CN116566939A - A mail processing method, device, storage medium and electronic equipment - Google Patents

Abstract

The present invention provides a mail processing method, device, storage medium and electronic equipment. The mail processing method includes: obtaining unique identification information of a predetermined mail; detecting whether there is an antivirus scanning record corresponding to the unique identification information in a predetermined address database; If the antivirus scan record exists, determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined mail; process according to the execution policy corresponding to the antivirus scan result The scheduled mail. The above email processing method can eliminate the need to perform virus scanning on all emails when the gateway device receives a large number of emails at the same time, which improves the scanning speed of the email virus when the gateway device encounters mass emails, and can reduce repeated scanning of the same email by the gateway equipment. The waste of performance resources caused by emails is eliminated, and the user experience is optimized.

Description

A mail processing method, device, storage medium and electronic equipment

technical field

The invention relates to the technical field of mail processing, in particular to a mail processing method, device, storage medium and electronic equipment.

Background technique

Electronic mail (abbreviated as E-Mail) is a communication method for sending and receiving mail between network or Internet users, usually using one of the three main Internet mail standards (POP3, SMTP, IMAP) to send and receive e-mail. When a computer user browses emails or downloads email attachments, various types of viruses may also be hidden in emails, which will be downloaded to the user's local computer with the user's operation, causing the user's computer to be infected by viruses, so it is very important to do a good job of virus protection important.

The current filtering gateway device (or firewall device) mainly supports the above three protocols in the email virus protection function. There is a proxy engine mode in the gateway device, which can act as an intermediate server to restore and scan each incoming and outgoing email. If a virus is found in a certain email, it will perform operations such as clearing or intercepting it, so that the user client cannot download files containing Virus attachments.

When a user uses a mail client to receive mail, such as using the POP3 protocol, the data packet fragments pass through the gateway device. The gateway device will collect all the packet fragments of this email, restore the file, and store it in the device. Then the next step of virus scanning is carried out. After the virus scanning is completed, if the email does not have virus characteristics, it will be forwarded directly, and the user will normally receive the email. If there are virus characteristics in the email, according to the policy on the device, the content of the email will be cleared or intercepted, and then the data will be forwarded. The email seen by the client is the modified email content of the device.

When each email passes through the gateway device, the gateway device will go through the same process, that is, data sending and receiving, email restoration, virus signature comparison, etc. When there is mass mailing, multiple users jointly receive mails, which will cause the gateway device to process a large amount of mails at this point in time, and it is likely that the performance of the device is insufficient, so that the mail forwarding is too slow or affects the detection of other modules. It is reflected in the situation that the client will receive emails too slowly or the network environment will be fluctuated, and the user experience will be poor.

Contents of the invention

In view of this, the embodiment of the present invention proposes an email processing method, device, storage medium, and electronic equipment to solve the following problems in the prior art: when the existing gateway equipment receives a large number of emails at the same time, it needs to process All emails are scanned for viruses. The scanning process will take up a lot of performance of the gateway device, resulting in insufficient performance of the gateway device. The client will receive emails too slowly or the network environment will fluctuate, and the user experience will be poor.

An embodiment of the present invention provides a mail processing method, including:

Obtain unique identification information for scheduled mail;

Detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database;

If the antivirus scan record exists, determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined email;

The predetermined email is processed according to the execution policy corresponding to the antivirus scanning result.

In some embodiments, after detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database, the method further includes:

In the absence of the unique identification information, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result;

An antivirus scan record is generated according to the antivirus scan result and the unique identification information of the predetermined email, and the antivirus scan record is stored in the predetermined address database.

In some embodiments, the processing of the predetermined email according to the execution policy corresponding to the antivirus scanning result specifically includes:

If the antivirus scanning result shows that there is a virus, process the predetermined email according to a predetermined antivirus strategy;

If the result of the antivirus scanning is that there is no virus, the predetermined email is forwarded to the target address.

In some embodiments, the detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database specifically includes:

Detecting whether the same unique identification information as the unique identification information exists in the predetermined address database.

An embodiment of the present invention also provides a mail processing device, including:

an obtaining module configured to obtain unique identification information of scheduled mail;

A detection module configured to detect whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database;

A determining module, configured to determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined email if the antivirus scan record exists;

A processing module configured to process the predetermined email according to the execution policy corresponding to the antivirus scanning result.

In some embodiments, the processing module is further configured to, after detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database,

In the absence of the unique identification information, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result;

An antivirus scan record is generated according to the antivirus scan result and the unique identification information of the predetermined email, and the antivirus scan record is stored in the predetermined address database.

In some embodiments, the processing module is further configured to process the predetermined email according to a predetermined antivirus strategy if the antivirus scanning result shows that it has a virus;

If the result of the antivirus scanning is that there is no virus, the predetermined email is forwarded to the target address.

In some embodiments, the detection module is further configured to detect whether unique identification information identical to the unique identification information exists in the predetermined address database.

An embodiment of the present invention also provides a storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the above mail processing method are realized.

An embodiment of the present invention also provides an electronic device, including at least a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above mail processing method when executing the computer program on the memory .

Compared with the prior art, the beneficial effect of the embodiment of the present invention is that: by obtaining the unique identification information of the scheduled mail, it is detected whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database, and if it exists, the corresponding antivirus The scanning record is determined to be the antivirus scanning result of the scheduled emails, so that when the gateway device receives a large number of emails at the same time, it is not necessary to perform virus scanning on all emails separately, which solves the antivirus of emails when receiving multiple emails at the same time in the prior art The technical problem of insufficient device performance caused by scanning has improved the scanning speed of email viruses when the gateway device encounters mass emails, and can reduce the waste of performance resources caused by repeated scanning of the same email by the device, optimizing the user experience.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments described in the present disclosure. Those skilled in the art can also obtain other drawings based on these drawings without any creative effort.

Fig. 1 is the flowchart of the mail processing method of the first embodiment of the present invention;

Fig. 2 is the flowchart of the mail processing method of the second embodiment of the present invention;

Fig. 3 is the flowchart of the mail processing method of the third embodiment of the present invention;

Fig. 4 is a structural block diagram of a mail processing device according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiments of the present invention. Apparently, the described embodiments are some, not all, embodiments of the present invention. Based on the described embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Unless otherwise defined, the technical terms or scientific terms used in the present invention shall have the usual meanings understood by those skilled in the art to which the present invention belongs. "First", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Comprising" or "comprising" and similar words mean that the elements or items appearing before the word include the elements or items listed after the word and their equivalents, without excluding other elements or items. Words such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "Down", "Left", "Right" and so on are only used to indicate the relative positional relationship. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

To keep the following description of the embodiments of the present invention clear and concise, detailed descriptions of known functions and known components are omitted from the present invention.

An embodiment of the present invention provides a mail processing method, and the mail processing method can be applied to an electronic device including a gateway device. Electronic devices may refer to different electronic devices such as smart phones, tablet computers, notebook computers, and personal computers. The present invention does not limit the specific types of electronic devices, as long as they can receive and process emails.

As shown in FIG. 1 , the mail processing method includes steps S101 to S104.

Step S101: Obtain the unique identification information of the scheduled email.

Specifically, the unique identification information of the above scheduled mail can be understood as Message-id, and the Message-id header is a field defined in RFC 2822 that contains a unique message identifier. Insufficient performance on virus scanning. It should be noted that in the email header information, "Message-id" is a unique tag assigned to emails by the email system, which will not change during email transmission, and at least includes information such as identification numbers, symbols, and host names. In addition, the above "Message-id" contains the sender's e-mail address.

Specifically, the above-mentioned predetermined mail can enter the device through the POP3 protocol or the IMAP protocol.

Step S102: Detect whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database.

Specifically, the aforementioned predetermined address data can be understood as a database related to the Message-id, in which the Message-id and its corresponding mark are stored, and the mark can be a non-virus mark or a virus mark. Antivirus scan records can be used to record the Message-ids of scanned emails without virus signatures and with virus signatures.

Specifically, a display block for virus scanning according to the unique identification information may be presented on the display interface of the electronic device adopting the above-mentioned mail processing method. Step S102 above.

Specifically, the aforementioned predetermined address database may be built into an electronic device adopting the aforementioned mail processing method, so as to execute the aforementioned mail processing method.

Step S103: If the antivirus scan record exists, determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined email.

The above-mentioned method of determining the antivirus scanning result of the preset email through the antivirus scanning records in the database can quickly determine whether the preset email contains a virus without performing antivirus scanning on the preset email, and effectively improves the protection against email viruses. scan speed.

Specifically, the antivirus scanning record may determine that the preset email is an antivirus scanning result of a virus email, or may determine that the preset email is an antivirus scanning result of a non-virus email.

Specifically, if there is an anti-virus scanning record corresponding to the unique identification information, it indicates that the mail with the same unique identification information as the preset mail has been scanned and killed. Corresponding anti-virus scanning records, and then determine whether the predetermined email is a virus email according to the anti-virus scanning records.

Step S104: Process the predetermined email according to the execution policy corresponding to the antivirus scanning result.

Specifically, the above execution strategy corresponds to the antivirus scanning result, and the execution strategy at least includes a strategy corresponding to the antivirus scanning result that the predetermined email is a virus email, and a strategy corresponding to the antivirus scanning result that the predetermined email is a non-virus email.

By obtaining the unique identification information of the scheduled mail, it is detected whether there is an anti-virus scanning record corresponding to the unique identification information in the predetermined address database, and if it exists, the corresponding anti-virus scanning record is determined as the anti-virus scanning result of the scheduled mail. In this way, in the gateway device When a large number of emails are received at the same time, there is no need to perform virus scanning on all emails separately, which solves the technical problem of insufficient equipment performance caused by the antivirus scanning of emails in the prior art when multiple emails are received at the same time, and improves the gateway equipment. The scanning speed of email viruses when sending emails in groups can reduce the waste of performance resources caused by repeated scanning of the same email by the device, and optimize the user experience.

In some embodiments, as shown in FIG. 2 , after detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database in step S102 , step S201 and step S202 are further included.

Step S201: If the unique identification information does not exist, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result.

Step S202: Generate an antivirus scan record according to the antivirus scan result and the unique identification information of the predetermined email, and store the antivirus scan record in the predetermined address database.

In some optional embodiments, as shown in FIG. 3 , the above step S202 specifically includes steps S301 to S303.

Step S301: judging whether the predetermined email has a virus according to the antivirus scanning result in step S201;

Step S302: If yes, store the unique identification information of the scheduled mail in the database, and set a virus flag on the unique identification information;

Step S303: If not, store the unique identification information of the scheduled email into the database, and set a non-virus flag on the unique identification information.

In some embodiments, as shown in FIG. 3 , the step S104 of processing the predetermined email according to the execution policy corresponding to the antivirus scanning result specifically includes steps S401 and S402 .

Step S401: in the case that the antivirus scanning result shows that there is a virus, process the predetermined email according to a predetermined antivirus policy.

Step S402: If the antivirus scanning result shows that there is no virus, forward the predetermined email to the target address.

Specifically, processing the scheduled mail according to the predetermined antivirus policy in the above step S104 can be understood as processing the scheduled mail in one or more of the following ways: recording and deleting virus files in the log, and intercepting the mail.

Specifically, the above-mentioned forwarding of the scheduled email to the target address can be understood as directly releasing the scheduled email and storing it in the corresponding target address, so as to facilitate the user's reference.

Specifically, after step S302 is executed, step S401 of processing the predetermined email according to a predetermined antivirus policy may be executed.

Specifically, step S402 of forwarding the predetermined email to the target address may be performed after step S303 is performed.

In some embodiments, the step S102 of detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database specifically includes: detecting whether the same unique identification information as the unique identification information exists in the predetermined address database.

In this way, the detection accuracy of detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database can be increased, thereby increasing the accuracy of judging whether the email is a virus.

The embodiment of the present invention also provides a mail processing device 110 . As shown in FIG. 4 , the mail processing apparatus 110 includes an acquisition module 101 , a detection module 102 , a determination module 103 and a processing module 104 . The obtaining module 101 is configured to obtain the unique identification information of the scheduled mail. The detecting module 102 is configured to detect whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database. The determining module 103 is configured to determine the antivirus scanning result corresponding to the antivirus scanning record in the predetermined address database as the antivirus scanning result of the predetermined email if the antivirus scanning record exists. The processing module 104 is configured to process the predetermined email according to the execution policy corresponding to the antivirus scanning result.

Specifically, the unique identification information of the above scheduled mail can be understood as Message-id, and the Message-id header is a field defined in RFC 2822 that contains a unique message identifier. Insufficient performance on virus scanning. It should be noted that in the email header information, "Message-id" is a unique tag assigned to emails by the email system, which will not change during email transmission, and at least includes information such as identification numbers, symbols, and host names. In addition, the above "Message-id" contains the sender's e-mail address.

Specifically, the above-mentioned predetermined mail can enter the device through the POP3 protocol or the IMAP protocol.

Specifically, the aforementioned predetermined address data can be understood as a database related to the Message-id, in which the Message-id and its corresponding mark are stored, and the mark can be a non-virus mark or a virus mark. Antivirus scan records can be used to record the Message-ids of scanned emails without virus signatures and with virus signatures.

Specifically, a display block for virus scanning according to the unique identification information may be presented on the display interface of the electronic device adopting the above-mentioned mail processing method. The above-mentioned step of detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database.

Specifically, the aforementioned predetermined address database may be built into an electronic device adopting the aforementioned mail processing method, so as to execute the aforementioned mail processing method.

Specifically, the antivirus scanning record may determine that the preset email is an antivirus scanning result of a virus email, or may determine that the preset email is an antivirus scanning result of a non-virus email.

Specifically, if there is an anti-virus scanning record corresponding to the unique identification information, it indicates that the mail with the same unique identification information as the preset mail has been scanned and killed. Corresponding anti-virus scanning records, and then determine whether the predetermined email is a virus email according to the anti-virus scanning records.

Specifically, the above execution strategy corresponds to the antivirus scanning result, and the execution strategy at least includes a strategy corresponding to the antivirus scanning result that the predetermined email is a virus email, and a strategy corresponding to the antivirus scanning result that the predetermined email is a non-virus email.

In this way, the above-mentioned mail processing device 110 obtains the unique identification information of the scheduled mail, detects whether there is an anti-virus scanning record corresponding to the unique identification information in the predetermined address database, and if it exists, determines the corresponding anti-virus scanning record as the anti-virus scanning of the scheduled mail. As a result, in this way, when the gateway device receives a large number of mails at the same time, it is not necessary to perform virus scanning on all mails separately, which solves the technical problem of insufficient equipment performance caused by the antivirus scanning of mails when receiving multiple mails at the same time in the prior art , which improves the scanning speed of email viruses when the gateway device encounters mass emails, and can reduce the waste of performance resources caused by repeated scanning of the same email by the device, and optimize the user experience.

In some embodiments, the processing module 104 is further configured to, after detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database,

In the absence of the unique identification information, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result;

An antivirus scan record is generated according to the antivirus scan result and the unique identification information of the predetermined email, and the antivirus scan record is stored in the predetermined address database.

In some embodiments, the processing module 104 is further configured to: judge whether the predetermined mail has a virus according to the antivirus scanning result; if so, store the unique identification information of the predetermined mail into the database, and set the virus mark; if not, store the unique identification information of the scheduled mail into the database, and set a non-virus mark on the unique identification information.

In some embodiments, the processing module 104 is further configured to process the predetermined email according to a predetermined antivirus strategy if the antivirus scanning result shows that it has a virus;

If the result of the antivirus scanning is that there is no virus, the predetermined email is forwarded to the target address.

Specifically, the above-mentioned forwarding of the scheduled email to the target address can be understood as directly releasing the scheduled email and storing it in the corresponding target address, so as to facilitate the user's reference.

In some embodiments, the detection module 102 is further configured to detect whether unique identification information identical to the unique identification information exists in the predetermined address database. In this way, the detection accuracy of detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database can be increased, thereby increasing the accuracy of judging whether the email is a virus.

An embodiment of the present invention also provides a storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the above mail processing method are implemented.

An embodiment of the present invention also provides an electronic device, including at least a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above mail processing method when executing the computer program on the memory .

Optionally, in this embodiment, the above-mentioned storage medium may include but not limited to: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk Various media that can store program codes such as discs or optical discs. Optionally, in this embodiment, the processor executes the method steps described in the foregoing embodiments according to the program code stored in the storage medium. Optionally, for specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and optional implementation manners, and details are not repeated in this embodiment. Obviously, those skilled in the art should understand that each module or each step of the present invention described above can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

Furthermore, while exemplary embodiments have been described herein, the scope includes any and all implementations based on the present invention having equivalent elements, modifications, omissions, combinations (eg, crossover aspects of various embodiments), adaptations, or changes example. Elements in the claims are to be interpreted broadly based on the language employed in the claims and are not limited to examples described in this specification or during the practice of the application, which examples are to be construed as non-exclusive. It is therefore intended that the specification and examples be considered as illustrations only, with a true scope and spirit being indicated by the following claims, along with their full scope of equivalents.

The above description is intended to be illustrative rather than restrictive. For example, the above examples (or one or more aspects thereof) may be used in combination with each other. For example, other embodiments may be used by those of ordinary skill in the art upon reading the above description. Additionally, in the foregoing Detailed Description, various features may be grouped together in order to simplify the present invention. This is not to be interpreted as intending that an unclaimed disclosed feature is essential to any claim. Rather, inventive subject matter may lie in less than all features of a particular disclosed embodiment. Thus, the following claims are hereby incorporated into the detailed description as examples or embodiments, where each claim stands on its own as a separate embodiment, and it is contemplated that these embodiments may be combined with each other in various combinations or permutations. The scope of the invention should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Multiple embodiments of the present invention have been described in detail above, but the present invention is not limited to these specific embodiments. Those skilled in the art can make various variations and modifications on the basis of the concept of the present invention. These variations and modifications All should fall within the scope of protection required by the present invention.

Claims (10)

1. A mail processing method, characterized in that, comprising: Obtain unique identification information for scheduled mail; Detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database; If the antivirus scan record exists, determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined email; The predetermined email is processed according to the execution policy corresponding to the antivirus scanning result. 2. The mail processing method according to claim 1, further comprising: In the absence of the unique identification information, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result; An antivirus scan record is generated according to the antivirus scan result and the unique identification information of the predetermined email, and the antivirus scan record is stored in the predetermined address database. 3. The mail processing method according to claim 1, wherein the processing of the predetermined mail according to the execution policy corresponding to the antivirus scanning result specifically comprises: If the antivirus scanning result shows that there is a virus, process the predetermined email according to a predetermined antivirus strategy; If the result of the antivirus scanning is that there is no virus, the predetermined email is forwarded to the target address. 4. The mail processing method according to any one of claims 1 to 3, wherein the detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database specifically includes: Detecting whether the same unique identification information as the unique identification information exists in the predetermined address database. 5. A mail processing device, characterized in that, comprising: an obtaining module configured to obtain unique identification information of scheduled mail; A detection module configured to detect whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database; A determining module, configured to determine the antivirus scan result corresponding to the antivirus scan record in the predetermined address database as the antivirus scan result of the predetermined email if the antivirus scan record exists; A processing module configured to process the predetermined email according to the execution policy corresponding to the antivirus scanning result. 6. The mail processing device according to claim 5, wherein the processing module is further configured to, after detecting whether there is an antivirus scanning record corresponding to the unique identification information in the predetermined address database, In the absence of the unique identification information, perform a predetermined antivirus scanning operation on the predetermined email, and record the antivirus scanning result; An antivirus scan record is generated according to the antivirus scan result and the unique identification information of the predetermined email, and the antivirus scan record is stored in the predetermined address database. 7. The mail processing device according to claim 5, wherein the processing module is further configured to process the predetermined mail according to a predetermined anti-virus strategy when the anti-virus scanning result shows that there is a virus; If the result of the antivirus scanning is that there is no virus, the predetermined email is forwarded to the target address. 8. The mail processing device according to any one of claims 5 to 7, wherein the detection module is further configured to detect whether there is unique identification information identical to the unique identification information in the predetermined address database. 9. A storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the mail processing method according to any one of claims 1 to 4 are realized. 10. An electronic device, comprising at least a memory and a processor, and a computer program is stored on the memory, wherein the processor implements any one of claims 1 to 4 when executing the computer program on the memory. The steps of the mail processing method described in the item.