Riba:
- Ikon bincika imel ɗin da ake tuhuma a cikin yadudduka uku (abun ciki / injiniyan zamantakewa, URL / tsarin haɗe-haɗe, masu kai da SPF / DKIM / DMARC) tare da tallafin bayanan ɗan adam
- Ikon amfani da horo na nazarin hanyoyin haɗin kai a cikin tsarin rayuwa ba tare da danna su ba da kuma tabbatar da shawarar 'phishing / aminci' na AI tare da take, sunan yanki da mahallin.
- Ikon gane cewa basirar wucin gadi ba ta san mahallin cibiyar ba kuma yana iya yin kuskuren sahihan imel ɗin don phishing (ƙarya mai kyau) kuma yanke shawarar toshe shi azaman manazarci.
Yawancin hare-hare suna farawa daga yaudarar mutum, ba daga raunin fasaha ba. Fishing hari ne na injiniyanci na zamantakewa wanda ke ƙoƙarin yaudarar wanda aka azabtar don samun kalmomin shiga, bayanan katin, ko dannawa ta hanyar yaudarar wanda aka azabtar da imel, saƙo, ko gidan yanar gizo na karya. Wani ma'aikaci da ya faɗi don "ba za a iya isar da jigilar ku ba, danna nan" saƙon ko "General Manager yana buƙatar canja wuri na gaggawa" zai ƙetare ko da mafi girman bangon wuta. Shi ya sa nazarin saƙon imel ɗin da ake tuhuma cikin sauri da daidai shine abincin yau da kullun na ƙungiyar tsaro.
Hankali na wucin gadi yana da ƙarfi sosai a cikin binciken phishing saboda phishing, a ainihinsa, matsala ce ta harshe da tsari. AI na iya karkatar da sautin imel, matsa lamba na gaggawa, nahawu quirks, kwaikwayi tambarin karya, da tsarin hanyar haɗin yanar gizo da ake tuhuma cikin daƙiƙa; zai iya bayyana dalilin da yasa URL ke yaudara; Yana iya nuna rashin daidaituwa a cikin rubutun imel. Amma AI ba zai iya (kuma bai kamata) tabbatarwa ta danna cewa hanyar haɗin yanar gizo ba ce da gaske, kuma ba za ta iya yanke hukunci na ƙarshe cewa imel ɗin karya ne a cikin mahallin kamfani ba. AI yana nazarin phishing kuma yana tabbatar da zato; Manazarci ya yanke shawara "wannan shine phishing, toshe/share" da kuma sanarwa ga mai amfani.
Abin da ake nema a cikin imel ɗin phishing
Lokacin bincika imel ɗin da ake tuhuma, ana duba yadudduka uku, kuma AI yana taimakawa kowane Layer:
- Abun ciki da injiniyan zamantakewa. Matsi na gaggawa ("nan da nan", "za a rufe asusun ku"), ɓata ikon ("babban manajan", "Sashen IT"), tsoro / lada, kurakurai na nahawu, rashin keɓancewa. AI yana ƙaddamar da sautin da dabarun lallashi da kyau.
- Fasaha Manuniya - mahada da abin da aka makala. Bambanci tsakanin rubutun da aka nuna da URL na ainihi, sunan yanki na karya tare da haruffa iri ɗaya (typosquatting; misali paypa1.com), gajeriyar URL, abubuwan da aka makala fayil ɗin (.html, .iso, Fayilolin Office mai ɗauke da macros). AI yana nazarin tsarin URL.
- Maganganun imel. Sunan yanki na ainihi na mai aikawa, sakamakon tabbatarwa na SPF/DKIM/DMRC (hanyoyin tantancewa guda uku waɗanda ke tabbatar da imel ɗin sun fito da gaske daga yankin da yake iƙirarin zama), rashin daidaiton hanyar uwar garke. AI yana taƙaita lakabi da tutoci marasa daidaituwa.
Muhimmin ƙa'idar tsaro: Kada a taɓa danna hanyoyin haɗin yanar gizo masu tuhuma akan tsarin rayuwa. Ana yin nazarin URL ta hanyar rubutu, a cikin keɓe (akwatin sandbox) idan ya cancanta. Samun AI ta nazarin URL ba "ziyartar" shi bane; amma kar a ɗauka AI shima zai iya shiga wannan rukunin yanar gizon - binciken ya dogara ne akan tsari da kuma sanannen hankali na barazanar.
Dashboard na phishing
Layer
alamar shakka
Gudunmawar AI
iyaka
Abun ciki
Gaggawa, iko, matsa lamba na tsoro
Tone da lallashi fasaha bincike
Bai san mahallin ba
Wanda aka buga
Kwaikwayo na yanki, sunan da bai dace ba
Gano kamanni/ganewar typosquat
Bai gane cibiyar ba
URL
Bayyana ≠ na gaske, yanki da aka kwaikwayi
Binciken tsari, bayani
Ba za a iya danna da tabbatarwa ba
Annex
Hatsari mai haɗari, macro
Ƙimar haɗari / nau'in haɗari
Ba za a iya gudanar da fayil ɗin ba
Take
SPF/DKIM/DMRC sun kasa
Takaitacciyar taken, rashin daidaito
Tabbatar da sakamakon
Magana
roƙon da ba zato ba tsammani
yana haifar da tambayoyi
Matakin yana hannun manazarci
uku mini lokuta
Case 1 - Bincike a cikin dakika 30. Mai amfani ya sami "daga bankin ku: an daskarar da asusun ku, tabbatar" imel ɗin da ake tuhuma kuma ya tura shi ga ƙungiyar tsaro. Manazarci yana ba da imel (masanya bayanan sirri) ga AI. AI ta taƙaita cikin daƙiƙa 30: Sunan yankin mai aikawa shine guvenli-banka-tr.info (ba ainihin yankin banki ba), URL ɗin tabbas bankin ne amma ainihin manufa wani yanki ne na daban, tabbacin DKIM ya gaza, harshe yana matsa lamba akan gaggawa. Manazarcin da kansa ya tabbatar da waɗannan alamomin a cikin taken da URL, ya bayyana saƙon imel, kuma ya toshe duk ƙungiyar. AI ya haɓaka bincike; Manazarcin ya yanke shawarar.
Shari'a 2 - Kuskuren saƙon imel na halal don phishing (ƙarya mai inganci). AI yana aika imel a matsayin "mai tuhuma, mai yiwuwa phishing: ya samo asali daga wani yanki na waje kuma ya ƙunshi hanyar haɗi." Manazarci yana bincika mahallin: imel ɗin ya fito ne daga ainihin mai ba da software na HR na ƙungiyar, SPF/DKIM/DMRC duk suna da inganci, kuma mai ba da sabis ɗin ya kasance shekaru da yawa. AI ta tuƙi saƙon imel na halal saboda bai san mahallin ba. Manazarci yana gyara madaidaicin karya. Darasi: Alamar “phishing” ta AI hasashe ce; Ba tare da tabbatar da take da mahallin hukuma ba, ba ya zama yanke shawara.
Shari'a 3 - Shawarar "lafiya" ta yanke shawara. Wani manazarci ya ba AI URL kuma ya tambaya "Shin wannan lafiya?" Ya tambaya. AI ta ce "eh, wannan yanki ne sananne kuma amintacce." Amma AI ba a zahiri ya kalli wannan rukunin yanar gizon ba; Sunan yankin sabon rajista ne mai rijista ba tare da suna ba, kuma samfurin ya samar da amsa mai kyau saboda yana tunanin yana da "amfani" don ba da amana. Manazarci da kansa yana bincika kwanan rajista da sabis na suna na yankin suna kuma yana ganin haɗarin. Darasi: Kawai saboda AI ta ce "lafiya" ba shaida ba ce; Ana tabbatar da sunan yankin ta shekaru, suna da bayanan take.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rawanin faɗakarwa:
Shin wannan imel ɗin phishing ne, gaya mani ee/a'a: [email]
This prompt asks the AI for a direct decision (yes/no), it does not ask for justification or evidence, it does not question the possibility of a false positive. Amsar kalma ɗaya ta AI na iya zama mai ruɗi kuma ƙila bayanan sirri sun ɓace.
Ƙarfi mai ƙarfi:
Matsayinku: Mataimaki ga SOC manazarci yana shirya DRAFT na bincike na phishing. Yanke shawara; Kar a ce "wasu phishing ne, share shi". Bincika waɗannan imel ɗin da ba a san su ba a cikin matakai uku: (1) abun ciki / siginonin injiniya na zamantakewa (gaggawa, iko, tsoro, harshe), (2) Tsarin URL - bambanci tsakanin bayyane da ainihin manufa, typosquat, kwaikwaya; amma kar a ɗauka cewa kun ziyarci kowace hanyar haɗin yanar gizo, (3) masu kai sun haɗa da SPF/DKIM/DMRC da rashin daidaituwar mai aikawa - alama sakamakon a matsayin "[tabbatar a cikin taken]". Bayyana yadda ƙarfin shaida yake ga kowace alama; Hakanan rubuta aƙalla bayanan marasa laifi 2 (ƙarya mai inganci). Ƙirƙirar suna / tsara yanke shawara. Imel: [manna ba a sani ba]
Ƙarfin da'awar ya raba nau'i-nau'i guda uku, yana tambayar ƙarfin shaida, yana tilasta gaskiyar ƙarya, ya hana zato na dannawa da ƙirƙira.
Samfuran gaggawar da za a iya kwafi
TAMFURIN BINCIKEN ABUBUWA NA EMAIL Yi nazarin rubutun imel ɗin da ba a san shi ba don aikin injiniyan zamantakewa: matsa lamba na gaggawa, iko/ kwaikwayi tambari, tsoro/lada, rashin keɓancewa, harshe/sauti quirks. Nuna kowace alama tare da zance. Kada ku yanke shawara; kawai jera alamomi da ƙimar ƙarfi. Email: [Paste]
TAFIYA TAMBAYA TA URL (ba tare da dannawa ba) Yi nazarin URL mai zuwa azaman TSARI (Kada ku ziyarta, kar ku ɗauka): bambanci tsakanin rubutu na fili da ainihin yankin da ake hari, typosquat/wasiƙun wasiƙa, ɓarna yanki, gajarta, ma'auni mai tuhuma. KADA KA YI FAKE da sunan yankin; Alama "ya kamata a duba suna / kwanan rajista daban".URL: [manna]
Samfurin Binciken HEADER Taƙaita waɗannan shugabannin imel masu zuwa: yankin mai aikawa na ainihi, Tafarkin Komawa, Sakamakon SPF/DKIM/DMRC, hanyar uwar garke (An karɓo) rashin daidaituwa, sunan nuni da bambancin adireshi na gaske. Alama kowane sakamako tare da "[tabbatar a cikin ɗan gajeren labari]"; dacewa. Taken: [manna]
TEMPLATE KYAUTA GARGAƊI MAI AMFANIRubuta gajeriyar rubutun gargaɗin da ba na zargi ba da za a aika wa ma'aikata don tabbatar da saƙo: abin da za a yi (kada a danna, turawa, gogewa), dalili, ga wanda za a ba da rahoto. Kar a yi amfani da yaren tsoro. Wannan daftarin yana wucewa ta hanyar amincewar manazarta. Takaitaccen taron: [manna]
Kuskuren gama gari
- Danna kai tsaye akan mahaɗin da ake tuhuma. Ana yin nazari ta hanyar rubutu da keɓaɓɓen kafofin watsa labarai; danna kai tsaye zai iya sa ka zama wanda aka azabtar kuma.
- Aminta da shawarar e/a'a na AI. Kalmar nan guda ɗaya "phishing/amin" ba shaida ba ce; Tabbatar da take, tsarin URL, da yanki.
- Ketare mahallin cibiyar (ƙarya mai kyau). Masu samar da halal kuma suna aika imel daga wuraren waje; Dubi SPF/DKIM/DMRC da mahallin amfani na tarihi.
- Ba da bayanan sirri / m ba tare da abin rufe fuska ba. Rufe suna, adireshi, bayanin katin/kalmar sirri a cikin imel kafin bincike.
- Kuskure sunan filin karya a matsayin gaskiya. AI na iya yin karya cewa yanki yana "aminci/sani"; Tabbatar da kwanan rajista da sabis na suna.
Tukwici: Alamar mafi ƙarfi guda ɗaya a cikin binciken phishing galibi shine taken: idan SPF/DKIM/DMARC duk sun gaza kuma yankin mai aikawa ya lalace, zato ya yi ƙarfi sosai. Amma tabbatar da wannan daga ainihin taken, ba daga taƙaitaccen AI ba.
Tsanaki: Bayyana saƙon imel "phishing" da toshe shi a cikin ƙungiyar kuma na iya rushe halaltaccen imel ɗin kasuwanci. Binciken AI hujja ce; Shawarar toshewa da sanarwar mai amfani ya rataya ne ga mai sharhi bayan tabbatarwar take da mahallin.
a takaice
Fitar da wasiƙa tana kai hari ga mutane, ba dabaru ba, kuma ainihin harshe ne da matsalar ƙima; That's why it is so powerful in AI analysis. Ana bincika imel ɗin da ake tuhuma a matakai uku: abun ciki / injiniyan zamantakewa, URL/tsarin haɗe-haɗe, da masu kai imel (SPF/DKIM/DMARC). AI yana haifar da gaskatawa da sauri a kowane Layer, amma ba zai iya tabbatar da hanyar haɗin yanar gizo ta hanyar danna shi ba, bai san mahallin cibiyar ba, kuma yana iya yanke shawarar "aminci / phishing". Don haka nazarin AI shine hasashe: an tabbatar da tabbatar da taken ta hanyar sunan yanki da mahallin ma'aikata, sannan mai binciken ya yanke shawarar toshewa da sanarwar mai amfani. Dokoki guda biyu sun kasance masu dorewa: kar a danna hanyoyin haɗin yanar gizo kai tsaye, kar a raba mahimman bayanai ba tare da abin rufe fuska ba.
Aikin aikace-aikace
Samfuran imel ɗin da ake tuhuma (ko dai ba a san su ba ko samfurin keɓewar ku). Shin AI ta warware yadudduka guda uku daban tare da samfuran "Content", "URL" da "Title". Tabbatar da kanku a cikin ɗanyen bayanan (musamman SPF / DKIM / DMARC a cikin taken) mafi ƙarfi mai nuna alama cewa AI yana yin alama a kowane Layer kuma la'akari da aƙalla bayanin tabbataccen ƙarya. A ƙarshe, yanke shawara: shin wannan phishing ɗin ne ko a'a, kuma me yasa - rubuta wace shaida kuka kafa shawarar ku.
jerin abubuwan dubawa
- [ ] Na ɓoye sunan imel ɗin kafin bincike; bayanan sirri/masu hankali an rufe su.
- [ ] Na bincika yadudduka uku (abun ciki, URL/abin da aka makala, take) daban.
- [ ] Ban danna kowane mahaɗan da ake tuhuma ba kai tsaye; Na rarraba URL ɗin azaman tsari.
- [ ] Na tabbatar da sakamakon SPF/DKIM/DMRC a cikin danyen rubutun.
- [ ] Na tabbatar da shawarar "phishing/amin" ta AI tare da shaida, ban amince da shi a makance ba.
- [ ] Na yi la'akari da aƙalla magana tabbatacce (marasa laifi).
- [ ] A matsayina na manazarci, na yanke shawarar toshewa da sanar da masu amfani.