An email detection model training method and apparatus, and electronic device

Abstract

The present application relates to the technical field of computers, and in particular relates to an email detection model training method and apparatus, and an electronic device. An email detection model comprises a convolutional neural network model and a deep neural network model. The method comprises: converting email text into an image, and extracting image features by means of a convolutional neural network model to obtain a first feature vector; inputting the first feature vector into a deep neural network model to obtain a first predicted value and a first loss function; converting email features into a second vector, concatenating the second vector with the first vector to obtain a combined vector, and inputting the combined vector into the deep neural network model to obtain a second predicted value and a second loss function; and calculating a weighted sum of the first loss function and the second loss function to obtain an overall loss function, and on the basis of the overall loss function, training an email detection model until the overall loss function converges, in order to obtain a trained email detection model. The solution can improve the accuracy of phishing email detection.

Description

A method, apparatus and electronic device for training an email detection model

[0001] Cross-references to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411643257.9, filed on November 18, 2024, with the State Intellectual Property Office of the People's Republic of China, entitled "A Method, Apparatus and Electronic Equipment for Training an Email Detection Model", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of computer technology, and in particular to a method, apparatus and electronic device for training an email detection model. Background Technology

[0004] Phishing emails are a very common and highly stealthy attack method in the field of cybersecurity. Attackers impersonate legitimate information senders (such as notifications from banks, reminders from online services, or internal company emails) to trick victims into revealing sensitive information (such as usernames, passwords, bank card details, etc.) or performing harmful actions (such as clicking on links containing malware or downloading harmful attachments).

[0005] With the widespread use of the internet and email in daily life, phishing attacks have become a global cybersecurity threat. How to improve the accuracy of phishing email detection is a question worth discussing. Summary of the Invention

[0006] This application provides a method, apparatus, and electronic device for training an email detection model to improve the accuracy of detecting phishing emails.

[0007] In a first aspect, embodiments of this application provide a method for training an email detection model, the email detection model including a convolutional neural network model and a deep neural network model, the method comprising:

[0008] The email text in the email set to be trained is converted into an image, and the first feature vector is obtained by extracting features from the image through a convolutional neural network model.

[0009] The first feature vector is input into the deep neural network model to obtain the first predicted value and the first loss function representing whether the email is a phishing email. The first loss function represents the loss of the deep neural network model in detecting emails based on email image features.

[0010] Email features are obtained by classifying emails using a set of email feature keywords. These email features are then converted into a second vector. The second vector is concatenated with the first vector to obtain a combined vector. This combined vector is then input into a deep neural network model to obtain a second predicted value and a second loss function that indicate whether an email is a phishing email. The second loss function represents the loss of the deep neural network model in detecting emails after integrating image and text feature information.

[0011] Calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function. Train the email detection model based on the overall loss function until the overall loss function converges to obtain the trained email detection model. The sum of the weights of the first loss function and the second loss function is 1.

[0012] Optionally, the above set of email feature keywords is obtained through the following methods:

[0013] Natural language processing technology is used to perform text analysis on the phishing email set to extract high-frequency words and obtain the target keyword set. Text analysis is performed on each email in the phishing email set, and phishing emails containing at least one keyword in the target keyword set are combined into the first email set.

[0014] Encode each email in the first email set to generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of the two vectors.

[0015] The cosine similarity of the embedded vector pairs is compared with a preset similarity threshold to obtain a set of similar word pairs. Duplicate word pairs in the set of similar word pairs are deleted. The term frequency (TF) value of each word in the first email set and the inverse document frequency (IDF) value of each word in the phishing email set are calculated. Part-of-speech tagging is performed on each word in the email.

[0016] Based on the frequency, inverse document frequency, and part-of-speech tagging results of each word, determine whether to add the keyword to the email feature keyword set.

[0017] Optionally, based on the frequency value, inverse document frequency, and part-of-speech tagging results of each word, the determination of whether to add the keyword to the email feature keyword set includes:

[0018] Multiply the frequency value by the inverse document frequency value to obtain the term frequency-inverse document frequency value;

[0019] The weighted term frequency-inverse file frequency value is obtained by multiplying the term frequency-inverse file frequency value of each word with the weight corresponding to the part of speech.

[0020] The weighted term frequency-inverse document frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

[0021] Optionally, the above method of concatenating the second vector with the first vector to obtain a combined vector specifically includes:

[0022] The second vector is expanded to the same dimension as the first vector using a fully connected layer;

[0023] The expanded second vector is concatenated with the first vector to obtain the combined vector.

[0024] Optionally, the above-mentioned training email set includes multiple emails and multiple email labels. The first loss function includes a cross-entropy loss function based on the deep neural network output and the labels, and the second loss function includes a cross-entropy loss function based on the deep neural network output and the labels.

[0025] Optionally, the above-mentioned use of natural language processing techniques to perform text analysis on phishing email sets to extract high-frequency words and obtain a target keyword set, specifically including:

[0026] Natural language processing techniques were used to analyze the text of phishing emails to extract high-frequency words, thus obtaining a first set of keywords.

[0027] Merge the first keyword set and the second keyword set, iterate through the merged keyword set, identify and delete duplicate keywords, and obtain the target keyword set.

[0028] Secondly, embodiments of this application provide an email detection method, the method comprising:

[0029] Obtain the email detection model obtained using any of the methods described in the first aspect;

[0030] Input the email to be detected into the email detection model to determine whether the email is a phishing email.

[0031] Thirdly, embodiments of this application provide an email detection model training apparatus, the apparatus comprising:

[0032] The processing module is used to convert the email text in the email set to be trained into images, and to extract the first feature vector by using a convolutional neural network model.

[0033] The prediction module is used to input the first feature vector into the deep neural network model to obtain a first predicted value and a first loss function representing whether the email is a phishing email. The first loss function represents the loss of the deep neural network model in detecting emails based on email image features.

[0034] The prediction module is also used to classify emails by using a set of email feature keywords to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into a deep neural network model to obtain a second predicted value and a second loss function that indicates whether the email is a phishing email. The second loss function represents the loss of the deep neural network model in detecting emails after integrating image features and text features.

[0035] The processing module is also used to calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function. The email detection model is trained based on the overall loss function until the overall loss function converges, resulting in a trained email detection model. The sum of the weights of the first loss function and the second loss function is 1.

[0036] Fourthly, embodiments of this application provide an email detection device, which includes:

[0037] The acquisition module is used to acquire the email detection model obtained using any of the methods described above in the first aspect;

[0038] The processing module is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

[0039] Fifthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor enables the processor to implement any of the email detection model training methods in the first aspect or any of the email detection methods in the second aspect.

[0040] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the email detection model training method of any one of the first aspects, or the email detection method of any one of the second aspects.

[0041] In a seventh aspect, embodiments of this application also provide a computer program product, including a computer program executed by a processor to implement the email detection model training method as described in any of the first aspects above, or the email detection method as described in any of the second aspects.

[0042] The technical effects of any of the implementation methods in aspects three through seven can be found in the technical effects of the corresponding implementation methods in aspects one through two, and will not be repeated here. Attached Figure Description

[0043] Figure 1 is a schematic diagram of an application scenario for training an email detection model according to an embodiment of this application;

[0044] Figure 2 is a flowchart of an email detection model training method provided in an embodiment of this application;

[0045] Figure 3 is a flowchart of a method for determining a set of email feature keywords according to an embodiment of this application;

[0046] Figure 4 is a schematic diagram of an apparatus for training an email detection model according to an embodiment of this application;

[0047] Figure 5 is a schematic diagram of an email detection device provided in an embodiment of this application;

[0048] Figure 6 is a schematic diagram of the structure of the electronic device provided in an embodiment of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] The application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided in this application are also applicable to similar technical problems. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0051] Phishing emails are a very common and highly stealthy attack method in the field of cybersecurity. Attackers impersonate legitimate information senders (such as notifications from banks, reminders from online services, or internal company emails) to trick victims into revealing sensitive information (such as usernames, passwords, bank card details, etc.) or performing harmful actions (such as clicking on links containing malware or downloading harmful attachments).

[0052] With the widespread use of the internet and email in daily life, phishing attacks have become a global cybersecurity threat. How to improve the accuracy of phishing email detection is a question worth discussing.

[0053] To address the aforementioned problems, this application provides a method for training an email detection model. The email detection model includes a convolutional neural network (CNN) model and a deep neural network (DNN) model. The method includes: converting email text in a set of emails to be trained into images; extracting features from the images using a CNN model to obtain a first feature vector; inputting the first feature vector into a DNN model to obtain a first predicted value indicating whether an email is a phishing email and a first loss function, where the first loss function represents the loss of the DNN model in detecting emails based on email image features; classifying emails using a set of email feature keywords to obtain email features; converting the email features into a second vector; concatenating the second vector with the first vector to obtain a combined vector; inputting the combined vector into the DNN model to obtain a second predicted value indicating whether an email is a phishing email and a second loss function, where the second loss function represents the loss of the DNN model in detecting emails after integrating image and text feature information; calculating the weighted sum of the first and second loss functions to obtain an overall loss function; training the email detection model based on the overall loss function until the overall loss function converges, resulting in a trained email detection model where the sum of the weights of the first and second loss functions is 1.

[0054] In this way, by introducing convolutional neural network models and deep neural network models, and training them using the image features and text content features of emails, accurate identification of phishing emails can be achieved. By calculating the weighted sum of the first and second loss functions, the overall loss function is obtained, and the email detection model is trained based on this function. This ensures that the email detection model achieves a balance in understanding the image features and text content features of emails, thereby improving the training efficiency and performance of the model.

[0055] This application provides an embodiment of an optional email detection model training method, illustrated in Figure 1. The method includes a server 100 and a terminal 101. The server 100 and terminal 101 can communicate via a network to implement the email detection model training method of this application.

[0056] Users can use server 100 to interact with terminal 101 via the network, such as receiving or sending messages. Various client applications can be installed on terminal 101, such as programming applications, web browser applications, search applications, etc.

[0057] It is understood that in this embodiment, the server 100 can be a standalone server or a server cluster consisting of multiple servers. The terminal 101 can be various electronic devices with a display screen and support web browsing, including but not limited to smartphones, tablets, desktop computers, etc.

[0058] Server 100 can be used to: convert email text in the email set to be trained into images; extract features from the images using a convolutional neural network model to obtain a first feature vector; input the first feature vector into a deep neural network model to obtain a first predicted value and a first loss function indicating whether an email is a phishing email; the first loss function represents the loss of the deep neural network model in detecting emails based on email image features; classify emails by using a set of email feature keywords to obtain email features; convert the email features into a second vector; concatenate the second vector with the first vector to obtain a combined vector; input the combined vector into the deep neural network model to obtain a second predicted value and a second loss function indicating whether an email is a phishing email; the second loss function represents the loss of the deep neural network model in detecting emails after integrating image and text feature information; calculate the weighted sum of the first and second loss functions to obtain the overall loss function; train the email detection model based on the overall loss function until the overall loss function converges, obtaining the trained email detection model, where the sum of the weights of the first and second loss functions is 1.

[0059] Figure 2 shows a flowchart of an email detection model training method provided in this embodiment of the application. The email detection model includes a convolutional neural network model and a deep neural network model. Specifically, it may include the following steps.

[0060] Step S201: Convert the email text in the email set to be trained into images, and extract the first feature vector by using a convolutional neural network model.

[0061] The training email set includes multiple emails and their labels.

[0062] In one alternative embodiment, to analyze email content using image processing and deep learning models, techniques such as text-to-image rendering and visualization of email content can be employed to convert the email text content into an image, such as a 512x512 pixel image. This image is then input into a convolutional neural network model, such as a 50-layer Residual Network (ResNet50) model. After processing each email by the ResNet50 model, a 768-dimensional feature vector is generated. ResNet50 is a type of convolutional neural network.

[0063] Step S202: Input the first feature vector into the deep neural network model to obtain the first predicted value and the first loss function representing whether the email is a phishing email.

[0064] The first loss function represents the loss of the deep neural network model in detecting emails based on email image features.

[0065] For example, the first feature vector (such as a 768-dimensional feature vector) generated by the convolutional neural network model can be input into the deep neural network model to obtain the first 1x1 prediction value generated by the deep neural network model.

[0066] The first loss function is used to evaluate the difference between the predicted vector value and the actual target value, thereby guiding the optimization of the model during training.

[0067] The above method converts email text into images and uses convolutional neural network models for feature extraction and prediction, enabling intelligent analysis and processing of email content. By converting email content into image form and combining it with graphic feature analysis technology, it is possible to identify and utilize the commonalities in the visual presentation of phishing emails. This goes beyond just email layout, color usage, and font styles; it delves into the overall visual sensory features, significantly enhancing the robustness and accuracy of subsequent email detection.

[0068] Step S203: Classify emails by using the set of email feature keywords to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into a deep neural network model to obtain a second predicted value and a second loss function that indicate whether the email is a phishing email.

[0069] The second loss function represents the loss of the deep neural network model in detecting emails after integrating image and text features.

[0070] As shown in Figure 3, this application embodiment provides a flowchart of a method for determining a set of email feature keywords.

[0071] Step S301: Use natural language processing technology to perform text analysis on the phishing email set to extract high-frequency words and obtain the target keyword set. Perform text analysis on each email in the phishing email set, and combine the phishing emails containing at least one keyword from the target keyword set into the first email set.

[0072] For example, natural language processing techniques can be used to analyze the text of phishing email sets and extract high-frequency words. Alternatively, a second set of keywords can be received from the user-defined phishing email set. The first and second keyword sets are then merged, and the merged keyword set is iterated through to identify and remove duplicate keywords, resulting in a target keyword set. This target keyword set can then be used for subsequent email filtering and feature extraction.

[0073] Text analysis is performed on each email in the phishing email set. Phishing emails containing at least one keyword from the target keyword set are grouped into a first email set. After obtaining the first email set, text analysis can be performed on each email in the phishing email set to check whether the email content contains keywords from the target keyword set. Phishing emails containing at least one keyword from the target keyword set are grouped into the first email set. This narrows down the scope of subsequent phishing email analysis, improving the efficiency and accuracy of phishing email analysis.

[0074] Alternatively, visualization tools such as WordCloud can be used to generate keyword cloud maps based on high-frequency words, so as to visually display the first set of keywords in phishing emails.

[0075] Step S302: Encode each email in the first email set to generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of the two vectors.

[0076] For example, a pre-defined text model can be used to encode each email in the first email set, generating an embedding vector representing each word. The pre-defined text model could be a word embeddings (Word2Vec) model, a Bidirectional Encoder Representations from Transformer (BERT) model, or any model that can capture the semantic relationships between words. The cosine similarity of each pair of embedding vectors is then calculated.

[0077] Step S303: Compare the cosine similarity of the embedded vector pairs with the preset similarity threshold to obtain a set of similar word pairs. Delete duplicate word pairs in the set of similar word pairs. Calculate the term frequency (TF) value of each word in the first email set and the inverse document frequency (IDF) value of each word in the phishing email set. Then, perform part-of-speech tagging on each word in the emails.

[0078] For example, the cosine similarity of the embedded vector pairs is compared with a preset similarity threshold to obtain a set of similar word pairs. Specifically, if the cosine similarity of the embedded vector pairs is greater than or equal to the preset similarity threshold, then the word pairs represented by the embedded vector pairs are considered similar word pairs. After obtaining the set of similar word pairs, duplicate word pairs can be deleted from the set for deduplication.

[0079] Calculate the term frequency (TF) value for each word appearing in the matched emails. A higher frequency value indicates greater importance of the word in the email. Also, calculate the inverse document frequency (IDF) value for each word appearing in the phishing email set. A higher IDF value indicates fewer occurrences of the word in the phishing email set.

[0080] You can also use NLP tools to tag each word in the email with its part of speech, such as verbs, nouns, adjectives, and other parts of speech. Based on this part-of-speech information, different weights can be assigned to different parts of speech. For example, verbs and nouns, which are more descriptive and important in the email content, can be given higher weights.

[0081] Step S304: Based on the frequency, inverse document frequency and part-of-speech tagging results of each word, determine whether to add the keyword to the email feature keyword set.

[0082] In one optional embodiment, the frequency value can be multiplied by the inverse document frequency value to obtain the term frequency-inverse document frequency value. The term frequency-inverse document frequency value of each word is then multiplied by the weight corresponding to its part-of-speech tag to obtain a weighted term frequency-inverse document frequency value. This weighted term frequency-inverse document frequency value is compared with a preset threshold to determine whether the keyword should be added to the email feature keyword set.

[0083] It is understandable that the preset threshold can be set in advance by those skilled in the art. It can also be changed based on changes in the application scenario.

[0084] In the above method, by updating and expanding the set of email feature keywords based on enticing words and keywords, it is easier to identify and adapt to new and unknown phishing emails in a timely manner, thereby improving the comprehensiveness and accuracy of detection.

[0085] For example, suppose an email reads: "I like to eat apples, apples are sweet." We need to calculate the word frequency (TF) of the word "apple." Total words in the email: 6 ("I," "like," "eat," "apple," "very," "sweet"). "Apple" appears twice. Therefore, the TF value (term frequency) of "apple" is approximately 2 / 6 ≈ 0.33.

[0086] Suppose the email set contains 100 emails, and the word "apple" appears in 10 of them. The total number of emails is 100. The number of emails containing "apple" is 10. Therefore, the inverse document frequency (IDF value) of "apple" is log(100 / (1+10)) ≈ log(100 / 11) ≈ 1.04.

[0087] Multiplying the term frequency and inverse document frequency of "apple" yields its TF-IDF value: TF-IDF(apple) = TF(apple) × IDF(apple) ≈ 0.33 × 1.04 ≈ 0.34

[0088] Assume the weight of nouns is 1.2, the weight of verbs is 1.0, and the weight of adjectives is 0.8. Since "apple" is a noun, multiply its TF-IDF value by the noun weight: Weighted TF-IDF(apple) = TF-IDF(apple) × noun weight ≈ 0.34 × 1.2 ≈ 0.41.

[0089] The weighted TF-IDF value is compared with a preset threshold. Let's assume the preset threshold is 0.35. Since the weighted TF-IDF(apple) = 0.41 > 0.35, "apple" can be added to the email feature keyword set.

[0090] In one optional embodiment, emails are classified using a set of email feature keywords to obtain email features. A fully connected layer can then be used to expand a second vector to the same dimension as the first vector. The expanded second vector is then concatenated with the first vector to obtain a combined vector. This combined vector is then input into a deep neural network model to obtain a second predicted value indicating whether the email is a phishing email.

[0091] For example, the first vector is a 768-dimensional vector. The second vector is a 64-dimensional vector. To concatenate these two vectors, a fully connected layer needs to be applied to the second vector to expand its dimension to the same 768 dimensions as the first vector. The fully connected layer can learn a 768-dimensional output vector based on the 64 features of the input vector, where each output feature is a linear combination of the input features. Once the second vector is expanded to 768 dimensions, it can be easily concatenated with the first vector to obtain a 1536-dimensional combined vector.

[0092] It is understood that the embodiments of this application do not specifically limit how vectors are concatenated. For example, vectors can be joined end to end.

[0093] Step S204: Calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function. Train the email detection model based on the overall loss function until the overall loss function converges to obtain the trained email detection model.

[0094] The sum of the weights of the first loss function and the second loss function is 1.

[0095] The overall loss function is used in the training process of the email detection model and can be used to update the model's weights through backpropagation. The overall loss function satisfies the following formula:

[0096] Where loss represents the overall loss function value. The values ​​represent the preset weights, loss1 represents the first loss function value, and loss2 represents the second loss function value.

[0097] The above method integrates the first loss function and the second loss function through an overall loss function, thereby improving the accuracy and robustness of prediction.

[0098] In one optional embodiment, after obtaining the trained email detection model, the trained email detection model can be retrieved. The email to be detected is then input into the email detection model to determine whether the email is a phishing email.

[0099] In this way, the trained email detection model can quickly analyze email content, determine whether it contains characteristics of phishing attacks, and promptly identify and block phishing emails. It automates email detection and analysis without human intervention, improving work efficiency and reducing the possibility of human error.

[0100] Figure 4 is a schematic diagram of the structure of an email detection model training device provided in an embodiment of this application. As shown in Figure 4, the device includes: a processing module 401 and a prediction module 402.

[0101] The processing module 401 is used to convert the email text in the email set to be trained into an image, and to extract the first feature vector by performing feature extraction on the image through a convolutional neural network model.

[0102] The prediction module 402 is used to input the first feature vector into the deep neural network model to obtain a first predicted value and a first loss function representing whether the email is a phishing email. The first loss function represents the loss of the deep neural network model in detecting emails based on email image features.

[0103] The prediction module 402 is also used to classify emails by email feature keywords to obtain email features, convert email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into a deep neural network model to obtain a second prediction value and a second loss function that indicate whether the email is a phishing email. The second loss function represents the loss of the deep neural network model in detecting emails after integrating image features and text features.

[0104] The processing module 401 is also used to calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function, and to train the email detection model based on the overall loss function until the overall loss function converges to obtain the trained email detection model, wherein the sum of the weight values ​​of the first loss function and the second loss function is 1.

[0105] Optionally, the set of email feature keywords is obtained in the following way:

[0106] The processing module 401 is also used to: use natural language processing technology to perform text analysis on the phishing email set to extract high-frequency words to obtain a target keyword set, perform text analysis on each email in the phishing email set, and combine phishing emails containing at least one keyword in the target keyword set into a first email set.

[0107] Encode each email in the first email set to generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of the two vectors.

[0108] The cosine similarity of the embedded vector pairs is compared with a preset similarity threshold to obtain a set of similar word pairs. Duplicate word pairs in the set of similar word pairs are deleted. The term frequency (TF) value of each word in the first email set and the inverse document frequency (IDF) value of each word in the phishing email set are calculated. Part-of-speech tagging is performed on each word in the email.

[0109] Based on the frequency, inverse document frequency, and part-of-speech tagging results of each word, determine whether to add the keyword to the email feature keyword set.

[0110] Optionally, based on the frequency value, inverse document frequency, and part-of-speech tagging results of each word, the processing module 401 determines whether to add the keyword to the email feature keyword set. Specifically, the processing module 401 is used for:

[0111] Multiply the frequency value by the inverse document frequency value to obtain the term frequency-inverse document frequency value;

[0112] The weighted term frequency-inverse file frequency value is obtained by multiplying the term frequency-inverse file frequency value of each word with the weight corresponding to the part of speech.

[0113] The weighted term frequency-inverse document frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

[0114] Optionally, the second vector is concatenated with the first vector to obtain a combined vector. The prediction module 402 is specifically used for:

[0115] The second vector is expanded to the same dimension as the first vector using a fully connected layer;

[0116] The expanded second vector is concatenated with the first vector to obtain the combined vector.

[0117] Optionally, the above-mentioned training email set includes multiple emails and multiple email labels. The first loss function includes a cross-entropy loss function based on the deep neural network output and the labels, and the second loss function includes a cross-entropy loss function based on the deep neural network output and the labels.

[0118] Optionally, natural language processing techniques are used to analyze the phishing email set to extract high-frequency words and obtain a target keyword set. Processing module 401 is specifically used for:

[0119] Natural language processing techniques were used to analyze the text of phishing emails to extract high-frequency words, thus obtaining a first set of keywords.

[0120] Merge the first keyword set and the second keyword set, iterate through the merged keyword set, identify and delete duplicate keywords, and obtain the target keyword set.

[0121] Figure 5 is a schematic diagram of an email detection device provided in an embodiment of this application. As shown in Figure 5, the device includes: an acquisition module 501 and a processing module 502.

[0122] The acquisition module 501 is used to acquire the email detection model obtained by any one of the methods of claims 1 to 6;

[0123] The processing module 502 is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

[0124] Based on the same technical concept, this application also provides an electronic device that can realize the functions of the aforementioned email detection model training device or email detection device.

[0125] Figure 6 is a schematic diagram of the structure of the electronic device provided in an embodiment of this application.

[0126] At least one processor 601 and a memory 602 connected to at least one processor 601 are included. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 illustrates an example where the processor 601 and the memory 602 are connected via a bus 600. The bus 600 is represented by a thick line in Figure 6. The connection methods between other components are for illustrative purposes only and are not intended to be limiting. The bus 600 can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in Figure 6, but this does not indicate that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; the name is not limited.

[0127] In this embodiment, the memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in the memory 602, the at least one processor 601 can perform a distributed training method as described above. The processor 601 can implement the functions of each module in the device shown in FIG4 or FIG5.

[0128] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0129] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, driver interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0130] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the email detection model training method or email detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0131] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0132] By designing and programming the processor 601, the code corresponding to a distributed training method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute a distributed training method of the embodiment shown in Figure 2 during runtime. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0133] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0134] This application also provides a computer-readable storage medium storing computer-executable instructions for causing a computer to execute an email detection model training method or an email detection method as described in the above embodiments.

[0135] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagram.

[0137] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more blocks of a block diagram.

[0138] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of a block diagram.

[0139] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for training an email detection model, characterized in that, The email detection model includes a convolutional neural network model and a deep neural network model, and the method includes: The email text in the email set to be trained is converted into an image, and the first feature vector is obtained by extracting features from the image through the convolutional neural network model; The first feature vector is input into the deep neural network model to obtain a first predicted value and a first loss function representing whether the email is a phishing email. The first loss function represents the loss of the deep neural network model in detecting emails based on email image features. The email features are obtained by classifying the emails using a set of email feature keywords. The email features are then converted into a second vector. The second vector is concatenated with the first vector to obtain a combined vector. The combined vector is then input into the deep neural network model to obtain a second prediction value and a second loss function that indicate whether the email is a phishing email. The second loss function represents the loss of the deep neural network model in detecting emails after integrating image and text feature information. Calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function. Train the email detection model based on the overall loss function until the overall loss function converges to obtain the trained email detection model. The sum of the weights of the first loss function and the second loss function is 1.

2. The method according to claim 1, characterized in that, The set of email feature keywords was obtained in the following way: Natural language processing technology is used to perform text analysis on a phishing email set to extract high-frequency words and obtain a target keyword set. Text analysis is performed on each email in the phishing email set, and phishing emails containing at least one keyword in the target keyword set are combined into a first email set. Encode each email in the first email set to generate an embedding vector representing each word, and calculate the cosine similarity of each pair of embedding vectors, where the cosine similarity is used to measure the similarity between the directions of the two vectors. The cosine similarity of the embedded vector pairs is compared with a preset similarity threshold to obtain a set of similar word pairs. Duplicate word pairs in the set of similar word pairs are deleted. The term frequency (TF) value of each word in the first email set and the inverse document frequency (IDF) value of each word in the phishing email set are calculated. Part-of-speech tagging is performed on each word in the email. Based on the frequency, inverse document frequency, and part-of-speech tagging results of each word, it is determined whether to add the keyword to the set of email feature keywords.

3. The method according to claim 2, characterized in that, The process of determining whether to add keywords to the email feature keyword set based on the frequency value, inverse document frequency, and part-of-speech tagging results for each word specifically includes: Multiply the frequency value by the inverse document frequency value to obtain the term frequency-inverse document frequency value; The weighted word frequency-reverse file frequency value is obtained by multiplying the word frequency-reverse file frequency value of each word with the weight corresponding to the part of speech. The weighted word frequency-inverse file frequency value is compared with a preset threshold to determine whether to add the keyword to the email feature keyword set.

4. The method according to claim 1, characterized in that, The step of concatenating the second vector with the first vector to obtain a combined vector specifically includes: The second vector is expanded to the same dimension as the first vector using a fully connected layer; The combined vector is obtained by concatenating the expanded second vector with the first vector.

5. The method according to any one of claims 1 to 3, characterized in that, The set of emails to be trained includes multiple emails and labels for the multiple emails. The first loss function includes a cross-entropy loss function based on the output of the deep neural network and the labels. The second loss function includes a cross-entropy loss function based on the output of the deep neural network and the labels.

6. The method according to claim 1, characterized in that, The method of using natural language processing technology to analyze the text of phishing email sets and extract high-frequency words to obtain a target keyword set specifically includes: Natural language processing techniques were used to analyze the text of phishing emails to extract high-frequency words, thus obtaining a first set of keywords. Merge the first keyword set and the second keyword set, traverse the merged keyword set, identify and delete duplicate keywords, and obtain the target keyword set.

7. An email detection method, characterized in that, The method includes: Obtain an email detection model using the method described in any one of claims 1 to 6; The email to be detected is input into the email detection model to determine whether the email to be detected is a phishing email.

8. A training device for an email detection model, characterized in that, The device includes: The processing module is used to convert the email text in the email set to be trained into an image, and to extract features from the image using the convolutional neural network model to obtain a first feature vector; The prediction module is used to input the first feature vector into the deep neural network model to obtain a first predicted value and a first loss function representing whether the email is a phishing email. The first loss function represents the loss of the deep neural network model in detecting emails based on email image features. The prediction module is further configured to classify the email by a set of email feature keywords to obtain email features, convert the email features into a second vector, concatenate the second vector with the first vector to obtain a combined vector, and input the combined vector into the deep neural network model to obtain a second prediction value and a second loss function representing whether the email is a phishing email. The second loss function represents the loss of the deep neural network model in detecting emails after integrating image features and text features. The processing module is further configured to calculate the weighted sum of the first loss function and the second loss function to obtain the overall loss function, and to train the email detection model based on the overall loss function until the overall loss function converges to obtain the trained email detection model, wherein the sum of the weight values ​​of the first loss function and the second loss function is 1.

9. An email detection device, characterized in that, The device includes: The acquisition module is used to acquire the email detection model obtained by the method described in any one of claims 1 to 6; The processing module is used to input the email to be detected into the email detection model to determine whether the email to be detected is a phishing email.

10. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-6 or 7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that causes the computer to perform the method of any one of claims 1-6 or 7.

12. A computer program product, characterized in that, When the computer program product is invoked by a computer, it causes the computer to perform the method as described in any one of claims 1-6 or 7.

Images