Security framework system for detecting targeted email attacks

Abstract

The present invention relates to a security framework system for detecting targeted email attacks, the security framework system comprising: a security management layer which synchronizes targeted email security threat information configured by scanning for targeted email security threats in incoming mails and targeted email security threat information configured by scanning for targeted email security threats in outgoing mails; an incoming mail security layer for performing a security scan on incoming mails by using incoming mail data transmitted from the security management layer; and an outgoing mail security layer for performing a security scan on outgoing mails by using outgoing mail data transmitted from the security management layer.

Description

A security framework system for detecting targeted email attacks.

[0001] The present invention relates to a configuration of a security framework for detecting targeted email attacks and an operating method thereof.

[0002] With the advancement of network attack technology, cyberattacks via email are evolving in modern society. The rise of targeted email attacks, which target specific targets and employ sophisticated cyberattack tactics using malware and social engineering, is impacting active Internet users and businesses worldwide.

[0003] Unlike spam phishing attacks that target an unspecified number of people, these targeted email attacks target individuals or companies and then target specific individuals to damage or destroy the information assets of the target entity.

[0004] To carry out targeted email attacks, threat actors gather information and create personalized email messages that appear authentic, persuading the target to respond and ultimately creating a security vulnerability.

[0005] Furthermore, targeted attacks on inbound and outbound emails often employ sophisticated and unknown methods, such as using header forgery, lookalike email addresses, or account takeovers (ATOs), attaching unknown advanced malware, or impersonating legitimate senders trusted by the target. This forces victims to respond to the emails by clicking on attachments intended by the attacker to cause fraudulent transfers, data breaches, or computer system failures, or by sending replies containing personal information.

[0006] This can pose a serious risk to the victim's information assets. However, compared to the severity of these targeted email attacks, email security solutions proposed to date remain limited to fragmented techniques such as simple inbound spam blocking and inbound domain blocking. No solutions have been proposed that comprehensively utilize known technologies to effectively prevent or block targeted email attacks.

[0007] In particular, targeted email attacks on the receiving (inbound) side ultimately lead to security issues on the sending (outbound) side, and issues with sending security in turn lead to security issues on the receiving side. Therefore, a systematic security system is required to comprehensively consider these issues and block targeted email attacks, but no appropriate solution has been proposed.

[0008] The present invention has been devised to solve the problems described above, and its purpose is to provide a security framework system and its operating method capable of effectively detecting targeted email attacks.

[0009] In order to solve the above-described problem, a targeted email security framework system according to an embodiment of the present invention includes a security management layer that synchronizes targeted email security threat information configured by performing an inspection of targeted email security threats in received emails and targeted email security threat information configured by performing an inspection of targeted email security threats in sent emails; an incoming email security layer that performs a security inspection on received emails using incoming email data transmitted from the security management layer; and an outgoing email security layer that performs a security inspection on outgoing emails using outgoing email data transmitted from the security management layer.

[0010] Meanwhile, at least some steps of the operations of the targeted email security framework system according to an embodiment of the present invention for solving the above-described problem can be implemented as a program for executing on a computer and a computer-readable recording medium having the program recorded thereon.

[0011] According to an embodiment of the present invention, a targeted email security framework system is configured with an external system and an internal system, and the internal system is configured with a security management layer, an incoming mail security layer, and an outgoing mail security layer, thereby facilitating synchronization of inspection data between the incoming mail security layer and the outgoing mail security layer.

[0012] Figure 1 is a conceptual diagram schematically illustrating the entire system according to an embodiment of the present invention.

[0013] FIG. 2 is a block diagram illustrating a service providing device according to an embodiment of the present invention.

[0014] FIG. 3 and FIG. 4 are block diagrams for more specifically explaining some configurations of a service providing device according to an embodiment of the present invention.

[0015] FIG. 5 and FIG. 6 are flowcharts for explaining a service process using a system according to an embodiment of the present invention.

[0016] FIG. 7 is a diagram for explaining a large-capacity file leak detection process according to an embodiment of the present invention.

[0017] FIG. 8 is a ladder diagram illustrating a policy-based approval process for a large file according to an embodiment of the present invention.

[0018] FIG. 9 is a block diagram illustrating a security framework system for detecting a targeted email attack and its operating method according to an embodiment of the present invention.

[0019] The following merely illustrates the principles of the present invention. Therefore, those skilled in the art will be able to implement the principles of the present invention and invent various devices and methods within the scope and spirit of the present invention, even if not explicitly described or illustrated herein. Furthermore, all conditional terms and embodiments listed herein are expressly intended, in principle, to facilitate understanding of the concepts of the present invention, and should be understood as being in no way limiting to the specifically listed embodiments and conditions.

[0020] Furthermore, it should be understood that all detailed descriptions of the principles, aspects, and embodiments of the present invention, as well as specific embodiments, are intended to encompass structural and functional equivalents thereof. Furthermore, it should be understood that such equivalents encompass not only currently known equivalents but also equivalents developed in the future, i.e., all devices invented to perform the same function, regardless of structure.

[0021] Thus, for example, the block diagrams herein should be understood as representing conceptual views of exemplary circuits embodying the principles of the present invention. Similarly, all flowcharts, state transition diagrams, pseudocode, and the like, which may be substantially represented on a computer-readable medium, should be understood as representing various processes performed by a computer or processor, regardless of whether a computer or processor is explicitly depicted.

[0022] Furthermore, any explicit use of terms such as processor, controller, or similar concepts should not be construed as exclusively referring to hardware capable of executing software, but should be understood to implicitly include, without limitation, digital signal processor (DSP) hardware, read-only memory (ROM), random access memory (RAM), and non-volatile memory for storing software. Other commonly used hardware may also be included.

[0023] The above-described purposes, features, and advantages will become more apparent through the following detailed description, taken in conjunction with the accompanying drawings. Accordingly, those skilled in the art will be able to readily implement the technical concepts of the present invention. Furthermore, if a detailed description of known technologies related to the present invention is deemed to unnecessarily obscure the gist of the invention, such detailed description will be omitted.

[0024] The terminology used in this application is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this application, it should be understood that the terms "comprise" or "have" indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0025] Hereinafter, with reference to the attached drawings, preferred embodiments of the present invention will be described in more detail. In order to facilitate an overall understanding in describing the present invention, identical reference numerals will be used for identical components in the drawings, and redundant descriptions of identical components will be omitted.

[0026] The term 'mail' used in this specification can be used collectively to refer to electronic mail, web mail, electronic mail, electronic mail, etc. that users send and receive through a computer network via a terminal device and a client program installed on the terminal or a website.

[0027] Figure 1 is a conceptual diagram illustrating an entire system according to one embodiment of the present invention.

[0028] Referring to FIG. 1, a system according to one embodiment of the present invention includes a service providing device (100), a user terminal (200), and a mail server (300).

[0029] More specifically, the service providing device (100), user terminal (200), and mail server (300) can transmit and receive data by being connected to a public network through one or more wired and wireless connections. The public network is a communication network built and managed by a country or a communication infrastructure operator, and generally includes a telephone network, data network, CATV network, and mobile communication network, etc., and provides connection services so that an unspecified number of ordinary people can access other communication networks or the Internet. In the present invention, the public network is replaced with the word "network."

[0030] In addition, the service providing device (100), user terminal (200), and mail server (300) may each include a communication module for communicating using a protocol corresponding to each communication network.

[0031] The above service providing device (100) can be connected to each user terminal (200) and mail server (300) via a wired / wireless network to provide mail security and diagnosis services, and devices or terminals connected to each network can communicate with each other via a preset network channel.

[0032] Here, each of the above networks can be implemented as any type of wired / wireless network, such as a Local Area Network (LAN), a Wide Area Network (WAN), a Value Added Network (VAN), a Personal Area Network (PAN), a Mobile Radio Communication Network, or a Satellite Communication Network.

[0033] The service providing device (100) described in this specification can provide a mail security service that can detect and block attacks that cause unintended program execution through mail, reduction in data processing capability of mail-related systems, phishing scams, etc.

[0034] Furthermore, the service providing device (100) can provide a mail security service that synchronizes targeted email security threat information configured according to a targeted email security threat inspection of an incoming mail with targeted email security threat information configured according to a targeted email security threat inspection of an outgoing mail, configures security threat information synchronization data, and performs a targeted email security threat inspection corresponding to a new incoming mail or a new outgoing mail using the security threat information synchronization data, thereby performing targeted email security threat response processing according to the targeted email security threat inspection of the new incoming mail or the new outgoing mail.

[0035] Here, the targeted email security threat inspection corresponding to the new incoming mail or new outgoing mail may include at least one of a spam attack threat inspection, a malware email attack threat inspection, a social engineering email attack threat inspection, and an email information leak threat inspection targeting a specific email account using the security threat information synchronization data, and the targeted email inspection is processed according to a predefined step-by-step inspection process corresponding to a security level, and the processed inspection data may be used to update the security threat information synchronization data.

[0036] In addition, the service providing device (100) can provide a mail diagnosis service that performs a mail diagnosis process based on quantitative analysis of mail security threat factors in response to targeted email attacks using security threat information synchronization data and targeted email inspection processing information, and provides a diagnosis report based on the above diagnosis process to each email system user terminal (200).

[0037] And the user terminal (200) described in this specification may include a personal computer (PC), a laptop computer, a mobile phone, a tablet PC, a personal digital assistant (PDA), a portable multimedia player (PMP), etc., but the present invention is not limited thereto, and may be a device that can be connected to the service providing device (100) and the mail server (300) through a public network or a private network, etc.

[0038] In addition, each device may be a variety of devices capable of inputting and outputting information through application operation or web browsing. In particular, user terminals (200) may generally be connected to the service providing device (100) through a separate secure network.

[0039] Meanwhile, the mail server (300) is a system that relays and stores e-mail content so that a user can send an e-mail written through a user terminal (200) or a recipient can receive an e-mail written through a user terminal (200). The mail server (300) can perform mutual communication using a preset protocol according to the purpose of use, which is to process the reception and transmission of e-mail.

[0040] Typically, the above protocols may use POP3 (Post Office Protocol 3) and IMAP (Internet Message Access Protocol) when receiving mail. Additionally, the above protocols may use SMTP (Simple Mail Transfer Protocol) when sending mail. In this way, the mail server (300) may be configured and operated as a server system for sending and receiving mail. Furthermore, the mail server (300) may be subdivided into a mail receiving server and a mail sending server, each providing its own function.

[0041]

[0042] FIG. 2 is a block diagram for explaining a service providing device according to an embodiment of the present invention, and FIGS. 3 and 4 are block diagrams for explaining in more detail some configurations of a service providing device according to an embodiment of the present invention.

[0043] First, referring to FIG. 2, a service providing device (100) according to an embodiment of the present invention includes a control unit (110), an inspection data collection unit (120), a targeted email security threat inspection unit (130), a security threat information synchronization processing unit (140), an incoming mail processing unit (150), an outgoing mail processing unit (160), a record management unit (170), a diagnostic reporting unit (180), and a communication unit (125).

[0044] The control unit (110) may be implemented as one or more hardware processors for overall control of the operation of each component of the service providing device (100).

[0045] The communication unit (125) may be equipped with one or more communication modules for communicating with a network where a user terminal (200) or a mail server (300) is located.

[0046] The inspection data collection unit (120) can collect mail information transmitted and received between one or more user terminals (200) via a mail server (300). The mail information may include email header information, email subject, email content body, number of receptions over a certain period, etc.

[0047] Specifically, the email header information may include a mail sending server IP address, mail sending server host name information, sender mail domain information, sender mail address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient mail address, mail protocol information, mail receiving time information, mail sending time information, etc.

[0048] Additionally, the above email header may include network path information required during the process of sending and receiving email, information on protocols used between email service systems for email exchange, etc.

[0049] Additionally, the above mail information may include the extension of the attached file, hash information of the attached file, the attached file name, the body of the attached file content, URL (Uniform Resource Locator) information, etc. The above attached file may include additional content to convey additional information in addition to the body of the mail that the sender wishes to convey to the recipient or to request a response to information.

[0050] The above content can include text, images, videos, and more. Recipients can view the content by launching the corresponding application attached to the email. Recipients can also download, store, and manage the attached files on their local storage.

[0051] The extension of the above attached file can distinguish the file format or type. The extension of the above attached file can be distinguished by a string that generally indicates the file's properties or the application that created the file. For example, text files can be distinguished by the extension [file name].txt, MS Word files by the extension [file name].doc (docx), and Hangul files by the extension [file name].hwp. Additionally, image files can be distinguished by the extension [gif], [jpg], [png], and [tif].

[0052] Additionally, executable files, which are computer files that perform directed tasks according to coded commands, can be classified as [file name].com, [file name].exe, [file name].bat, [file name].dll, [file name].sys, [file name].scr, etc.

[0053] The hash information in the attached file can protect against falsification and ensure information integrity. Hash information, or hash values, can be mapped to a bit string of a fixed length for any data of any length using a hash function.

[0054] Through this, the hash information output through the hash function for the initially created attachment has a unique value. The output hash information or hash value has a one-way property that cannot be used to extract the data input to the function in reverse. In addition, the hash function can guarantee collision avoidance, which makes it computationally impossible for another input data to provide the same output as the output hash information or hash value for a given input data. Accordingly, if the data of the above-mentioned attached file is modified or added, the output value of the hash function will be returned differently.

[0055] In this way, the unique hash information of the attached file can be compared with the hash information or hash value of files exchanged via email to determine whether the file has been modified or tampered with. Furthermore, because the hash information is fixed as a unique value, it can utilize reputation information, a database of past history of files created with malicious intent, enabling proactive quarantine measures. Additionally, the hash function can be utilized in technologies and versions that ensure one-way access and collision avoidance.

[0056] For example, hash information can be used to search for malware in files through websites like VirusTotal or Malwarez. Websites that analyze hash information for these files provide information such as the file provider and hash value. Furthermore, search results for file hash information can be cross-checked with reputation information from numerous global companies that provide IT information security solutions, making them more reliable.

[0057] The targeted email security threat inspection unit (130) processes step-by-step matching of the mail security inspection process corresponding to the mail information according to a preset targeted email security threat inspection process, inspects the mail information by the matched mail security process, and stores and manages mail security inspection information according to the inspection results.

[0058] Here, the targeted email security threat inspection process may include at least one of a spam attack threat inspection, a malicious code email attack threat inspection, a social engineering email attack threat inspection, and an email information leak threat inspection targeting a specific email account using the security threat information synchronization data in response to a new incoming email or a new outgoing email.

[0059] Additionally, these spam attack threat checks, malware email attack threat checks, social engineering email attack threat checks, and email information leak threat checks can be processed sequentially with preset step priorities set according to each security threat type.

[0060] Additionally, the targeted email security threat inspection process can determine different email security processes corresponding to new incoming or outgoing emails. Furthermore, the inspection targets, inspection order, and inspection method of the email security process can be predetermined based on synchronized security threat information synchronization data.

[0061] The above-described targeted email security threat inspection process allocates independently distinct processes as resources when mail information for inbound or outbound transmission is transmitted from a user terminal (200), and can be immediately executed in the inspection area allocated from the mail information. This dynamic resource allocation method can be explained using the concept of virtual space. In this method of allocating resources to virtual space, the mail security process can immediately process tasks in the inspection area allocated from sequentially incoming mail information upon completion of processing.

[0062] In contrast, environments like virtual environments and virtual machines, where processing is limited to a single resource and a specific process is allocated, may have idle time while processing a requested task, while other processes wait for a specific process to complete. In this process-based analysis approach, dynamic resources can offer advantages in processing speed and performance compared to fixed resources.

[0063] The targeted email security threat inspection unit (130) can classify emails for receiving or sending purposes based on the email information collected by the inspection data collection unit (120). Thereafter, the targeted email security threat inspection unit (130) can acquire targeted email security inspection information for each email by sequentially or based on a set priority matching and analyzing the email security processes.

[0064] Here, the targeted email security threat inspection unit (130) can inspect not only email threats using malware, but also non-malicious attack types. Specific types of targeted email attacks include not only malware attacks but also social engineering attacks such as impersonation and account hijacking, which can lead to unintentional or intentional information leaks.

[0065] Accordingly, the targeted email security threat inspection unit (130) includes a spam attack threat inspection unit (131), a malware attack threat inspection unit (133), a social engineering attack threat inspection unit (135), and an information leak inspection unit (137) to detect each type of attack in stages.

[0066] Here, the targeted email security threat inspection unit (130) can use pre-configured security threat information synchronization data from the security threat information synchronization processing unit (140).

[0067] To this end, the security threat information synchronization processing unit (140) can configure security threat information synchronization data by synchronizing targeted email security threat information configured according to the performance of targeted email security threat inspection of received emails and targeted email security threat information configured according to the performance of targeted email security threat inspection of sent emails.

[0068] Here, the security threat information synchronization data may include information on malicious files and identification information on malicious accounts collected from each inspection process and an external security server, and may be configured by synchronizing targeted email security threat information configured according to the performance of targeted email security threat inspection of incoming mail and targeted email security threat information configured according to the performance of targeted email security threat inspection of outgoing mail.

[0069] For example, the security threat information synchronization data may include file information that has been detected as having a high level of malicious threat in a targeted email security threat scan of a specific incoming email, or sender account information that has been detected as having a high possibility of impersonation or account hijacking.

[0070] Additionally, the security threat information synchronization data may include file information that has been detected as having a high information leakage threat level in a targeted email security threat inspection of a specific outgoing email, or recipient account information that has been detected as having a high possibility of impersonation or account hijacking.

[0071] In addition, the security threat information synchronization data may include similar domain inspection information including email account and domain information detected as being associated with similar domain attacks.

[0072] Additionally, the security threat information synchronization data may include account takeover attack detection information including email account and domain information detected as being associated with an account takeover attack.

[0073] In addition, the security threat synchronization data may include zero-day URL attack inspection information that changes the redirection path information of a URL link after the date of receiving the email, and zero-day malware inspection information that processes malicious code or hacking attacks that exploit system security vulnerabilities before a patch to block them is released after the vulnerability is discovered.

[0074] Additionally, the security threat synchronization data may further include delivery routing information including email server information, transit information, and sender information.

[0075] Furthermore, the security threat information synchronization data can be continuously updated and processed using the inspection data processed in each processing unit of the targeted email security threat inspection unit (130), thereby enabling integrated security management of the sending and receiving security systems, and effectively preventing damage to the internal system or information leakage to the outside due to targeted email attacks in advance.

[0076] This security threat information synchronization data is information examined in each security inspection process described below, and may include, for example, unknown malware information, attachment malware information, URL malware information, header forgery information, similar domain information, account hijacking information, URL phishing information, intentional information leak information, unintentional information leak information, and unauthorized email server access information.

[0077]

[0078] In order to perform this inspection process and configure security threat information synchronization data, first, the targeted email security threat inspection unit (130) may include a spam mail inspection unit (131).

[0079] The above spam mail inspection unit (131) can, if the above mail security process is a spam mail security process, match the mail information including mail header information, mail subject, mail content body, number of receptions during a certain period, etc., with a preset spam indicator in stages.

[0080] Here, the aforementioned spam email security threat may include emails that are indiscriminately distributed to an unspecified number of people, often in bulk, for purposes such as advertising or promotional purposes, between unrelated senders and recipients. Furthermore, large volumes of spam emails can overwhelm the data processing capabilities of email systems, potentially reducing their processing capabilities. Furthermore, spam emails carry the risk that users may unintentionally connect to indiscriminate information contained in the body of the email, potentially disguised as information for potential phishing scams.

[0081] Accordingly, the spam mail inspection unit (131) can utilize the spam indicator as an inspection item by inspecting certain patterns that can distinguish mail information including mail header information, mail subject, mail content body, etc. as spam mail. Through this, the spam mail inspection unit (131) can acquire, store, and manage spam mail inspection information by matching the spam indicators step by step.

[0082]

[0083] In addition, the targeted email security threat inspection unit (130) may further include a malware attack threat inspection unit (132).

[0084] Malware can access the memory of the victim's computer system to damage or delete files and programs. Here, the malware attack that is the target of the targeted email security threat inspection can be broadly classified into three types of attacks. The malware attack threat inspection unit (133) can check the synchronized security threat information synchronization data for performing the inspection process for each attack type, and transmit the inspection data according to the inspection result to the security threat information synchronization processing unit (140) to process it so that the security threat information synchronization data is updated again.

[0085] First, the attack type for unknown malware refers to attacks using new, unknown malware that is not registered in big data databases and therefore difficult to detect in antivirus testing. For example, attackers can exploit zero-day vulnerabilities to distribute malware by redirecting URL links or attachments within emails to a later time, rather than the day they were sent. They can then send emails containing attachments containing new malware undetected by security solutions and lure users to click on them.

[0086] Furthermore, malware attacks via attachments are a type of threat where attackers hide malware within files typically sent via email. These attachments can be disguised as documents, compiled and executable files, and even image and video files, and may even be encrypted files with different extensions. Furthermore, attacks using executable files can involve forging the sender's address to trick recipients into opening emails containing malicious documents, or they can involve embedding malware in images and attaching them to the email body.

[0087] Meanwhile, URL-based malware attacks can involve inserting clickable links containing malware into emails with the goal of luring users to malicious websites. Malicious URLs can be embedded in large attachments or emails. Attacks can also include those that execute malware not only when the user clicks the URL in an email or regular attachment, but also when the email is forwarded.

[0088] The above malware attack threat inspection unit (132) can match the above mail information, which further includes hash information of the attached file, attached file name, attached file content body, URL (Uniform Resource Locator) information, etc., with preset malware indicators in stages to perform the security inspection process for each type described above.

[0089] The above-mentioned malware attack threat inspection unit (132) can use the extension of the attached file, the hash information of the attached file, the attached file name, etc., which can be confirmed as attribute values ​​of the attached file, as well as the main body of the attached file content and the URL (Uniform Resource Locator) information included in the main body of the content, as malware indicator inspection items. Through this, the above-mentioned malware attack threat inspection unit (132) can match the above-mentioned malware indicators step by step according to each type and item to obtain malware inspection information, and can store and manage it through the record management unit (170), and provide it to the security threat information synchronization processing unit (140) to process the update of the security threat information synchronization data.

[0090] The above malware indicator can be set to a level value through inspection and inspection items based on items included in the mail information for each step, and each inspection level value can be updated according to the security threat information synchronization data described above.

[0091] For example, the malware indicator Level 1 can match the attachment file name and attachment file extension included in mail information based on big data and reputation information acquired from security threat information synchronization data. Through this, the malware indicator Level 1 can obtain the evaluated level value as the malware indicator Level 1 inspection information. For example, when the inspection information of the malware indicator Level 1 includes the attachment file name, which is a inspection item, as 'Trojan' and the attachment file extension as 'exe', if it matches the information defined as malware in the big data and reputation information, it can be evaluated as '1' from the level value distinguished between 0 and 1. Through this, the inspection information of the malware indicator Level 1 can be obtained as '1'.

[0092] Additionally, the malware indicator Level 2 can match the hash information of an email attachment based on big data and reputation information obtained from security threat information synchronization data. Through this, the evaluated level value can be obtained as the malware indicator Level 2 inspection information. For example, when the inspection item, the attachment hash information, is analyzed as 'a1b2c3d4', if it matches the information defined as malware in the reputation information, the inspection information of the malware indicator Level 2 can be evaluated as '1' from the level value distinguished between 0 and 1. Through this, the malware indicator Level 2 inspection information can be obtained as '1'.

[0093] In the next step, the malware indicator Level 3 can match the URL (Uniform Resource Locator) information included in the attachment or the body of the email content based on the URL reputation information acquired from the security threat information synchronization data. Through this, the evaluated level value can be acquired as the malware indicator Level 3 inspection information. For example, when the inspection item URL information is confirmed as 'www.malicious-code.com', if it matches the information defined as a harmful site that includes a malware file in the URL reputation information, the inspection information of the malware indicator Level 3 can be evaluated as '1' from the level value distinguished between 0 and 1. Through this, the malware indicator Level 3 inspection information can be acquired as '1'. In addition, the malware attack threat inspection unit (132) can respond to zero-day attacks that may be omitted from the URL reputation information. The malware attack threat inspection unit (132) can change the link IP address for a URL without reputation information to the IP address of a specific system and provide the changed IP address to the user terminal (200). When the user terminal (200) attempts to access the URL, it may be connected to the IP address of a specific system changed by the malware attack threat inspection unit (132). The specific system whose link IP address for the URL has previously been changed can continuously check for malware up to the URL's endpoint.

[0094] Meanwhile, the malware attack threat inspection unit (133) uses security threat information synchronization data to classify and manage malware to identify unknown malware, enabling the administrator to classify emails identified as malicious files, and accordingly, even if a user requests retransmission, it can be processed to prevent viruses, etc. from being transmitted.

[0095] In addition, the malware attack threat inspection unit (133) can perform a multi-analysis inspection to inspect unknown malware, and the multi-analysis inspection can detect new viruses that were not detected in the first inspection by inspecting the behavior of malware on the system by combining static inspection and dynamic inspection. The behavior inspection results can be classified into, for example, 'forgery', 'memory access', 'hooking warning', 'file creation', 'file deletion', and 'process execution', and accordingly, the malware attack threat inspection unit (133) inspects malware attack threats from the behavior inspection performance result information, and transmits the inspection results to the security threat information synchronization processing unit (140), so that they can be used to update the security threat information synchronization data.

[0096] For example, the malware attack threat inspection unit (133) can perform a virus test consisting of three stages, and can inspect for malware attack threats by processing the first test (antivirus test), the second test (environmental operating system change test), and the third test (behavior-based analysis test) in stages, and using the results of the inspection at each stage.

[0097] In addition, the malware attack threat inspection unit (133) can regularly scan all inbound and outbound email data of users through a cloud service to perform security threat information synchronization data and big data-based inspection to extract malicious attachments requiring additional inspection.

[0098] In addition, the malware attack threat inspection unit (133) can determine whether there is a risk of a targeted email attack based on data built as big data by the security threat information synchronization processing unit (140) through security threat information synchronization data. The big data analysis function can identify and detect even forged extensions (e.g., .doc, .docx, .ppt, .pptx, .pdf, .txt, .rtf, etc.) as targets for malware analysis.

[0099] Meanwhile, if malicious code is detected in a URL, the malware attack threat inspection unit (133) can convert the URL data of the mail information transmitted to the receiving mail processing unit (150) into an image. Accordingly, in a dangerous detection environment where an attached malicious URL is recognized, the URL link can be prevented from being opened.

[0100] In addition, the malware attack threat inspection unit (133) can monitor potential risks through the aforementioned endpoint URL monitoring and continuously track the final destination of all URLs within the email body or document file. Here, the malware attack threat inspection unit (133) can track all URLs as the nth URL interconnected. In addition, the malware attack threat inspection unit (133) can check the document file included in the email body from the URL, and especially in the case of large-capacity attachments, all URLs for malicious attachments or document files can be tracked after downloading, even for large-capacity attachments that are downloaded by bypassing the URL in the email body.

[0101] In addition, the malware attack threat inspection unit (133) can perform URL post-testing to re-examine access to the URL in real time through file and endpoint scanning when a user attempts to click a URL link after receiving an email, and restrict access if a risk is detected. The URL post-testing information according to this can be updated in real time in the security threat information synchronization data, and the receiving mail processing unit (150) and the sending mail processing unit (160) can perform processing such as blocking of targeted email attacks and user notifications by referring to the URL post-testing results confirmed by the security threat information synchronization data.

[0102] In addition, the malware attack threat inspection unit (133) can perform image-based filtering to inspect for malware attacks, which can detect text malicious graphic images configured to avoid text-based filtering or malicious attachment filtering.

[0103] In this way, the inspection information acquired at each malware indicator level through the above malware security process can be ultimately aggregated ('3') and stored and managed as malware inspection information. The aggregated malware inspection information can be provided to the security threat information synchronization processing unit (140) and used to update security threat information synchronization data.

[0104]

[0105] Zero-day malware, the first type of malware email attack described above, is not registered in big data databases, making it difficult for security systems to detect unknown malware used by attackers. Vulnerabilities in zero-day malware can be exploited to send emails that insert attachments or clickable links containing unknown malware undetectable by security systems, and to entice users to click on undesirable links. Furthermore, zero-day malware can access the user's computer memory, potentially damaging or deleting files and programs.

[0106] Meanwhile, as a security requirement to respond to zero-day malware attacks, as mentioned above, behavior-based analysis inspections must be performed to detect new viruses not registered in the pattern to address the threat of new malware attacks. Furthermore, descriptions of the behavior of newly discovered or detected malware must be reported manually or through an automated process.

[0107] Additionally, as a countermeasure against the aforementioned zero-day malware, malware classification management and multi-analysis inspection are performed. Malware classification management allows security administrators to configure emails identified as malicious files, preventing viruses from being delivered even if the user requests retransmission. Furthermore, multi-analysis inspection detects unknown malware not detected in primary testing through environmental operating system change testing, which examines the behavior of malware on the system through a combination of static and dynamic testing. Behavior results are categorized into, for example, 'forgery,' 'memory access,' 'hooking warning,' 'create file,' 'delete file,' or 'run process.'

[0108] A second type of malware email attack, malware in attachment, involves attackers hiding malware within files typically sent via email. Attachments within these malicious emails can be disguised as documents, executables, or image and video files. These files may also be encrypted with different extensions. Attacks using executable files may involve spoofing the sender's address and tricking recipients into opening emails containing malicious documents.

[0109] Meanwhile, as a security requirement to respond to the above-mentioned attachment malware attack, it is possible to detect fake file extensions of various file formats and provide email reputation analysis.

[0110] Additionally, as a countermeasure against the aforementioned attachment malware, big data-based inspection is performed. Big data-based inspection regularly scans all users' inbound and outbound email data via a cloud service, extracting malicious attachments requiring further inspection. Based on data stored in the big data system, it determines whether there is a risk of targeted email attacks. This feature also identifies and detects forged file extensions.

[0111] A third type of malware email attack, the "Malware in URL" attack, involves inserting a clickable link containing malware into an email to lure the user into visiting a malicious website. Furthermore, the malicious URL may be included in a large attachment and / or the email body. This attack can execute malware not only during transmission, but also when the user clicks the URL in the email or a regular attachment.

[0112] Meanwhile, as a security requirement to counter the aforementioned URL malware attacks, all URLs must be checked for malware and the final destinations of URLs within multiple linked URLs must be tracked. Furthermore, when a user executes a URL after receiving an email, the post-URL must be checked to prevent malware attacks. Furthermore, opening URL links can be disabled to prevent users from accidentally clicking on malicious URLs.

[0113] Additionally, as countermeasures against the aforementioned URL malware, URL image conversion, endpoint URL monitoring, and URL post testing are implemented. URL image conversion prevents URL links from being opened in risky environments where attached malicious URLs are recognized. Endpoint URL monitoring continuously tracks the final destination of all URLs within email bodies or document files by monitoring potential threats. For example, for large attachments downloaded by bypassing URLs in the email body, all URLs to malicious attachments or document files after downloading must be tracked. URL post testing re-examines URL access in real time through file and endpoint scans when a user attempts to click a URL link after receiving an email, and restricts access if a threat is detected. Additionally, inbound email security generates a new URL for inspection each time the URL is accessed, and if no issues are found, the user is redirected to the original URL.

[0114]

[0115] Meanwhile, the targeted email security threat inspection unit (130) may further include a social engineering attack threat inspection unit (133). The social engineering attack threat inspection unit (133) is executed when the email security inspection process is a social engineering attack threat security process, and can match social engineering attack analysis data acquired from email information item by item based on security threat information synchronization data and preset social engineering attack security threat items. The social engineering attack analysis data may be acquired by performing an analysis process for each attack type corresponding to the email information.

[0116] For example, the social engineering attack threat inspection unit (133) may use the recipient email domain, sender email domain, recipient email address, sender email address, email routing, email content body information, etc., which can be extracted from emails determined to be normal, as social engineering attack threat inspection items. Through this, the social engineering attack threat inspection unit (133) may perform a type inspection for each social engineering attack threat inspection item, thereby acquiring, storing, and managing social engineering attack threat inspection information.

[0117] More specifically, the social engineering attack threat inspection unit (135) can perform header forgery inspection, similar domain inspection, account hijacking inspection, and URL phishing inspection when performing attack type inspection for each social engineering attack threat inspection item.

[0118] Forged headers are a type of social engineering attack that evades detection by forging account information in the header. Attackers use forged email headers to bypass the email's destination when replying. Through forged header attacks, attackers can intercept legitimate users' emails, which may contain company credentials and personal information. Detection of such header forgery can include detecting forged email headers that allow attackers to bypass the email destination when replying. If the headers are forged, attackers risk intercepting regular users' emails, which may contain company credentials and personal information.

[0119] As a security requirement to counter the aforementioned forged header attack, if the reply email address is different when replying to an inbound email, the user must be blocked or warned, and compliance with the email communication protocol must be verified. Accordingly, the social engineering attack threat inspection unit (135) can detect and block such header forgery attacks in advance through header forgery inspection. Based on the inspection information of the social engineering attack threat inspection unit (135), the outgoing email processing unit (160) can block in advance or issue a warning to the sending user if the reply email address is different when replying to an incoming email. For this purpose, the social engineering attack threat inspection unit (135) can check in advance whether the email communication protocol is authenticated.

[0120] In header forgery inspection, the social engineering attack threat inspection unit (135) can detect a forged sender address in an email by checking whether the sender's email complies with a communication protocol (e.g., SPF, DKIM, DMARC).

[0121] In header forgery inspection, the social engineering attack threat inspection unit (135) can also manage the sender reputation of the IP address and domain and check whether the email address has a trustworthy domain.

[0122] In addition, as a countermeasure against the aforementioned forged header attack, analysis of email header information and communication protocol authentication are performed. By analyzing the email header information, the sender header value (From:) of the received email is determined.<id@domain> ) and the reply-to header value (Reply-To:<id@domain> ) are the same or different, and provide filtering results by checking which part of each header value is different. In addition, communication protocol authentication verifies the sender's email to determine whether it complies with the communication protocol (e.g., SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail)), detects a forged sender address in the email, manages the sender reputation of the IP address and domain, and checks whether the email address has a reliable domain. For example, in order to check for header forgery, the social engineering attack threat inspection unit (135) analyzes the email header information to check the sender header value (From:) of the inbound email.<id@domain> ) and the reply-to header value (Reply-To:<id@domain> ) can be checked to see if they are different.

[0123] And, the social engineering attack threat inspection unit (135) can output the step-by-step filtering results as inspection results by determining which part of each header value is different. For example, in case of ID forgery, the sender header value (From:<ABC@XYZ.com> ) and the reply-to header value (Reply-To:<BAC@XYZ.com> ) may be a different email address. Also, in case of domain forgery, the sender header value (From:<ABC@XYZ.com> ) and the reply-to header value (Reply-To:<ABC@YXZ.com> ) may be a case where the 'Domain' is a different email address. In addition, in the case of address forgery, it may be a case where the sender address in the reply is a different email address, and in the case of signature forgery, it may be a case where the signature part of the email content is a different email address.

[0124] Look-alike domain scanning examines a type of attack where attackers send malicious emails from email addresses that are so similar to common, familiar senders that the human eye cannot distinguish them, but may actually be malicious domains of the attacker. For example, the capital letter "I" and the lowercase letter "l" are similar in shape, and this similarity can be exploited in attacks.

[0125] As a security requirement to respond to the aforementioned similar domain attacks, if the sender's domain is detected as a similar domain based on accumulated email history, the user should be notified of the level of risk similarity and the attack should be blocked. Furthermore, the difference in the number of email addresses should be used as a criterion for determining similar email fraud attacks, and if the top-level domain (TLD) is different, it should be managed separately. In addition, the security administrator should be able to directly register fraudulent similar email addresses that appear suspicious. Accordingly, the social engineering attack threat inspection unit (135) can check whether the sender's email address or domain is a similar domain based on accumulated email history, and the received email processing unit (150) can notify the user of the level of risk similarity and block the corresponding email.

[0126] Here, the social engineering attack threat inspection unit (135) may use the number of similar but non-identical characters between the email address of the email history accumulated and managed in the security threat information synchronization data and the email address included in the header information of the new email as a criterion for determining whether a new email is a similar email fraud attack and the possibility of a social engineering attack threat. For example, the social engineering attack threat inspection unit (135) may determine that the possibility of a social engineering attack threat is higher as the number of similar but non-identical characters is smaller, and may output the judgment result as a risk level as an inspection result.

[0127] Additionally, email security administrators can directly register suspicious similar email addresses in the security threat information synchronization data, and email addresses that are similar but have different TLDs (top level domains) can be classified and managed separately.

[0128] More specifically, the social engineering attack threat inspection unit (135) can detect mails of similar domains that include a number of similar characters (e.g., 3 characters) or less that are generally difficult for users to distinguish as social engineering attack threat mails by calculating the similarity between the domain information included in the header information of a new mail and the accumulated domain information included in the mail history of the security threat information synchronization data synchronized by the security threat information synchronization processing unit (140).

[0129] Accordingly, the receiving mail processing unit (150) or the sending mail processing unit (160) can perform targeted email security threat response processing, including blocking the reception or transmission of mail, delaying the reception or transmission of mail, deleting mail, or sending a user warning notification message, based on the results of the social engineering attack threat inspection corresponding to the new mail.

[0130] As a countermeasure against the aforementioned similar domain attacks, domain similarity calculation is performed. Domain similarity calculation accumulates the sender domains of inbound emails and analyzes newly received emails by comparing them against the accumulated domains. Meanwhile, similar domains with three or fewer characters that are difficult to identify can be blocked. Inbound emails are suspended or blocked if the top-level domain (TLD) is modified, the order of the string array is changed, or one of the strings is changed to a similar character or characters, creating a set of strings. However, to prevent false positives, domain similarity may not be determined solely based on a difference in the number of characters. For example, the social engineering attack threat inspection unit (135) can detect a social engineering attack threat level if the TLD (top level domain) of the sender domain of a new received mail has been partially modified, the string array has been partially rearranged, or one of the strings has been changed to a similar character or a different character compared to other existing mail history information included in the security threat information synchronization data, and can output the detected threat level as an inspection result to the received mail processing unit (150). The received mail processing unit (150) can selectively perform processing such as blocking reception, delaying reception, or deleting reception of a new received mail according to the threat level, and processing a user warning notification message, according to a preset similar domain processing policy.

[0131] The risk level of similar domains for these social engineering attack threats can be categorized into five stages, as shown below, based on the degree of change in similar but inconsistent characters compared to other existing mail history information included in the security threat information synchronization data.

[0132] That is, the social engineering attack threat inspection unit (135) can perform an inspection process that checks in stages whether the sender domain included in the new received mail is similar to, but does not match, the domain included in the accumulated domain information by using the accumulated domain information obtained from the security threat information synchronization data through the performance of the similar domain inspection, and can output the similar domain attack risk stage level of the social engineering attack threat, which is divided into five stages as shown below, as an inspection result.

[0133] TLD level: When the last segment of the email domain (e.g., .com, .net, .org, etc.) is changed to a similar character.

[0134] Low Level: If the email address alphabet has been changed to three or more similar characters that are distinguishable.

[0135] Normal level: If the email address alphabet has been changed to two similar characters that are distinguishable.

[0136] High Level: If the email address alphabet has been changed to a single distinguishable character.

[0137] Risk Level: If the email address alphabet consists only of similar letters that are difficult to distinguish (e.g., l (lowercase L) and I (uppercase I)).

[0138] According to this configuration, the social engineering attack threat inspection unit (135) can, through the step-by-step inspection process, step-by-step calculate the degree of similarity based on the number of similar characters of similar domains detected as similar but not matching the domain included in the accumulated domain information, and, based on the degree of similarity based on the number of similar characters, determine the social engineering email attack threat level based on the similar domain of the new sent mail or new received mail.

[0139] Such similar domain-based social engineering email attack threat level information is composed of targeted email security threat inspection data for new emails and is transmitted to the receiving email processing unit (150) or the sending email processing unit (160), and corresponding blocking, delaying, or deleting of the aforementioned emails and a user warning notification process can be performed.

[0140] Meanwhile, the social engineering attack threat inspection unit (135) can detect social engineering attack threats that use actual user accounts by performing an account takeover (ATO) inspection.

[0141] In an account takeover attack, an attacker attempts to log into a stolen email account and then scans the user's email history to find confidential information and potential secondary victims. For example, an attacker may use account information stolen from a phishing site to send emails requesting changes to a remittance account or requesting the transfer of confidential information stored in the account.

[0142] As a security requirement to respond to the aforementioned account takeover (ATO) attack, if the sender location of the email is different from that of previously received emails, the user should be warned or the email should be blocked. In addition, if the IP address of the email server is different from that of previously received emails, the user should be warned or the email should be blocked. Also, if the email transmission path is different from that of previously received emails, the user should be warned or the email should be blocked. To this end, the social engineering attack threat detection unit (135) according to an embodiment of the present invention can perform an account takeover inspection to detect social engineering attack threats utilizing account takeover using learning data for each account takeover inspection item obtained from the security threat information synchronization data of the security threat information synchronization processing unit (140).

[0143] To this end, the security threat information synchronization processing unit (140) can configure accumulated learning data for each account hijacking inspection item, and according to the artificial intelligence model learning processing between the configured learning data and the email item data of the actual account hijacking case, a learning model can be configured to output the possibility of recognizing that the new sent email or the new received email is an email sent by a hijacked account. Here, the artificial intelligence model learning processing is a known artificial intelligence deep learning neural network technology, and various known learning technologies such as CNN, DNN, RNN, LSTM, and regression analysis can be applied.

[0144] In addition, the social engineering attack threat inspection unit (135) can perform an inspection process to inspect whether the new sent email or the new received email is an email sent by a hijacked account by applying the account hijacking inspection item data of the new sent email or the new received email to the learning model of the accumulated learning data for each account hijacking inspection item.

[0145] For example, according to the learning model described above, the security threat information synchronization processing unit (140) can learn the header structure information of mail information for account hijacking detection, and the social engineering attack threat detection unit (135) can input the header structure information of a new incoming mail or a new outgoing mail into the configured header structure learning model to check the validity corresponding to the account hijacking detection. This account hijacking detection method includes a comparative analysis between the artificial intelligence-based learning records of past data on email and current new data.

[0146] In addition, the social engineering attack threat inspection unit (135) can perform account takeover inspection according to a preset inspection process using not only the learning model but also the sender history information.

[0147] More specifically, the accumulated learning data for each account hijacking inspection item may include sender history information obtained from the mail header of a received or sent mail, and the account hijacking inspection of the social engineering attack threat inspection unit (135) may include an inspection process for comparing the accumulated learning data of the sender history information with the sender location information or sender IP information of the new sent or new received mail to check whether the new sent or new received mail is a mail sent by a hijacked account.

[0148] Here, the sender history information includes initial destination information, waypoint information, and final destination information, which are configured based on a mail sending IP and a mail server IP, and the account hijacking inspection may include an inspection process for comparing the initial destination information, waypoint information, or final destination information obtained from a header of the new sent mail or the new received mail to check whether the new sent mail or the new received mail is a mail sent by a hijacked account.

[0149] More specifically, if an account hijacking occurs, the sender's location or IP address is likely to change. Accordingly, the security threat information synchronization processing unit (140) can map the sender's location information and IP history information to the security threat information synchronization data and manage them cumulatively. The social engineering attack threat inspection unit (135) can analyze the header information of mail information to check for account hijacking and determine whether the sender's location information and IP history information have changed.

[0150] Here, the sender's location information and IP history information may include the sender's country information, sender IP address information, and server IP address information. In particular, the email header information may include the IP address from which the email was first created and sent (initial destination information), the IP address of the server through which the email was delivered (waypoint information), and the IP address of the server that ultimately sent the email (final destination information).

[0151] That is, the email header information includes the IP address history of the sending server for sending the email, including initial destination information, transit information, and final destination information. The security threat information synchronization processing unit (140) can map and accumulate the sender's location information and IP history information, including the initial destination information, transit information, and final destination information, to the security threat information synchronization data.

[0152] In addition, the social engineering attack threat inspection unit (135) can check whether the sender's account has been hijacked by comparing the initial destination information, transit information, and final destination information obtained from each accumulated managed sender's location information and IP history information with the header information of the new mail.

[0153] More specifically, for example, a case in which an account is taken over can be exemplified as follows:

[0154] - In case of change of initial destination: If the initial destination of the sender location and IP of the email included in the header information of the new email (the IP address of the mail server from which the initial email was requested to be sent) is identified as a changed country that is different from the location information and IP history information of each cumulatively managed sender (e.g., if the initial destination of the cumulatively managed sender is 1.1.1.1 (country A) and the final destination is 2.2.2.2 (country A), but the header of the new email has the initial destination as 3.3.3.3 (country B) and the final destination as 2.2.2.2 (country A))

[0155] - In case of change in final destination: If the sender location and final destination of the IP address (the IP address of the mail server that last processed the email transmission) included in the header information of the new email are identified as a changed country that is different from the location information and IP history information of each cumulatively managed sender (e.g., if the cumulatively managed sender's transit point is 1.1.1.1 (country A) and the final destination is 2.2.2.2 (country A), but the new email's header has the transit point 3.3.3.3 (country B) and the final destination has changed to 3.3.3.3 (country B)).

[0156] Additionally, as a countermeasure against the aforementioned account takeover (ATO) attack, training and validation of email data for the same sender, as well as sender location change detection analysis, are performed. After email data for the same sender is trained, received emails must be analyzed in real time to perform training data and validation. Training data validation involves training the configured header structure and social graph, and comparing and analyzing past training records with current data when sending emails. Sender location change detection analyzes the header information of received emails to accumulate sender location IP history and compares newly received emails with the sender IP countries in the accumulated history. Email headers include the IP address of the email's original creator, the server IP address at the time of sending, and the IP address of the server from which the email was ultimately sent. Accordingly, the IP history for the destinations (first destination, transit destination, and final destination) of all received emails is accumulated, and if the country of the sender's location IP address of a new received email differs from that of a previous received email, the authenticity of the sender is detected. Accordingly, the social engineering attack threat inspection unit (135) can perform an account hijacking attack inspection and transmit the inspection results to the receiving email processing unit (150) and the sending email processing unit (160).

[0157] For example, if the sender's current location is different from that of a previously received email, the outgoing email processing unit (160) may warn the user of the account hijacking check result or block the outgoing email. In addition, the incoming email processing unit (150) may warn the user of the account hijacking check result or block the email if the IP address of the received email server is different from that of a previously received email. Furthermore, the incoming email processing unit (150) may warn the user of the account hijacking check result or recommend blocking the email if the current email has a different sending path from that of a previously received email. In addition, the social engineering attack threat detection unit (135) may also perform an inbound management function that blocks emails based on a specific bandwidth or IP range.

[0158] Meanwhile, the social engineering attack threat inspection unit (135) can further perform URL phishing inspection. URL phishing refers to an attack that steals a victim's ID and password. The attacker creates a phishing page or website and uses a malicious URL or file included in an email to induce the victim to enter account information.

[0159] As a security requirement to counter URL phishing attacks, such as the one described above, the final destination of URLs containing webpages that induce personal information input must be continuously tracked. For example, for phishing detection, the social engineering attack threat detection unit (135) can track the final destination of a URL within the URL when an email user accesses a phishing site and enters their ID and password, and check whether the URL contains a webpage that induces personal information input.

[0160] Additionally, as a countermeasure against URL phishing attacks, URL endpoint tracking and analysis of the HTML source code of web pages are performed. To track URL endpoints, the final destination of all URLs must be tracked to monitor for the possibility of information input guidance. Furthermore, the HTML source code of web pages must be analyzed to check for input text boxes that prompt users to provide personal information or account information such as IDs and passwords, and to determine whether the input information is transmitted to an external (third-party) server.

[0161] In this way, through the above-mentioned social engineering attack threat inspection process, the inspection information can be finally combined ('3') and stored and managed as social engineering attack threat inspection information. The combined social engineering attack threat inspection information can be transmitted to the security threat information synchronization processing unit (140) and used for updating, storing, and managing security threat information synchronization data, and can be transmitted to the receiving mail processing unit (150) and the sending mail processing unit (160) and used as security threat determination information.

[0162]

[0163] Meanwhile, the targeted email security threat inspection unit (130) may include an information leak inspection unit (137) to respond to internal information leak security threats. Here, the information leak inspection unit utilizes security threat information synchronization data and mail information attribute information to inspect whether outgoing mail has been leaked, and transmits the inspection information to the outgoing mail processing unit (160), so that sending can be blocked or approval for transmission of the outgoing mail through the mail server (300) can be denied.

[0164] The information leak inspection unit (137) can inspect information leaks as outbound email threats by users, i.e., targeted email attack security threats arising from email transmission by users.

[0165] First, the information leak detection unit (137) can detect intentional information leakage. Intentional information leakage refers to an act in which employees intentionally leak the company's confidential information and / or their personal information to an outside party via work or personal email due to the absence of an internal security policy. If the information leak detection unit (137) matches specific leakage conditions corresponding to intentional information leakage set by the security manager in response to an outgoing email, it can transmit the detection information to the outgoing email processing unit (160) to perform processing to suspend or block the email transmission. In addition, if the outgoing email processing unit (160) matches specific leakage conditions, it can transmit and process a notification message and a warning notification message to the user terminal (200) that allows the sender to set a transmission delay time for the outgoing email.

[0166] Meanwhile, as a security requirement to respond to intentional information leakage among the outbound email threats by users as mentioned above, the security manager must be able to set conditions for email transmission and must be able to use a function to reconsider email transmission if the set conditions are not met.

[0167] In addition, the information leakage detection unit (137) can detect unintentional information leakage and transmit the detection information to the outgoing mail processing unit (160) to block, warn, or delay unintentional information leakage. Unintentional information leakage can occur due to the carelessness or negligence of internal employees. On the other hand, when an account user using internal network isolation sends a large attachment file externally from an isolated internal network, if the attachment file contains important company information or personal information of other employees, a serious information leakage problem can occur.

[0168] Meanwhile, as a security requirement to counter unintentional information leaks among the aforementioned outbound email threats, users should be warned or automatically blocked from replying to or sending emails to addresses classified as malicious. Furthermore, emails containing large attachments should be converted to allow secure transmission from the internal network to the external network, and converted emails should be restored to allow secure transmission of large attachments from the internal network to the external network. Furthermore, to prevent information leaks, emails sent by the sender should be recalled, and the content of outbound emails that meet certain criteria, such as the IP address from which the email was viewed and the number of times the email was opened, should be encrypted.

[0169] The information leak detection unit (137) can detect cases where a user replies or sends an email to an email address classified as a similar email address from malicious account data obtained from security threat synchronization data, configure unintentional information leak information, and transmit the information to the outgoing email processing unit (160). The outgoing email processing unit (160) can provide a warning for an outgoing email, automatically block it, or delay processing based on the unintentional information leak information.

[0170] In addition, the information leak detection unit (137) can check the security risk for detecting unintentional or intentional information leaks corresponding to large-capacity attachments in cases where large-capacity attachments of emails are converted into general attachments and passed through a network connection system in order to safely transmit large-capacity attachments to an external network in a security network where the internal and external networks are isolated. This means cases where large-capacity attachments are converted into general attachments so that they can pass the approval of the network connection system according to a preset email transmission policy. In this case, the information leak risk detection can include malware scans, virus scans, and internal information leak risk inspections for large-capacity attachments converted and inserted as general attachments. Here, the internal information leak risk inspection can include an internal information leak risk inspection that checks whether specific security keywords or specific security phrases are included and the frequency thereof, according to preset security policy data.

[0171] In addition, the information leak inspection unit (137) can perform malware scans, virus scans, and internal information leak risk scans when restoring large-capacity attachments that have been converted and transferred from an external network to an internal network in a security network where the internal and external networks are isolated. In particular, this may apply when encrypted external network path information of a large-capacity attachment is attached as URL information, or when a web page file that can access the encrypted external network path information of a large-capacity attachment is attached as a general attachment.

[0172] In addition, the information leak inspection unit (137) can perform encryption of the contents of the sent email if the IP address that checked the email, the number of times the email was opened, etc. meet certain conditions, and it is desirable that the recovery of the email that has been sent be processed so that individual users cannot access it.

[0173] As a countermeasure against the aforementioned user-driven outbound email threats, secure email management, application configuration for approval emails, and email delivery restrictions are implemented. Instead of sending actual emails to recipients, secure emails are sent with links to preview email information (e.g., sender, subject line) on a secure web portal. Users are then able to manage the sent secure emails. Furthermore, approval emails allow for the configuration of identity applications that notify users when there are pending actions for approval or denial of a request. Furthermore, if an email contains specific keywords and attachment types, the approver sets up an approval process based on the organization chart. These emails can be sent when the approver approves or denies the sending of emails containing specific keywords requiring approval in the subject line, attachment, or file extension. And with email sending limits, you can set limits on the maximum number of emails you can send at once, limit the number of users you can send to per day, and limit the number of recipients per email, all to maintain the health of your email server and the security of your account.

[0174] Meanwhile, as a countermeasure against intentional information leaks through outbound emails by users, an outbound blocking policy is established, along with outbound email delay and retrieval / delete features. The outbound blocking policy blocks attempts to leak information and data via email by setting a customized outbound policy for the company. Blocking policy conditions include attachments, outbound email capacity (to block attempts at large-scale data leaks), capacity limitations for large files, image size limits within the email body, an exception sender list, keywords (numbers or words reflecting personal information), and attachment file names or extensions. Furthermore, email delay and retrieval / delete can set a delay between the sending and delivery times, and email delivery can be canceled during this delay. The ability to cancel mail within the delay period is granted to security administrators and users. Once canceled, mail cannot be re-delivered and must be re-composed.

[0175] Additionally, as countermeasures against unintentional information leaks, which are threats from outbound emails by users, email encryption, email conversion, and email retrieval are performed. Email encryption protects sensitive information from being read by anyone other than the intended recipient by encrypting or disguising the contents of emails and attachments. Meanwhile, as email conversion conditions, the following conditions must be met for email conversion to safely transmit emails with large attachments from a separate internal network to an external network. Large attachments, inserted as general attachments according to a preset email delivery policy, are inspected for security risks and, after approval, the converted email is transmitted. Furthermore, as email retrieval conditions, the following conditions for restoring converted emails must be met to safely transmit emails with large attachments from a separate internal network to an external network. Security risks for large attachments inserted to be classified as general attachments according to preset email transmission policies should be checked, encrypted external network path information for large attachments restored from converted mail should be attached as URL information, and a web page file that can access the encrypted external network path information of large attachments should be attached as a general attachment.

[0176]

[0177] Targeted email attack threats include outbound email threats by attackers, including the use of taken-over accounts and unauthorized email server access. In the case of taken-over accounts, outbound email attacks typically begin after a user account has been compromised. The attacker then uses the compromised account to randomly send follow-up emails that exploit other people's personal information contained in the user's inbound and outbound emails. Consequently, accounts associated with the compromised user can potentially become secondary victims and are subsequently reused in phishing attacks.

[0178] Meanwhile, unauthorized email server access is an outbound email attack method where an attacker gains control of an email server by taking control of it. Using stolen account credentials, the attacker can gain unauthorized access to a user's corporate email account. For example, if an email server is compromised, the attacker can retrieve a user's password, which can then grant access to other hosts on the organization's network.

[0179] As a security requirement to respond to outbound email threats by attackers as mentioned above, for attacks using hijacked accounts, security administrators and users are required to set specific IPs and countries that are allowed to access email accounts, and malware detection functions are implemented in the same way as inbound email security requirements are implemented when sending emails.

[0180] Additionally, to combat unauthorized email server access attacks, access to unregistered SMTP (Simple Mail Transfer Protocol) and national webmail services should be blocked. Furthermore, detailed information about access is essential to identify unauthorized email server attacks. Requests for unauthorized email server access should not be forwarded to the email server. Furthermore, if the sender's SMTP information does not match the recipient's SMTP information, email delivery should be blocked.

[0181] Additionally, as a countermeasure against outbound email attacks by external attackers, as described above, IP permission settings are implemented to address attacks using hijacked accounts. IP permission settings allow security administrators and email users to register specific IP addresses and countries with "Security IP Registration" or "Permitted Country Registration," allowing them to block email attacks by receiving emails from these permitted IP addresses and countries.

[0182] Meanwhile, regarding unauthorized email server access, Email server / IP access control allows security administrators to control secure email links by restricting access to webmail or mail clients. Webmail can be blocked via registered IP addresses, and mail client communications can be blocked by controlling POP3 (Client Server Protocol) / SMTP (Mail Transfer Protocol)-based communication connections. Furthermore, emails can be sent from registered IP addresses and countries, and email server access restriction logs, including IP address and date, can be provided. Email server access logs allow administrators to determine whether user access is authorized or denied.

[0183]

[0184] Meanwhile, the receiving mail processing unit (150) and the sending mail processing unit (160) can process the mail status according to the targeted email security threat determination information obtained through the mail security inspection information and the mail information analysis.

[0185] The above-described receiving mail processing unit (150) and sending mail processing unit (160) can determine whether to suspend subsequent mail security processes and process the mail status if the targeted email security threat identification information determines the mail to be abnormal. Accordingly, the receiving mail processing unit (150) and sending mail processing unit (160) can, based on priority, perform only the necessary processing in the initial inspection stage if a problem is discovered, and then determine whether to terminate the inspection and terminate the subsequent inspection stage without performing any further processing. This can secure the efficiency of the mail security service, reduce system complexity, and improve processing efficiency.

[0186] The above-mentioned mail security inspection information may utilize information obtained by synthesizing the spam mail attack threat inspection information, malware attack threat inspection information, social engineering attack threat inspection information, and information leak inspection information generated by the targeted email security threat inspection unit (130). For example, if the targeted email security threat inspection unit (130) performs an inspection process on mail information, and the score generated from the spam mail inspection information is '3', the score generated from the malware attack threat inspection information is '2', the score generated from the social engineering attack threat inspection information is '1', and the score generated from the government leak attack threat inspection information is '0', the score combined with the targeted email attack threat inspection information may be obtained as '7'. At this time, based on the preset security threat determination information, a comprehensive score in the range of 0-3 may be classified as a normal mail, a score in the range of 4-6 as a gray mail, and a score in the range of 7-12 as an abnormal mail. Accordingly, emails with a mail security inspection value of '7' can be identified as abnormal emails. Furthermore, the results of each inspection item included in the mail information inspection information can be assigned an absolute priority or prioritized based on weighted information, depending on the item.

[0187] And, as illustrated in FIG. 4, the receiving mail processing unit (150) may include a mail distribution processing unit (151) that processes mail determined to be normal mail based on the security threat determination information into a receiving or sending status that can be processed by the user terminal.

[0188] In addition, the above-described receiving mail processing unit (150) may further include a mail disposal processing unit (152) that processes mails determined to be abnormal mails based on the security threat determination information in a state where access by the user terminal is impossible.

[0189] Additionally, the above-described receiving mail processing unit (150) may further include a mail neutralization processing unit (153) that converts and processes mail determined to be graymail based on the security threat determination information into non-executable file content and provides the user terminal with the ability to selectively process the mail status.

[0190] In general, the gray mail can be classified as spam or junk mail, or conversely, as normal mail. In the present invention, the gray mail can be defined as a mail type that is classified when the security threat identification information is calculated as an intermediate value within a certain range that cannot be determined as normal or abnormal. The mail sanitization processing unit (153) can convert the gray mail including the body of the suspicious content, etc., into an image file and provide it in a mail state that can be checked by the user terminal (200). In addition, the mail sanitization processing unit (153) can remove or modify a section suspected of being a malicious code in an attached file and provide it to the user terminal (200).

[0191] Furthermore, the mail distribution processing unit (151), mail disposal processing unit (152), and mail detoxification processing unit (153) can perform the same process for outgoing mails processed in the outgoing mail processing unit (160).

[0192] Meanwhile, the outgoing mail processing unit (160) includes an outgoing mail approval system linkage unit (161) and an outgoing mail filtering processing unit (162).

[0193] The outgoing mail approval system linkage (161) can, when a targeted email attack security threat such as information leakage is determined from the mail information of the outgoing mail, send a request message to reject mail approval to the mail approval system connected to the mail server (300) or process a warning notification.

[0194] Here, the sending mail approval system linkage (161) can be configured to send an email to the user informing him of each processing status information when the security manager approves, rejects, or puts on hold an approval request through the mail approval system.

[0195] For example, in a mail approval system, approval can be determined based on the organizational chart if specific keywords and attachment file formats set by the administrator are included. In this case, the outgoing mail approval system linkage (161) can, when specific keywords requiring approval are detected among the subject, attachment, or file extension, compose an email containing processing status information, including whether the administrator approved or rejected the email transmission, and send it to the sender's account.

[0196] Furthermore, the outgoing email approval system integration (161) can also set limits on the maximum number of emails that can be sent at one time by limiting email transmissions to the email approval system. The outgoing email approval system integration (161) can maintain email server health and account security by limiting the number of users who can send emails per day and the number of recipients per email.

[0197] In addition, the outgoing mail filtering processing unit (162) can perform filtering processing such as discarding or neutralizing the outgoing mail when a targeted email attack security threat such as a malicious code is determined from the mail information of the outgoing mail.

[0198] For example, if a targeted email security threat is determined to be present in a requested email, the outgoing email processing unit (160) may transmit a secure email containing a link that allows the recipient to preview a filtered email that has been neutralized, instead of sending the actual email to the email recipient.

[0199] In addition, the outgoing mail processing unit (160) can process post-management services to respond to targeted email attack security threats against outgoing mail even after the user has sent the mail. The post-management services are limited to be processed by special accounts such as administrators, and the outgoing mail processing unit (160) can, through the post-management services, perform the following functions: confirming the recipient's access and inquiry for email security, confirming the recipient's secure email access IP, confirming the recipient's secure email access date and time, and controlling the recipient's access to the secure email (allowing / blocking).

[0200] In addition, the outgoing mail processing unit (160) can perform log monitoring and notification of malicious account information obtained from security threat synchronization data, and the monitored log can include detailed log information such as ID, location (country), IP address, date, and status (success or failure).

[0201] The outgoing mail processing unit (160) can report the results of monitoring malicious accounts within the email server by identifying malicious login attempts to a user account, providing a notification to the user terminal, and displaying the notification on an email or dashboard interface.

[0202] Meanwhile, the outgoing email processing unit (160) can process email encryption to prevent intentional information leakage. Email encryption protects sensitive information from being read by anyone other than the intended recipient by encrypting or disguising the contents of emails and attachments.

[0203] In addition, the outgoing mail processing unit (160) may provide functions for delaying sending, checking sent mail, and deleting sent mail to prevent intentional or unintentional information leakage. To prevent intentional or unintentional information leakage by users, the outgoing mail processing unit (160) may set a delay time between the sending time and the delivered time, and mail transmission may be canceled within the delay time. The authority to cancel emails within the delay time may be granted to administrators and users, and once canceled, outgoing emails cannot be sent and must be re-written.

[0204] Additionally, the outgoing mail processing unit (160) can restrict the country and IP addresses associated with an account to proactively block account hijacking attacks. To set these restrictions, the outgoing mail processing unit (160) provides a function that allows security administrators and email users to register specific IP addresses and countries accessible through "Security IP Registration" or "Allowed Country Registration." Accordingly, users can only send emails from allowed IP addresses and countries.

[0205] In addition, the outgoing mail processing unit (160) can block access to the email server for unauthorized mail sending in advance through email server IP access control.

[0206] For example, an administrator can control whether to allow email links in sent emails, etc. by restricting access to webmail or mail clients. For example, the outgoing mail processing unit (160) can block outgoing webmail connections using registered IPs, and can also block outgoing emails based on mail client communication by controlling communication access based on POP3 (client server protocol) / SMTP (mail transfer protocol).

[0207] In addition, the outgoing mail processing unit (160) can configure, store, and manage an email server access restriction log, such as an IP address and date, when sending an email from a registered IP address and country. In addition, this email server access restriction log can be used to confirm whether the user is allowed to send an email the next time he or she connects. In order to confirm whether the user is allowed to send an email, the outgoing mail processing unit (160) can check an email server access restriction log that includes user identification information, encrypted email information, user password information, device identification information, access IP information, access time information, access location information, and communication protocol identification information for the email engine.

[0208] Meanwhile, referring back to FIG. 2, the record management unit (170) can store and manage the mail information processed according to the targeted email attack security threat determination information as record information. If the mail is processed as a normal mail according to the targeted email attack security threat determination information, the record management unit (170) stores and manages the record information including the receiving mail domain, sending mail domain, receiving mail address, sending mail address, mail routing, mail content body information, etc. as trust authentication information, and if the mail is processed as an abnormal mail, the record information can be transmitted to the security threat information synchronization processing unit (140) to update the security threat information synchronization data.

[0209] In addition, the record management unit (170) can build a security threat information learning model for blocking targeted email attacks based on learning of the normal email and abnormal email information, including a learning data processing unit (171), and the security threat information learning model can be transmitted to the security threat information synchronization processing unit (140) and included in the security threat information synchronization data.

[0210]

[0211] Meanwhile, the diagnostic reporting unit (180) can collect processing result information of the targeted email security threat inspection unit (130), configure email security diagnosis service information from the processing result information, and provide it as an email security diagnosis service to the user terminal (200).

[0212] More specifically, the diagnostic reporting unit (180) can collect step-by-step matching result information of the mail security process processed by the targeted email security threat inspection unit (130), and determine a threat level ratio factor for applying one or more quantitative classification conditions corresponding to the collected matching result information.

[0213] In addition, the diagnostic reporting unit (180) can produce quantitative analysis information corresponding to the threat level ratio factor from the matching result, and based on the quantitative analysis information, can determine a score for each threat level stage classification for the mail system that is the diagnosis target.

[0214] Accordingly, the diagnostic reporting unit (180) can configure email security diagnostic analysis reporting based on a score by threat level stage classification, and the configured email security diagnostic analysis reporting information can be provided to the user terminal (200).

[0215] As described above, the targeted email security threat inspection unit (130) can process spam mail security threats, malware security threats, social engineering security threats, internal information leak security threats, etc. by classifying them, and the security threat type / level / process / priority / processing order can be set by the security threat architecture, and the processing process of the incoming mail processing unit (150) and the outgoing mail processing unit (160) corresponding thereto can be performed, and the number of matching cases of each threat level ratio element can be calculated by corresponding each matching processing result to various quantitative classification conditions. These quantitative classification conditions can also be referred to as threat level element classification criteria.

[0216] In addition, the diagnostic reporting unit (180) can configure diagnostic analysis reporting information that can confirm the comprehensive security threat level of the email system to be diagnosed and provide a response guide for the user by applying quantitative analysis information of each threat level ratio element to a score calculation formula for each preset threat level stage classification.

[0217] Accordingly, the user terminal (200) can receive the above diagnostic analysis reporting information, accurately check the email security threat status based on the security threat architecture based on quantitative actual data, and receive a corresponding guide to take action, thereby enabling the user terminal (200) to proactively block increasingly diverse security threats such as targeted email attacks.

[0218] Additionally, the diagnostic reporting unit (180) can provide a warning message to the user terminal (200) based on the diagnostic analysis reporting information. The warning message displays the risk of a targeted email attack with terms such as "spam," "similar domain," and "forged header" along with the email subject in the user's mailbox, allowing the user to identify the type of email. Furthermore, the security manager can configure suspicious emails to be delivered or not delivered to the user, and can also manage the words / phrases in the warning message by group.

[0219] Meanwhile, the diagnostic reporting unit (180) can configure pre-email security reporting information and provide it to the user terminal (200). The pre-email security reporting information can be provided as a notification before the user opens the email, and can provide information on the risk of the received email.

[0220] This pre-email security reporting information may be displayed individually or as an overall threat level, at least in response to the following information:

[0221] - Reporting of receipt history: History of previous receipts to an email address to check for similar domains.

[0222] - Forwarding path report: Current forwarding path and history of forwarding path changes for email transmissions

[0223] - Header Forgery Report: Status of sender header forgery

[0224] - URL Scan Report: Number of malicious URLs detected

[0225] - Similar domains: The risk level of the similar domain (e.g., TLD, low, medium, high, and critical).

[0226] In addition, the diagnostic reporting unit (180) can configure post-email security reporting information and provide it to the user terminal (200). The post-email security reporting information is a detailed summary report that allows a security manager or user to recognize the email security status, and may include investigation analysis information such as information on the current status of risky emails, including the following.

[0227] - Security risk assessment: daily number of scam emails, number of attacks received per user account, attack area status by country, and security rating for current email risk.

[0228] - Security Risk Analysis: Email attack status by attack type (e.g., spam, malware, malicious URLs and attachments, forged headers, similar domains)

[0229] - Attack scenarios (e.g., malware, malicious URLs, suspicious sender addresses, forged headers, and lookalike domains)

[0230] Additionally, the diagnostic reporting unit (180) can provide a status dashboard interface to the user terminal (200), and the status dashboard interface can provide an overview of the real-time technical status of incoming and outgoing emails that affect the operation of a selected technical entity, such as the operating status, configuration, and operating environment.

[0231] For example, the Status Dashboard interface configures real-time information panels for the entire targeted email attack blocking capability (e.g., total number and status of emails, reasons for inbound and outbound email failures, number of targeted email attacks received), enabling internal security administrators to be aware of and control the situation.

[0232] Accordingly, the diagnostic reporting unit (180) can configure email security diagnostic analysis reporting for targeted email attacks based on scores classified by threat level stage, and the configured email security diagnostic analysis reporting information can be provided to the user terminal (200).

[0233] In addition, the diagnostic reporting unit (180) can configure diagnostic analysis reporting information that can confirm the comprehensive security threat level of the email system and individual emails to be diagnosed by applying quantitative analysis information of each threat level ratio element to a score calculation formula for each preset threat level stage classification, and provide a response guide for the user to respond to the same.

[0234] More specifically, the criteria for determining the overall security threat level of an individual email can be determined based on the threat level element classification criteria.

[0235] The classification conditions of the above threat level element classification criteria can be set in response to the risk detection results of each targeted email attack, and for example, can include at least one of malware mail detection, malware behavior detection, virus detection, ransomware detection, malicious URL detection, URL detection in the body, URL detection in the attachment, header forgery detection, address change detection upon reply, ID change detection, domain change detection, ID & domain order change detection, sender change detection, similar domain detection, header forgery warning mail detection, spam mail (advertisement, business) detection, and reliability warning mail detection.

[0236] If each of these classification conditions is met, a score can be assigned to each classification condition, and a final score can be calculated based on operations such as the sum or average of each threat level element classification criteria. Accordingly, the diagnostic reporting unit (180) can determine a score for each threat level stage classification of the diagnosis target email.

[0237] More specifically, the above classification conditions can be assigned to each threat level stage classification, and quantitative analysis values ​​detected according to the classification conditions can be summed corresponding to each threat level stage classification, and a score for each threat level stage classification can be determined according to the summed value.

[0238] For example, the threat level stages can be classified into stages 1, 2, 3, and 4 according to the degree of risk, and a score can be calculated for each stage and added together.

[0239] Furthermore, the diagnostic reporting unit (180) can set risk weights corresponding to each of the above threat level stages. The risk weights can be assigned as follows: 10% for Level 1, 20% for Level 2, 30% for Level 3, and 40% for Level 4.

[0240] Accordingly, the diagnostic reporting unit (180) can calculate the targeted email attack security threat risk of the diagnosis target email by multiplying the score for each threat level step by the above-mentioned risk weight and adding up the results.

[0241] The level of risk of such targeted email attack security threats can be mapped to security levels such as A, B, C, D, and E according to preset levels, and based on this mapping, the diagnostic reporting unit (180) can compose threat level-based guide content that displays the comprehensive security threat risk corresponding to a specific email as a security level, and provide it to the email user terminal.

[0242] Here, the diagnostic reporting unit (180) can change and calculate the score in real time by reflecting the user's email history information and setting information that are updated in real time based on the security threat information synchronization data.

[0243] For example, if a user configures permission management settings for a specific sending country, emails received from that sender may be excluded from the risk assessment or given a risk score of 0.

[0244] This reflection of user settings is intended to diagnose the risk of targeted email attacks when users, such as companies, have customized their settings according to their email sending and receiving environments.

[0245] In addition, since the results of the targeted email attack risk inspection of the sent mail data are reflected through the security threat information synchronization data, the diagnostic reporting unit (180) can process the calculation of the targeted email attack risk score for each received mail by using the sender address, sender country, and detected malicious code determined to be dangerous in the sent mail.

[0246] Additionally, in calculating the risk score of these targeted email attacks, each threat level element classification criterion can be classified by category, and a scoring table for each classified category can be pre-built.

[0247] For example, threat level factor classification criteria may include email protocol and advertising email category, and scores may be assigned such as 1 point for advertising-related blocking history, 1 point for warning history, and 2 points for trustworthy blocking history.

[0248] Additionally, for example, the threat level element classification criteria may include malware categories, and scores may be assigned such as 3 points for URL detection (including post-risks such as zero-day URLs), 2 points for malicious links within documents, 1 point for viruses, 2 points for ransomware, and 3 points for behavior-based detection.

[0249] Additionally, for example, the threat level factor classification criteria may include basic symmetry risk categories related to social engineering attacks, and scores may be assigned such as 2 points for address falsification, 1 point for ID falsification, 1 point for domain falsification, and 3 points for other falsifications.

[0250] Additionally, for example, the threat level element classification criteria may include an intelligent impersonation risk category related to social engineering attacks, and scores may be assigned such as 1 point for initial sender risk, 2 points for final sender risk, 3 points for other sender risk, 3 points for similar domain risk, 2 points for high, 1 point for medium, 1 point for low, and 2 points for TLD (top-level domain).

[0251] The diagnostic reporting unit (180) calculates an email risk score for blocking such targeted email attacks, maps security levels for targeted email attacks, and configures the mapped security level information as guide content, which can then be provided to the user terminal. For example, the diagnostic reporting unit (180) can insert the guide content into email data as text or image markers, and the markers can be displayed adjacent to the email subject line or at the start of the email body.

[0252] In addition, the diagnostic reporting unit (180) determines whether the sum of the targeted attack risk scores for each item is equal to or greater than a first threshold, or the targeted attack risk score for a specific item is equal to or greater than a second threshold, or the sum of the targeted attack risk scores for each item is equal to or greater than a third threshold for a predetermined period of time, or the number of mails having the sum of the targeted attack risk scores for each item is equal to or greater than a predetermined number within a predetermined period of time, and when each condition is determined, a warning notification can be provided to the receiving mail processing unit (150) or the sending mail processing unit (160). The receiving mail processing unit (150) or the sending mail processing unit (160) can process an administrator notification corresponding to a warning-notified mail, or perform automatic mail blocking processing, etc.

[0253] Accordingly, in the user terminal (200), the targeted email security threat status calculated based on the security threat information synchronization data that synchronizes the targeted email security threat information configured according to the targeted email security threat inspection of the received email and the targeted email security threat information configured according to the targeted email security threat inspection of the sent email can be accurately confirmed based on quantitative actual data for each email and system, and by receiving and taking action on the corresponding guide, it is possible to block in advance the increasingly diverse security threats to targeted email attacks.

[0254]

[0255] FIG. 5 and FIG. 6 are flowcharts for explaining a service process using a system according to an embodiment of the present invention.

[0256] Referring to FIGS. 5 and 6, FIG. 5 first relates to the targeted email attack threat inspection processing of received email, and the service providing device (100) collects received email information (S101).

[0257] In addition, the service providing device (100) performs a targeted email security threat inspection corresponding to a new received email using security threat information synchronization data, and the targeted email security threat inspection can perform multi-level inspections for each stage, such as a spam threat inspection (S103), a malware attack threat inspection (S105), and a social engineering threat inspection (107).

[0258] Here, malware attack threat inspection may include targeted email attack threat inspection such as unknown malware, attachment malware, URL malware, etc., and social engineering threat inspection may include header forgery, similar domain, account hijacking, and URL phishing inspection.

[0259] Thereafter, based on the inspection results, the service providing device (100) can perform user diagnosis reporting (S109) and decide to export or block to the mail server based on the inspection results (S111).

[0260] Furthermore, the service providing device (100) can configure a warning notification message corresponding to export, blocking or delay and provide it to the administrator's user terminal (200) or the recipient terminal (20).

[0261] In addition, each inspection result can be configured as configured security threat information synchronization data by synchronizing the targeted email security threat information configured according to the performance of the targeted email security threat inspection of the received email and the targeted email security threat information configured according to the performance of the targeted email security threat inspection of the sent email (S113).

[0262] Meanwhile, Fig. 6 relates to processing of targeted email attack threat inspection of sent email, and the service providing device (100) collects sent email information (S201).

[0263] Thereafter, the service providing device (100) obtains the security threat information synchronized to date from the security threat information synchronization data in which the targeted email security threat information configured according to the performance of the targeted email security threat inspection of the received email and the targeted email security threat information configured according to the performance of the targeted email security threat inspection of the sent email are synchronized (S203).

[0264] And, the service providing device (100) performs an information leakage threat inspection based on a sending approval system using synchronized security threat information (S205).

[0265] Thereafter, the service providing device (100) performs filtering inspection processing of the sent mail using the synchronized security threat information.

[0266] And, the service providing device (100) uses the inspection result of the sent mail to decide whether to export, block, or delay the mail to the mail server (S209).

[0267] Furthermore, the service providing device (100) can configure a warning notification message corresponding to export, blocking or delay and provide it to the administrator's user terminal (200) or the sender terminal (10).

[0268]

[0269] FIG. 7 is a diagram for explaining a large-capacity file leak detection process according to an embodiment of the present invention.

[0270] Referring to FIG. 7, a system according to an embodiment of the present invention includes a sender terminal (10), a first mail management server device (300), a mail conversion processing device (30), a service providing device (100), a network-linked mail approval device (500), a mail restoration processing device (250), a second mail management server device (400), and a recipient terminal (20).

[0271] More specifically, the sender terminal (10), the first mail management server device (300), and the mail conversion processing device (30) can form a secure network separated from the internal network. The network-separated secure network is a network in which mail transmission to an external network is possible only through a network-linked mail approval device (500), and for this purpose, a secured internal network and security devices based on various network interface environments can be constructed.

[0272] To this end, the network-linked mail approval device (500) receives a request for approval of email data to be transmitted to an external network from a first mail management server device (300) that constructs a mail server in an internal network, compares the data with a preset approval policy, and processes a leak inspection for blocking targeted email attacks through a service provision device (100) only for approved and security-verified emails, and can export them to a second mail management server device (400) or the like through an external network.

[0273] Here, the pre-configured approval policy can be applied in a complex manner to confirm approval, such as verifying administrator authentication information, verifying approval from an organizational superior corresponding to the sender, or checking whether email data has security vulnerabilities.

[0274] Conversely, when an external user's external mail is received in the internal network through the second mail management server device (400) of the external network, the network-linked mail approval device (500) may perform processing to bring only verified mail into the internal network by performing security checks on attachments and URLs of the external mail through the service providing device (100).

[0275] Unlike the operation of the internal network system and the network-linked mail approval device (500), the mail restoration processing device (250), the second mail management server device (400), and the recipient terminal (20) located in the external network can transmit and receive data by being connected to at least one of a wired and wireless network through a connection to a public network. The public network is a communication network constructed and managed by a country or a communication infrastructure operator, and generally includes a telephone network, a data network, a CATV network, and a mobile communication network, and can provide a connection service so that an unspecified number of ordinary people can access other communication networks or the Internet.

[0276] Meanwhile, the sender terminal (10), the first mail management server device (300), the mail conversion processing device (30), and the network-linked mail approval device (500) may each include a communication module for communicating with a first protocol corresponding to the internal network.

[0277] In addition, the network-linked mail approval device (500), mail restoration processing device (250), second mail management server device (400), and recipient terminal (20) may each include a communication module for communicating with a second protocol corresponding to an external network.

[0278] In this way, each internal network separation security network and each device constituting the external network can be connected to each other through a wired / wireless network, and devices or terminals connected to each network can communicate with each other through a mutually secured network channel.

[0279] Here, each of the above networks can be implemented as various types of wired / wireless networks, such as a local area network (LAN), a wide area network (WAN), a value-added network (VAN), a personal area network (PAN), a mobile radio communication network, or a satellite communication network.

[0280] And the sender terminal (10) and the receiver terminal (20) may include a personal computer (PC), a laptop computer, a mobile phone, a tablet PC, a personal digital assistant (PDA), a portable multimedia player (PMP), etc., but the present invention is not limited thereto, and various devices that can connect to the first mail management server device (300) or the second mail management server device (400) through an internal network, a public network, a private network, etc. may be exemplified. In addition, each of the sender terminal (10) and the receiver terminal (20) may be various devices capable of inputting and outputting information through application operation or web browsing.

[0281] Meanwhile, each of the first mail management server device (300) and the second mail management server device (400) includes a system for relaying and storing e-mail content so that a user can send an e-mail written by the user or receive an e-mail written by the other party, and can perform communication between the devices by utilizing a preset mail protocol according to the purpose of use, which is to process receiving and sending e-mail.

[0282] Typically, the above mail protocols may use POP3 (Post Office Protocol 3) or IMAP (Internet Message Access Protocol) when receiving mail. Additionally, the above protocols may use SMTP (Simple Mail Transfer Protocol) or EML (Electronic mail) when sending mail. In this way, each of the first mail management server device (300) and the second mail management server device (400) may be configured as a server system for sending and receiving mail within separate networks, and may each operate accordingly.

[0283] In such a system configuration, the mail conversion processing device (30) according to an embodiment of the present invention may be located in an internal network of a security network separated from an external network, and may process a function of converting an email containing link information of a large-capacity file located in the internal network, and then, after receiving a leak inspection for blocking a targeted email attack through a service providing device (100), receiving approval from a network-linked mail approval device (500), and then transmitting the email to a mail restoration processing device (250) in an external network.

[0284] To this end, first, the mail conversion processing device (30) can obtain a transmission mail requested for transmission from a sender terminal (10) located in the internal network through the first mail management server device (300), identify link information of a large file located in the internal network from the transmission mail, and obtain the large file located in the internal network based on the link information.

[0285] In addition, the mail conversion processing device (30) can generate a conversion mail in which the large file is inserted to be distinguished as a general attachment file of the transmission mail, and this conversion mail can be transmitted to the mail restoration processing device (250) located in the external network via the network-linked mail approval device (500).

[0286] In this case, the network-linked mail approval device (500) can check the security risk of the large file inserted to be classified as the general attachment file according to the preset mail sending policy, and after receiving a leak inspection for blocking a targeted email attack through the service providing device (100), can approve the sending of the converted mail, and the approved converted mail can be received by the mail restoration processing device (250) according to the embodiment of the present invention before being transmitted to the second mail management server device (400).

[0287] The mail restoration processing device (250) may be located in an external network separated from the internal network of the security network, and upon receiving a converted mail transmitted from the internal network through a network-linked mail approval device (500), the device may perform a restoration and delivery process of configuring a restored mail in which a large file of the internal network is restored from the converted mail after a leak inspection for blocking targeted email attacks through a service providing device (100), and then delivering the configured restored mail to the recipient terminal (20) via a second mail management server device (400).

[0288] More specifically, the mail restoration processing device (250) can obtain a large file of the internal network from the general attachment file data included in the converted mail, separate the large file of the internal network from the converted mail, and upload it to an encrypted arbitrary external network path.

[0289] And, the mail restoration processing device (250) configures a restoration mail of the converted mail by including the uploaded external network path information in the converted mail from which the large file is separated, and the configured restoration mail is transmitted to the second mail management server device (400) and can be transmitted to the recipient terminal for processing.

[0290] According to this system configuration, large files in the internal network that could not be exported to the external network by mail can be processed so that they can be exported through a secure email system. Through this process, a mail service can be implemented that allows mail recipients on the external network to easily check large files in the internal network while utilizing the mail system security system as is.

[0291] For example, if a sender terminal (10) of an internal network user simply inputs a file to be exported as a large file attachment to a general email, the recipient terminal (20) can obtain the uploaded large file from the external network path information included in the received email, which is restored in the same manner as the large file attachment to the sent email, so that actual export of the large file can be processed.

[0292] In addition, since access rights and connection information for large files in these external networks can be managed by the mail restoration processing device (250), it complements the vulnerable security environment in which existing cloud sharing services, etc. were inevitably used, and enables more convenient and secure external network mail transmission of internal network files.

[0293]

[0294] FIG. 8 is a ladder diagram illustrating a policy-based approval process for a large file according to an embodiment of the present invention.

[0295] Referring to FIG. 8, first, the first mail management server device (300) receives a mail transmission request from a sender terminal (10) and transmits it to a mail conversion processing device (30) (S1001).

[0296] Thereafter, the mail conversion processing device (30) identifies internal network link information corresponding to the internal network large-capacity attachment file from the mail for which transmission has been requested (S1003).

[0297] In order to identify internal network link information, the mail conversion processing device (30) according to an embodiment of the present invention can first extract link information (URL or URI) included in a transmission-requested mail through the internal network link identification unit (110) and perform a tracking inspection of the link information.

[0298] More specifically, the mail conversion processing device (30) extracts, through the internal network link identification unit (110), all link information included in the requested transmission mail or designated link information designated as a preset internal network path (e.g., link information starting with a private IP address whose IP address is set to the internal network), and accesses the extracted link information to check whether a file has been downloaded and the size of the file.

[0299] Accordingly, the internal network link identification unit (110) of the mail conversion processing device (30) identifies the size information of the file to be downloaded among the link information checked to be capable of file download, and if the size information is greater than a certain size, it can be identified as link information corresponding to the internal network large-capacity attachment file.

[0300] For example, the above schedule size may be exemplified as 2 megabytes, and the internal network link identification unit (110) may extract link information for downloading an internal network file exceeding 2 megabytes from among all link information or designated link information, and identify it as internal network link information corresponding to the internal network large capacity attachment file.

[0301] And, the mail conversion processing device (30) downloads the target file from the internal network link and deletes the internal network large capacity link from the transmission mail (S1005).

[0302] Thereafter, the mail conversion processing device (30) includes the target file as an attachment file in a general attachment mail format in the transmission mail from which the large-capacity link has been deleted, thereby configuring EML data (S1007).

[0303] And, the mail conversion processing device (30) requests the network-linked mail approval device (500) to approve transmission of the converted mail based on the EML data (S1009).

[0304] The network-linked mail approval device (500) performs a targeted email attack inspection process of a large file using a service providing device (100) (S1010), determines whether to approve an email based on a preset policy (S1011), and if approval is rejected, transmits a rejection message to the sender terminal (10) via the first mail management server device (300) (S1013), and if approval is confirmed, transmits the converted email to the mail restoration processing device (250) connected to the second mail management server device (400) of the external network (S1015).

[0305] Afterwards, the mail restoration processing device (250) separates the target file from the general attachment file of the above-mentioned converted mail, performs targeted email attack inspection processing of a large file using the service providing device (100) (S1016), and configures restoration as a general mail (S1017).

[0306] And, the mail restoration processing device (250) uploads the separated target file to an arbitrary path (S1019) and configures a web page that can access the upload path information (S1021).

[0307] Thereafter, the mail restoration processing device (250) adds a web page to the attachment file of the restored general mail (S1023) and transmits the restored general mail to the recipient terminal (20) through the second mail management server device (400) (S1025, S1027).

[0308] In the embodiment of the present invention, the upload path information is exemplified as being added as a web page, but the present invention is not limited thereto, and the upload path information may be attached to the restored general mail in various ways, such as link information, URL text, etc.

[0309]

[0310] Meanwhile, general security requirements for responding to targeted email attacks require synchronization between inbound and outbound scanning of collected malicious files and account data. The email security system's folder structure should be periodically updated, either manually or automatically, and scanned for malware in addition to whitelists. Furthermore, it should monitor users, security administrators, and the web for malicious account takeover attempts.

[0311] Additionally, as security requirements for an email security reporting system, the system must provide users with reports to verify the security of received emails before opening them. It must also provide diagnostic reports based on data collected on the email security status of a domain or server. Furthermore, calculated risk results must be provided for all inbound emails, and these results must be displayed alongside the email. Information on blocked fraudulent emails must be regularly provided to security administrators and users, and when forwarding an email with a security issue, a warning message with the email subject line must be provided to users. Furthermore, emails detected as false positives during the security screening process must be restored.

[0312] Additionally, as general countermeasures against targeted email attacks, email whitelist / blacklist registration, email security data synchronization, and login log monitoring are performed. Email whitelist / blacklist registration allows security administrators to manually enter specific email addresses, IP addresses, and domains that are allowed and disallowed. This automatically filters user access by approving or deleting emails. Furthermore, additional screening is required for email accounts or IP addresses on the whitelist to block malware inflow from inbound and outbound emails. Email security data synchronization collects and analyzes new and existing data from inbound and outbound emails, allowing for synchronization and blocking of inbound and outbound data. Detailed information about email security data includes zero-day malware, similar domains, and delivery path information (e.g., email server and sender location). And the login log displays login attempts for users, security administrators, and the web, along with detailed log information such as ID, location (country), IP address, date, and status (e.g., success or failure), allowing you to monitor malicious account takeover attempts within your email server.

[0313] As countermeasures related to the email security reporting system, warning messages, email risk score determination criteria, email security reports for users, and a status board are provided. Warning messages alert users to the risk of targeted email attacks by using terms such as "look-alike domain" and "forged header" along with the email subject line in their mailboxes, allowing them to recognize the type of malicious email they have received. Security administrators can also configure suspicious emails to be forwarded or not, and warning words / phrases in messages can be set and managed by group. Email risk score determination criteria provide criteria for users to easily and intuitively assess or recognize the risk of emails and can be divided into methods for calculating email risk scores and implementation conditions. The email security report (for users) displays a notification before users open an email, indicating the risk of the received email. For this purpose, the Email Security Report displays the received history, current delivery route, and changes in the delivery route history of emails sent from email addresses identified as similar domains, the status of sender header forgery, the number of malicious URLs detected (URL inspection), and the risk level of similar domains (e.g., TLD, low, high, and critical). The status board provides an overview of the real-time technical status of inbound and outbound emails, which affects the operation of selected technical objects, such as operational status, configuration, and operating environment.Here, fully functioning panels with real-time information such as total number and status of emails, reasons for failure of inbound and outbound emails, number of targeted email attacks received, etc. are displayed to be controlled by internal security administrators to identify risks and disruptions to email security.

[0314]

[0315] FIG. 9 illustrates a security framework system and its operation method for detecting targeted email attacks according to an embodiment of the present invention.

[0316] The security framework (1000) illustrated in FIG. 9 provides an email security system device and an operating method for effectively blocking and responding to targeted email attacks, which is performed through a step-by-step targeted email attack threat inspection process for both incoming and outgoing emails, thereby providing an appropriate response process and diagnostic report.

[0317] The security framework system and its operation method for detecting targeted email attacks described below can be applied to the same content as described above with reference to FIGS. 1 to 8, and a detailed description thereof will be omitted.

[0318] Referring to FIG. 9, a security framework (1000) for detecting targeted email attacks may be composed of an external system (External System, 1100) and an internal system (Internal System, 1200).

[0319] The external system (1100) includes an email server (Email Server, 1110), a user device (User Device, 1120), and an email security appliance (Email Security Appliance, 1130), and these components can be connected via a wired or wireless network to facilitate data exchange via a public network.

[0320] Here, public network can have the same meaning as network, and refers to a communication network managed by a country or a communication service provider to provide connection services to the general public.

[0321] Meanwhile, the internal system (1200) may be configured to include a security management layer (Security Management Layer, 1210), an inbound email security layer (Inbound Email Security Layer, 1220), and an outbound email security layer (Outbound Email Security Layer, 1230).

[0322] In the security management layer (1210), received email data can be forwarded to the receiving email security layer (1220) for receiving email security inspection.

[0323] The incoming mail security layer (1220) can perform security inspection on incoming mail through functions corresponding to each component, including a data collection unit (1211), a targeted email threat detection unit (1212), a DNS record management unit (1213), a reporting system (1214), a threat information storage unit (1215), and an incoming email processing unit (1216).

[0324] Meanwhile, the outgoing email security layer (1230) can perform security checks on outgoing emails through functions corresponding to each component, including a data collection unit (1231), a threat information retrieval unit (1231), and an outgoing email processing unit (1233).

[0325] Afterwards, the identified sender email can be forwarded to the email security device (1130).

[0326] Additionally, a data synchronization mechanism between the receiving mail security layer (1220) and the sending mail security layer (1230) allows for easy sharing of inspection data detected in each for comprehensive inspection in both components.

[0327] Specifically, within the security framework (1000), a network is a communication network established and supervised by a country or a communication service provider, which performs the function of providing connection services to the general public to enable access to various communication networks and the Internet, and may include telephone networks, data networks, CATV networks, and mobile communication networks.

[0328] The email server (1110) performs the role of relaying or storing email content, and enables emails to be sent and received between the sender and recipient through a predefined protocol according to the intended purpose of the received and sent emails.

[0329] And the email server (1110) can be configured to include a receiving mail server and an outgoing mail server, each of which provides unique functions.

[0330] For example, a receiving mail process can retrieve and manage incoming emails using the Post Office Protocol 3 (POP3) or Internet Message Access Protocol (IMAP) protocols, and a sending mail process can facilitate the transmission of outgoing emails using the Simple Mail Transfer Protocol (SMTP) protocol.

[0331] The user terminal (1120) can establish a connection to the email security device (1130) and the email server (1110) through a public or private network, and can be a variety of devices such as a personal computer (PC), a laptop computer, a mobile phone, a tablet PC, a personal digital assistant (PDA), and a portable multimedia player (PMP).

[0332] Meanwhile, the user terminal (1120) can facilitate input or output of information through application execution or web browsing, and can be connected to an email security device (1130) through a dedicated security network.

[0333] The email security device (1130) can provide an email security service that can identify and prevent attacks that may lead to the execution of unintended programs, degradation of data processing capabilities of email-related systems, phishing scams, and various other malicious activities conducted via email.

[0334] In addition, the email security device (1130) can perform a mail diagnosis process based on quantitative analysis of mail security threat factors in response to targeted email attacks using security threat information synchronization data and targeted email inspection processing information, and provide a mail diagnosis service that provides diagnosis reporting based on the diagnosis process to the user terminal (1120).

[0335] The internal system (1200) may refer to an internal framework of an email security device (1130) including a security management layer (1210), an incoming mail security layer (1220), and an outgoing mail security layer (1230), and each layer may be configured to detect and block targeted email attacks.

[0336] The security management layer (1210) is implemented with one or more hardware or software processors and can comprehensively control the operations of each layer, including components included in the internal system (1200), such as the receiving mail security layer (1220) and the sending mail security layer (1230).

[0337] Additionally, the security management layer (1210) may provide an inbound email interface for data communication with the inbound email security layer (1220) and an outbound email interface for data communication with the outbound email security layer (1230).

[0338] And the security management layer (1210) can synchronize the targeted email security threat information configured by performing an inspection for targeted email security threats of incoming mail and the targeted email security threat information configured by performing an inspection for targeted email security threats of outgoing mail, thereby configuring the security threat information synchronization data as described above.

[0339] The security threat information synchronization data may include information on malicious files and identification information on malicious accounts collected from each inspection process and an external security server, and may be configured by synchronizing targeted email security threat information configured according to the performance of targeted email security threat inspection of incoming mail and targeted email security threat information configured according to the performance of targeted email security threat inspection of outgoing mail.

[0340] In addition, the security threat information synchronization data can be continuously updated using inspection data processed in each of the receiving mail security layer (1220) and the sending mail security layer (1230), thereby enabling integrated security management of the sending and receiving security systems, and effectively preventing damage to the internal system or information leakage to the outside due to targeted email attacks in advance.

[0341] The data collection unit (1211) of the receiving mail security layer (1220) collects mail information received by the user terminal (1120) through the email server (1110), and the mail information may include email header information, email subject, email content body, number of receptions during a certain period, etc.

[0342] Mail header information may include mail sending server IP address, mail sending server host name information, sender mail domain information, sender mail address, mail protocol information, mail reception time information, etc.

[0343] Additionally, mail information may include the extension of the attached file, hash information of the attached file, name of the attached file, body of the attached file content, URL (Uniform Resource Locator) information, etc., and the attached file may include additional content to convey additional information in addition to the body of the mail that the sender wants to convey to the recipient or to request a response to information.

[0344] Here, the unique hash information of the attached file can be compared with the hash information or hash value of files exchanged via email to determine whether the file has been modified or tampered with. Furthermore, because the hash information is fixed as a unique value, it can be used to leverage reputation information, a database of past history of files created with malicious intent, enabling proactive quarantine measures. Hash functions can be utilized in technologies and versions that ensure one-way access and collision avoidance.

[0345] The targeted email attack detection unit (1212) processes step-by-step matching of the mail security inspection process corresponding to the mail information collected by the data collection unit (1211) according to a preset targeted email security threat inspection process, inspects the mail information by the matched mail security process, and stores and manages mail security inspection information according to the inspection results.

[0346] The targeted email security threat inspection process may include spam attack threat inspection, malware email attack threat inspection, social engineering email attack threat inspection, and email information leak threat inspection targeting a specific email account using security threat information synchronization data in response to new incoming emails.

[0347] Spam attack threat detection, malware email attack threat detection, social engineering email attack threat detection, and email information leak threat detection can be processed sequentially with preset step priorities set according to each security threat type.

[0348] The targeted email security threat inspection process can determine different email security processes corresponding to newly received emails, and the inspection target, inspection order, or inspection method of the email security process can be determined in advance by synchronized security threat information synchronization data.

[0349] Additionally, the targeted email security threat inspection process can allocate independently distinct processes as resources when mail information for reception is transmitted from a user terminal (1120), and can be immediately executed in the inspection area allocated from the mail information. The dynamic resource allocation method can be explained using the concept of virtual space, and in the method of allocating resources in virtual space, the mail security process can immediately process tasks in the inspection area allocated from sequentially incoming mail information upon completion of processing.

[0350] The mail security inspection information obtained according to the targeted email security threat inspection process is transmitted to the DNS record management unit (1213), the threat information storage unit (1215), and the received mail processing unit (1216), and can be utilized as security threat determination information.

[0351] The DNS record management unit (1213) receives targeted email attack security threat determination information from the targeted email attack detection unit (1212) and manages mail information processed according to the targeted email attack security threat determination information as record information.

[0352] The DNS record management unit (1213) manages record information including the receiving mail domain, receiving mail address, mail routing, and mail content body information as trust authentication information when a received mail is processed as a normal mail based on the information on the security threat of a targeted email attack.

[0353] Meanwhile, if a received email is processed as an abnormal email, the DNS record management unit (1213) can transmit the record information to the security management layer (1210) to update the security threat information synchronization data.

[0354] In addition, the DNS record management unit (1213) can build a security threat information learning model for blocking targeted email attacks based on learning of normal and abnormal email information, and the security threat information learning model can be transmitted to the security management layer (1210) and included in the security threat information synchronization data.

[0355] The reporting department (1214) collects processing result information and configures email security diagnosis service information from the processing result information so that the email security diagnosis service can be provided to the user terminal (1120).

[0356] The reporting unit (1214) collects step-by-step matching result information of the mail security process processed by the targeted email attack detection unit (1212), and can determine a threat level ratio factor for applying one or more quantitative classification conditions corresponding to the collected matching result information.

[0357] The reporting unit (1214) then generates quantitative analysis information corresponding to the threat level ratio factor from the matching results, and based on the quantitative analysis information, determines a score for each threat level stage classification for the mail system being diagnosed and each mail. Accordingly, email security diagnosis analysis reporting based on the score for each threat level stage classification is configured, and the configured email security diagnosis analysis reporting information can be provided to the user terminal (1120).

[0358] Additionally, the reporting unit (1214) may provide a warning message to the user terminal (1120) based on diagnostic analysis reporting information. The warning message displays the email subject in the user's mailbox along with terms such as "spam," "similar domain," and "forged header" to indicate the risk of a targeted email attack, allowing the user to identify the type of email.

[0359] The reporting unit (1214) can configure pre-email security reporting information and provide it to the user terminal (1120). The pre-email security reporting information can be provided as a notification before the user opens the email, and can provide information on the risk of the received email.

[0360] Meanwhile, the reporting unit (1214) can provide a status dashboard interface to the user terminal (1120), and the status dashboard interface can provide an overview of the real-time technical status of incoming and outgoing emails that affect the operation of a selected technical entity, such as the operational status, configuration, and operating environment.

[0361] The reporting department (1214) can calculate the targeted email attack security threat risk of the email to be diagnosed by multiplying the score for each threat level step by each risk weight and adding up the results.

[0362] The threat information storage unit (1215) stores mail security inspection information based on the inspection results of the targeted email attack detection unit (1212), and the mail security inspection information includes spam mail inspection information, malicious code inspection information, and social engineering attack threat inspection information.

[0363] Additionally, the threat information storage unit (1215) may store record information managed by the DNS record management unit (1213).

[0364] And the threat information storage unit (1215) stores security threat information synchronization data, and the stored security threat information synchronization data can be updated by the security management layer (1210).

[0365] The receiving mail processing unit (1216) can process the status of the receiving mail according to the targeted email security threat determination information obtained through mail security inspection information and mail information analysis.

[0366] The receiving mail processing unit (1216) processes mails determined to be normal mail based on security threat identification information into a reception status that can be processed by the user terminal (1120). If the mail is determined to be abnormal, the unit determines whether to stop the subsequent mail security process and processes the mail status.

[0367] For example, if a problem is found in the inspection step according to priority, the receiving mail processing unit (1216) can perform only the necessary processing in that step and determine whether to terminate the inspection, and terminate the inspection without performing subsequent inspection steps.

[0368] In addition, the receiving mail processing unit (1216) may convert gray mail determined to be normal or abnormal based on security threat determination information into non-executable file content and provide a user terminal (1120) with the ability to selectively process the mail status.

[0369] For example, the receiving mail processing unit (1216) can convert gray mail including suspicious content, etc., into an image file and provide it in a mail state that can be confirmed by the user terminal (1120).

[0370] The data collection unit (1231) included in the outgoing mail security layer (1230) collects mail information sent from a user terminal (1120), and the mail information may include email header information, email subject, email content body, number of receptions during a certain period, etc.

[0371] Mail header information may include mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient mail address, mail protocol information, mail sending time information, etc.

[0372] Additionally, mail information may include the extension of the attached file, hash information of the attached file, name of the attached file, body of the attached file content, URL (Uniform Resource Locator) information, etc., and the attached file may include additional content to convey additional information in addition to the body of the mail that the sender wants to convey to the recipient or to request a response to information.

[0373] Here, the unique hash information of the attached file can be compared with the hash information or hash value of files exchanged via email to determine whether the file has been modified or tampered with. Furthermore, because the hash information is fixed as a unique value, it can be used to leverage reputation information, a database of past history of files created with malicious intent, enabling proactive quarantine measures. Hash functions can be utilized in technologies and versions that ensure one-way access and collision avoidance.

[0374] For outgoing mails, the step-by-step matching of the mail security inspection process corresponding to the mail information collected by the data collection unit (1231) is processed according to the preset targeted email security threat inspection process as described above, the mail information is inspected by the matched mail security process, and the mail security inspection information according to the inspection results is stored and managed.

[0375] To this end, the threat information search unit (1232) can search for security threat information synchronization data and receive it from the security management layer (1210).

[0376] The outgoing mail processing unit (1233) processes the status of outgoing mail based on targeted email security threat identification information obtained through mail security inspection information and mail information analysis.

[0377] The outgoing mail processing unit (1233) processes mails determined to be normal mail based on security threat identification information into a sending status that can be processed by the user terminal (1120). If the mail is determined to be abnormal, the unit determines whether to stop the subsequent mail security process and processes the mail status.

[0378] For example, if a problem is found in the inspection stage according to priority, the outgoing mail processing unit (1233) can perform only the necessary processing in that stage and determine whether to terminate the inspection, and terminate the inspection without performing subsequent inspection stages.

[0379] In addition, if a targeted email attack security threat, such as information leakage, is determined from the email information of the email sent, the outgoing email processing unit (1233) may send a request message to reject email approval to the email approval system connected to the email server (1110) or process a warning notification.

[0380] The outgoing mail processing unit (1233) sends an email to the user informing him of the processing status when the security manager approves, rejects, or puts on hold an approval request through the email approval system, and when a targeted email attack security threat such as malicious code is determined from the email information of the outgoing email, the outgoing email can be discarded or processed as harmless by performing filtering processing.

[0381] In addition, the outgoing mail processing unit (1233) provides a post-management service for responding to targeted email attack security threats to outgoing mail even after the user sends the mail, performs log monitoring and notification of malicious account information obtained from security threat synchronization data, and can identify malicious login attempts to the user account and provide notification to the user terminal (1120).

[0382] Below, a method for detecting targeted email attacks in the receiving email security layer (1220) and the sending email security layer (1230) will be described in more detail.

[0383] The incoming mail security layer (1220) collects incoming mail information and uses security threat information synchronization data to perform targeted email security threat inspections on newly received mail. Targeted email security threat inspections may include multi-level inspections at each stage, such as spam threat inspections, malware attack threat inspections, and social engineering threat inspections.

[0384] Malware attack threat scanning may include targeted email attack threat scanning for unknown malware, attachment malware, URL malware, etc., and social engineering threat scanning may include header forgery, lookalike domain, account hijacking, and URL phishing scanning.

[0385] Based on the inspection results, the receiving mail security layer (1220) performs user diagnosis reporting and decides to export or block the mail to the mail server based on the inspection results.

[0386] And the receiving mail security layer (1220) can configure a warning notification message corresponding to export, blocking or delay and provide it to the administrator's user terminal (1120).

[0387] Additionally, each inspection result may be configured as security threat information synchronization data by synchronizing the targeted email security threat information configured according to the targeted email security threat inspection performed on the received email and the targeted email security threat information configured according to the targeted email security threat inspection performed on the sent email.

[0388] If the mail security process is a spam mail security process, the incoming mail security layer (1220) can match mail information including mail header information, mail subject, mail content body, number of receptions over a certain period, etc., with preset spam indicators in stages.

[0389] The incoming mail security layer (1220) can perform a virus test consisting of three stages, and can examine malware attack threats using the results of the tests at each stage by processing the first test (antivirus test), the second test (environmental operating system change test), and the third test (behavior-based analysis test) in stages.

[0390] The receiving mail security layer (1220) can perform a header forgery inspection, a similar domain inspection, an account takeover inspection, and a URL phishing inspection in performing an attack type inspection for each social engineering attack threat inspection item.

[0391] Meanwhile, the outgoing mail security layer (1230) collects outgoing mail information and obtains synchronized security threat information.

[0392] Each inspection result can be obtained from the synchronized security threat information data in which the targeted email security threat information configured according to the targeted email security threat inspection performed on the received email and the targeted email security threat information configured according to the targeted email security threat inspection performed on the sent email are synchronized.

[0393] The outgoing mail security layer (1230) performs information leakage threat inspection based on the outgoing approval system using synchronized security threat information.

[0394] For example, the outgoing mail security layer (1230) can use security threat information synchronization data and mail information attribute information to check whether outgoing mail has information leaks in order to respond to internal information leak security threats, and can block sending or reject approval for sending outgoing mail through the email server (1110) based on the check information.

[0395] Thereafter, the outgoing mail security layer (1230) performs filtering inspection processing of outgoing mail using synchronized security threat information.

[0396] And, the outgoing mail security layer (1230) uses the inspection results of the outgoing mail to decide whether to export, block, or delay it to the email server (1110).

[0397] The outgoing mail security layer (1230) can configure a warning notification message corresponding to export, blocking, or delay and provide it to the user terminal (1120).

[0398]

[0399] Below, examples of methods for providing security services to respond to targeted email attacks are described.

[0400] An integrated security service according to one embodiment of the present invention may include a preprocessing section (first stage), a filtering and blocking section (second stage), an analysis and management section (third stage), and a filtering / sending / management section (sending stage).

[0401] In the preprocessing section, spam and attachment inspection are performed along with external access control, and mail can be passed to the filtering and blocking section after responding to network attacks, learning spam filtering, and static / dynamic attachment inspection.

[0402] Here, static inspection for attachments may be a signature inspection that performs inspection using hash information of the attachment, etc., and dynamic inspection may be an inspection that performs inspection by actually downloading and executing the attachment.

[0403] In the filtering and blocking section, the comprehensive inspection and fraudulent mail inspection and blocking functions are integrated into one, so that comprehensive inspection of attachments, URLs, and forgery / alteration can be performed, and integrated blocking of risky mails including preprocessing section filtering mails can be performed.

[0404] In the analysis and management section, content separation and post-analysis management of received emails are performed, and notifications can be provided through content separation, storage, post-analysis, and management of normal emails received in the preprocessing section.

[0405] Meanwhile, in the filtering / sending / management section at the sending stage, attachment file separation and post-management of outgoing emails are performed, so that post-management of attachment files and prevention of mail server exposure can be achieved through attachment file separation and conversion of outgoing emails.

[0406] For example, in the preprocessing section of the receiving security process, network attack blocking and learning spam filtering can be performed.

[0407] Specifically, attack blocking items in the preprocessing section may include SMTP attacks, bulk emails, illegal relays, spam emails, viruses, and bad emails, and may additionally include new malware, ransomware, and malicious macros.

[0408] During the filtering and blocking section of the receiving security process, sender reliability checks, header forgery / alteration checks, and similar domain checks are performed, and static and dynamic analysis are performed on general / large attachments and URLs within the body / attachment files, respectively. In addition, Nth-level URL tracking checks and password compression file checks can be performed.

[0409] Here, static checking for a URL may be checking that compares the URL with already known URL information, and dynamic checking may be checking that connects to a server using the URL.

[0410] Specifically, attack blocking items in the filtering and blocking section may include viruses, new malware, ransomware, malicious macros, phishing sites, phishing within documents, Nth-level phishing sites, encrypted compressed files, etc. through attachment / URL inspection.

[0411] Additionally, attack blocking items in the filtering and blocking section may include header forgery and modification, similar domains, SPF rule violations, sending IP forgery, sender forgery, and reply address change through fraudulent email inspection.

[0412] Additionally, during the management and analysis section of the receiving security process, EML and attachment separation, attachment storage, URL post-inspection, attachment post-inspection, and static analysis are performed, and a warning can be issued to the user for emails determined to be malicious as a result of the post-inspection.

[0413] Specifically, attack blocking items in the management and analysis section may include viruses, malicious document files, ransomware, and malicious macros, and this can enable secure management through securing mail server storage space, managing attachment history, and post-inspection.

[0414] Meanwhile, during the filtering and sending section of the sending security process, sending policy filtering such as approval / reference, personal information identification check, and blocking of sending confidential information may be performed.

[0415] Additionally, during the filtering and sending section of the outgoing security process, malware inspection and attachment download link conversion may be performed, and additional attachment policy such as link-type attachment conversion criteria and download period / number of times / IP settings may be applied.

[0416] Accordingly, downloads for attachments can be enabled or disabled.

[0417] During the analysis and management section of the outgoing security process, EML and attachment separation, attachment file storage, EML content reassembly, attachment file download link conversion, and link image body insertion can be performed.

[0418] According to another embodiment of the present invention, the preprocessing section (first step) as described above may be performed by a first email security device, and the filtering and blocking section (second step) may be performed by a second email security device.

[0419] Here, the first email security device can perform external access control, spam attack inspection, and attachment inspection for incoming emails, and can perform the role of inspecting, filtering, and sending outgoing emails.

[0420] Meanwhile, the second email security device can perform the role of filtering and forwarding received emails by checking for attachments, URLs, and forgery.

[0421] The first email security device and the second email security device as described above can operate in conjunction with each other using synchronization information.

[0422] For example, the first email security device sequentially performs network attack blocking, learning spam filtering, and signature virus scanning on received emails, and if an attachment exists in the received email, performs static and dynamic inspections on the attachments, and then adds the detection results to a header and transmits them to the second email security device.

[0423] The second email security device sequentially performs static and dynamic inspections for general / large attachments, static and dynamic inspections for Nth-level URL tracking, header forgery / alteration inspection, similar domain inspection, and sender reliability inspection, and combines the detection results from the preprocessing section (first stage) transmitted from the first email security device to determine whether the received email is a normal email.

[0424] The second email security device can block the received email and send an email notifying the user of the detection results if the received email is determined to be abnormal.

[0425] In this case, the detection result information for abnormal mail in the second email security device may be provided in synchronization with the detection result information for abnormal mail in the second email security device.

[0426] For example, a first email security device may request detection result information based on the inspection results from a second email security device, and in response, the second email security device may transmit detection result information regarding the above-described abnormal email to the first email security device, and the first email security device may send an integrated detection result notification email based on the synchronized detection result information.

[0427] Meanwhile, if the received email is determined to be normal, the second email security device may forward the received email to the third email security device to perform the analysis and management section (third step) as described above.

[0428] The third email security device can separate the EML and attachments from received emails judged to be normal emails, store the attachments, and forward the EML to the email server directly or through a report attachment.

[0429] Additionally, the third-party email security device can perform post-inspections such as URL tracking post-inspection and attachment post-inspection at regular intervals, and provide a path notification if the post-inspection results determine that the email is malicious.

[0430] As described above, by performing a step-by-step inspection on received emails by dividing them into a preprocessing section and a filtering and blocking section, the processing load on a single email security device can be prevented from being excessive, and more accurate filtering and blocking can be achieved.

[0431] Here, the third-party email security device can block attacks such as viruses, malicious document files, ransomware, and malicious macros.

[0432] And the third email security device can perform the analysis and management section at the sending stage as described above.

[0433] For example, a third email security device may receive an outgoing email from an email server, sequentially separate the EML and attachments for the outgoing email, store the attachments, and reassemble the EML contents, and then transmit the reassembled EML to the first email security device.

[0434] Here, EML content reassembly can be performed by converting the download link for the attachment and inserting the linked image into the body of the outgoing email.

[0435] The first email security device receives the reassembled EML from the third email security device, sequentially performs sending policy filtering, malware inspection, attachment download link conversion, and attachment policy application, and then sends the email.

[0436] Here, in the sending policy filtering, sending policies can be applied based on approval / automatic reference, personal information identification check, and blocking of sending confidential information, and in the attachment policy application, attachment policies can be applied based on the conversion criteria for link-type attachments and download period / number of times / IP settings, etc.

[0437] Meanwhile, depending on the attachment policy, downloads for the attached file may be enabled or disabled, and depending on the result, the recipient of the sent email may download the attached file.

[0438] And the malware scan performed by the first email security device on outgoing emails and the malware scan performed by the second email security device on incoming emails may be at least partially identical, and accordingly, the first email security device and the second email security device may utilize the security threat information synchronization data described above.

[0439]

[0440] The method according to the present invention described above can be produced as a program to be executed on a computer and stored in a computer-readable recording medium. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0441] Computer-readable recording media can be distributed across network-connected computer systems, allowing computer-readable code to be stored and executed in a distributed manner. Furthermore, functional programs, codes, and code segments for implementing the above method can be readily inferred by programmers skilled in the art to which the present invention pertains.

[0442] In addition, although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and various modifications can be made by a person having ordinary skill in the art to which the invention pertains without departing from the gist of the present invention claimed in the claims, and such modifications should not be understood individually from the technical idea or prospect of the present invention.

Claims

1. In a security framework system for detecting targeted email attacks, A security management layer that synchronizes targeted email security threat information configured by performing an inspection of incoming emails for targeted email security threats and targeted email security threat information configured by performing an inspection of outgoing emails for targeted email security threats; A receiving mail security layer that performs a security check on receiving mail using receiving mail data transmitted from the above security management layer; and A security framework system comprising: an outgoing mail security layer that performs a security check on outgoing mail using outgoing mail data transmitted from the security management layer; 2. In paragraph 1, A security framework system further comprising an email security device providing an interface for data communication with the above security management layer.

3. In the second paragraph, the email security device A security framework system that performs a mail diagnosis process based on quantitative analysis of mail security threat factors in response to targeted email attacks using security threat information synchronization data and targeted email inspection processing information, and provides a diagnosis report based on the diagnosis process to the user terminal.

4. In paragraph 1, the receiving mail security layer A data collection unit that collects mail information received by a user terminal through an email server; A targeted email attack detection unit that processes step-by-step matching of a mail security inspection process corresponding to mail information collected from the data collection unit according to a preset targeted email security threat inspection process, and inspects mail information by the matched mail security process; A DNS record management unit that receives targeted email attack security threat determination information from the targeted email attack detection unit and manages mail information processed according to the targeted email attack security threat determination information as record information; and A security framework system including a threat information storage unit that stores mail security inspection information according to the inspection results of the above-mentioned targeted email attack detection unit.

5. In paragraph 4, the receiving mail security layer A security framework system further comprising a reporting unit that collects processing result information of the above-mentioned targeted email attack detection unit, configures email security diagnosis service information from the processing result information, and provides an email security diagnosis service to a user terminal.

6. In paragraph 4, the receiving mail security layer A security framework system further comprising a received mail processing unit that processes the status of received mail based on targeted email security threat identification information obtained through mail security inspection information and mail information analysis.

7. In paragraph 1, the sending mail security layer A data collection unit that collects mail information sent from user terminals; An attack information retrieval unit that searches for security threat information synchronization data and receives it from the security management layer; and A security framework system including a receiving mail processing unit that processes the status of an outgoing mail based on targeted email security threat identification information obtained through mail security inspection information and mail information analysis.

Images