CN107453973A

CN107453973A - A kind of method and apparatus for screening Email senders' identity characteristic

Info

Publication number: CN107453973A
Application number: CN201610373221.2A
Authority: CN
Inventors: 沈朝阳
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Group Holding Ltd
Priority date: 2016-05-31
Filing date: 2016-05-31
Publication date: 2017-12-08
Anticipated expiration: 2036-05-31
Also published as: CN107453973B

Abstract

A kind of method and apparatus for screening Email senders' identity characteristic of disclosure, wherein, this method is by establishing default characteristic matching model, characteristic matching model is preset by this and is used as basis for estimation, feature in the default feature set to be screened of extraction is carried out to the judgement of matching condition, when corresponding feature meets the characteristic matching condition in the default feature set, the identity for illustrating the sender of Email to be screened is real believable.Therefore, the method that the application provides need not require that e-mail sending does the setting of any aspect, but it is entirely to send behavioural information by collecting and comparing mail, with this information to match the identity characteristic with screened mail sender, and it can accurately confirm whether the identity of sender is genuine and believable by this method.

Description

A kind of method and apparatus for screening Email senders' identity characteristic

Technical field

The application is related to the technical field of e-mail system, and in particular to one kind screens Email senders The method and apparatus of identity characteristic.

Background technology

Due to the development of network technology, traditional communication modes are almost substituted by network communication mode, for example, The appearance of Email gradually substitutes traditional mail delivery.In the network popular epoch, no matter is user Still it is more likely to carry out the biography of file and information at work on the living conditions using Email as transmission means It is defeated.

According to email protocol, when an envelope Email transmits in same e-mail system, for Recipient and sender use the situation of same e-mail system, and recipient and sender are both needed to when logging in Authentication is carried out by modes such as passwords, therefore, if recipient and sender use identical systems, Sender needs just log in the system by authentication, now can then illustrate the identity of the sender and be Really, therefore recipient is not needed to do other certifications again.But when an envelope Email at two not With e-mail system between transmit when, the system of Email is different used by recipient and sender, The authentication for the system that system is applied to sender is uncertain therefore, to be used by recipient The authentication mechanism of system is limited, and is directed to the situation, existing two kinds of conventional personal identification methods point Not Wei SPF methods and DKIM methods, two kinds of existing methods are introduced below：

SPF (Sender Policy Framework), this is to transmit the domain name owner of address by setting by mail The DNS (domain name system) for putting sending domain is recorded by spf or txt modes to state that the legal of this domain transmits IP, Therefore otherwise all mails in this domain all, should may belong to forgery from the IP of these statements.

DKIM (Domain Keys Identified Mail), this is a kind of authentication machine based on digital signature System, public signature key is arranged in DNS (domain name system) records of designated domain name in advance by sender, Mail is digitally signed using private key when transmitting and inserts result into mail header, recipient is by basis Email letter header obtains public key from DNS and checking is digitally signed to mail.

SPF and DKIM modes are a kind of more effective mail sending domain domains between two e-mail systems Name identification mechanism, still, two ways can have problems with actual applications：

Both mechanism require that the domain name owner of mail sending domain must carry out corresponding DNS (domain name systems System) set, DKIM modes also need to increase corresponding signature field in mail header, but both modes Above-mentioned setting is not that email protocol is Qiang Zhiyaoqiud, therefore, in actual applications, many mails Sender is not set using corresponding, and recipient also just has no way of carrying out respective identity Zhen using these mechanism Not.Even if some address domain names have carried out corresponding setting, but in many cases, some recipients are not to being inconsistent The mail that SPF or DKIM is set and indefinite refusal are closed, therefore, only with the still bad confirmation postal of these mechanism Whether part identity of the sender is genuine and believable.

The content of the invention

The application provides a kind of method for screening Email senders' identity characteristic, to solve in the prior art Existing above mentioned problem.

The application provides a kind of device for screening Email senders' identity characteristic in addition.

The application provides a kind of method for screening Email senders' identity characteristic, including：

Extract the default feature set of the Email to be screened received；

Using the characteristic matching condition in the good characteristic matching model of training in advance as foundation, by the default feature Feature the to be screened feature corresponding with the characteristic matching condition concentrated carries out matching degree test, judges institute State whether feature to be screened in default feature set meets the characteristic matching condition；

Sent if so, the identity characteristic of the sender of the Email to be screened is screened for believable mail Person.

Optionally, the training method of the good characteristic matching model of the training in advance includes：

Data in preset time period based on off-line data system, characteristic matching bar is obtained using predetermined manner Part and trusted IP address；The trusted IP address deposit trusted IP address is concentrated；

Obtain linked character corresponding with the trusted IP address；

Linked character corresponding to the characteristic matching condition of acquisition, trusted IP address collection and trusted IP address is stored In the characteristic matching model.

Optionally, it is described using predetermined manner obtain trusted IP address step in, the predetermined manner include with At least one of under type：

According to sending domain and transmit IP address judge this transmit IP address whether be trusted IP address mode；

Judge that this transmits whether IP address is trusted IP address with transmitting IP address according to originator system banner Mode；

Being judged according to the similarity of the linked character for transmitting IP address linked character corresponding with trusted IP address should Transmit IP address whether be trusted IP address mode；

The response rate according to corresponding to the mail for transmitting IP address transmission judges that this transmits whether IP address is credible IP The mode of address；

Linked character and mail opening rate according to corresponding to transmitting IP address judge this transmit IP address whether be can Believe the mode of IP address.

Optionally, it is described to judge that this transmits whether IP address is credible IP with transmitting IP address according to sending domain The mode of address includes；

Email is obtained from off-line data system transmits IP address；

The sending domain of Email is parsed, the IP address after being parsed；

Transmit whether IP address matches with the IP address after the parsing described in judgement；

If so, using IP address corresponding to this transmits IP address as trusted IP address；

Wherein, the characteristic matching condition obtained using predetermined manner is that judgement transmits IP address and sending domain solution Whether the IP address information after analysis matches.

Optionally, the IP address after IP address and the parsing is transmitted described in the judgement whether in matching step, Mode used by whether IP address matches with the IP address after the parsing is transmitted described in judgement to be included：

Whether transmitted described in judgement between two addresses of IP address after IP address and the parsing has predetermined number Identical digit；

If so, then described transmit IP address and the IP address information match after the parsing；

If it is not, then the IP address that transmits mismatches with the IP address information after the parsing.

Optionally, in described the step of being parsed the sending domain of Email, the sending domain parsing side Formula includes any one in the following manner：

The sending domain is parsed by the way of setting IP address to record；

Sending domain is parsed by the way of mail exchange record.

Optionally, it is described according to originator system banner with transmit IP address judge this transmit IP address whether be Trusted IP address mode includes：

Email sending domain is obtained from off-line data system transmits IP address and originator system banner；

Judge that the originator system banner transmits whether IP address matches with described；

Wherein, the characteristic matching condition obtained using predetermined manner be judge Email transmit method, system Identify and transmit whether IP address matches.

It is optionally, described to judge the originator system banner with the IP address that transmits whether in matching step, Judge the originator system banner with it is described transmit IP address whether match used by mode include：

Judge the top-level domain of Email sending domain and the originator system banner top-level domain whether phase Together；

If so, judge IP address that the originator system banner parses with it is described transmit IP address whether Match somebody with somebody；

When the IP address parsed with it is described transmit IP address there is the identical digit of predetermined number when, the hair Letter method, system mark matches with the IP address that transmits；

When the IP address parsed with it is described transmit IP address do not have predetermined number identical digit when, it is described Originator system banner transmits IP address mismatch with described.

Optionally, the basis transmits the linked character linked character corresponding with trusted IP address of IP address Similarity judges that this transmits whether IP address is that the mode of trusted IP address includes：

Transmitting for Email is obtained from off-line data system and IP address and transmits the linked character of IP address； The linked character includes originator system banner and mail header feature；

The linked character that IP address is transmitted described in judgement is corresponding with the trusted IP address that trusted IP address is concentrated Whether linked character matches；

If so, using IP address corresponding to this transmits IP address as credible IP；

Wherein, the characteristic matching condition obtained using predetermined manner is to judge to transmit the linked character of IP address Whether linked character corresponding with the trusted IP address that trusted IP address is concentrated matches.

Optionally, the credible IP that the linked character of IP address is concentrated with trusted IP address is transmitted described in the judgement Whether linked character corresponding to address matches in step, judges to transmit the linked character of IP address and credible IP Mode includes used by whether linked character corresponding to the trusted IP address in address set matches：

The linked character of IP address and credible IP are transmitted using described in the method for measuring similarity calculating of characteristic vector The similarity of characteristic vector in address set corresponding to corresponding linked character；

Judge whether the similarity is more than or equal to default similarity threshold；

If so, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered matches；

If it is not, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered mismatches.

Optionally, the method for measuring similarity of the characteristic vector specifically includes：

Obtain linked character and the linked character for transmitting IP address corresponding to trusted IP address collection；

By the feature in linked character corresponding to the trusted IP address collection and the weight corresponding to each feature Constitutive characteristic vector；

Transmitted described in acquisition in the linked character of IP address in linked character corresponding with the trusted IP address collection Same characteristic features；

Calculate the weight for obtaining the same characteristic features；

The weight of the same characteristic features and the total weight of all features are contrasted, the pass of IP address is transmitted described in acquisition Join the similarity of the characteristic vector of feature linked character corresponding with the trusted IP address collection.

Optionally, the basis transmit IP address transmission mail corresponding to response rate judge that this transmits IP address Whether it is that the mode of trusted IP address includes：

Obtained from off-line data system using the e-mail hash for transmitting IP address transmission；

Obtain the quantity for transmitting IP address mail received in the preset time period；

This is obtained according to the quantity of the transmission e-mail hash and the mail received and transmits IP address Response rate；

Judge whether the response rate is more than or equal to default response rate threshold value；

If so, this is then transmitted into IP address as trusted IP address.

Optionally, the basis transmits linked character corresponding to IP address and mail opening rate judges that this transmits IP Whether address is that the mode of trusted IP address includes：

The frequency of use obtained from off-line data system in preset time period transmits IP higher than predeterminated frequency Address；

Judge that this transmits originator system banner corresponding to IP address and whether mail header feature is stablized；

If so, judge that whether this transmits the opening rate for the mail that IP address is sent higher than default opening rate threshold value；

When the opening rate that this transmits the mail that IP address is sent is higher than default opening rate threshold value, and this transmits IP Record of bad behavior is not present in address, and this is transmitted into IP address as trusted IP address.

Optionally, received in the default feature set step for extracting the Email to be screened received Default feature set in wait to screen and be characterized as to be screened transmitting IP address；

Accordingly, the characteristic matching condition in the characteristic matching model good using training in advance, will as foundation Feature to be screened feature corresponding with the characteristic matching condition in the default feature set carries out matching degree Test, judges whether feature to be screened meets that the characteristic matching condition step includes in the default feature set：

Characteristic matching condition in the good characteristic matching model of the training in advance is whether to judge a certain IP address Belong to the trusted IP address collection；

It is to be screened described in judgement to transmit whether IP address belongs to institute according to the characteristic matching condition of setting State trusted IP address collection；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.

Optionally, transmit whether IP address belongs to the trusted IP address collection when to be screened described in the judgement Judged result for it is no when, again perform characteristic matching model in characteristic matching condition judgement, the spy Sign matching condition transmits whether the IP address after IP address parses with sending domain matches for judgement；

Specific judgment mode includes：

The sending domain of Email is parsed, the IP address after being parsed；

According to this feature matching condition, it is wait the transmit IP address and the IP address after parsing screened described in judgement No matching；

Optionally, transmit whether IP address matches step with the IP address after parsing wait what is screened described in the judgement The judgment mode whether matched in rapid includes：

Whether have between two addresses of IP address described in judgement after that screens transmits IP address and parsing pre- If the identical digit of quantity.

Optionally, transmit whether IP address matches step with the IP address after parsing wait what is screened described in the judgement When judged result in rapid is no, the judgement of the characteristic matching condition in characteristic matching model, the spy are performed Sign matching condition is the originator system banner for judging Email with transmitting whether IP address matches；

Specific judgment mode includes：

According to this feature matching condition, the IP address that transmits to be screened transmits method, system mark with described described in judgement Whether knowledge matches；

Optionally, described in the judgement it is to be screened transmit IP address and the originator system banner whether Include with the judgement matching way in step：

Judge whether the top-level domain of mail sending domain is identical with the top-level domain of the originator system banner；

If so, judge IP address that the originator system banner parses with it is described it is to be screened with transmitting IP Whether location matches.

Optionally, described in the judgement it is to be screened transmit IP address and the originator system banner whether If be no with judged result in step, the judgement of the characteristic matching condition in characteristic matching model, institute are performed State characteristic matching condition and transmit the linked character of IP address with the credible IP of trusted IP address concentration for judgement Whether linked character corresponding to location matches；The linked character includes originator system banner and mail header Feature；

Specific judgment mode includes：

According to this feature matching condition, the linked character for transmitting IP address to be screened described in judgement and credible IP Whether linked character matches corresponding to trusted IP address in address set；

Optionally, the linked character for transmitting IP address to be screened described in the judgement is concentrated with trusted IP address Trusted IP address corresponding to the linked character judgement matching way used in step that whether matches include：

The association corresponding with the trusted IP address of the linked character for transmitting IP address to be screened described in judgement is special Whether the similarity of sign is more than or equal to default similarity threshold.

Optionally, the IP address that transmits to be screened meets the characteristic matching condition step, performs following Step：

The credible IP that the linked character for transmitting IP address to be screened described in judgement is concentrated with trusted IP address Whether linked character corresponding to location matches；

Optionally, treated described in the default feature set step for extracting the Email to be screened received The reception mode of the Email of examination includes：Electronics postal to be screened is received using Mail Transfer Agent system Part.

Optionally, the characteristic information included in the default characteristic matching model includes：Transmit IP address, Send domain information, originator system banner and mail header feature.

The application also provides a kind of device for screening Email senders' identity characteristic, including：

Default feature set extraction unit, for extracting the default feature set of the Email to be screened received；

Characteristic matching condition judgment unit, for the characteristic matching in the good characteristic matching model of training in advance Condition is foundation, and the feature to be screened in the default feature set is corresponding with the characteristic matching condition Feature carries out matching degree test, judges whether feature to be screened meets the feature in the default feature set With condition；

Identity characteristic discriminator unit, it is described if the judged result for characteristic matching condition judgment unit is yes It is believable Email Sender that the identity characteristic of the sender of Email to be screened, which is screened,.

Optionally, also include in the characteristic matching condition judgment unit：Characteristic matching model training subelement；

The characteristic matching model training subelement also includes：

Characteristic matching condition and trusted IP address obtain subelement, during for default based on off-line data system Between data in section, characteristic matching condition and trusted IP address are obtained using predetermined manner；The credible IP Location deposit trusted IP address is concentrated；

Linked character obtains subelement, for obtaining linked character corresponding with the trusted IP address；

Storing sub-units, for by the characteristic matching condition of acquisition, trusted IP address collection and trusted IP address pair The linked character answered is stored in the characteristic matching model.

Optionally, the predetermined manner that the characteristic matching condition and trusted IP address are obtained in subelement include with At least one of lower unit：

Sending domain judgment sub-unit, for judging whether this transmits IP address with transmitting IP address according to sending domain For the mode of trusted IP address；

Originator system banner judgment sub-unit, for being judged according to originator system banner with transmitting IP address This transmits whether IP address is trusted IP address mode；

Special similarity judgment sub-unit is associated, for according to the linked character and trusted IP address for transmitting IP address The similarity of corresponding linked character judge this transmit IP address whether be trusted IP address mode；

Response rate judgment sub-unit, judging for the response rate according to corresponding to the mail for transmitting IP address transmission should Transmit IP address whether be trusted IP address mode；

Opening rate judgment sub-unit, transmit linked character corresponding to IP address for basis and mail opening rate is sentenced Break this transmit IP address whether be trusted IP address mode.

Optionally, the sending domain judgment sub-unit includes：

Transmit IP address obtain subelement, for from off-line data system obtain Email with transmitting IP Location；

Parse subelement, for the sending domain of Email to be parsed, the IP address after being parsed；

Judgment sub-unit, for judging described to transmit whether IP address matches with the IP address after the parsing；

Trusted IP address generates subelement, if the judged result of judgment sub-unit is yes, for this to be transmitted into IP IP address is as trusted IP address corresponding to address；

Optionally, the judgment sub-unit includes：

Digit judgment sub-unit, for judging described to transmit IP address and two addresses of IP address after the parsing Between whether have predetermined number identical digit；

Optionally, the originator system banner judgment sub-unit includes：

Transmit IP address and originator system banner obtains subelement, for obtaining electricity from off-line data system Sub- mail sending domain transmits IP address and originator system banner；

Judgment sub-unit, for judging that the originator system banner transmits whether IP address matches with described；

Optionally, the judgment sub-unit includes：

Top-level domain judgment sub-unit, for the top-level domain for judging Email sending domain and the originator Whether the top-level domain of system banner is identical；

Matching judgment subelement, it is described for judging if the judged result of top-level domain judgment sub-unit is yes The IP address that originator system banner parses transmits whether IP address matches with described；

Optionally, the special similarity judgment sub-unit of association includes：

Linked character obtains subelement, and IP address is transmitted for obtaining Email from the off-line data system With the linked character for transmitting IP address；The linked character includes originator system banner and mail header feature；

Judgment sub-unit, can for judge that the linked character for transmitting IP address and trusted IP address concentrate Whether linked character corresponding to letter IP address matches；

Optionally, the judgment sub-unit includes：

Similarity obtains subelement, for transmitting IP described in the method for measuring similarity calculating using characteristic vector The linked character of address is similar with the characteristic vector corresponding to the corresponding linked character of trusted IP address concentration Degree；

Threshold decision subelement, for judging whether the similarity is more than or equal to default similarity threshold；

Optionally, the similarity obtains subelement and included：

Linked character obtains subelement, for obtaining linked character corresponding to trusted IP address collection and described transmitting The linked character of IP address；

Characteristic vector generates subelement, for by the feature in linked character corresponding to the trusted IP address collection And the weight constitutive characteristic vector corresponding to each feature；

Same characteristic features obtain subelement, for obtain in the linked character for transmitting IP address with it is described credible Same characteristic features in linked character corresponding to IP address collection；

Weight calculation subelement, the weight of the same characteristic features is obtained for calculating；

Similarity obtains subelement, for the weight of the same characteristic features and the total weight of all features to be contrasted, Transmitted described in acquisition the feature of the linked character linked character corresponding with the trusted IP address collection of IP address to The similarity of amount.

Optionally, the response rate judgment sub-unit includes：

The e-mail hash of transmission obtains subelement, and IP is transmitted for obtaining to use from off-line data system The e-mail hash that address is sent；

The quantity of the mail received obtains subelement, and IP address is transmitted in the preset time period for obtaining this The quantity of interior received mail；

Response rate computation subunit, for according to the transmission e-mail hash and the mail received Quantity obtain the response rate for transmitting IP address；

Threshold decision subelement, for judging whether the response rate is more than or equal to default response rate threshold value；

If so, this is then transmitted into IP address as trusted IP address.

Optionally, the opening rate judgment sub-unit includes：

Transmit IP address and obtain subelement, make for being obtained from off-line data system in preset time period With frequency IP address is transmitted higher than predeterminated frequency；

Judgement of stability subelement, for judging that this transmits originator system banner and mail corresponding to IP address Whether letter head feature is stablized；

Default opening rate threshold decision subelement, if the judged result of judgement of stability subelement is yes, is used for Judge that whether this transmits the opening rate for the mail that IP address is sent higher than default opening rate threshold value；

Trusted IP address generates subelement, for transmitting the opening rate for the mail that IP address is sent when this higher than pre- If during opening rate threshold value, and this transmits IP address and record of bad behavior is not present, and this is transmitted into IP address as credible IP address.

Optionally, the default feature set lifts the feature in the default feature set received in unit to wait to discriminate It is not characterized as to be screened transmitting IP address；

Accordingly, characteristic matching condition judgment unit includes：

A certain IP address judgment sub-unit, the feature in the characteristic matching model good for the training in advance It is to judge whether a certain IP address belongs to the trusted IP address collection with condition；

Trusted IP address collection judgment sub-unit, for the characteristic matching condition according to setting, described in judgement To be screened transmits whether IP address belongs to the trusted IP address collection；

Optionally, when the judged result of the trusted IP address collection judgment sub-unit is no, in addition to：

IP address after parsing obtains subelement, for the sending domain of Email to be parsed, is solved IP address after analysis；

IP address matching judgment subelement, for foundation this feature matching condition, hair to be screened described in judgement Whether letter IP address matches with the IP address after parsing；

Optionally, when the judged result of the IP address matching judgment subelement is no, in addition to：

IP address and the originator system banner matching judgment subelement are transmitted, for being matched according to this feature Condition, it is to be screened described in judgement to transmit whether IP address matches with the originator system banner；

Optionally, when the judgement for transmitting IP address and the originator system banner matching judgment subelement When being as a result no, in addition to：

Linked character matching judgment subelement, it is to be screened described in judgement for foundation this feature matching condition Transmit IP address linked character linked character corresponding with the trusted IP address that trusted IP address is concentrated whether Match；

Optionally, also include after the trusted IP address generation subelement：

Linked character matching judgment subelement, for judging the linked character for transmitting IP address to be screened Whether linked character corresponding with the trusted IP address that trusted IP address is concentrated matches；

Compared with prior art, the application has advantages below：

The application provides a kind of method for screening Email senders' identity characteristic, and this method includes：Extraction The default feature set of the Email to be screened received；With in the good characteristic matching model of training in advance Characteristic matching condition is foundation, by the feature to be screened in the default feature set and the characteristic matching condition In corresponding feature carry out matching degree test, judge whether feature to be screened meets institute in the default feature set State characteristic matching condition；If so, the identity characteristic of the sender of the Email to be screened is believable Email Sender.This method is preset characteristic matching model by establishing default characteristic matching model, by this and made For basis for estimation, the feature in the default feature set to be screened of extraction is carried out to the judgement of matching condition, when When corresponding feature meets the characteristic matching condition in the default feature set, illustrate electronics postal to be screened The identity of the sender of part is real believable.Therefore, the method that the application provides need not require that mail is sent out The setting of any aspect is done by the side of sending, but is entirely to send behavioural information by collecting and comparing mail, with this Information can accurately confirm to send out to match the identity characteristic with screened mail sender by this method Whether the identity for the person of sending is genuine and believable.

Brief description of the drawings

Fig. 1 is the stream of the method for examination Email senders' identity characteristic that the application first embodiment provides Cheng Tu.

Fig. 2 is the flow chart for the characteristic matching model training method that the application first embodiment provides.

Fig. 3 is the knot of the device for examination Email senders' identity characteristic that the application second embodiment provides Structure schematic diagram

Embodiment

The application first embodiment provides a kind of method for screening Email senders' identity characteristic, this method For identifying whether the sender of Email has true identity, when an envelope Email is different at two When being transmitted between e-mail system, receiver system needs the domain name for transmitting address to the mail of the reception The authenticity of identity is screened and verified, is gathered around with judging whether the mail of the reception comes from the domain name really The e-mail system that the person of having authorizes, or judge whether the mail of the reception comes from the domain name and possess The mail that person authorizes sends what IP address was sent, further can identify forgery or personation by this method The suspicious mail that other people domain names are sent.

Wherein, e-mail system is a set of single system, and the system has the server of oneself, in electricity Multiple domains can be set in sub- mailing system, multiple users can be set in each domain, if for example, having bought certain postal The mailing system that the mailing system for the business version that part manufacturer provides either is increased income, can carry out multinomial setting, And its data are placed on the server of oneself.

In addition, this method that the application first embodiment provides mainly can apply to the anti-spam of Email System in, the spam in Email is identified by this method, and enters one by other relevant ways The effective interception of step or shielding rubbish mail.

This method provided below by way of specific description the application first embodiment illustrates, and Fig. 1 is The flow chart of the method for examination Email senders' identity characteristic that the application first embodiment provides, please join According to Fig. 1, this method comprises the following steps：

Step S101, extract the default feature set of the Email to be screened received.

The step is for the Email received, therefore the step is a certain electronics to reception The examination of mail, that is, whether screen the sender of the Email received is special with true identity Sign, therefore, this receive Email more precisely be known as Email to be screened.And for Email to be screened, must include certain feature in received Email, and and the application The feature for the method correlation that first embodiment provides is generally multiple features, therefore will can also wait to discriminate from described The correlated characteristic obtained in other Email is referred to as default feature set.

When an envelope Email transmits between two different mailing systems, used by recipient Mailing system, the electronics that the external system transmits usually is received using mail transport agent (MTA) Mail.

Specifically, the module with user mutual that MTA modules belong in e-mail system, belongs to mail clothes The front-end module for device system of being engaged in.The client of each Email is configured to carry out to a mailing system Mail transport agent MTA (mail transfer agent), which sends mail and obtained from a MTA, issues some The message of the Email of station address.Therefore, need to be provided with an Email on mail server Account, and can use standard Internet protocol, either off-line processing e-mail (using POP3), Or e-mail is stayed and (uses IMAP) on the server.Between Mail Clients and MTA and The agreement that mail is sent between MTA and MTA is all Simple Mail Transfer protocol SMTP (Simple Mail Transfer Protocol)。

By above-mentioned MTA systems receive described in after the Email screened, it is necessary to be carried from the Email All related features are taken, multiple correlated characteristics of extraction form default feature set.The default feature set one As can be mail send domain information, mail to transmit IP address, originator system banner and mail header special Sign.

The domain information that sends refers to that mail sends the domain name part of address, and the mail sends address and is usually Refer to, the smtp protocol that the mail transfer of standard uses is carried out, the postal during SMPT protocol interactions The address in part source, form can be user@example.com.Therefore, address is sent for the mail, The domain information that sends can be the example.com parts in user example.com.Each mail It must be carried during transmission and sends the domain name part of address.

The mail sends IP address and refers to used IP address when mail sending domain sends mail.General feelings Under condition, analytic trnasformation form can be carried out by corresponding analytic method between domain name and IP address, domain name Resolving can be completed by domain name system (DNS).

The originator system banner is that to identify is the domain of sender's mailing system, may be sent out with mail Send domain entirely different.And the originator system banner can by way of dns resolution with IP address shape Into association.Mailing system for comparing specification, its IP DNS PTR parsings are exactly helo domain, And helo domain DNS A parsings are exactly that this transmits IP, but, and not all mailing system all presses this Set.

The mail header feature can include header field (header fields).The mail header feature is certain Reflect some related features of outgoing mail system in degree.

The originator system banner step, which has been completed, default feature set is obtained in Email to be screened Process, by following steps can be preset by this feature set person's of being transmitted identity examination judge.

Step S102, using the characteristic matching condition in the good characteristic matching model of training in advance as foundation, by institute Feature the to be screened feature corresponding with the characteristic matching condition stated in default feature set carries out matching degree survey Examination, judges whether feature to be screened meets the characteristic matching condition in the default feature set.

Mainly the default feature set of extraction is carried out by the characteristic matching model trained in the step Matching and the process screened.

The training which kind of method to carry out characteristic matching model using is introduced first.

The main trusted IP address collection for including training acquisition in several ways in the characteristic matching model, with And the linked character related to the trusted IP address that the trusted IP address is concentrated can also be obtained, meanwhile, in institute State in characteristic matching model, include the matching condition of the feature corresponding with the default feature set.

The IP address that the trusted IP address collection refers to deposit in the set is believable, has authenticity IP address, these believable IP address are trained by off-line data and learn to be formed afterwards, its It can be used as the existing feature set of fixation.

Fig. 2 is the flow chart for the characteristic matching model training method that the application first embodiment provides, and be refer to Fig. 2, the training process of the characteristic matching model are as follows：

Step S102-1, the data in the preset time period based on off-line data system, is obtained using predetermined manner Take characteristic matching condition and trusted IP address；The trusted IP address deposit trusted IP address is concentrated.

Off-line data system can periodically excavate the user behaviors log of each mail sending domain in preset time period, And it can be obtained in the user behaviors log out of this preset time period and transmit IP address.

Time in the preset time period can be one month or three months, can also be basis Specific actual conditions carry out sets itself.The time length of preset time period does not interfere with the reality of subsequent step It is existing.

The step mainly obtains corresponding characteristic matching condition by predetermined manner, and with obtaining credible IP Location, and save as trusted IP address collection using the trusted IP address detected as a set.

Specifically, the predetermined manner can be between one kind or various ways in various ways Any combination, can form characteristic matching condition, and trusted IP address collection eventually through predetermined manner.

The predetermined manner is illustrated below.

First way can be, according to sending domain and transmit IP address judge this transmit IP address whether be can Believe the mode of IP address.

The first way specific embodiment is as follows：

First, Email is obtained from off-line data system transmits IP address.

The sending domain of Email is parsed, the IP address after being parsed；

After acquisition and recorded electronic mail transmit IP address step, the sending domain is passed through into analysis mode Parsing obtains the IP address after parsing.

Mail sending domain can resolve to the form of IP address by way of parsing.Specific analysis mode can To be a variety of, generally, MX (Mail Exchange) parsings and the sending domain in domain can be transmitted A (Address) parsing.Can obtaining MX records respectively by above-mentioned analysis mode, (mail exchanges note Record) and A records (mail IP address record).

By the above-mentioned parsing to sending domain, the IP address after being parsed.

The IP address after the parsing is illustrated herein.For some big domain name business, it is possible that The IP address transmitted the situation different from the IP address collected mail, that is to say, that, may for some sending domain The credible IP address transmitted corresponding to it can not be directly determined, but its IP address collected mail is generally real IP address, therefore, the IP address now obtained by the parsing to sending domain are the collections of letters corresponding to the sending domain IP address.

Above step has obtained the IP address after the parsing parsed corresponding to sending domain, therefore, connects Get off to need to transmit whether IP address matches with the IP address after the parsing described in judgement.

The step is by the process for transmitting IP address and being compared with the IP address after the parsing of acquisition, above-mentioned judgement The step of whether matching is the process that two IP address are compared herein, whether compares two addresses It is identical or adjacent.

If all fields of two IP address are identicals, illustrate that this transmits the IP corresponding to IP address Address is believable true.In addition, it is adjacent situation for two IP address.When the big portion of two addresses Point field be identical, and between the field of fraction relatively in the case of, illustrate two IP address Belong to identical domain, accordingly it is also possible to by this kind of situation transmit IP address be set as it is believable real.

Whether in matching step, sentence with the IP address after parsing specifically, transmitting IP address described in the judgement Mode used by whether IP address matches with the IP address information after the parsing is transmitted described in disconnected to be included：

Whether transmitted described in judgement between two addresses of IP address after IP address and the parsing has predetermined number Identical digit.

The deterministic process be it is above-mentioned described in all or part of fields of IP address whether same case is sentenced Disconnected process.

The identical digit of the above-mentioned predetermined number being related to refers to the same field quantity of IP address.If two IP All fields in location are identical, illustrate between two addresses it is identical, and when two IP address part fields When identical, then the quantity of the field of same section be present.Generally, can be by the IP address word of C classes Section identical IP address can be regarded as the adjacent IP address of two.For example, an IP address is： 192.168.0.1 another IP address is：192.168.0.2, although last field is different, both belong to The IP address field identical IP address of C classes, therefore, it is adjacent feelings to be considered as the two IP address Condition.

Whether transmitted described in judgement between IP address and described correctly two addresses of IP address has predetermined number Identical digit step in, it is if the determination result is YES, then described to transmit IP address and the correct IP address Information match.

Opposite, it is described to transmit IP address and the correctly IP address information not if judged result is no Matching.

Above-mentioned is the judgement for whether being matched to transmitting IP address with correct IP address information progress, when the judgement Judged result for when being, using IP address corresponding to this transmits IP address as described in trusted IP address is stored in Trusted IP address collection in characteristic matching model.

When the above-mentioned judged result judged is is, then explanation transmits the collection of letters of IP address and real sending domain IP address be identical or adjacent, illustrate that it is identical to transmit IP address domain corresponding with real IP address , therefore, it is possible to determine that, this transmits IP address and belongs to believable IP address, in such a case it is possible to will This transmits IP address corresponding to IP address as credible in the trusted IP address deposit characteristic matching model IP address collection.

In addition, the judgement during above-mentioned training pattern is transmitted into IP address and the IP after sending domain parsing The step for whether address information matches is as the matching condition in the characteristic matching model.

When subsequently judging whether a certain IP address meets characteristic matching condition online, it is necessary to using this feature With model, IP address is transmitted for be screened, as long as judging to be screened transmit using the matching condition Whether IP address matches with the correct IP address information in this feature Matching Model, and being judged according to matching result should Whether the Email transmitted transmitted by IP address to be screened belongs to real.

Above-mentioned is to be matched by transmitting the correct IP address information after IP address and parsing to determine and can Believe IP address, carry out forming trusted IP address collection.The trusted IP address collection will be stored in as a set In the characteristic matching model trained.

The description of the above-mentioned wherein first way to the predetermined manner, is retouched to the second way below State.Second of predetermined manner is to judge that this transmits IP address with transmitting IP address according to originator system banner Whether it is trusted IP address mode.

Its specific mode is as follows：

First, transmitting for Email sending domain is obtained from off-line data system and IP address and transmits method, system Mark.

The originator system banner refers to, the mark sender that sending direction recipient's mail server is sent The order of the identity of itself.The originator system banner can be marked with helo, described to transmit method, system mark Knowing the mode that again may be by parsing can be similar with the form of IP address.The originator system banner pair The domain name answered needs to match with the IP address that transmits, therefore the step needs first to obtain transmitting for its correlation In above-mentioned correlated characteristic.

Above-mentioned correlated characteristic is obtained afterwards, it is necessary to transmit method, system mark according to judging above-mentioned correlated characteristic Know and transmit whether IP address matches with described.

Its specific matching judgment mode may be accomplished by：Particularly, it is described to judge the hair Letter method, system mark with the IP address that transmits whether in matching step, judge the originator system banner with It is described transmit IP address whether match used by mode include：

Judge the top-level domain of Email sending domain and the originator system banner top-level domain whether phase Together.

Top-level domain refers in TLD, on the left of com, com.cn or org plus one " " and in having Hold the domain name of field composition, for example, example.com is known as top-level domain.Application for domain names is always pressed Apply according to top-level domain, generally, the domain name of two level even more stages is all to belong to top-level domain owner, Possess for example, www.example.com is generally also the owner for belonging to example.com.

First determine whether the top-level domain of sending domain is identical with the first domain name of the originator system banner, Judge both top-level domain part it is identical, illustrate identity of the sender identification information with transmission domain information be identical , illustrate that sender mark is real, then need to transmit method, system mark to transmitting IP address and this again Know the IP address that parses to be compared, further determine that whether transmit IP address genuine and believable.

Therefore, when the top-level domain of the top-level domain and the originator system banner that judge the sending domain is No identical judged result is, it is necessary to determining whether the IP that the originator system banner parses when being Location transmits whether IP address matches with described.

IP address form is resolved to by A firstly the need of to originator system banner, passes through the IP after parsing Address is compared and matching judgment with the IP address that transmits.

The specific adoptable mode of matching judgment is the comparison for the digit for carrying out IP address same field, above-mentioned The comparison to which carried out introduction, will not be described in further detail herein.

By by the IP address after parsing and the contrast for transmitting IP address, when the IP address parsed with it is described When transmitting IP address has the identical digit of predetermined number, the originator system banner with it is described with transmitting IP Location matches.

Opposite, when the IP address parsed and the identical digit for transmitting IP address and not having predetermined number When, the originator system banner transmits IP address mismatch with described.

Above is retouched to how to carry out originator system banner with transmitting IP address matching judgment concrete mode State, after being judged according to above-mentioned specific judgment mode, corresponding judged result can be obtained.

When judge the originator system banner with it is described transmit IP address whether the judged result in matching step During to be, the characteristic matching mould is stored in using IP address corresponding to this transmits IP address as trusted IP address Trusted IP address collection in type.Final step in first mode of the step and model training mode is identical, Trusted IP address is to determine, and the trusted IP address is stored as credible IP in the characteristic matching model Address set.

Wherein, it is described to judge the originator system banner and institute for the model training mode of this kind of mode State and transmit whether IP address is matched as the matching condition in the characteristic matching model.In subsequent step, Using during this feature Matching Model, it is necessary to by it is to be screened transmit IP address with the characteristic matching model Originator system banner carries out matching judgment, and according to judge acquisition this it is to be screened transmit IP address whether be It is believable real.

Except two kinds of predetermined manners of above-mentioned introduction, there is the third mode, the training method can combine upper One or both of two kinds of training methods are stated, can also be individually configured.

And the linked character of the linked character with transmitting IP address of the third mode and trusted IP address is relevant System, therefore, it is necessary to it is related to the second step S102-2 of training characteristics Matching Model.

Specifically, step S102-2 is to obtain linked character corresponding with the trusted IP address.

The linked character includes originator system banner and mail header feature.Corresponding to the credible address Linked character refers to correspond to its linked character in the trusted IP address that trusted IP address is concentrated, this is credible IP Corresponding linked character is matched for the linked character with transmitting IP address in address set.

Accordingly, the third mode is corresponding with trusted IP address according to the linked character for transmitting IP address The similarity of linked character judge this transmit IP address whether be trusted IP address mode.Specifically include：

Email is obtained from off-line data system transmits IP address, and transmits the association spy of IP address Levy (originator system banner and mail header feature).

Obtained in above-mentioned steps and recorded electronic mail sending domain transmits IP address, hair in preset time period Letter method, system mark is described in second of mode, and no longer these information are introduced, weighed below Point, which is introduced, obtains mail header feature.

In addition, generally, normal email system transmits mailing system spy caused by method, system sign and the system Sign will not often change, therefore can be using above-mentioned two characteristic information as examination Email senders' identity The basis for estimation of feature.

The linked character for transmitting IP address can be obtained by above-mentioned steps, may determine that according to the linked character The linked character for transmitting IP address originator system banner corresponding with the trusted IP address and mail Whether head feature matches.

Its specific matching judgment mode may be accomplished by：Particularly, it is described to judge the hair Believe the linked character originator system banner corresponding with the trusted IP address and mail header feature of IP address In the step that whether matches, judgment mode includes：

Using the method for measuring similarity of characteristic vector calculate described in transmit the linked character of IP address with it is described can Believe the characteristic vector of linked character (originator system banner and mail header feature) corresponding to IP address concentration Similarity.

In this step, the method for measuring similarity of characteristic vector is introduced, this method comprises the following steps：

First, obtain linked character corresponding to the trusted IP address collection and transmit the association corresponding to IP address Feature.

For example, linked character herein is generally the correlated characteristic of originator system banner, such as helo domain Feature, mail header feature etc..

Secondly, by corresponding to the feature in linked character corresponding to the trusted IP address collection and each feature Weight constitutive characteristic vector.

Assuming that the feature helo of the originator system banner of trusted IP address collection known to sending domain example.com Domain, the mail header feature header etc. linked character are as follows：

Mail header feature header is as follows successively：There is x-aliyun-envid (weight setting 1) simultaneously, X-Alimail-AntiSpam (weight may be set to 1), x-aliyun-fingerprint (weight may be set to 1), X-aliyun-clustdate header (weight can set 1)

Helo domain suffix form is：.aliyun.com (weight setting 3).

, wherein it is desired to require that helo domain resolution or reverse resolution exist and matched simultaneously.

Thirdly, pass corresponding with the trusted IP address collection in the linked character of IP address is transmitted described in acquisition Join the same characteristic features in feature.

According to it is described transmit IP address corresponding to feature, check whether it matches above-mentioned header or helo Domain, if it does, then having respective weights.For example, identical is characterized as X-Alimail-AntiSpam, X-aliyun-clustdate header and helo dmain, then weight possessed by same characteristic features is respectively 1,1 He 3。

Followed by, the weight for obtaining the same characteristic features is calculated.

It is 5 by the weight that the weight of above-mentioned same characteristic features is added acquisition same characteristic features.

Finally, the weight of the same characteristic features and the total weight of all features are contrasted, described in acquisition with transmitting IP The similarity of the characteristic vector of the linked character of location linked character corresponding with the trusted IP address collection.

The weight of total feature is 1+1+1+1+3=7, so, similarity now is 5/7=0.71.

In addition, in addition：The linked character of sending domain example.com is credible IP collection is dug using offline mode Pick generation, the letter head in the domain may have a lot, it is only necessary to which the most of mails extracted in the presence of the domain all have Some letter heads.

Header only selection x- classes can believe head, and weight be drawn according to its representativeness, such as, if some Header is appeared in all sending domain mails, weight 1, is appeared in 70% mail, then weight is 0.7, the great letter head in specific threshold (such as 0.6) of a weighting.

Helo domain power kind can require accounting 0.3, such as, the weight of other letter head features is 7, then Helo domain are at least 3, and certainly, this is also a kind of empirical value, can also be directed in practical application some Sending domain adjusts.

Aforesaid way is the similarity calculated by the similarity based method of characteristic vector, it can in addition contain pass through it The mode of his similarity carries out calculating acquisition.

Similarity can be obtained by the similarity based method of features described above vector, sentenced according to the similarity of acquisition Whether the similarity of breaking is more than or equal to default similarity threshold.

Default similarity threshold can be set as 0.7, then the similarity that above-mentioned calculating obtains is 0.71, the meter Calculate the similarity obtained and be more than default similarity threshold 0.7, therefore, the hair can be judged according to the result Believe the linked character of IP address and matching for the corresponding linked character of trusted IP address collection.

Above-mentioned default similarity threshold is an illustrative example, and specific threshold value can also be according to specific Actual conditions set.Likewise, when the default similarity threshold of setting is 0.8, then above-mentioned meter Calculate the similarity 0.7 obtained and be less than the threshold value, therefore, IP address can be transmitted according to judging the result Linked character linked character corresponding with the trusted IP address collection mismatch.

Above-mentioned steps be by the method for characteristic vector similarity judge described in transmit the linked character of IP address with Whether linked character corresponding to the trusted IP address collection matches, and when judged result is to be, this is sent out With believing the credible IP that IP address corresponding to IP address is stored in as trusted IP address in the characteristic matching model Location collection.Final step in first mode of the step and predetermined manner is identical, is to determine trusted IP address, And the trusted IP address is stored as trusted IP address collection in the characteristic matching model.

Wherein, the trusted IP address for judging the linked character for transmitting IP address and being concentrated with trusted IP address Whether corresponding linked character matches as the matching condition in the characteristic matching model.

Except three kinds of predetermined manners of above-mentioned introduction, also the 4th kind of mode, the training method can combine upper The combination of any-mode in three kinds of modes is stated, can also be individually configured.

Specifically, the 4th kind of mode is, the response rate according to corresponding to the mail for transmitting IP address transmission judges This transmit IP address whether be trusted IP address mode.Specific which includes：

Obtained from off-line data system using the e-mail hash for transmitting IP address transmission.

When being transmitted using some IP address of mail sending domain, this can be recorded and transmit the postal that IP address is sent The quantity of part, form the quantity of the Email of transmission.

Obtain the quantity for transmitting IP address mail received in the preset time period.

IP address is transmitted for this, the quantity of reply of the different addressees to the mail records, and formation connects The quantity of the mail received.

This is obtained according to the quantity of the transmission e-mail hash and the mail received and transmits IP address Response rate.

The quantity of the above-mentioned mail received and the quantity of the Email of the transmission are compared, are somebody's turn to do Transmit the response rate of IP address.

Judge whether the response rate is more than or equal to default response rate threshold value.

It can be assumed the response rate threshold value set as 80%.Judge to calculate whether the response rate obtained exceedes threshold value 80%.

When response rate exceedes default response rate threshold value, then this is transmitted into IP address and deposited as trusted IP address Enter the trusted IP address collection in the characteristic matching model.

Above-mentioned is the 4th kind of predetermined manner, and fifth procedure introduced below, the fifth procedure is, according to hair Linked character and mail opening rate judge that this transmits whether IP address is trusted IP address corresponding to letter IP address Mode.Concrete mode is as follows：

The frequency of use obtained from off-line data system in preset time period transmits IP higher than predeterminated frequency Address.

Afterwards, judge that this transmits originator system banner corresponding to IP address and whether mail header feature is stablized.

If so, judge that whether this transmits the opening rate for the mail that IP address is sent higher than default opening rate threshold value.

Default opening rate threshold value herein can be set as 30%-40% degree.

When the opening rate that this transmits the mail that IP address is sent is higher than default opening rate threshold value, and this transmits IP Record of bad behavior is not present in address, and this is transmitted into IP address is stored in the characteristic matching model as trusted IP address In trusted IP address collection.

If when mail sending domain were fixed for a long time to be transmitted using some IP address, the one of helo domain Level domain name and mail header feature will keep stable, may be set to non-spam email, and it also requires keeping special The mail opening rate of sign, it may be said that the complaint in terms of bright no fake and forged commodity, thus, it is believed that the IP address is Trusted IP address.

Above is trusted IP address collection and characteristic matching condition are obtained by predetermined manner in five, it is preferred that The trusted IP address collection is completed using above-mentioned five kinds of predetermined manners jointly and characteristic matching condition is obtained and received Collection, i.e., the above-mentioned trusted IP address collection and characteristic matching condition included in this feature Matching Model is by upper State what five kinds of predetermined manners were realized.

Step S102-3, by corresponding to the characteristic matching condition of acquisition, trusted IP address collection and trusted IP address Linked character is stored in the characteristic matching model.

Finally, during training characteristics Matching Model, by the characteristic matching condition of acquisition, credible IP Linked character corresponding to location collection and trusted IP address is stored in the characteristic matching model, forms the feature With model.

The above-mentioned introduction completed to the characteristic matching model, be below by this feature Matching Model, The Email for treating examination specific discriminate otherwise and process.

During above-mentioned training pattern, also make referrals to, there is trusted IP address in this feature Matching Model Collection, and the matching condition of individual features.By the feature to be screened in the default feature set and the feature Corresponding feature carries out matching degree test in matching condition, to judge feature to be screened in the default feature set Whether the characteristic matching condition is met.

Specific matching judgment mode according to the different of another characteristic to be discriminated can introduce and say accordingly respectively It is bright.

It is default when what is received in the default feature set step of the Email to be screened for extracting and receiving Waiting screen in feature set is characterized as to be screened transmitting IP address.

Characteristic matching condition in the good characteristic matching model of the training in advance is set as judging a certain IP address The trusted IP address collection whether belonged in the default characteristic matching model.

In that case, first by matching condition be arranged to whether with it is credible in default characteristic matching model IP address collection matches.

According to the characteristic matching condition of setting, the hair to be screened in the default feature set information is judged Whether letter IP address belongs to the trusted IP address collection.

If so, then the IP address that transmits to be screened meets the characteristic matching condition；Now, may be set to The end of examination process.When judged result is no, then illustrate that the IP address that transmits to be screened is unsatisfactory for institute State characteristic matching condition, it is also necessary to differentiated again by characteristic matching condition.

This kind of examination mode is, when mail, which transmits IP address, belongs to the trusted IP address collection, it is believed that should The identity of Email Sender is believable, and therefore, its IP address that transmits to be screened meets the characteristic matching Condition, otherwise, the IP address that transmits to be screened are unsatisfactory for the characteristic matching condition.

Furthermore it is also possible to using second of discriminating method, this method can be the step in the first examination mode Judge that the IP address that transmits to be screened is unsatisfactory for carrying out in the case of the characteristic matching condition in rapid, certainly, The characteristic matching condition can also be met in the IP address that transmits to be screened, carried out again to transmitting IP address Screen the process of checking.

Second of discriminating method is as follows：

The default spy received in the default feature set step for extracting the Email to be screened received Feature in collection transmits IP address to send domain information and to be screened.

The sending domain of Email is parsed, the IP address after being parsed.

Characteristic matching condition in the good characteristic matching model of the training in advance is to transmit IP address described in judgement Whether matched with the IP address information after parsing.

The IP address that transmits to be screened is transmitted into IP address as in characteristic matching condition, according to the spy Matching condition is levied, transmits whether IP address matches with the IP address after parsing wait what is screened described in judgement.

Whether IP address described in the judgement after that screens transmits IP address and the parsing is in matching step The judgment mode whether matched includes：

Whether have between two addresses of IP address described in judgement after that screens transmits IP address and the parsing There is the identical digit of predetermined number.

If it is not, then the IP address that transmits to be screened is unsatisfactory for the characteristic matching condition.

Further, it is also possible to using the third discriminating method, this method can be that the step of mode is screened at second Judge that the IP address that transmits to be screened is unsatisfactory for carrying out in the case of the characteristic matching condition in rapid, certainly, The characteristic matching condition can also be met in the IP address that transmits to be screened, carried out again to transmitting IP address Screen the process of checking.

The third discriminating method is as follows：

The default spy received in the default feature set step for extracting the Email to be screened received Feature in collection is sends domain information, to be screened transmits IP address and originator system banner.

Characteristic matching condition in the good characteristic matching model of the training in advance is to transmit method, system described in judgement Mark transmits whether IP address matches with described.

The IP address that transmits to be screened is transmitted into IP address as in characteristic matching condition, according to the spy Matching condition is levied, it is to be screened described in judgement to transmit whether IP address matches with the originator system banner.

Whether to be screened IP address and the originator system banner of transmitting be in matching step described in the judgement Judgement matching way include：

Judge whether the top-level domain of the sending domain is identical with the top-level domain of the originator system banner. If so, judge that the IP address that the originator system banner parses is with the IP address that transmits to be screened No matching.

If so, then the IP address that transmits to be screened meets the characteristic matching condition；It is if it is not, then described The IP address that transmits to be screened is unsatisfactory for the characteristic matching condition.

Further, it is also possible to using the 4th kind of discriminating method, this method can be at the third or screen for second Judge that the IP address that transmits to be screened is unsatisfactory for entering in the case of the characteristic matching condition in the step of mode OK, it is of course also possible to meet the characteristic matching condition in the IP address that transmits to be screened, to transmitting IP Location carries out screening again the process of checking.

4th kind of discriminating method is as follows：

The default spy received in the default feature set step for extracting the Email to be screened received Feature in collection is that the linked character for transmitting IP address, transmitting IP address to be screened (transmits method, system mark Know and mail header feature).

The credible IP that the linked character for transmitting IP address to be screened described in judgement is concentrated with trusted IP address Whether linked character corresponding to location matches.

The credible IP that the linked character for transmitting IP address to be screened described in the judgement is concentrated with trusted IP address The judgement matching way used in step that whether matches of linked character corresponding to address includes：

In addition, in above-mentioned discriminating method, after completing the examination judgement of the first discriminating method, the postal of judgement Part transmits IP address no matter whether it belongs to trusted IP address collection, still can be in order to ensure confidence level accurately Problem, IP address is transmitted to this further examination judgement is carried out using second to the 4th kind of discriminating method.

Such as：Received in the default feature set step for extracting the Email to be screened received Feature in default feature set also includes：Send domain information, originator system banner and mail header feature.

Accordingly, judge in the default feature set information to be screened transmits whether IP address belongs to described When the judged result of trusted IP address collection step is no, following steps are performed：

By the IP address after being parsed after the transmission domain information parsing.

When described pre- wait not having between two addresses of IP address after transmitting IP address and the parsing screened If during the identical digit of quantity, then perform following steps：

It is to be screened described in judgement to transmit IP address and the originator system banner and the phase of mail header feature Whether it is more than or equal to default similarity threshold like degree.

Another way is, in the default feature set step for extracting the Email to be screened received Feature in the default feature set received also includes：Send domain information, originator system banner and mail Head feature.

Accordingly, it is described this it is to be screened transmit after IP address meets the characteristic matching condition step, bag Include：

The transmission domain information is resolved into the IP address after parsing.

When described default wait having between two addresses of IP address after transmitting IP address and the parsing screened During the identical digit of quantity, then perform following steps：

Aforesaid way it is described transmit IP address and belong to trusted IP address collection when, still it is carried out further Judge, to make the examination of tightened up similarity, the same characteristic matching for transmitting IP address while checking When condition is more, then the confidence level of the IP address will be higher.

Step S103, it is believable mail that the identity characteristic of the sender of the Email to be screened, which is screened, Sender.

Matching condition of the default feature set of extraction respectively in the good characteristic matching model of training in advance is entered The test of row matching degree, judge whether feature to be screened meets the feature in the default feature set With condition, when when screening feature and meeting the characteristic matching condition, then can sentencing in the default feature set The identity characteristic examination for being set to the sender of the Email to be screened is believable Email Sender.

In a word, this method that the application first embodiment provides does not need Email Sender to make any mode Set, but behavioural information is sent come the true of the identity of screened mail sender by collecting and matching mail Property and it is credible, therefore, this method is set independent of the correlation of sender, and is applied to any hair The Email that the person of sending sends, it is more accurate by examination of this method to identity of the sender feature, and not Set and limited by any sender's mail.

In addition, in practice, the method that the application first embodiment provides can be combined with prior art In SPF methods or DKIM methods applied.

The method of the examination Email senders' identity characteristic provided with respect to the application first embodiment, this Shen Please second embodiment also provide it is a kind of screen Email senders' identity characteristic device, Fig. 3 is the application The structural representation of the device for examination Email senders' identity characteristic that second embodiment provides, refer to Fig. 3, the device include：

Default feature set extraction unit 201, for extracting the default feature of the Email to be screened received Collection；

Characteristic matching condition judgment unit 202, for the feature in the good characteristic matching model of training in advance It is foundation with condition, the feature to be screened in the default feature set is corresponding with the characteristic matching condition Feature carry out matching degree test, judge whether feature to be screened meets the feature in the default feature set Matching condition；

Identity characteristic discriminator unit 203, if the judged result for characteristic matching condition judgment unit is yes, institute The identity characteristic examination for stating the sender of Email to be screened is believable Email Sender.

Preferably, also include in the characteristic matching condition judgment unit：Characteristic matching model training subelement；

The characteristic matching model training subelement also includes：

Preferably, the predetermined manner that the characteristic matching condition and trusted IP address are obtained in subelement include with At least one of lower unit：

Preferably, the sending domain judgment sub-unit includes：

Preferably, the judgment sub-unit includes：

Preferably, the originator system banner judgment sub-unit includes：

Preferably, the judgment sub-unit includes：

Preferably, the special similarity judgment sub-unit of association includes：

Preferably, the judgment sub-unit includes：

Preferably, the similarity obtains subelement and included：

Preferably, the response rate judgment sub-unit includes：

If so, this is then transmitted into IP address as trusted IP address.

Preferably, the opening rate judgment sub-unit includes：

Preferably, the default feature set lifts the feature in the default feature set received in unit to wait to discriminate It is not characterized as to be screened transmitting IP address；

Accordingly, characteristic matching condition judgment unit includes：

Preferably, when the judged result of the trusted IP address collection judgment sub-unit is no, in addition to：

Preferably, when the judged result of the IP address matching judgment subelement is no, in addition to：

Preferably, when the judgement for transmitting IP address and the originator system banner matching judgment subelement When being as a result no, in addition to：

Preferably, also include after the trusted IP address generation subelement：

Although the application is disclosed as above with preferred embodiment, it is not for limiting the application, Ren Heben Art personnel are not being departed from spirit and scope, can make possible variation and modification, Therefore the protection domain of the application should be defined by the scope that the application claim is defined.

In a typical configuration, computing device includes one or more processors (CPU), input/output Interface, network interface and internal memory.Internal memory may include the volatile memory in computer-readable medium, The form such as random access memory (RAM) and/or Nonvolatile memory, such as read-only storage (ROM) or Flash memory (flash RAM).Internal memory is the example of computer-readable medium.

Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by appointing What method or technique realizes that information stores.Information can be computer-readable instruction, data structure, program Module or other data.The example of the storage medium of computer includes, but are not limited to phase transition internal memory (PRAM), static RAM (SRAM), dynamic random access memory (DRAM), its The random access memory (RAM) of his type, read-only storage (ROM), electrically erasable is read-only deposits Reservoir (EEPROM), fast flash memory bank or other memory techniques, read-only optical disc read-only storage (CD-ROM), digital versatile disc (DVD) or other optical storages, magnetic cassette tape, tape magnetic magnetic Disk storage or other magnetic storage apparatus or any other non-transmission medium, it can be set available for storage by calculating The standby information accessed.Defined according to herein, computer-readable medium does not include non-temporary computer-readable matchmaker The data-signal and carrier wave of body (transitory media), such as modulation.

It will be understood by those skilled in the art that embodiments herein can be provided as method, system or computer journey Sequence product.Therefore, the application can use complete hardware embodiment, complete software embodiment or combine software and The form of the embodiment of hardware aspect.Moreover, the application can use wherein includes calculating in one or more Machine usable program code computer-usable storage medium (include but is not limited to magnetic disk storage, CD-ROM, Optical memory etc.) on the form of computer program product implemented.

Claims

A kind of 1. method for screening Email senders' identity characteristic, it is characterised in that including：

Extract the default feature set of the Email to be screened received；

Using the characteristic matching condition in the good characteristic matching model of training in advance as foundation, by the default feature Feature the to be screened feature corresponding with the characteristic matching condition concentrated carries out matching degree test, judges institute State whether feature to be screened in default feature set meets the characteristic matching condition；

Sent if so, the identity characteristic of the sender of the Email to be screened is screened for believable mail Person.
2. the method according to claim 1 for screening Email senders' identity characteristic, its feature exist In the training method of the good characteristic matching model of the training in advance includes：

Data in preset time period based on off-line data system, characteristic matching bar is obtained using predetermined manner Part and trusted IP address；The trusted IP address deposit trusted IP address is concentrated；

Obtain linked character corresponding with the trusted IP address；

Linked character corresponding to the characteristic matching condition of acquisition, trusted IP address collection and trusted IP address is stored In the characteristic matching model.
3. the method according to claim 2 for screening Email senders' identity characteristic, its feature exist In described to be obtained using predetermined manner in trusted IP address step, the predetermined manner is included in the following manner At least one：

According to sending domain and transmit IP address judge this transmit IP address whether be trusted IP address mode；

Judge that this transmits whether IP address is trusted IP address with transmitting IP address according to originator system banner Mode；

Being judged according to the similarity of the linked character for transmitting IP address linked character corresponding with trusted IP address should Transmit IP address whether be trusted IP address mode；

The response rate according to corresponding to the mail for transmitting IP address transmission judges that this transmits whether IP address is credible IP The mode of address；

Linked character and mail opening rate according to corresponding to transmitting IP address judge this transmit IP address whether be can Believe the mode of IP address.
4. the method according to claim 3 for screening Email senders' identity characteristic, its feature exist In, it is described according to sending domain and transmit IP address judge this transmit IP address whether be trusted IP address side Formula includes；

Email is obtained from off-line data system transmits IP address；

The sending domain of Email is parsed, the IP address after being parsed；

Transmit whether IP address matches with the IP address after the parsing described in judgement；

If so, using IP address corresponding to this transmits IP address as trusted IP address；

Wherein, the characteristic matching condition obtained using predetermined manner is that judgement transmits IP address and sending domain solution Whether the IP address information after analysis matches.
5. the method according to claim 4 for screening Email senders' identity characteristic, its feature exist In the IP address after IP address and the parsing being transmitted described in the judgement whether in matching step, described in judgement Transmitting mode used by whether IP address matches with the IP address after the parsing includes：

Whether transmitted described in judgement between two addresses of IP address after IP address and the parsing has predetermined number Identical digit；

If so, then described transmit IP address and the IP address information match after the parsing；

If it is not, then the IP address that transmits mismatches with the IP address information after the parsing.
6. the method according to claim 4 for screening Email senders' identity characteristic, its feature exist In, in described the step of being parsed the sending domain of Email, the sending domain analysis mode include with Any one under type：

The sending domain is parsed by the way of setting IP address to record；

Sending domain is parsed by the way of mail exchange record.
7. the method according to claim 3 for screening Email senders' identity characteristic, its feature exist In described to judge that this transmits whether IP address is credible IP with transmitting IP address according to originator system banner Address mode includes：

Email sending domain is obtained from off-line data system transmits IP address and originator system banner；

Judge that the originator system banner transmits whether IP address matches with described；

If so, using IP address corresponding to this transmits IP address as trusted IP address；

Wherein, the characteristic matching condition obtained using predetermined manner be judge Email transmit method, system Identify and transmit whether IP address matches.
8. the method according to claim 7 for screening Email senders' identity characteristic, its feature exist In described to judge that the originator system banner whether in matching step, judges institute with the IP address that transmits State originator system banner with it is described transmit IP address whether match used by mode include：

Judge the top-level domain of Email sending domain and the originator system banner top-level domain whether phase Together；

If so, judge IP address that the originator system banner parses with it is described transmit IP address whether Match somebody with somebody；

When the IP address parsed with it is described transmit IP address there is the identical digit of predetermined number when, the hair Letter method, system mark matches with the IP address that transmits；

When the IP address parsed with it is described transmit IP address do not have predetermined number identical digit when, it is described Originator system banner transmits IP address mismatch with described.
9. the method according to claim 3 for screening Email senders' identity characteristic, its feature exist In the similarity that the basis transmits the linked character linked character corresponding with trusted IP address of IP address is sentenced Breaking, this transmits whether IP address is that the mode of trusted IP address includes：

Transmitting for Email is obtained from off-line data system and IP address and transmits the linked character of IP address； The linked character includes originator system banner and mail header feature；

The linked character that IP address is transmitted described in judgement is corresponding with the trusted IP address that trusted IP address is concentrated Whether linked character matches；

If so, using IP address corresponding to this transmits IP address as credible IP；

Wherein, the characteristic matching condition obtained using predetermined manner is to judge to transmit the linked character of IP address Whether linked character corresponding with the trusted IP address that trusted IP address is concentrated matches.
10. the method according to claim 9 for screening Email senders' identity characteristic, its feature It is, the trusted IP address that the linked character of IP address is concentrated with trusted IP address is transmitted described in the judgement Whether corresponding linked character matches in step, judges to transmit the linked character and trusted IP address of IP address Mode includes used by whether linked character corresponding to the trusted IP address of concentration matches：

The linked character of IP address and credible IP are transmitted using described in the method for measuring similarity calculating of characteristic vector The similarity of characteristic vector in address set corresponding to corresponding linked character；

Judge whether the similarity is more than or equal to default similarity threshold；

If so, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered matches；

If it is not, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered mismatches.
11. the method according to claim 10 for screening Email senders' identity characteristic, its feature It is, the method for measuring similarity of the characteristic vector specifically includes：

Obtain linked character and the linked character for transmitting IP address corresponding to trusted IP address collection；

By the feature in linked character corresponding to the trusted IP address collection and the weight corresponding to each feature Constitutive characteristic vector；

Transmitted described in acquisition in the linked character of IP address in linked character corresponding with the trusted IP address collection Same characteristic features；

Calculate the weight for obtaining the same characteristic features；

The weight of the same characteristic features and the total weight of all features are contrasted, the pass of IP address is transmitted described in acquisition Join the similarity of the characteristic vector of feature linked character corresponding with the trusted IP address collection.
12. the method according to claim 3 for screening Email senders' identity characteristic, its feature Be, the basis transmit IP address transmission mail corresponding to response rate judge this transmit IP address whether be The mode of trusted IP address includes：

Obtained from off-line data system using the e-mail hash for transmitting IP address transmission；

Obtain the quantity for transmitting IP address mail received in the preset time period；

This is obtained according to the quantity of the transmission e-mail hash and the mail received and transmits IP address Response rate；

Judge whether the response rate is more than or equal to default response rate threshold value；

If so, this is then transmitted into IP address as trusted IP address.
13. the method according to claim 3 for screening Email senders' identity characteristic, its feature It is, the basis transmits linked character corresponding to IP address and mail opening rate judges that this transmits IP address and is The no mode for trusted IP address includes：

The frequency of use obtained from off-line data system in preset time period transmits IP higher than predeterminated frequency Address；

Judge that this transmits originator system banner corresponding to IP address and whether mail header feature is stablized；

If so, judge that whether this transmits the opening rate for the mail that IP address is sent higher than default opening rate threshold value；

When the opening rate that this transmits the mail that IP address is sent is higher than default opening rate threshold value, and this transmits IP Record of bad behavior is not present in address, and this is transmitted into IP address as trusted IP address.
14. the method according to claim 3 for screening Email senders' identity characteristic, its feature It is, what is received in the default feature set step for extracting the Email to be screened received is default Waiting screen in feature set is characterized as to be screened transmitting IP address；

Accordingly, the characteristic matching condition in the characteristic matching model good using training in advance, will as foundation Feature to be screened feature corresponding with the characteristic matching condition in the default feature set carries out matching degree Test, judges whether feature to be screened meets that the characteristic matching condition step includes in the default feature set：

Characteristic matching condition in the good characteristic matching model of the training in advance is whether to judge a certain IP address Belong to the trusted IP address collection；

It is to be screened described in judgement to transmit whether IP address belongs to institute according to the characteristic matching condition of setting State trusted IP address collection；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
15. the method according to claim 2 for screening Email senders' identity characteristic, its feature It is, when the judgement for transmitting IP address and whether belonging to the trusted IP address collection to be screened described in the judgement When being as a result no, the judgement of the characteristic matching condition in characteristic matching model, the characteristic matching are performed again Condition transmits whether the IP address after IP address parses with sending domain matches for judgement；

Specific judgment mode includes：

The sending domain of Email is parsed, the IP address after being parsed；

According to this feature matching condition, it is wait the transmit IP address and the IP address after parsing screened described in judgement No matching；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
16. the method according to claim 15 for screening Email senders' identity characteristic, its feature Be, the IP address described in the judgement after that screens transmits IP address and parsing whether be in matching step The judgment mode of no matching includes：

Whether have between two addresses of IP address described in judgement after that screens transmits IP address and parsing pre- If the identical digit of quantity.
17. the method according to claim 15 for screening Email senders' identity characteristic, its feature It is, IP address is transmitted with the IP address after parsing whether in matching step wait what is screened described in the judgement When judged result is no, the judgement of the characteristic matching condition in characteristic matching model, the characteristic matching are performed Condition is the originator system banner for judging Email with transmitting whether IP address matches；

Specific judgment mode includes：

According to this feature matching condition, the IP address that transmits to be screened transmits method, system mark with described described in judgement Whether knowledge matches；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
18. the method according to claim 17 for screening Email senders' identity characteristic, its feature Be, described in the judgement it is to be screened transmit IP address and the originator system banner whether matching step In judgement matching way include：

Judge whether the top-level domain of mail sending domain is identical with the top-level domain of the originator system banner；

If so, judge IP address that the originator system banner parses with it is described it is to be screened with transmitting IP Whether location matches.
19. the method according to claim 1 for screening Email senders' identity characteristic, its feature Be, described in the judgement it is to be screened transmit IP address and the originator system banner whether matching step When if judged result is no in, the judgement of the characteristic matching condition in characteristic matching model, the feature are performed Matching condition is corresponding with the trusted IP address that trusted IP address is concentrated to judge the linked character for transmitting IP address Linked character whether match；The linked character includes originator system banner and mail header feature；

Specific judgment mode includes：

According to this feature matching condition, the linked character for transmitting IP address to be screened described in judgement and credible IP Whether linked character matches corresponding to trusted IP address in address set；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
20. the method according to claim 19 for screening Email senders' identity characteristic, its feature It is, the linked character for transmitting IP address to be screened is concentrated credible with trusted IP address described in the judgement The judgement matching way used in step that whether matches of linked character corresponding to IP address includes：

The association corresponding with the trusted IP address of the linked character for transmitting IP address to be screened described in judgement is special Whether the similarity of sign is more than or equal to default similarity threshold.
21. the method according to claim 14 for screening Email senders' identity characteristic, its feature It is, the IP address that transmits to be screened meets the characteristic matching condition step, performs following steps：

The credible IP that the linked character for transmitting IP address to be screened described in judgement is concentrated with trusted IP address Whether linked character corresponding to location matches；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
22. the method according to claim 1 for screening Email senders' identity characteristic, its feature It is, it is to be screened described in the default feature set step for extracting the Email to be screened received The reception mode of Email includes：Email to be screened is received using Mail Transfer Agent system.
23. the method according to claim 1 for screening Email senders' identity characteristic, its feature It is, the characteristic information included in the default characteristic matching model includes：Transmit IP address, sending domain Information, originator system banner and mail header feature.
A kind of 24. device for screening Email senders' identity characteristic, it is characterised in that including：

Default feature set extraction unit, for extracting the default feature set of the Email to be screened received；

Characteristic matching condition judgment unit, for the characteristic matching in the good characteristic matching model of training in advance Condition is foundation, and the feature to be screened in the default feature set is corresponding with the characteristic matching condition Feature carries out matching degree test, judges whether feature to be screened meets the feature in the default feature set With condition；

Identity characteristic discriminator unit, it is described if the judged result for characteristic matching condition judgment unit is yes It is believable Email Sender that the identity characteristic of the sender of Email to be screened, which is screened,.
25. the device according to claim 24 for screening Email senders' identity characteristic, its feature It is, also includes in the characteristic matching condition judgment unit：Characteristic matching model training subelement；

The characteristic matching model training subelement also includes：

Characteristic matching condition and trusted IP address obtain subelement, during for default based on off-line data system Between data in section, characteristic matching condition and trusted IP address are obtained using predetermined manner；The credible IP Location deposit trusted IP address is concentrated；

Linked character obtains subelement, for obtaining linked character corresponding with the trusted IP address；

Storing sub-units, for by the characteristic matching condition of acquisition, trusted IP address collection and trusted IP address pair The linked character answered is stored in the characteristic matching model.
26. the device according to claim 25 for screening Email senders' identity characteristic, its feature It is, the predetermined manner in the characteristic matching condition and trusted IP address acquisition subelement is included with lower unit At least one of：

Sending domain judgment sub-unit, for judging whether this transmits IP address with transmitting IP address according to sending domain For the mode of trusted IP address；

Originator system banner judgment sub-unit, for being judged according to originator system banner with transmitting IP address This transmits whether IP address is trusted IP address mode；

Special similarity judgment sub-unit is associated, for according to the linked character and trusted IP address for transmitting IP address The similarity of corresponding linked character judge this transmit IP address whether be trusted IP address mode；

Response rate judgment sub-unit, judging for the response rate according to corresponding to the mail for transmitting IP address transmission should Transmit IP address whether be trusted IP address mode；

Opening rate judgment sub-unit, transmit linked character corresponding to IP address for basis and mail opening rate is sentenced Break this transmit IP address whether be trusted IP address mode.
27. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the sending domain judgment sub-unit includes：

Transmit IP address obtain subelement, for from off-line data system obtain Email with transmitting IP Location；

Parse subelement, for the sending domain of Email to be parsed, the IP address after being parsed；

Judgment sub-unit, for judging described to transmit whether IP address matches with the IP address after the parsing；

Trusted IP address generates subelement, if the judged result of judgment sub-unit is yes, for this to be transmitted into IP IP address is as trusted IP address corresponding to address；

Wherein, the characteristic matching condition obtained using predetermined manner is that judgement transmits IP address and sending domain solution Whether the IP address information after analysis matches.
28. the device according to claim 27 for screening Email senders' identity characteristic, its feature It is, the judgment sub-unit includes：

Digit judgment sub-unit, for judging described to transmit IP address and two addresses of IP address after the parsing Between whether have predetermined number identical digit；

If so, then described transmit IP address and the IP address information match after the parsing；

If it is not, then the IP address that transmits mismatches with the IP address information after the parsing.
29. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the originator system banner judgment sub-unit includes：

Transmit IP address and originator system banner obtains subelement, for obtaining electricity from off-line data system Sub- mail sending domain transmits IP address and originator system banner；

Judgment sub-unit, for judging that the originator system banner transmits whether IP address matches with described；

If so, using IP address corresponding to this transmits IP address as trusted IP address；

Wherein, the characteristic matching condition obtained using predetermined manner be judge Email transmit method, system Identify and transmit whether IP address matches.
30. the device according to claim 29 for screening Email senders' identity characteristic, its feature It is, the judgment sub-unit includes：

Top-level domain judgment sub-unit, for the top-level domain for judging Email sending domain and the originator Whether the top-level domain of system banner is identical；

Matching judgment subelement, it is described for judging if the judged result of top-level domain judgment sub-unit is yes The IP address that originator system banner parses transmits whether IP address matches with described；

When the IP address parsed with it is described transmit IP address there is the identical digit of predetermined number when, the hair Letter method, system mark matches with the IP address that transmits；

When the IP address parsed with it is described transmit IP address do not have predetermined number identical digit when, it is described Originator system banner transmits IP address mismatch with described.
31. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the special similarity judgment sub-unit of association includes：

Linked character obtains subelement, and IP address is transmitted for obtaining Email from the off-line data system With the linked character for transmitting IP address；The linked character includes originator system banner and mail header feature；

Judgment sub-unit, can for judge that the linked character for transmitting IP address and trusted IP address concentrate Whether linked character corresponding to letter IP address matches；

If so, using IP address corresponding to this transmits IP address as credible IP；

Wherein, the characteristic matching condition obtained using predetermined manner is to judge to transmit the linked character of IP address Whether linked character corresponding with the trusted IP address that trusted IP address is concentrated matches.
32. the device according to claim 31 for screening Email senders' identity characteristic, its feature It is, the judgment sub-unit includes：

Similarity obtains subelement, for transmitting IP described in the method for measuring similarity calculating using characteristic vector The linked character of address is similar with the characteristic vector corresponding to the corresponding linked character of trusted IP address concentration Degree；

Threshold decision subelement, for judging whether the similarity is more than or equal to default similarity threshold；

If so, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered matches；

If it is not, the trusted IP address pair that then linked character for transmitting IP address is concentrated with trusted IP address The linked character answered mismatches.
33. the device according to claim 24 for screening Email senders' identity characteristic, its feature It is, the similarity, which obtains subelement, to be included：

Linked character obtains subelement, for obtaining linked character corresponding to trusted IP address collection and described transmitting The linked character of IP address；

Characteristic vector generates subelement, for by the feature in linked character corresponding to the trusted IP address collection And the weight constitutive characteristic vector corresponding to each feature；

Same characteristic features obtain subelement, for obtain in the linked character for transmitting IP address with it is described credible Same characteristic features in linked character corresponding to IP address collection；

Weight calculation subelement, the weight of the same characteristic features is obtained for calculating；

Similarity obtains subelement, for the weight of the same characteristic features and the total weight of all features to be contrasted, Transmitted described in acquisition the feature of the linked character linked character corresponding with the trusted IP address collection of IP address to The similarity of amount.
34. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the response rate judgment sub-unit includes：

The e-mail hash of transmission obtains subelement, and IP is transmitted for obtaining to use from off-line data system The e-mail hash that address is sent；

The quantity of the mail received obtains subelement, and IP address is transmitted in the preset time period for obtaining this The quantity of interior received mail；

Response rate computation subunit, for according to the transmission e-mail hash and the mail received Quantity obtain the response rate for transmitting IP address；

Threshold decision subelement, for judging whether the response rate is more than or equal to default response rate threshold value；

If so, this is then transmitted into IP address as trusted IP address.
35. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the opening rate judgment sub-unit includes：

Transmit IP address and obtain subelement, make for being obtained from off-line data system in preset time period With frequency IP address is transmitted higher than predeterminated frequency；

Judgement of stability subelement, for judging that this transmits originator system banner and mail corresponding to IP address Whether letter head feature is stablized；

Default opening rate threshold decision subelement, if the judged result of judgement of stability subelement is yes, is used for Judge that whether this transmits the opening rate for the mail that IP address is sent higher than default opening rate threshold value；

Trusted IP address generates subelement, for transmitting the opening rate for the mail that IP address is sent when this higher than pre- If during opening rate threshold value, and this transmits IP address and record of bad behavior is not present, and this is transmitted into IP address as credible IP address.
36. the device according to claim 26 for screening Email senders' identity characteristic, its feature It is, the feature that the default feature set lifts in the default feature set received in unit is feature to be screened IP address is transmitted for be screened；

Accordingly, characteristic matching condition judgment unit includes：

A certain IP address judgment sub-unit, the feature in the characteristic matching model good for the training in advance It is to judge whether a certain IP address belongs to the trusted IP address collection with condition；

Trusted IP address collection judgment sub-unit, for the characteristic matching condition according to setting, described in judgement To be screened transmits whether IP address belongs to the trusted IP address collection；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
37. the device according to claim 36 for screening Email senders' identity characteristic, its feature It is, when the judged result of the trusted IP address collection judgment sub-unit is no, in addition to：

IP address after parsing obtains subelement, for the sending domain of Email to be parsed, is solved IP address after analysis；

IP address matching judgment subelement, for foundation this feature matching condition, hair to be screened described in judgement Whether letter IP address matches with the IP address after parsing；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
38. the device of examination Email senders' identity characteristic according to claim 37, its feature It is, when the judged result of the IP address matching judgment subelement is no, in addition to：

IP address and the originator system banner matching judgment subelement are transmitted, for being matched according to this feature Condition, it is to be screened described in judgement to transmit whether IP address matches with the originator system banner；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
39. the device of examination Email senders' identity characteristic according to claim 38, its feature It is, IP address is transmitted and the judged result of the originator system banner matching judgment subelement is when described When no, in addition to：

Linked character matching judgment subelement, it is to be screened described in judgement for foundation this feature matching condition Transmit IP address linked character linked character corresponding with the trusted IP address that trusted IP address is concentrated whether Match；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.
40. the device according to claim 27 for screening Email senders' identity characteristic, its feature It is, also includes after the trusted IP address generation subelement：

Linked character matching judgment subelement, for judging the linked character for transmitting IP address to be screened Whether linked character corresponding with the trusted IP address that trusted IP address is concentrated matches；

If so, then the IP address that transmits to be screened meets the characteristic matching condition.