E-mail is a commonly used attack vector in APT attacks. This article proposes an APT e-mail attack detection method based on multi-dimensional analysis for APT e-mail attacks. First

the mail header

body information and file attachments are parsed and extracted. Then

the mail header

mail body

intelligence detection

file content depth detection

and mail multi-dimensional analysis of abnormal behavior detection and self-learning of the mail site; finally

based on the analysis results

the mail is classified as ordinary mail and mail with APT attack characteristics. The solution proposed in this paper firstly detects threats based on rule characteristics

then integrates intelligence detection and in-depth detection of file content

then analyzes abnormal e-mail behavior

and finally conducts customer business self-learning

which can effectively improve the APT e-mail attack. The detection accuracy rate provides a good detection scheme for APT mail attack detection.