CN116633670A - Mail sending path and sending IP extraction method based on front edge mail service data - Google Patents

Abstract

The invention discloses a mail sending path and a mail sending IP extraction method based on front edge mail service data, which relate to the field of mail analysis and comprise the steps of S1, acquiring a mail head of a mail to be detected; s2, detecting an origin IP field and a Received field of the mail header; s3, analyzing whether an origin IP field and a Received field exist or not, and if both the origin IP field and the Received field exist, proceeding to S4; if only the originating IP field exists, S5 is entered; if only the Received field exists, proceeding to S6; if none exists, the sending path and the sending IP are empty; s4, analyzing the relation between the source IP field and the Received field, and determining a transmission path and a sender IP; s5, analyzing the related information of the source IP field, determining a sending path and a sender IP, wherein the S6 sending path is a path formed by upward combination of Received fields, and the sender IP is a first non-local area network IP; the sending path and the sending IP can be found and extracted from the mail, and reliable data support is provided for tracing the mail attack behavior; the real mail sending path and the sending IP of the attack mail are identified, and the problem that an attacker falsifies mail sending information is solved.

Description

Mail sending path and sending IP extraction method based on frontier postal service data

technical field

The invention relates to the field of mail analysis, in particular to a method for extracting mail sending paths and sending IPs based on frontier postal service data.

Background technique

The mail system is one of the important means of communication produced by the development of modern enterprise information technology. Enterprises can build their own mail system by building a mail server to provide email communication services to internal employees and external customers. E-mail can transmit a variety of information, including text, pictures, HTML, audio and so on. And can send email through mail client proxy. A characteristic of e-mail is that the act of sending is independent of the act of receiving. Therefore, even if the recipient is offline, the email can still be sent to the recipient's email server and cached, waiting for the recipient to read the letter from it. In network attacks, phishing emails are the mainstream attack methods. There are endless ways to forge and modify the content and key fields of emails, which undoubtedly increases the difficulty of analyzing email-type cyber attacks.

Contents of the invention

The object of the present invention is to design a method for extracting mail sending path and sending IP based on frontier postal service data in order to solve the above problems.

The present invention achieves the above object through the following technical solutions:

Email sending path and sending IP extraction method based on frontier postal service data, including:

S1. Obtain the mail header of the mail to be tested;

S2, detecting the source IP field and the Received field of the mail header;

S3, analyze whether the source IP field and the Received field exist, if both exist, enter S4; if only the source IP field exists, then enter S5; if only the Received field exists, then enter S6; if neither exist, send the path and sender IP are empty;

S4. Analyze the relationship between the source IP field and the Received field to determine the sending path and sending IP;

S5. Analyzing the relevant information of the source IP field to determine the sending path and sending IP;

S6. The sending path is a path formed by upward combination of Received fields, and the sending IP is the first non-local area network IP.

The beneficial effect of the present invention is that: the method can discover and extract the real mail sending path and sending IP from the mail, and provide reliable data support for tracing the source of mail attack behavior; identify the real mail sending path and sender of the attack mail IP, to solve the problem of attackers forging email sending information.

Description of drawings

Fig. 1 is a schematic flowchart of the mail sending path and sending IP extraction method based on frontier postal service data in the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, embodiments of the present invention. The components of the embodiments of the invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations.

Accordingly, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.

In the description of the present invention, it should be understood that the orientations or positional relationships indicated by the terms "upper", "lower", "inner", "outer", "left", "right" etc. are based on those shown in the accompanying drawings. Orientation or positional relationship, or the orientation or positional relationship that is usually placed when the product of the invention is used, or the orientation or positional relationship that is commonly understood by those skilled in the art, is only for the convenience of describing the present invention and simplifying the description, rather than indicating or It should not be construed as limiting the invention by implying that a referenced device or element must have a particular orientation, be constructed, and operate in a particular orientation.

In addition, the terms "first", "second", etc. are only used for distinguishing descriptions, and should not be construed as indicating or implying relative importance.

In the description of the present invention, it should also be noted that, unless otherwise specified and limited, terms such as "setting" and "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection or a Detachable connection, or integral connection; it can be mechanical connection or electrical connection; it can be direct connection or indirect connection through an intermediary, and it can be the internal communication of two components. Those of ordinary skill in the art can understand the specific meanings of the above terms in the present invention according to specific situations.

The specific implementation manners of the present invention will be described in detail below in conjunction with the accompanying drawings.

As shown in Figure 1, the mail sending path and sending IP extraction method based on the frontier postal service data include:

S1. Obtain the mail header of the mail to be tested.

S2. Detect the source IP field and Received field of the mail header. When detecting the Received field, the Received field is the combination of Received at the bottom of the mail header. If there is an IP in the fromby, the resolved IP will be displayed; if there is no IP, the email address or server address will be displayed. .

S3, analyze whether the source IP field and the Received field exist, if both exist, enter S4; if only the source IP field exists, then enter S5; if only the Received field exists, then enter S6; if neither exist, send the path and sender IP are all empty.

S4. Analyze the relationship between the source IP field and the Received field to determine the sending path and sending IP; specifically:

S41, analyze whether the source IP field exists in the Received field, if it exists, then the sending path is the path formed by the upward combination of the Received field, then enter S42, otherwise the sending path is the upward combination of the Received field and the source IP access to the first before the combined public network IP, and enter S44;

S42, analyze whether the source IP is a public network IP, if so, then enter S43, otherwise the sending IP is the first public network IP in the sending path;

S43, analyzing whether the source IP is a single IP, if so, the sending IP is equal to the source IP; otherwise, the sending IP is the first source IP;

S44, analyze whether the source IP is a public network IP, if so, then enter S45, otherwise the sending IP is the first public network IP in the mail address;

S45. Analyze whether the originating IP is a single IP, if yes, then the sending IP is the originating IP; otherwise, the sending IP is the first originating IP.

S5. Analyze the relevant information of the source IP field to determine the sending path and sending IP; specifically:

S51. Analyzing the relevant information of the source IP field is specifically analyzing whether the source IP is a public network IP, and if so, proceeding to S52; otherwise, the sending IP is empty, and the sending path is the source IP;

S52. Analyze whether the originating IP is a single IP, if so, the sending IP is the originating IP, and the sending path is the originating IP; otherwise, the sending IP is the first originating IP, and the sending path is the first originating IP -> the second source IP.

S6. The sending path is a path formed by upward combination of Received fields, and the sending IP is the first non-local area network IP.

When the Received field is combined upwards to form a path, all source IPs are displayed in the order of IP1->IP2. The originating IP field includes X-Originating-IP, X-Sender-IP, X-SenderIP, X-SentIP, senderIP, X-EMDG-ORIGINAL-IP.

This method can discover and extract the real mail sending path and sending IP from the mail, and provide reliable data support for tracing the source of mail attack behavior; identify the real mail sending path and sending IP of the attack mail, and solve the problem of attackers forging mail Problem sending information.

The technical solution of the present invention is not limited to the limitations of the above-mentioned specific embodiments, and any technical deformation made according to the technical solution of the present invention falls within the protection scope of the present invention.

Claims (4)

1. The mail sending path and the sending IP extraction method based on the front mail service data are characterized by comprising the following steps:

s1, acquiring a mail header of a mail to be tested;

s2, detecting an origin IP field and a Received field of the mail header;

s3, analyzing whether an origin IP field and a Received field exist or not, and entering S4 if both the origin IP field and the Received field exist; if only the originating IP field exists, then S5 is entered; if only the Received field exists, entering S6; if none exists, the sending path and the sending IP are empty;

s4, analyzing the relation between the source IP field and the Received field, and determining a transmission path and a sender IP;

s5, analyzing the related information of the origin IP field, and determining a transmission path and a transmission IP;

s6, the sending path is a path formed by upward combination of Received fields, and the sender IP is a first non-local area network IP.

2. The mail sending path and the sender IP extraction method based on the front edge mail service data according to claim 1, wherein when the Received field is detected, the Received field is the last Received of the mail header, and IP in from by is displayed and resolved, and mailbox address or server address is displayed without IP.

3. The mail transmission path and the delivery IP extraction method based on the front edge mail service data as set forth in claim 1, comprising in S4:

s41, analyzing whether an origin IP field exists in a Received field, if so, entering S42 if a transmission path is a path formed by upward combination of the Received field, otherwise, entering S44 if the transmission path is upward combination of the Received field and the origin IP before the first combined public network IP is accessed;

s42, analyzing whether the origin IP is a public network IP, if so, entering S43, otherwise, the sender IP is the first public network IP in the sending path;

s43, analyzing whether the origin IP is single IP, if so, enabling the sender IP to be equal to the origin IP; otherwise, the sender IP is the first origin IP;

s44, analyzing whether the origin IP is a public network IP, if so, entering S45, otherwise, sending the IP to be the first public network IP in the mail address;

s45, analyzing whether the originating IP is single IP, if so, the originating IP is the originating IP; otherwise, the sender IP is the first origin IP.

4. The mail transmission path and the delivery IP extraction method based on the front edge mail service data as set forth in claim 1, comprising in S5:

s51, analyzing whether the source IP is a public network IP or not according to the related information of the source IP field, if so, entering S52; otherwise, the sender IP is empty, and the sending path is the origin IP;

s52, analyzing whether the originating IP is single IP, if so, the originating IP is the originating IP, and the sending path is the originating IP; and otherwise, the sender IP is the first origin IP, and the sending path is the first origin IP- > the second origin IP.