Development of the Automated Alert System for Detection and Handling of Compromised Email Accounts

Abstract

With the increasing volume of email-based attacks and unauthorized access to mail servers, the need for automated monitoring and response mechanisms has become essential. This paper presents the development of an automated alert system designed to detect and handle compromised email accounts. The system monitors the mail server queue on a Linux server, detecting anomalies based on a significant surge in queued messages. Upon identifying suspicious activity, the system attempts to determine the username associated with the highest number of SASL authentications and triggers appropriate alerts or mitigation actions. Additionally, the system is integrated with a Telegram bot, allowing administrators to take immediate corrective actions remotely. This approach provides a lightweight, effective method for preventing email abuse and ensuring the integrity of email servers.