DEVICE FOR PROVIDING PROTECTIVE SERVICE AGAINST EMAIL SECURITY-BASED ZERO-DAY URL ATTACK AND METHOD FOR OPERATING SAME

A method for operating a device for providing a protective service against a mail security-based zero-day uniform resource locator (URL) attack, according to an embodiment of the present invention, comprises: a collection step of collecting email information transmitted and received between one or more user terminals; a security threat inspection step of, when a URL is included in the email information, inspecting the URL by means of a email security process according to a preset security threat architecture and storing and managing URL inspection information according to the inspection result; a zero-day URL conversion step of, when the URL is determined as a zero-day URL having a potential zero-day attack risk, converting the zero-day URL into a preset secure URL on the basis of the URL inspection information; and a zero-day URL diagnosis step of periodically diagnosing whether the zero-day URL is a malicious URL.