Patent ID: 9740858
Date: 2017-08-22
CPC Classifications: G06F

Claim:
1. A method of detecting forged emails, the method comprising: receiving a sender email in a first computer, the sender email being addressed to a user of a private computer network; extracting a plurality of email address parts from a sender email address of the sender email; determining a first mutation ratio of a first email address part of the sender email address relative to a first reference string, the first mutation ratio being a measure of a degree of similarity of the first email address part to the first reference string; comparing the first mutation ratio to a first ratio threshold; when the first mutation ratio indicates that the first email address part is not identical to the first reference string and the first mutation ratio is above the first ratio threshold, identifying the sender email address as a suspicious email address based on a result of comparing the first mutation ratio to the first ratio threshold; when the first mutation ratio indicates that the first email address part is not identical to the first reference string and the first mutation ratio is below the first ratio threshold, identifying the sender email as a normal email that is allowed into the private computer network, and after deeming the sender email address to be the suspicious email address, consulting a first computer security server to obtain a computer security information that identifies the sender email as a forged email.