outgoing mail, making it possible to process the actual export of a large file.

[0240] In addition, access rights and connection information for such large files on external networks can be managed by the mail restoration processing device 250, compensating for the vulnerable security environment that inevitably requires the use of existing cloud sharing services, etc., and enabling more convenient and secure transmission of mail from internal network files to external networks.

[0241] FIG. 8 is a ladder diagram illustrating a policy-based approval process for large files according to an embodiment of the present invention.

[0242] Referring to FIG. 8, first, the first mail management server device 300 receives a request for mail transmission from the sender terminal 10 and transfers it to the mail conversion processing device 30 (S1001).

[0243] Thereafter, the mail conversion processing device 30 identifies internal network link information corresponding to a large-volume attached file in the internal network from the mail for which a transmission request has been made (S1003).

[0244] In order to identify the information of internal network links, the mail conversion processing device 30 according to an embodiment of the present invention can first extract the link information (URL or URI (Uniform Resource Identifier)) embedded in the mail for which a transmission request has been made via the internal network link identification unit 110, and then perform a tracking inspection of the link information.

[0245] More specifically, the mail conversion processing device 30 extracts, via the internal network link identification unit 110, all link information embedded in the mail for which the transmission request has been made or specified link information designated as a pre-set internal network route (for example, link information whose IP address starts with a private IP address set as the internal network), and connects to the extracted link information to check whether a file has been downloaded and the size of the file.

[0246] As a result, the internal network link identification unit 110 of the mail conversion processing device 30 identifies the size information of the file to be downloaded from the link information that has been checked to be capable of file downloading, and if the size information is equal to or larger than a certain size, it can identify it as link information corresponding to the internal network large-capacity attachment.

[0247] For example, the certain size may be 2 megabytes, and the internal network link identification unit 110 can extract link information for downloading internal network files exceeding 2 megabytes from all link information or specified link information, and identify it as internal network link information corresponding to the internal network large-capacity attachment.

[0248] Then, the mail conversion processing device 30 downloads the target file from the internal network link, and deletes the internal network large capacity link from the transmitted mail (S1005).

[0249] Thereafter, the mail conversion processing device 30 configures EML data by including the target file as an attachment in a normal attachment mail format in the transmission mail from which the large capacity link has been deleted (S1007).

[0250] Then, the mail conversion processing device 30 requests the network-linked mail approval device 500 for approval of transmission of the converted mail in the EML database (S1009).

[0251] The network-linked mail approval device 500 performs inspection processing for attacks on targeted e-mails of large files using the service providing device 100 (S1010), and can determine whether or not to approve the mail based on a preset policy (S1011).If approval is rejected, a rejection message is transferred to the sender terminal 10 via the first mail management server device 300 (S1013), and if approval is confirmed, the converted mail is transmitted to the mail restoration processing device 250 connected to the second mail management server device 400 in the external network (S1015).

[0252] Thereafter, in the mail restoration processing device 250, the target file is separated from the normal attachment of the converted mail, and an inspection process for a targeted email attack of large capacity files is performed using the service providing device 100 (S1016), and the file is restored to a normal mail (S1017).

[0253] Then, the mail restoration processing device 250 uploads the separated target file to an arbitrary route (S1019), and configures a web page that allows access to the upload route information (S1021).

[0254] After this, the mail restoration processing device 250 adds a web page to the attachment of the restored normal mail (S1023), and transfers the restored normal mail to the recipient terminal 20 via the second mail management server device 400 (S1025, S1027).

[0255] In an embodiment of the present invention, the upload path information is exemplified as being added as a web page, however, the present invention is not limited thereto, and the upload path information may be attached to the restored normal email in various ways, such as link information, URL text, etc.

[0256] The above-mentioned method according to the present invention can be created as a program to be executed on a computer and stored in a computer-readable recording medium. Examples of computer-readable recording media include read only memory (ROM), random access memory (RAM), compact disc read only memory (CD-ROM), magnetic tape, floppy disk, optical data storage device, etc.

[0257] In addition, the computer-readable recording medium may be distributed among computers connected via a network, so that the computer-readable code may be stored and executed in a distributed manner.Functional programs, codes, and code segments for implementing the above method may be easily construed by a programmer skilled in the art to which the present invention pertains.

[0258] Furthermore, while the preferred embodiments of the present invention have been illustrated and described above, the present invention is in no way limited to the specific embodiments described above, and it goes without saying that various modifications can be made by a person having ordinary knowledge in the technical field to which the invention pertains without departing from the gist of the present invention as claimed in the claims, and these modified embodiments should not be understood individually from the technical ideas and perspectives of the present invention.

Claims

1. A method of operating an email security system comprising: A step of synchronizing information on targeted e-mail security threats formed by inspecting the targeted e-mail security threats of received e-mails with information on targeted e-mail security threats formed by inspecting the targeted e-mail security threats of outgoing e-mails to form synchronized data of security threat information; and processing newly received emails using delivery routing information included in the security threat information synchronization data; The processing step includes: If the IP information of the newly received mail differs from the accumulated sender's IP history information, the newly received mail is warned to the user or blocked; The IP information of the newly received mail and the accumulated sender's IP history information are A method for operating an email security system, including IP information from which an email was originally created and sent, the IP addresses of servers to which it was forwarded along the way, and the IP address of the server that ultimately sent it.

2. The method of claim 1 , further comprising updating the security threat information synchronization data based on the results of inspecting the newly received email for targeted email security threats.

3. The security threat information synchronization data includes:

10. The method of claim 1, further comprising URL final destination trace inspection information for inspection of malicious code email attack threats.

4. The security threat information synchronization data includes:

2. The method of claim 1, further comprising at least one of header forgery inspection information, similar domain inspection information, and account takeover inspection information for inspecting threats of social engineering attacks.

5. The security threat information synchronization data includes:

2. The method of claim 1, further comprising at least one of intentional information leakage inspection information and unintentional information leakage inspection information for email information leakage inspection.

6. A method of operating the email security system described in claim 5, further comprising a step of using the synchronized data of security threat information to determine whether a recipient of a newly outgoing email is classified as a fraudulent similar email address.

7. A method of operating the email security system described in claim 6, further comprising the step of automatically blocking the delivery of new outgoing email or warning the sender if the recipient is classified as a fraudulent similar email address.

8. A method of operating the email security system described in claim 5, further comprising a step of using the synchronized data of security threat information to inspect for security threats large-capacity attachments that should be converted into normal emails and attached to newly outgoing emails in accordance with an email policy.

9. A method of operating the email security system described in claim 8, further comprising a step of approving the conversion of the large-capacity attachment to be converted and attached to the normal email based on the results of an inspection of the large-capacity attachment for security threats.

10. In a service providing device using an e-mail security system, a security threat information synchronization processing unit that synchronizes information on targeted e-mail security threats formed by inspecting the targeted e-mail security threats of received e-mails with information on targeted e-mail security threats formed by inspecting the targeted e-mail security threats of outgoing e-mails to form synchronized data on the security threat information; a mail processing unit that processes newly received mail using delivery routing information included in the synchronization data of the security threat information; Equipped with The mail processing unit includes: If the IP information of the newly received mail differs from the accumulated sender's IP history information, the newly received mail is warned to the user or blocked; The IP information of the newly received mail and the accumulated sender's IP history information are This service providing device uses an electronic mail security system, which includes IP information from when an email was first created and sent, the IP address of a server to which the email was transferred on the way, and the IP address of a server from which the email was finally sent.

11. The service providing device of claim 10, wherein the inspection of targeted email security threats includes a similar domain inspection that uses cumulative domain information obtained from the synchronized data of the security threat information to detect threats of social engineering attacks using similar domains.

12. The service providing device of claim 11, wherein the similar domain check includes a check process that uses cumulative domain information obtained from the synchronized data of the security threat information to check in stages whether the sender domain included in the newly received email does not match and is similar to the domain included in the cumulative domain information.

13. The service providing device of claim 11, wherein the similar domain check includes a check process that uses cumulative domain information obtained from the synchronized data of the security threat information to check in stages whether the recipient domain included in the newly sent email does not match and is similar to the domain included in the cumulative domain information.

14. The similar domain check includes a step-by-step check process using cumulative domain information obtained from the synchronized data of the security threat information to check whether a recipient or sender domain included in the newly received mail or the newly sent mail is different from and similar to a domain included in the cumulative domain information; The stepwise inspection process includes stepwise calculating a similarity based on the number of similar characters of similar domains that are not identical to the domains included in the cumulative domain information and are detected as similar, The service providing device of claim 11, wherein the step of inspecting targeted email security threats further includes a step of determining a threat level of a similar domain-based social engineering email attack of the newly incoming email or the newly outgoing email based on the similarity based on the number of similar characters.

15. Further comprising the step of: performing diagnostic reporting corresponding to the newly inbound mail or the newly outbound mail based on the result of the inspection of the targeted email security threat; The step of performing diagnostic reporting comprises: The service providing device according to claim 10 , further comprising a step of determining a score for each item corresponding to a classification criterion of a threat level element based on the inspection result of the targeted email security threat.

16. The step of performing diagnostic reporting comprises: calculating a risk score of targeted email attacks using the scores for each item; determining a security grade corresponding to the attack email risk score of the targeted email; forming a guide content according to the determined security grade and embedding the guide content in the email data; The service providing device of claim 15 further comprising:

Images