KR102205997B1 - Method and server determining e-mail attached virus - Google Patents

Abstract

The present invention relates to a malicious e-mail identification method for determining whether an incoming e-mail is fraudulent or malicious (hereinafter referred to as'malicious') and guiding the recipient to a malicious e-mail identification method, and a security server for implementing the same, wherein Receiving; A sending information verification step of extracting a sending address from the sending information of the received mail by the security server; A search step of searching for the originating address from attribute information of received mails managed by the security server; A character string similarity checking step of comparing, by the security server, attribute information having a character string similar to the character string of the source address with the source address to check the character string similarity when the source address is not found in the property information; And a notification step of configuring, by the security server, notification content in the received mail when the character string similarity is within a threshold range.

Description

How to detect malicious email and security server to implement it {METHOD AND SERVER DETERMINING E-MAIL ATTACHED VIRUS}

The present invention relates to a method for determining a malicious email that informs a recipient by determining whether the received email is fraudulent or malicious (hereinafter referred to as “malicious”), and a security server for implementing the same.

The rapid development of services such as electronic communications, online commerce, and online banking commerce has been accompanied by an increase in electronic crime. In particular, Internet fraud in the form of phishing and identity theft has been a threat to Internet users.

On the other hand, details of personal information and other online transactions (hereinafter referred to as'personal information') were used as important information for Internet fraud, and even problems of unauthorized sale, theft, and leakage to third parties with malicious intent occurred. I did.

However, unauthorized use of personal information could cause direct financial loss to the parties through Internet fraud, spam mail or other hacking. In addition, since companies have to develop and apply various security technologies to protect users from unauthorized theft of personal information, security costs are additionally incurred and increased for each company, resulting in a problem of raising the corresponding price.

In order to solve this problem, conventionally, a technology has been developed to check the sender's e-mail address (hereinafter, referred to as'from address') and compare it with the existing list of malicious addresses. Since the prior art relies only on the list of existing malicious addresses to determine whether the email is malicious, there is a limitation in that it is impossible to determine whether the email is malicious if the sending address cannot be confirmed in the list due to the establishment of an email address.

Prior Art Document 1. Patent Publication No. 10-1437521 (announced on September 3, 2014)

Accordingly, the present invention was invented to solve the above problems, and a malicious email identification method capable of warning the recipient by determining whether the received email is malicious without malicious information registered with malicious URL, IP, phone number, etc. It is a task to solve the provision of a security server for doing so.

In order to achieve the above object, the present invention,

Receiving, by the security server, a received mail from the sending mail server;

A sending information verification step of extracting a sending address from the sending information of the received mail by the security server;

A search step of searching for the originating address from attribute information of received mails managed by the security server;

A character string similarity checking step of comparing, by the security server, attribute information having a character string similar to the character string of the source address with the source address to check the character string similarity when the source address is not found in the property information; And

A notification step of configuring, by the security server, notification content in the received mail if the character string similarity is within a threshold range;

It is a method of determining malicious emails including.

In order to achieve the above other technical problem, the present invention,

A malicious information management module for managing malicious information;

A mail history management module for managing attribute information of received mails;

A sending information checking module for extracting a sending address from sending information of the received mail;

A received mail checking module for searching for a sending address from the malicious information and attribute information, and generating a notification command value if the sending address is searched from malicious information or if the character string similarity between the sending address and attribute information is within a threshold range; And

A notification module configured to configure notification content corresponding to the notification command value in the received mail;

It is a security server with a malicious email identification function including.

According to the present invention, since the malicious URL, IP, phone number, etc. can be determined and warned to the recipient without the registered malicious information, the amount of data communication consumed while receiving and updating the malicious information online is reduced. In addition, there is an effect of reducing the burden on the system for storing relatively large amounts of malicious information.

1 is a block diagram schematically showing a security server as a preferred example according to the present invention,
2 is a flowchart showing a security process of a received mail according to a method for determining as a preferred example according to the present invention,
3 is a table illustrating an example of alteration of an email sending address,
FIG. 4 is an image illustrating a state in which a security server inserts notification content into a received mail identified as malicious as a preferred example according to the present invention.
5 is an image showing e-mail content determined by a security server as a preferred example according to the present invention,
6 is a block diagram schematically showing a security server as another preferred example according to the present invention,
FIG. 7 is a flowchart showing a security process of the next step that connects the security process of FIG. 2 according to the determination method as a preferred example according to the present invention,
8 is an image showing e-mail contents determined by a security server as another preferred example according to the present invention.

The features and effects of the present invention described above will become apparent through the following detailed description in connection with the accompanying drawings, whereby those of ordinary skill in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. There will be. Since the present invention can apply various changes and have various forms, specific embodiments will be illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to a specific disclosed form, and it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention. The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically showing a security server as a preferred example according to the present invention.

Referring to Figure 1, the security server 200 according to the present invention, a malicious information management module 210 for managing malicious information; A mail history management module 220 for managing attribute information of received mails; A sending information checking module 240 for extracting a sending address from sending information of the received mail; A received mail verification module 230 that searches for a sending address from the malicious information and attribute information, and generates a notification command value if the sending address is searched from malicious information or if the string similarity between the sending address and attribute information is within a threshold range. ); And a notification module 250 configured to configure notification content corresponding to the notification command value in the received mail.

Each component will be described in more detail. The malicious information management module 210 manages malicious information such as a spam email address, a voice phishing phone number, and an email address having a history of virus spread. The malicious information may be directly stored by the malicious information management module 210 or in a separate DB server (not shown).

The mail history management module 220 manages attribute information of received mails received by the security server 200. The attribute information is generated in order for the sending mail server 100 to mail data created by the sender client S through DNS (Domain Name System) and SMTP (Simple Mail Transfer Protocol). It includes receiving information for and sending information for confirming the source.

The received mail further includes body information and the like in addition to the sending information and the received information. The calling information includes a calling address, calling time, calling party and calling party identification. The received information includes a receiving address and a recipient. The body information includes the name of the email and the body of the email.

The sending information checking module 240 extracts a sending address from sending information of the received mail. Since the received mail is transmitted from the outgoing mail server 100 as data in an SMTP-based packet unit, the outgoing information verification module 240 comprehensively analyzes the data in the packet unit and extracts the outgoing address configured in the outgoing information. The sending address is an email address of the sender client 100 registered in the sending mail server 100.

The received mail confirmation module 230 searches for a sending address from the malicious information and attribute information, and if the sending address is searched from malicious information or a string similarity between the sending address and attribute information is within a threshold range, a notification command Create a value. The received mail confirmation module 230 checks whether the sending address of the received mail is present in attribute information managed by the mail history management module 220. In addition, since the received mail confirmation module 230 also determines whether the received mail is malicious, it checks whether the sending address of the received mail exists in malicious information managed by the malicious information management module 210. As a result of checking, if the sending address of the received mail exists in the attribute information and also exists in the malicious information, a notification command value is generated. In addition, if the originating address of the received mail does not exist in the attribute information, the similarity of the character string between the originating address of the received mail and the attribute information is checked. As a result of the confirmation, if the character string similarity is within the threshold range, the received mail confirmation module 230 determines that the sending address has a high possibility of maliciousness and generates a notification command value. For reference, the string similarity measurement is performed by a Levenshtein distance method. The levinstein distance is a method of measuring how many times a character string needs to be changed when replacing one character string with another character string.

In addition, when the character string similarity of the sending address is confirmed to be within a threshold range, the received mail confirmation module 230 checks the receiving address of the corresponding received mail and checks storage information of the sending mails associated with the receiving address. To this end, the security server 200 of the present embodiment further includes a process of classifying and individually managing a source address related to a destination address. In more detail, the mail history management module 220 links the sending address and the receiving address among attribute information of the received mail. Accordingly, the received mail confirmation module 230 may check the receiving address when searching for the sending address. As a result of the verification, when the corresponding destination address is retrieved from the stored information of the source address that has been previously identified within the threshold range, a notification command value is generated. Therefore, notification content is additionally configured only for incoming mails for recipients directly related to the sending address.

The notification module 250 configures notification content corresponding to the notification command value in the received mail. Since the security server 200 sends the received mail, which is determined to be malicious, to the receiving mail server 300, the recipient clients (R, R') receive the received mail by POP3 (Post Office Protocol) of the receiving mail server 300. Upon receiving the mail, the notification content is output together with the body of the email output to the recipient clients (R, R'). The recipient can recognize in advance whether the received mail is malicious by checking the notification content output along with the email body. The notification content may be a warning message, a color of a title, or an icon indicating that malicious code has been confirmed.

FIG. 2 is a flowchart showing a security process of a received mail according to a discrimination method as a preferred example according to the present invention, FIG. 3 is a table illustrating a modification of an email originating address, and FIG. 4 is a preferred one according to the present invention. As an example, this is an image illustrating how the security server inserts the notification content into the received mail that has been identified as malicious.

It will be described with reference to FIGS. 1 to 3.

S11; Steps to check incoming mail

The security server 200, that is, the received mail confirmation module 230 of the security server 200 receives the received mail from the outgoing mail server 100, and checks the information of the received mail. The information of the received mail includes sending information, receiving information, and body information.

The security server 200 according to the present invention is an email between the sending mail server 100 for sending an email by the sender client (S) and the receiving mail server 300 for receiving the email by the recipient client (R, R'). It is configured to relay communications. Therefore, the security server 200 is the sending mail server 100 or the receiving mail server 300 or the recipient client (R, R') among a number of email data that communicates the sending mail server 100 and the receiving mail server 300 ), security is selectively processed.

S12; Steps to check outgoing information

The security server 200, that is, the sending information confirmation module 240 of the security server 200 extracts the sending address from the sending information of the received mail.

S13; Search step

The security server 200, that is, the received mail confirmation module 230, searches for the sending address from attribute information of the received mails managed by the mail history management module 220. As described above, since the mail history management module 220 manages attribute information of emails sent and received between the sender client 100 and the recipient client 300, the sending address of the accumulated emails is the mail history management module 220 ) Is included in the attribute information managed by

S14; Steps to check string similarity

In the search step (S13), if the sending address is not searched among the attribute information, the security server 200, that is, the received mail verification module 230, compares attribute information having a character string similar to that of the sending address with the sending address. To check the string similarity.

In more detail, if this is a new type of sending address that has not been searched in the attribute information, it may be a malicious email that has not yet been verified. Therefore, the received mail is classified as a target to be determined whether it is malicious. To this end, the received mail confirmation module 230 first checks an email address similar to the originating address of the received mail among the email addresses included in the attribute information. The degree of similarity between the originating address of the received mail and the e-mail address of the attribute information is achieved through a character string similarity comparison. For example, as shown in FIG. 3, the normal sending address'susanlee@gmail.com' is altered to'susanleee@gmail.com' or'susnalee@gmail.com' and thus may be used as malicious. have. Here,'susanleee@gmail.com', which is the altered sending address, has the letter "e" added to the normal sending address. In addition, the positions of the letters "n" and "a" have been changed in the altered sending address,'susnalee@gmail.com'. Accordingly, the normal originating address is retrieved from attribute information, but the altered originating address is not retrieved from attribute information. However, it can be seen that the normal originating address and the altered originating address have a high character string similarity as only the minimum number of characters is added or only the positions of some characters are changed. This is the purpose of inducing the misunderstanding of the recipient, and may be the basis for proving that the received mail is malicious.

As described above, the string similarity measurement is performed by a Levenshtein distance method.

S15; Critical Range Check Step

The security server 200, that is, the received mail confirmation module 230, checks whether the character string similarity is within a threshold range. Since the sending address of the received mail is an email address that does not exist in the attribute information, the character string similarity cannot be 100% identical. Therefore, a threshold range that is more than the specified value but not 100% is specified.

S16; Notification steps

The security server 200, that is, the received mail confirmation module 230, when it is determined that the character string similarity is within a threshold range, considers that the sending address is a forged sender address and generates a notification command value.

The notification module 250 of the security server 200 receiving the notification command value processes notification content to be configured in the received mail, as shown in FIG. 4.

Accordingly, the received mail output to the recipient client 300 is output along with the notification content, and a recipient who checks the received mail output to the recipient client 300 can check the received mail with caution.

In addition, when the character string similarity of the sending address is confirmed to be within a threshold range, the received mail confirmation module 230 checks the receiving address of the corresponding received mail and checks storage information of the sending mails associated with the receiving address. As a result of the verification, when the corresponding destination address is retrieved from the stored information of the source address that has been previously identified within the threshold range, a notification command value is generated.

S17; Verification steps

When the same attribute information as the source address is confirmed in the search step, the security server 200, that is, the received mail confirmation module 230, checks whether the same attribute information is malicious information.

As described above, since the attribute information includes all email addresses sent and received regardless of whether or not the email is malicious, if the sending address is present in the attribute information, it is necessary to check whether it is malicious next. Accordingly, the received mail checking module 230 searches for malicious information managed by the malicious information management module 210 and checks whether the corresponding attribute information, that is, the sending address exists.

As a result of the confirmation, if the same attribute information is confirmed as malicious information, the security server 200, that is, the received mail confirmation module 230, generates a notification command value in the notification step S16, and the notification module 250 According to the notification command value, notification content is configured in the received mail. Since the description of the configuration of the notification content has been described above, redundant descriptions are avoided here.

The security server 200 and the determination method according to the present invention further include a technology for determining whether the received mail is malicious by checking the domain of the sending address.

The received mail confirmation module 230 of the security server 200 according to the present invention compares the domain of the originating address with the domain of the attribute information, and generates a notification command value if they do not match.

As shown in FIG. 3, the normal sending address'kyle@koreaseafood.com' and the altered sending address'kyle.koreaseafood@gmail.com' differ from the normal sending address because the letters constituting the email address are clearly different. String similarity is small. But at first glance, it can confuse the recipient with the same source address.

Accordingly, the received mail confirmation module 230 searches for a normal sending address, which is attribute information of an email address similar to the sending address in the mail history management module 220, and determines the domain of the searched attribute information and the sending address domain of the received mail. Compare.

The search for attribute information of the received mail confirmation module 230 proceeds as follows.

First, the sending address of the received mail is checked to confirm the domain and ID. In the sending address of the present embodiment,'kyle.koreaseafood@gmail.com', the domain is "gmail.com" and the ID is "kyle.koreaseafood".

Next, when the domain and ID of the sending address are confirmed, the received mail confirmation module 230 searches the mail history management module 220 for keywords "kyle" and "koreaseafood" configured in the ID. At this time, the search searches all attribute information including the keyword regardless of the ID and domain constituting the normal origination address of the attribute information. In addition, the received mail confirmation module 230 also searches all attribute information including keywords similar to the keyword. The similarity between keywords is determined through the measurement of the string similarity described above, and all attribute information having a similarity greater than or equal to a threshold is searched.

Next, the received mail confirmation module 230 checks whether the domain is identical between the sending address and the searched attribute information.

Next, the received mail confirmation module 230 generates a notification command value when the source address and the domain of the searched attribute information do not match.

5 is an image showing e-mail content determined by a security server as a preferred example according to the present invention.

1, 2, and 5, the sending information confirmation module 240 of the security server 200 according to the present invention checks the caller indication (refer to'①') in the sending information; The received mail checking module 230 compares the sender's email address checked by the sending information checking module 240 with the sending address, and generates a notification command value if it does not match.

As shown in Fig. 5, the sending information of the received mail includes a sender's identification ('Sender') as well as a sending address ('From'). Here, since the sender ID can be created by the sender, the sender may display an email address different from the sender address. Accordingly, the sender may display an e-mail address known to the recipient on the sender ID, and in this case, the receiver may misrecognize the sending address by viewing only the sender ID.

Accordingly, the sending information checked by the sending information checking module 240 includes the sender's indication, and the received mail checking module 230 compares the sender's email address with the sending address. If the comparison result is found to be inconsistent, the received mail confirmation module 230 generates a notification command value.

As shown in Fig. 5, the sending information checking module 240 checks the sending time (refer to'②') in the sending information; The received mail confirmation module 230 checks whether the sending time of the sender checked by the sending information confirmation module 240 is within a designated time, and generates a notification command value if it is not the designated time.

The calling information further includes a calling time, along with a calling address and a calling party identification. Since the sending time is automatically generated at the time when the corresponding received mail is transmitted, it is possible to check the correct sending time of the received mail.

In general, e-mails are written by the sender and sent to the recipient, except in special cases, so most of the e-mail sending time is the working hours of the field. Therefore, the transmission time checked by the sending information checking module 240 is checked whether the received mail checking module 230 is within the working hours, that is, within the specified time. The received mail confirmation module 230 generates a notification command value when the sending time of the received mail is not within the specified time.

6 is a block diagram schematically showing a security server as another preferred example according to the present invention.

5 and 6, an email text verification module 260 that analyzes the body information (refer to'③' and'④') of the received email to check for a specified word or letter, and the received email It further includes a link information checking module 270 for searching the configured link address.

The body information of the received mail is composed of contents such as various texts, images, and tables. Here, in the case of the text, words such as finance, legal, and medical fields that may be noted by the recipient may be included. Therefore, the words of the relevant fields are set as designated words, and the email text verification module 260 searches for the designated words from the body information.

In addition, in order to pass through the Spam keyword filter of the security server 200, an incorrect character in the text (hereinafter, referred to as'error') may be included. That is, the sender marks the designated word as coming, so that the email text verification module 260 cannot search for the designated word. Accordingly, the e-mail text verification module 260 performs an incorrect search in addition to searching for the designated word.

Meanwhile, the received mail confirmation module 230 generates a notification command value when the number of designated words or the number of errors checked by the email body confirmation module 260 is greater than or equal to a threshold value.

The body information of the received mail may include content linked to another IP through a link function such as a hyperlink. Accordingly, the link information checking module 270 searches for link information from the body information of the received mail and checks a link address such as URL or IP from the link information.

Meanwhile, the email text verification module 260 searches for a phone number from the text information; The received mail confirmation module 230 generates a notification command value when the link address searched by the link information confirmation module 270 or the phone number searched by the email body confirmation module 260 is confirmed in the malicious information. do.

An example of the execution process of the security server 200 according to the present invention described above will be described.

7 is a flowchart showing the next step of the security process of the security process of FIG. 2 according to the determination method as a preferred example according to the present invention, and FIG. 8 is another preferred example according to the present invention, which is determined by the security server. This is an image showing the contents.

5 to 8, the email text confirmation module 260 checks the body of the received email (S21). Since the email text verification module 260 searches for a designated word in the email text, a simple character string (pattern) search technology is utilized.

The e-mail text verification module 260 may search for a misleading designated word, and for this purpose, the e-mail text verification module 260 generates a similar keyword of the designated word and performs a string search.

Designated words'account' and'tax' are searched in the body information of the e-mail in Fig. 5, and designated words'payment','account' and'bankdraft' are searched in the e-mail body information of Fig. 8(a). Became.

The received mail confirmation module 230 counts the number of selected one or more of the specified words and errors searched by the email body confirmation module 260 (S22), and checks whether the number exceeds a threshold (S23).

As a result of the confirmation, when the number exceeds the threshold, the received mail confirmation module 230 generates a notification command value (S16). However, if the number does not exceed the threshold, the link information confirmation module 270 checks the link information L in the body information of the received mail as shown in Fig. 8B, and the checked link information L Check the link address of) (S24). 5, the link address of the link information ('⑤') is checked in the body information of the received mail.

The received mail confirmation module 230 searches for the link address checked by the link information confirmation module 270 from malicious information of the malicious information management module 210 (S241). As a result of the search, if the link address exists in the malicious information, the link address is designated as a malicious link (S242), and the received mail confirmation module 230 generates a notification command value (S16). However, if the malicious information does not exist, the phone number verification step (S25) is continued.

If the link information is not identified in the link address verification step (S24), or the link information is not designated as a malicious link in the malicious link verification step (S242), the received mail verification module 230 retrieves a phone number from the body information of the received email. Search (S25).

If an arbitrary phone number is searched as a result of the phone number search, the received mail confirmation module 230 searches for the phone number from malicious information of the malicious information management module 210 (S251). As a result of the search, if the phone number exists in the malicious information, the phone number is designated as the malicious phone number (S252), and the received mail confirmation module 230 generates a notification command value (S16).

In the detailed description of the present invention described above, it has been described with reference to preferred embodiments of the present invention, but those skilled in the art or those of ordinary skill in the relevant technical field, the spirit of the present invention described in the claims to be described later. And it will be understood that various modifications and changes can be made to the present invention within a range not departing from the technical field.

Claims (11)

A malicious information management module for managing malicious information; A mail history management module for managing attribute information of received mails; A sending information checking module for extracting a sending address from sending information of the received mail; A received mail checking module for searching for a sending address from the malicious information and attribute information, and generating a notification command value if the sending address is searched from malicious information or if the string similarity between the sending address and attribute information is within a threshold range; In the security server of the malicious e-mail identification function comprising; a notification module for configuring notification content corresponding to the notification command value in the received mail,
The received mail verification module searches the mail history management module for a sending address of attribute information whose ID and domain constituting keyword and string similarity are greater than or equal to a threshold value, and the domain of the sending address of the searched attribute information Generating a notification command value when the domain of the originating address of the corresponding received mail does not match;
A security server with a malicious email identification function, characterized in that. The method of claim 1,
The character string similarity calculation is performed by applying a Levenshtein distance algorithm;
A security server with a malicious email identification function, characterized in that. The method of claim 1,
The received mail verification module checks the first recipient address linked to the sending address within the threshold range, checks the second recipient address of the received mail, and if the first recipient address matches the second recipient address , Generating a notification command value;
A security server with a malicious email identification function, characterized in that. The method of claim 1,
The calling information confirmation module checks the calling party identification in the calling information;
The received mail checking module, comparing the sender's email address checked by the sending information checking module with the sending address, and generating a notification command value if a mismatch;
A security server with a malicious email identification function, characterized in that. The method of claim 1,
The origination information confirmation module checks an origination time in the origination information;
The received mail confirmation module is configured to check whether the sending time of the sender checked by the sending information checking module is within a designated time, and if not, generating a notification command value;
A security server with a malicious email identification function, characterized in that. The method of claim 1,
Further comprising an e-mail text verification module for analyzing the body information of the received e-mail to check whether a designated word or letter is missed;
The received mail confirmation module generates a notification command value when the number of designated words or the number of errors of letters is greater than or equal to a threshold value.
A security server with a malicious email identification function, characterized in that. The method of claim 6,
Further comprising a link information checking module for searching for a link address configured in the received mail;
The email text confirmation module searches for a phone number from the text information;
The received mail checking module generates a notification command value when a link address searched by the link information checking module or a phone number searched by the email text checking module is confirmed in the malicious information;
A security server with a malicious email identification function, characterized in that. delete delete delete delete

Images