KR102684949B1 - Method of detecting for mail attacks sent through accounts created by social engineering techniques and mail system accordingly - Google Patents

Abstract

A method of detecting an email attack sent through an account created using a social engineering technique according to the present invention includes the steps of receiving an email sent from a sending email system and outputting email information; receiving the mail information, checking whether the mail is trusted according to the SPF policy, classifying the normal mail, and outputting mail information about the normal mail; and receiving mail information for the normal mail, checking whether any of the account, identification information, and domain is different from previously received mail, and determining an unfamiliar mail predicted to be a hacking mail according to a social engineering technique; It is characterized by including.

Description

{Method of detecting for mail attacks sent through accounts created by social engineering techniques and mail system accordingly}

The present invention relates to mail security service technology. More specifically, it detects mail predicted to be a mail attack sent through an account created through social engineering techniques and blocks mail predicted to be a mail attack from being delivered to mail users. It concerns a method of detecting email attacks that protect innocent email users and the resulting email system.

As the speed of industry and paradigm change has rapidly increased, the way to approach the work environment or work system has changed significantly, and we have entered an era where all data can be easily shared and quick work processing is possible through cloud systems.

In addition, in the post-corona era, the usability of non-face-to-face work has increased, and the number of damage cases due to various attacks using email is rapidly increasing.

To solve this problem, technology has been developed that allows the server system to automatically distinguish between safe and dangerous mail without the mail user's intervention. Representative technologies include SPF (Sender Policy Framework) and DKIM (Domain Keys Identified). Mail) and DMARC (Domain-based Message Authentication).

The SPF is called the mail server registration system. Considering that most spam senders often misrepresent or change the sender's address or transmission path to hide their identity, the mail server information is publicly registered in DNS in advance so that the recipient can use it. It refers to an authentication technology that allows users to check whether the sender information displayed in the mail matches the information on the actual mail server.

DKIM, also known as domain key authentication mail, is a public key/private key based mail authentication method that inserts a digital signature into the mail header so that the recipient can verify whether the sender has been forged. It refers to authentication technology.

DMARC is an authentication technology that uses the Mail Server Registration System (SPF) and Domain Key Authenticated Mail (DKIM) to identify legitimate senders. It refers to an email authentication method that allows you to receive reports after processing suspicious emails. .

As mentioned above, various technologies have been proposed and commercialized to protect innocent mail users from various attacks through mail services, and hackers with malicious intent are also attempting various types of mail attacks.

Among the above email attacks, security attacks using non-technical means such as phishing, pharming, smishing, and vishing, which utilize trust among human psychological phenomena, are especially intensifying. This type of hacking technique is called social engineering hacking.

Unlike other hacking fields that require advanced computer skills, social engineering hacking uses human psychology, so it was difficult to block no matter how perfect technical security was.

Accordingly, hackers exploited these characteristics and used socially engineered hacked emails as a means of infiltrating internal systems. These emails neutralized the security infrastructure, allowing easy access to recipients. Here, the social engineering hacked email is forged into an account similar to or familiar to the existing communication account by abusing human trust.

The above-mentioned email used all possible methods to collect the information of the attack target, and cleverly used all the information to cause a security incident of enormous amount of money.

Accordingly, there has been an urgent need to develop technology that can detect email attacks using social engineering attack techniques and protect innocent email users.

Republic of Korea Patent Registration No. 10-2164338 Republic of Korea Patent Publication No. 10-2016-0018218

The present invention is based on a social engineering technique that protects well-intentioned mail users by detecting mail predicted to be a mail attack sent through an account created through a social engineering technique and blocking mail predicted to be a mail attack from being delivered to the mail user. The purpose is to provide a method for detecting email attacks and a corresponding email system.

In addition, another object of the present invention is to collect emails predicted from email attacks sent through accounts created through social engineering techniques, and then review emails predicted to be email attacks according to a predetermined schedule to detect emails that are not email attack emails. It provides a method for detecting email attacks based on social engineering techniques and a corresponding email system that processes emails and allows good-intentioned emails to be delivered to email users.

A method of detecting an email attack sent through an account created using a social engineering technique according to the present invention to achieve the above object includes the steps of receiving an email sent from a sending email system and outputting email information; receiving the mail information, checking whether the mail is trusted according to the SPF policy, classifying the normal mail, and outputting mail information about the normal mail; and receiving mail information for the normal mail, checking whether any of the account, identification information, and domain is different from previously received mails, and determining an unfamiliar mail predicted to be a hacking mail according to a social engineering technique; It is characterized by including.

The present invention detects e-mails predicted to be e-mail attacks from e-mail attacks sent through accounts created through social engineering techniques, and blocks e-mails predicted to be e-mail attacks from being delivered to e-mail users, thereby protecting innocent e-mail users. It has an effect.

In addition, the present invention collects emails predicted to be email attacks from email attacks sent through accounts created through social engineering techniques, and then reviews emails predicted to be email attacks according to a predetermined schedule to detect emails that are not mail attack emails. It has the effect of processing emails as they are received, allowing good-intentioned emails to be delivered to mail users.

1 is a configuration diagram of a mail system according to a first preferred embodiment of the present invention.
Figures 2 and 3 are flowcharts of a method for detecting an email attack from an email attack sent through an account created using a social engineering technique according to the first preferred embodiment of the present invention.
Figure 4 is a procedure diagram of a method for detecting an email attack from an email attack sent through an account created using a social engineering technique according to a second preferred embodiment of the present invention.

The present invention protects well-intentioned mail users by detecting mail predicted to be a mail attack using social engineering techniques and blocking mail predicted to be a mail attack from being delivered to mail users.

In addition, the present invention collects mail predicted to be a mail attack according to a social engineering technique, and then receives and processes mail that is not a mail attack mail through a review process for mail predicted to be a mail attack according to a predetermined schedule to receive and process good-faith mail. allows it to be delivered to the mail user.

The method and mail system for detecting mail attacks based on social engineering techniques according to the first preferred embodiment of the present invention will be described in detail with reference to the drawings.

<Configuration of mail system>

1 is a diagram showing the configuration of a mail system according to a first preferred embodiment of the present invention. Referring to FIG. 1, the mail system 100 according to the first preferred embodiment of the present invention includes a mail reception unit 102, a first mail processing unit 104, a second mail processing unit 106, and a third mail processing unit ( It consists of 108) and database 110.

The mail reception unit 102 is connected to the sender's mail system 200 through a network and receives mail by communicating with the sender's mail system 200 according to a mail transmission and reception protocol such as SMTP (simple mail transfer protocol). do.

When a mail is received from the sending mail system 200, the mail receiving unit 102 provides mail information about the received mail to the first mail processing unit 104.

The first mail processing unit 104 collects mail information provided by the mail receiving unit 102 and classifies it into trusted mail and untrusted mail based on SPF policy or permitted email address book, and sends the trusted mail to a second mail processing unit. It is provided to the mail processing unit 106, and the untrusted mail is blocked.

The second mail processing unit 106 receives mail information about trusted mail, processes mail information and mail headers, determines unfamiliar mails predicted to be hacking mails according to social engineering techniques, and detects hacking mails according to social engineering techniques. Unfamiliar emails predicted to be e-mails are classified and stored in the database 110, and if they are normal e-mails rather than unfamiliar e-mails predicted to be hacking e-mails based on social engineering techniques, they are provided to e-mail users.

Additionally, the second mail processing unit 106 calls the scheduler of the third mail processing unit 108 to request processing of unfamiliar mail predicted to be hacking mail according to the social engineering technique.

And the third mail processing unit 108 activates the scheduler according to the request of the second mail processing unit 106, and when the time set by the scheduler arrives, unfamiliar mail predicted to be hacking mail according to social engineering techniques The mail list for is transmitted to the mail manager's terminal, etc., and upon request from the mail manager's terminal, the mail is provided to the mail user or the hacked mail is reported to the hacking mail reporting system.

And the database 110 provides data storage for the mail service provided by the mail system 100.

Now, the procedure for detecting an email attack sent through an account created using a social engineering technique applicable to the above email system will be described with reference to the drawings.

<Procedures for detecting email attacks sent through accounts created through social engineering techniques>

Figures 2 and 3 illustrate the procedure of a method for detecting an email attack sent through an account created using a social engineering technique according to the first preferred embodiment of the present invention. Referring to FIG. 2, when the first mail processing unit 104 provides mail information classified as trusted mail based on the SPF policy, permitted email address book, etc., the second mail processing unit 106 of the mail system 100 provides mail information. (Step 300), check the mail sending information (MailFrom) included in the mail information (step 302), and check whether any of the account, identification information, and domain is different from the information about the previously received mail. (steps 304, 306, and 308), if any of the account, identification information, and domain are different, the second mail processing unit 106 sends an unfamiliar mail, that is, an unfamiliar mail predicted to be a hacking mail according to a social engineering technique. Classify and store in the database 102 (step 318). On the other hand, if the mail sending information (MailFrom) included in the mail information is checked and the account, identification information, and domain are all the same as the mail information for the previously received mail, the second mail processing unit 106 sends the mail. The header information of the information is checked (step 310), and whether any of the account, identification information, and domain is different from the mail information for previously received mail (steps 312, 314, and 316), and the account, identification information, and If any of the domains are different, it is classified as an unfamiliar email, that is, an unfamiliar email predicted to be a hacking email based on social engineering techniques, and stored in the database 102 (step 318).

The second mail processing unit 106 classifies the mail according to the mail information as safe and normal mail if the account, identification information, and domain recorded in the mail sending information (MailFrom) and header information included in the mail information are all the same. It is received, processed, and provided to mail users (step 320).

Referring to FIG. 3, the third mail processing unit 108 of the mail system 100 reads the scheduler information and when a predetermined time arrives (steps 400 and 402), the unfamily predicted as a hacking mail according to social engineering techniques The block list information for the e-mail is output through the administrator terminal, etc. (step 404). After outputting the block list information, the third mail processing unit 108 receives mail information confirmation information according to the results of the administrator's review through the administrator terminal (step 408) and classifies it into hacked mail and normal mail (step 410). ), processing of hacked emails, such as blocking and reporting, is performed (step 414), and normal emails are provided to mail users (step 412).

As mentioned above, the present invention takes advantage of the fact that the account and identification information of the mail system are unique in the mail system, so even if the account or identification information of the mail is impersonated, they cannot all be the same, and any one of the account or identification information of the mail and the domain is used. Even if there is a difference, it is judged to be an unfamiliar email predicted to be a hacking email based on social engineering techniques, thereby restricting emails with a risk of hacking from being delivered to mail users.

Unlike the above, mail that is similar to a previously received mail by a predetermined ratio or more may be judged to be an unfamiliar mail predicted to be a hacked mail based on social engineering techniques, and the society according to the second preferred embodiment of the present invention A method for detecting email attacks based on engineering techniques will be described with reference to FIG. 4. Referring to FIG. 4, the second mail processing unit 106 provides mail information classified as trusted mail by the first mail processing unit 104 based on the SPF policy, permitted email address book, etc. (step 300). , check the mail information (step 502), and check whether it is a new mail that is different from the mail information for previously received mail and any of the account, identification information, and domain (step 504). If the mail according to the mail information is a new mail that is different from the mail information for the previously received mail in any one of the account, identification information, and domain, the second mail processing unit 106 processes the mail for the previously received mail. By comparing the information, previously received mail that is similar to the account and identification information and mail contents of the mail according to the newly provided mail information is detected, and it is checked whether the similarity rate with the detected mail falls within a predetermined range. (Step 508).

If there is mail information among the mail information of the previously received mail that falls within a predetermined range of similarity ratio with the mail information of the newly received mail, the second mail processing unit 106 uses a social engineering technique to send the newly received mail. It is determined to be an unfamiliar email predicted as a hacked email (step 510).

Contrary to the above, if there is no mail information among the mail information of the previously received mail that falls within the range of a predetermined similarity ratio with the mail information of the newly received mail, the mail is considered safe and normal mail even though it is the first mail received. It is judged and provided to the mail user (step 512).

The embodiments of the present invention described above have been disclosed for illustrative purposes, and those skilled in the art will be able to make various modifications, changes, and additions within the spirit and scope of the present invention, and such modifications , changes and additions should be regarded as falling within the scope of this patent claim.

100: Mail system
102: Mail receiver
104: First mail processing unit
106: Second mail processing unit
108: Third mail processing unit

Claims (10)

A mail receiving unit that receives mail sent by the sender's mail system and outputs mail information;
a first mail processing unit that receives mail information from the mail receiver, checks whether the mail is trusted according to the SPF policy, classifies it into trusted mail and untrusted mail, and outputs mail information about the trusted mail;
When mail information for the trusted mail is provided from the first mail processing unit,
First, check whether any of the account, identification information, and domain recorded in the mail sending information of the mail information is different from previously received mails,
If any of the above account, identification information, and domain are different, the email is classified as an unfamiliar email predicted to be a hacked email based on social engineering techniques.
Conversely, if the account, identification information, and domain are all the same, it is secondarily checked to see if any of the account, identification information, and domain recorded in the header information of the mail information is different from previously received mails, and the account and If any of the identification information and domain are different, it is classified as an unfamiliar email predicted to be a hacking email based on social engineering techniques.
a second mail processing unit that classifies the mail as normal if the account, identification information, and domain recorded in the mail sending information and header information of the mail information are all the same; and
Scheduler information is read and block list information for the unfamiliar mail is provided to the administrator terminal at predetermined intervals, and result information classified into hacked mail and normal mail is provided from the administrator terminal for the block list information. , a third mail processing unit that blocks and reports the hacked mail and provides the normal mail to the recipient terminal;
Hacking emails based on the above social engineering techniques are forged into accounts similar to or familiar to previously communicated accounts by abusing human trust.
The second mail processing unit,
When mail information for the trusted mail is provided from the first mail processing unit,
Thirdly, the unfamiliar mail is sent based on whether the content of the mail recorded in the mail information is similar to the content of the mail recorded in the mail information for previously received mail to the extent that it falls within a predetermined range. A mail system that detects mail attacks sent through accounts created using social engineering techniques, which are characterized by identifying mail attacks. In a method of detecting a mail attack in a mail system connected to a network with the sender's mail system, the administrator's terminal, and the recipient's terminal,
The mail system is,
(a) receiving mail sent by the sender's mail system and outputting mail information;
(b) receiving the mail information provided in step (a), checking whether the mail is trusted according to the SPF policy, classifying the trusted mail, and outputting mail information about the trusted mail; and
(c) If mail information for the trusted mail is provided in step (b) above,
First, check whether any of the account, identification information, and domain recorded in the mail sending information of the mail information is different from previously received mails,
If any of the above account, identification information, and domain are different, the email is classified as an unfamiliar email predicted to be a hacked email based on social engineering techniques.
Conversely, if the account, identification information, and domain are all the same, it is secondarily checked to see if any of the account, identification information, and domain recorded in the header information of the mail information is different from previously received mails, and the account and If any of the identification information and domain are different, it is classified as an unfamiliar email predicted to be a hacking email based on social engineering techniques.
classifying the mail as normal if the account, identification information, and domain recorded in the mail sending information and header information of the mail information are all the same; and
(d) Reading the scheduler information and providing block list information for the unfamiliar mail in step (c) to the administrator terminal at a predetermined period, and sending hacking mail and hacking information about the block list information from the administrator terminal. A step of receiving result information classified as normal mail, blocking and reporting the hacked mail, and providing the normal mail to the recipient terminal,
Hacking emails based on the above social engineering techniques are forged into accounts similar to or familiar to previously communicated accounts by abusing human trust.
(e) In step (c) above, if mail information for the trusted mail is provided,
Thirdly, the unfamiliar mail is sent based on whether the content of the mail recorded in the mail information is similar to the content of the mail recorded in the mail information for previously received mail to the extent that it falls within a predetermined range. A method for detecting email attacks sent through an account created using a social engineering technique, further comprising a determination step. delete delete delete delete delete delete delete delete