A mail audit method, device and computer-readable storage medium

Abstract

The embodiment of the present invention discloses a mail auditing method, device and computer-readable storage medium, which analyze the acquired traffic information to obtain characteristic information; set corresponding characteristic labels for characteristic information according to the pre-established characteristic database; use and The audit library corresponding to the feature label detects the feature information, and when the feature information meets the preset conditions, it is determined that the traffic information is malicious information. In this technical solution, traffic information is classified according to the feature database, so that special detection is performed according to the audit database corresponding to the feature label, which makes the selected audit database more targeted and improves the accuracy of phishing email monitoring. And by setting the characteristic label, the scope of detecting the characteristic information is narrowed, thereby shortening the time spent on detection, reducing unnecessary detection, and further improving the performance of mail auditing.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a mail audit method, device and computer-readable storage medium. Background technique [0002] With the popularity of the network, the resulting network security problems are becoming more and more serious. Various malicious methods such as network Trojans, malicious attacks, extortion and fraud emerge in an endless stream. Email is one of the important means of intrusion for most attacks. Phishing emails use disguised emails to trick recipients into replying to designated recipients with information such as account numbers and passwords; or guide recipients to connect to specially crafted webpages, which usually pretend to be the same as real websites, such as banks or The webpage of financial management, making the log-in believe that it is real, enters the credit card or bank card number, account name and password, etc. and is stolen. [0003] There are many methods ...

AI Technical Summary

Problems solved by technology

Phishing emails such as defrauding trust and inducing spoofing often have no obvious malicious features, and it is necessary to artificially understand the sender's intention and follow the instructions to cause threats such as information leakage

Such emails that need to understand semantics often do not have payloads, such as links or attachments. Using simple feature matching, it is difficult to distinguish phishing emails, so it is easy to cause false positives, missed negatives, etc.

Images