29 results about "Email security" patented technology

Techniques for an email-security detection system to analyze incoming emails for Business Email Comprise (BEC) attacks of targeted new email users in an enterprise based on peer models of email recipients in an enterprise and the conversation history of recipients. A method is disclosed that includes analyzing an incoming email and identifying one or more recipients of the incoming email in an enterprise network; analyzing contextual information in the incoming email for the email intent, and associating the email with a target recipient; applying a relational model associated with peers of the target recipient for detecting whether the incoming email is a business email compromise (BEC) attack directed to the target recipient; applying a relationship model of other recipients of the incoming email for detecting whether the BEC attack is associated with the target recipient; and determining, whether the incoming email is a BEC attack.

The invention relates to the technical field of network and information security, in particular to a mail security detection method and device, equipment and a medium. In the embodiment of the invention, the risk is evaluated from multiple dimensions such as the basic information, the link risk and the emotional intention of the target mail through the multiple agents, the risk score of the target mail is generated, and when the risk score reaches the preset threshold value, the target mail is determined to be the abnormal mail, so that the robustness of abnormal mail detection is improved, and the detection efficiency is improved. And the false alarm rate of abnormal mail detection is reduced.

The invention belongs to the technical field of office automation, and discloses a mail security detection method and system based on frequency domain and semantic analysis, electronic equipment and a computer readable storage medium. The method comprises the following steps: obtaining a to-be-detected mail, and carrying out preprocessing operation on an image in an attachment of the to-be-detected mail; performing block operation on the preprocessed image, and then performing DCT (Discrete Cosine Transformation) on each block to generate a corresponding DCT coefficient matrix; according to the DCT coefficient matrix, respectively calculating a high-frequency component entropy # imgabs0 # corresponding to each block; determining a steganography suspicion detection result of the mail according to the # imgabs 1 # value; based on the steganography suspicion detection result, SMTP flow semantic analysis of the mail is triggered, and a comprehensive risk score # imgabs2 is obtained; and based on the comprehensive risk score # imgabs3 #, triggering a linkage mechanism of multi-level alarm. According to the invention, a data stealing protection effect with high detection rate, low delay and strong adaptability on the mail is realized, and a reliable technical guarantee is provided for enterprise-level network security.

An operation method of an email security system comprises the steps of: configuring security threat information synchronization data by synchronizing targeted email security threat information configured by performing a targeted email security threat inspection on an inbound mail with targeted email security threat information configured by performing a targeted email security threat inspection on an outbound mail; performing a targeted email security threat inspection corresponding to a new inbound mail or a new outbound mail using the security threat information synchronization data; and performing a targeted email security threat response process according to the targeted email security threat inspection of the new inbound mail or the new outbound mail.

This disclosure describes techniques for an email security system to detect a malicious email and take remedial actions in response to the detected malicious email. The techniques described herein may enable the email security system to detect whether an email is malicious based on whether one or more files attached to the email are malicious. In some cases, the email security system determines whether an email attachment file is malicious based on a set of features that are specific to both a classification of the email (e.g., a semantic classification of the email) and a format of the email attachment file.

The invention discloses a data processing method and device, a storage medium and electronic equipment, and relates to the technical field of data processing. Processing the to-be-tested mail data by using a mail management system; based on the processing operation of the mail management system on the to-be-tested mail data, determining a mail processing capability parameter and a mail security performance parameter; and evaluating the mail management system according to the mail processing capability parameter and the mail security performance parameter, and generating an evaluation result. Compared with the prior art, the method has the advantages that the overall management capability of the mail management system is comprehensively evaluated from multiple dimensions by collecting and analyzing the mail processing capability parameters and the mail safety performance parameters, so that the comprehensive efficiency of the mail management system in the running process is visually fed back; and a basis is provided for real-time monitoring and dynamic optimization of the system, so that the mail processing efficiency and the security protection capability are effectively improved.

This disclosure describes techniques for an email security system to detect a malicious email and take remedial actions in response to the detected malicious email. The techniques described herein may enable the email security system to detect whether an email is malicious based on whether one or more files attached to the email are malicious. In some cases, the email security system determines whether an email attachment file is malicious based on a set of features that are specific to both a classification of the email (e.g., a semantic classification of the email) and a format of the email attachment file.

The present invention relates to an email security system and an operation method thereof for blocking and responding to targeted email attacks, which perform inspection of unauthorized email server access attack, and the method comprises the steps of: configuring security threat information synchronization data by synchronizing targeted email security threat information configured by performing a targeted email security threat inspection on an inbound mail with targeted email security threat information configured by performing a targeted email security threat inspection on an outbound mail; performing a targeted email security threat inspection corresponding to a new inbound mail or a new outbound mail using the security threat information synchronization data; and performing a targeted email security threat response process according to the targeted email security threat inspection of the new inbound mail or the new outbound mail.

An optimization allocation method for email security defense resources, the optimization allocation method for email security defense resources includes the following steps: preprocessing of the user email access data set; determining the upper bound of the resource optimization rate; resource allocation between time intervals; resource allocation between nodes. In the context of limited defense resources, quantitatively give the minimum security defense resources required by the email system, and in the context of given security defense resources, determine the optimal allocation scheme of defense resources among different time periods and different email users, so as to achieve the optimal allocation of defense resources.

The application provides an email threat perception system, belonging to the field of network security and email protection, and researches and practices email security threat perception technology, utilizes an email behavior detection model and a machine learning model to perform multi-dimensional and multi-level deep analysis on emails, so as to identify abnormal email behaviors, discover phishing links and sensitive contents, etc. On this basis, an active and low false alarm rate email security threat perception system is realized, which detects and filters spam emails, phishing emails and emails containing sensitive contents, and improves the security of email applications.

This application provides a device fingerprint update method, apparatus, electronic device, and storage medium. It includes: generating first device fingerprint information based on first user agent information when a user logs into an email account; determining whether the first device fingerprint information is in a device fingerprint database; if the first device fingerprint information is not in the database, performing a recall operation of the device fingerprint database, the recall operation including: determining whether the first device fingerprint information meets device fingerprint update conditions based on the user agent information and the first user agent information; if the first device fingerprint information meets the device fingerprint update conditions, updating the stored second device fingerprint information to the first device fingerprint information, enabling the user to log into the email account, and verifying the user's device fingerprint information upon the next login using the updated device fingerprint database. This application can improve email security and reduce the erroneous blocking of legitimate users.

1. The name of the design product: computer with AI malicious email protection system graphical user interface. 2. The use of the design product: the design product is used to display and run application programs. 3. The design points of the design product: the interface content of the graphical user interface in the screen. 4. The picture or photo that best indicates the design points: front view. 5. The computer is a common design, and other views are omitted. 6. The use of the graphical user interface: the graphical user interface is mainly used for visual display of enterprise email security filtering situation of main users, filtering and detecting the received emails of users through AI, analyzing the intention information of malicious emails through AI, protecting the email security situation of enterprises, and reducing the loss of enterprises caused by malicious emails. 7. The human-computer interaction mode of the graphical user interface: the main view is the main interface of the graphical user interface; clicking the "data statistics" function module on the left side of the main view enters the interface change state diagram 1; clicking the "monitoring log" function module on the left side of the interface change state diagram 1 enters the interface change state diagram 2; clicking the "view" function module on the right side of the interface change state diagram 2 enters the interface change state diagram 3; clicking the "user management" function module on the left side of the interface change state diagram 3 enters the interface change state diagram 4; clicking the "new" function module in the interface change state diagram 4 enters the interface change state diagram 5; clicking the "information cockpit" function module in the upper right corner after clicking the confirmation in the interface change state diagram 5 enters the interface change state diagram 6.

The embodiment of the invention provides an E-mail secure delivery method and related equipment, and belongs to the technical field of information security. The method comprises the following steps: carrying out explicit content extraction on a received email to obtain email explicit information; performing first classification processing on the emails according to the email explicit information to obtain a first classification result; when the first classification result represents the junk mail, intercepting the E-mail; under the condition that the first classification result shows the credible email, delivering the email to a recipient mailbox; and under the condition that the first classification result shows the suspicious mail, delivering the e-mail to a recipient mailbox, and carrying out second classification processing on the link pointing content of the link domain name in the e-mail to obtain a second classification result. According to the invention, the E-mail delivery security and timeliness can be improved.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

Disclosed are methods, systems, computing devices, and machine-readable mediums for securing the delivery of OTPs via email. The disclosed methods utilize one or more of a combination of server-side vulnerability scans; security policy compliance enforcement; email provider integration to allow for real-time threat scanning; and / or utilizing executable files or secure links for additional authentication and OTP retrieval. This system ensures that OTPs are only sent to secure, verified email addresses and that the recipient's environment meets the necessary security standards.

Via a DNS record, an Internet domain designates a website as a Domain Email Authority (DEA): a consolidated entity that collects, validates, and stores all email-related policies of the domain to distribute them to the DNS, email servers, email clients, and end-users. Simple embodiments of this invention can be implemented without changes to existing email standards, servers, or clients, and can provide considerable benefits such as enhanced security and reduced spam. Also described are more advanced embodiments that can be introduced gradually through small modifications to specific standards, protocols, and specific components of email servers and clients. Given that the email standard is mature and highly resistant to change, the DEA is designed to be an inexpensive means for experimenting with new email features such that new features do not require significant changes or end-to-end adoption by the entire email ecology.

The invention relates to the technical field of network security, and discloses a mail data encryption gateway, which comprises a data scheduling bus which is respectively connected with a core service module, a management subsystem, a domestic credential foundation platform, an expansion service module, a national secret password acceleration card, a database and an HAL interface, and user management, administrator management, certificate management, service management, equipment management, system management and key management are also connected. The mail data encryption method is applied to a mail data encryption gateway and comprises the steps that a sender edits mail content and inputs a mail address through a mail terminal A, and a mail reaches the mail data encryption gateway, is transmitted to a mail server through a mail security gateway and is transmitted to a mail terminal B of a recipient in different forms according to the receiving and sending types of the mail. According to the invention, the national cryptographic algorithm is adopted to meet the requirements of high-strength security and policy compliance, and cross-enterprise and cross-boundary secure transmission of mails inside is ensured through the technologies of data encryption and decryption, a certificate system, transmission tunnel encryption and the like.

Disclosed are methods, systems, computing devices, and machine-readable mediums for securing the delivery of OTPs via email. The disclosed methods utilize one or more of a combination of server-side vulnerability scans; security policy compliance enforcement; email provider integration to allow for real-time threat scanning; and / or utilizing executable files or secure links for additional authentication and OTP retrieval. This system ensures that OTPs are only sent to secure, verified email addresses and that the recipient's environment meets the necessary security standards.

A service providing device according to an embodiment of the present invention comprises: a collection unit for collecting mail information transmitted between one or more user terminals; a security threat inspection unit for performing matching of a mail security process corresponding to the mail information in stages according to a preset security threat architecture, inspecting the mail information according to the matched mail security process, and storing and managing mail security inspection information according to the inspection results; and an email security diagnosis service unit for calculating quantitative analysis information, corresponding to a threat level element classification reference of a mail system to be diagnosed, from the architecture processing information from the security threat inspection unit, and creating an email security diagnosis analysis report based on the quantitative analysis information to provide the email security diagnosis analysis reporting to a user terminal of a manager.

The present invention belongs to the field of office automation technology and discloses an email security detection method and system based on frequency domain and semantic analysis, an electronic device, and a computer-readable storage medium. The method comprises obtaining an email to be detected and preprocessing images in its attachments; performing a block operation on the preprocessed image, then performing a DCT transform on each block to generate a corresponding DCT coefficient matrix; calculating the high-frequency component entropy value #imgabs0# corresponding to each block based on the DCT coefficient matrix; determining the steganographic suspicion detection result of the email based on the #imgabs1# value; triggering SMTP traffic semantic analysis of the email based on the steganographic suspicion detection result to obtain a comprehensive risk score #imgabs2#; and triggering a multi-level alarm linkage mechanism based on the comprehensive risk score #imgabs3#. The present invention achieves a high detection rate, low latency, and highly adaptable data theft protection for emails, providing reliable technical support for enterprise-level network security.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

The invention provides an automatic generation method, a sending method and a detection method of a security test mail, and belongs to the technical field of security validity verification. According to the automatic generation method for the security test mail, manual operation is reduced, an automatic system can quickly generate the mail according to the template, manual modification of an EML file is avoided, and the mail construction efficiency is improved; in addition, batch mail generation is supported, a large number of mails can be constructed at a time, and the method is suitable for large-scale mail testing or marketing activities; moreover, a flexible mail construction mode supports two modes of EML file replacement and standardized construction, and different mail security test service requirements can be met. According to the method provided by the invention, when the mail is sent anonymously, the probability that the mail is intercepted or classified as a junk mail is reduced by querying the MX record of the mail receiving server and selecting the locally adaptive SMTP server as the mail sending server, and the successful delivery rate of the mail is improved.

One variation of a method includes, intercepting an email addressed to a target recipient within an organization, the email received from a sender at an inbound email address and including a first inbound display name; accessing a whitelist including a set of contact information corresponding to an entity associated with the organization and including a verified display name associated with the entity and a set of verified email addresses associated with the entity. The method further includes, in response to the set of verified email addresses omitting the inbound email address: characterizing a display name difference between the inbound display name and the verified display name associated with the entity; and, in response to the display name difference falling below a threshold difference, withholding transmission of the email to the target recipient and flagging the email for authentication.

A method includes, in response to receiving an email message, detecting one or more artifacts within an email message, wherein each of the artifacts is associated with a payload; for each artifact, generating, a descriptor object representing the artifact that does not include the payload, so that the processor is prevented from accessing the payload via the descriptor object; and at least one payload button based on the payload associated with the artifact for causing the payload to be transmitted to an external system for analysis of the payload; and presenting an artifact dashboard in a graphical user interface (GUI) rendered on a display of the email security system, the artifact dashboard displaying, for each artifact, the descriptor object representing the artifact and the at least one payload button based on the payload associated with the artifact.

The invention provides a security processing method and device, a storage medium and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: acquiring a sender strategy framework detection result of a target mail; determining a first detection score of the target mail according to a sender strategy framework detection result of the target mail; determining a security score of the target mail according to the first detection score of the target mail, a preset first dynamic weight and a preset initial score in combination with a second detection strategy; and disposing the target mail according to the target mail security score and the score threshold. A sender strategy framework detection result of a target mail is obtained and converted into a first detection score, then a preset first dynamic weight, a preset initial score and a second detection strategy are combined, a safety score of the target mail is comprehensively determined, and finally differential mail disposal is executed according to a score threshold. And the overall performance of the mail security detection system is obviously improved.

This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.

This disclosure describes techniques for an email security system to detect and prevent callback phishing attacks included within electronic messages. An email security system may receive an email that is to be delivered to a receiving user. Based on the email metadata, the email security system may determine an intent associated with the email (e.g., whether the email is malicious). In some instances, the email may be associated with an indication of a phone number. Based on the metadata associated with the phone number, the email security system may be configured to determine a reputation associated with the phone number. The email security system may then use the reputation and / or the intent to determine whether the email is associated with a callback phishing attempt. The email security system may then determine whether to transmit the email to the receiving user, or perform a remedial action regarding the email.

The present invention provides a method for automatically generating, sending, and detecting security test emails, and belongs to the technical field of security validity verification. The method for automatically generating security test emails provided by the present invention reduces manual operations: the automated system can quickly generate emails based on templates, avoiding manual modification of EML files and improving email construction efficiency. In addition, it supports batch email generation: a large number of emails can be constructed at one time, which is suitable for large-scale email testing or marketing activities. Furthermore, the flexible email construction method supports both EML file replacement and standardized construction modes, which can meet different email security testing business needs. When the anonymous email sending rate is low, the method of the present invention reduces the probability of the email being intercepted or classified as spam by querying the MX record of the receiving server and selecting a locally adapted SMTP server as the sending server, thereby improving the successful delivery rate of the email.