Abstract: In recent years,with the widespread adoption of cloud-based email applications,the number of users has steadily increased,and security threats such as phishing attacks have become more prevalent.Effective defense resource allocation has thus become crucial for ensuring the stable operation of cloud email systems.However,existing resource allocation methods often fail to adequately consider factors such as user behavior,the interrelationships between multiple cloud nodes,and lateral phishing attacks,leading to inefficiencies in resource utilization and suboptimal defense performance.To address these issues and enhance the security and resource utilization of cloud email nodes,this paper proposes a user behavior-based defense resource allocation me-thod.Firstly,a risk assessment model for cloud email nodes is developed,which comprehensively evaluates the success rate of phishing attacks and the cloud risks associated with both individual nodes and multiple interconnected nodes.Next,dynamic defense resource allocation algorithms are designed for both individual nodes and collaborative resource allocation across multiple interlinked nodes.These algorithms adjust resource allocation strategies in real-time based on factors such as user login probabilities,trust relationships,behavior patterns,the available defense resources at each node,and the current threat landscape.Experimental results show that,compared to existing methods,the proposed approach enables collaborative resource allocation,improves utilization,achieves the lowest system loss,and offers a better solution for cloud email node defense resource allocation.

Key words: Cloud email, User behavior, Phishing emails, Defense strategies, Resource allocation