12 results about "Email security" patented technology

An operation method of an email security system comprises the steps of: configuring security threat information synchronization data by synchronizing targeted email security threat information configured by performing a targeted email security threat inspection on an inbound mail with targeted email security threat information configured by performing a targeted email security threat inspection on an outbound mail; performing a targeted email security threat inspection corresponding to a new inbound mail or a new outbound mail using the security threat information synchronization data; and performing a targeted email security threat response process according to the targeted email security threat inspection of the new inbound mail or the new outbound mail.

The invention discloses a data processing method and device, a storage medium and electronic equipment, and relates to the technical field of data processing. Processing the to-be-tested mail data by using a mail management system; based on the processing operation of the mail management system on the to-be-tested mail data, determining a mail processing capability parameter and a mail security performance parameter; and evaluating the mail management system according to the mail processing capability parameter and the mail security performance parameter, and generating an evaluation result. Compared with the prior art, the method has the advantages that the overall management capability of the mail management system is comprehensively evaluated from multiple dimensions by collecting and analyzing the mail processing capability parameters and the mail safety performance parameters, so that the comprehensive efficiency of the mail management system in the running process is visually fed back; and a basis is provided for real-time monitoring and dynamic optimization of the system, so that the mail processing efficiency and the security protection capability are effectively improved.

The present invention relates to an email security system and an operation method thereof for blocking and responding to targeted email attacks, which perform inspection of unauthorized email server access attack, and the method comprises the steps of: configuring security threat information synchronization data by synchronizing targeted email security threat information configured by performing a targeted email security threat inspection on an inbound mail with targeted email security threat information configured by performing a targeted email security threat inspection on an outbound mail; performing a targeted email security threat inspection corresponding to a new inbound mail or a new outbound mail using the security threat information synchronization data; and performing a targeted email security threat response process according to the targeted email security threat inspection of the new inbound mail or the new outbound mail.

The application provides an email threat perception system, belonging to the field of network security and email protection, and researches and practices email security threat perception technology, utilizes an email behavior detection model and a machine learning model to perform multi-dimensional and multi-level deep analysis on emails, so as to identify abnormal email behaviors, discover phishing links and sensitive contents, etc. On this basis, an active and low false alarm rate email security threat perception system is realized, which detects and filters spam emails, phishing emails and emails containing sensitive contents, and improves the security of email applications.

This application provides a device fingerprint update method, apparatus, electronic device, and storage medium. It includes: generating first device fingerprint information based on first user agent information when a user logs into an email account; determining whether the first device fingerprint information is in a device fingerprint database; if the first device fingerprint information is not in the database, performing a recall operation of the device fingerprint database, the recall operation including: determining whether the first device fingerprint information meets device fingerprint update conditions based on the user agent information and the first user agent information; if the first device fingerprint information meets the device fingerprint update conditions, updating the stored second device fingerprint information to the first device fingerprint information, enabling the user to log into the email account, and verifying the user's device fingerprint information upon the next login using the updated device fingerprint database. This application can improve email security and reduce the erroneous blocking of legitimate users.

Disclosed are methods, systems, computing devices, and machine-readable mediums for securing the delivery of OTPs via email. The disclosed methods utilize one or more of a combination of server-side vulnerability scans; security policy compliance enforcement; email provider integration to allow for real-time threat scanning; and / or utilizing executable files or secure links for additional authentication and OTP retrieval. This system ensures that OTPs are only sent to secure, verified email addresses and that the recipient's environment meets the necessary security standards.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

One variation of a method includes, intercepting an email addressed to a target recipient within an organization, the email received from a sender at an inbound email address and including a first inbound display name; accessing a whitelist including a set of contact information corresponding to an entity associated with the organization and including a verified display name associated with the entity and a set of verified email addresses associated with the entity. The method further includes, in response to the set of verified email addresses omitting the inbound email address: characterizing a display name difference between the inbound display name and the verified display name associated with the entity; and, in response to the display name difference falling below a threshold difference, withholding transmission of the email to the target recipient and flagging the email for authentication.

A method includes, in response to receiving an email message, detecting one or more artifacts within an email message, wherein each of the artifacts is associated with a payload; for each artifact, generating, a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and presenting an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

The invention provides a security processing method and device, a storage medium and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: acquiring a sender strategy framework detection result of a target mail; determining a first detection score of the target mail according to a sender strategy framework detection result of the target mail; determining a security score of the target mail according to the first detection score of the target mail, a preset first dynamic weight and a preset initial score in combination with a second detection strategy; and disposing the target mail according to the target mail security score and the score threshold. A sender strategy framework detection result of a target mail is obtained and converted into a first detection score, then a preset first dynamic weight, a preset initial score and a second detection strategy are combined, a safety score of the target mail is comprehensively determined, and finally differential mail disposal is executed according to a score threshold. And the overall performance of the mail security detection system is obviously improved.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

This disclosure describes techniques for an email security system to detect and prevent callback phishing attacks included within electronic messages. An email security system may receive an email that is to be delivered to a receiving user. Based on the email metadata, the email security system may determine an intent associated with the email (e.g., whether the email is malicious). In some instances, the email may be associated with an indication of a phone number. Based on the metadata associated with the phone number, the email security system may be configured to determine a reputation associated with the phone number. The email security system may then use the reputation and / or the intent to determine whether the email is associated with a callback phishing attempt. The email security system may then determine whether to transmit the email to the receiving user, or perform a remedial action regarding the email.