电子邮件欺骗的检测与识别  

Detection and Identification of Email Spoofing

作　　者：杨光宇 芦雅歌 莫德铭 叶海天 翟继强[1] YANG Guangyu;LU Yage;MO Deming;YE Haitian;ZHAI Jiqiang(School of Computer Science and Technology,Harbin University of Science and Technology,Harbin 150080,China)

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《计算机与网络》2021年第17期57-60,共4页Computer & Network

基　　金：国家级大学生创新创业训练项目(202010214017)。

摘　　要：电子邮件欺骗是最常见的电子邮件攻击类型,其攻击及检测是电子邮件取证研究中一个具有挑战性的问题。提出利用内存取证技术来获取浏览器的实时进程提取电子邮件头进行分析,采用Message-ID检测,结合nslookup查询提取MX记录来检测和识别用户收到的伪造电子邮件。实验测试和分析结果表明,可以有效检测电子邮件欺骗,精度高、误报少,并且不会中断机器的常规操作。Email spoofing is the most common type of email attack, and its attack and detection is a challenging problem in email forensics research. A memory forensics technique is proposed to obtain the real-time process of the browser to extract email headers for analysis. Message-ID detection is used, combined with nslookup query to extract MX records to detect and identify the forged emails received by users. Experimental tests and analysis results show that this method can effectively detect email spoofing with higher accuracy and fewer false positives, and the regular operation of the machine will not be interrupted.

关 键 词：电子邮件欺骗 内存取证 Message-ID MX记录 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]