JP2010244135A - Message processing apparatus, message processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To sort message data so that an act of a user is more effectively reflected. <P>SOLUTION: A message processing apparatus acquires a report on a spam mail (S101), and decides a group to which transmission source information (a mail address or the like) thereof belongs (S102). The message processing apparatus performs weighting by whether a user having performed the report is a heavy user (S103-S105), and calculates an evaluation value about the transmission source information (S106). The calculation of the evaluation value is performed in each group. The message processing apparatus decides whether a mail is the spam mail according to the evaluation value, adds the transmission source information wherein the evaluation value exceeds thresholds Th<SB>1</SB>and Th<SB>2</SB>to a common list (S113), and regards a transmission source of the transmission source information as a transmission source of the spam mail to all users. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a technique for distributing message data.

  As a method for distributing e-mails, for example, there is a method for distributing e-mails to so-called junk mails and e-mails that are not. Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for restricting the reception of an e-mail from a sender address registered as junk mail by more than a predetermined number of users as a junk mail for other users.

Japanese Patent Laid-Open No. 2003-234781

However, if junk mail is determined based on the number of e-mails and their sender addresses, it is not easy to deal with, for example, a case where a large amount of spam mails with slightly different sender addresses is sent.
Therefore, an object of the present invention is to distribute message data so that user actions are more effectively reflected.

  The message processing device according to the present invention obtains the transmission source information of message data having transmission source information that is a character string that identifies the transmission source and transmission destination information that is a character string that identifies the transmission destination. Obtaining means, report obtaining means for obtaining reports of the transmission source information by a plurality of users, evaluating the transmission source information based on the reports obtained by the report obtaining means, and assigning an evaluation value to the transmission source information An evaluation unit to be applied, and transmission of message data having the transmission source information when the evaluation value provided by the evaluation unit exceeds a predetermined threshold with respect to the transmission source information acquired by the transmission source acquisition unit. A configuration comprising: a transmission control unit that constrains processing so that the evaluation value is different from processing related to transmission of message data having the transmission source information that does not exceed the threshold value. To.

  The message processing device according to the present invention includes a determination unit that determines a group to which the transmission source information from which the report has been acquired by the report acquisition unit belongs based on a pattern included in a character string of the transmission source information, A configuration may be employed in which the transmission control means compares the total value of the evaluation values given to the transmission source information belonging to the group determined by the determination means with the threshold value.

  In the message processing device according to the present invention, the transmission source information includes an upper domain that classifies the transmission source according to a determined attribute, and a lower domain that further classifies the attribute classified by the upper domain, and the determination The means may adopt a configuration in which, when the upper domain is a predetermined character string, the plurality of pieces of transmission source information that match the upper domain and differ in the lower domain are determined to be the same group. it can.

  In the message processing device according to the present invention, the transmission source information includes an upper domain that classifies the transmission source according to a determined attribute, and a lower domain that further classifies the attribute classified by the upper domain, and the determination Means comprising similarity determination means for determining the similarity of the lower domains of a plurality of transmission source information, wherein the higher domains match with a predetermined character string, and the first transmission source information differs in the lower domains A configuration is adopted in which the first transmission source information and the second transmission source information are determined to be the same group when the similarity with the second transmission source information exceeds a predetermined threshold. be able to.

  The message processing device according to the present invention includes classification means for classifying users based on the number or timing of the reports, and the evaluation means assigns a weight for each user according to a classification result by the classification means to the evaluation value. A given configuration can be employed.

  A message processing method according to the present invention is a processing method for message data having transmission source information that is a character string that identifies a transmission source and transmission destination information that is a character string that identifies a transmission destination. An acquisition step of acquiring a report of the transmission source information according to: an evaluation step of evaluating the transmission source information based on the acquired report and giving an evaluation value to the transmission source information; and the message data to be transmitted When the evaluation value given to the transmission source information exceeds a predetermined threshold, the processing related to transmission of the message data is performed by transmitting the message data having the transmission source information whose evaluation value does not exceed the threshold. And a transmission control step that restricts the processing so as to be different from the processing according to the above.

  The transmission control method according to the present invention includes a determination step of determining a group to which the transmission source information from which the report has been acquired belongs based on a pattern included in a character string of the transmission source information. In the transmission control step, The aspect in which the total value of the evaluation values given to the transmission source information belonging to the group determined in the determination step is compared with the threshold value can be adopted.

  In the transmission control method according to the present invention, in the transmission control step, the individual list in which the transmission source information that restricts a specific transmission destination is described, and the transmission source information that performs common restriction on a plurality of transmission destinations are included. When the source information of the message data to be transmitted is described in the individual list using the described common list, the processing related to transmission of the message data is performed, and the evaluation value is set to the threshold value. When the transmission source information of the message data to be transmitted is described in the common list, the processing is restricted to be different from the processing related to the transmission of the message data having the transmission source information not exceeding the transmission source information. When the evaluation value given to the transmission source information exceeds the first threshold and is equal to or smaller than the second threshold larger than the first threshold, In the case where the evaluation value given by exceeding the second threshold value, it is possible to adopt a mode in which different aspects of the constraints.

The program according to the present invention allows a computer to acquire the transmission source information of message data having transmission source information that is a character string that identifies the transmission source and transmission destination information that is a character string that identifies the transmission destination. Source acquisition means, report acquisition means for acquiring reports of the transmission source information by a plurality of users, evaluation of the transmission source information based on the reports acquired by the report acquisition means, and evaluation values for the transmission source information When the evaluation value given by the evaluation means exceeds a predetermined threshold with respect to the transmission source information acquired by the transmission source acquisition means, the message data having the transmission source information is transmitted. As a transmission control means for restricting such processing to be different from processing related to transmission of message data having the transmission source information whose evaluation value does not exceed the threshold value. It has a structure to be.

  According to the present invention, it is possible to distribute message data so that a user's action is reflected more effectively.

Block diagram showing the configuration of the mail transmission / reception system Block diagram showing the hardware configuration of the mail server Functional block diagram showing the functions realized by the control unit Flow chart showing sender information evaluation process Flow chart showing group determination processing Diagram illustrating upper and lower domains The figure for illustrating the calculation method of the similarity of the lower domain Flow chart showing transmission control processing Functional block diagram showing configurations of mail server and message processing device

[Embodiment]
FIG. 1 is a block diagram showing a configuration of a mail transmission / reception system according to an embodiment of the present invention. The mail transmission / reception system 10 of this embodiment includes a mail server 100, a transmission source terminal 200, and a transmission destination terminal 300. The mail server 100 is an example of a message processing device of the present invention. The mail server 100 and the transmission source terminal 200 are connected by a network NW1, and the mail server 100 and the transmission destination terminal 300 are connected by a network NW2. Although there can be a plurality of transmission source terminals 200 and transmission destination terminals 300, only one terminal is shown in FIG. The network NW1 and the network NW2 are the Internet, a LAN (Local Area Network), a mobile communication network, or the like, but the network NW1 and the network NW2 may be the same communication network. Further, the network NW1 may include another mail server (a mail server different from the mail server 100) that relays electronic mail.

  In the present invention, “electronic mail” refers to messages (information) exchanged via a network, and “message data” refers to a collection of data for exchanging the messages. The message may be text information or image information. In addition to the message body, the message data includes transmission source information for specifying the transmission source and transmission destination information for specifying the transmission destination. In the present embodiment, transmission / reception of electronic mail compliant with SMTP (Simple Mail Transfer Protocol) will be described.

  The transmission source information and transmission destination information of this embodiment are so-called mail addresses. The transmission source information and the transmission destination information are character strings described in a predetermined rule such as “xxx @ yyy”. In this example, a portion corresponding to “xxx” represents a user name determined according to a transmission source or transmission destination user. A portion corresponding to “yyy” represents domain information in which a transmission source or transmission destination attribute is described. The domain information includes a character string (“co”, “or”, “jp”, etc.) representing the region or organization classification.

  In addition, the domain information may include a character string for further dividing the region and organization. Domain information is described hierarchically, such as a top level domain, a second level domain, and a third level domain. The domain information has a relationship in which the upper domain is more finely divided by the lower domain. That is, a plurality of lower domains can be included in one upper domain.

  The mail server 100 of the present embodiment has a mail box that stores message data addressed to the destination terminal 300. The mail server 100 is provided by a company or telecommunications carrier that constructs a communication network, and the transmission destination terminal 300 performs communication using a communication network constructed by the company or telecommunications carrier. is there. That is, the relationship between the mail server 100 and the destination terminal 300 is, for example, that the employee of a certain company uses the destination terminal 300 and the mail server of the company is the mail server 100. Alternatively, there may be a relationship such as a destination terminal 300 used by a member who receives a service of a certain ISP (Internet Service Provider) and the mail server 100 of the ISP. The mail server 100 according to the present embodiment is provided with an MTA (Mail Transfer Agent) function and an MDA (Mail Delivery Agent) function in an integrated manner.

  The transmission source terminal 200 and the transmission destination terminal 300 are computer devices having the function of an electronic mail client (mailer). The transmission source terminal 200 and the transmission destination terminal 300 include at least communication means for performing communication, control means for controlling communication and display of electronic mail, display means for displaying electronic mail, and operation means for receiving user operations. Prepare. For example, a personal computer or a mobile phone corresponds to the transmission source terminal 200 and the transmission destination terminal 300. In addition, the destination terminal 300 is provided with a function for reporting source information that is not desired to be received again. Such a report is performed, for example, by selecting a corresponding electronic mail and transmitting the transmission source information to the mail server 100.

FIG. 2 is a block diagram illustrating a hardware configuration of the mail server 100. As shown in the figure, the mail server 100 includes a control unit 110, a storage unit 120, a first communication unit 130, and a second communication unit 140. The control unit 110 includes an arithmetic processing unit such as a CPU (Central Processing Unit) and a memory, and controls the operation of the mail server by executing a program stored in advance. The storage unit 120 includes a rewritable storage medium such as a hard disk and stores data. The first communication unit 130 is a communication interface for connecting to the network NW1, and the second communication unit 140 is a communication interface for connecting to the network NW2.
Note that the mail server 100 may include a means for displaying information and a means (such as a keyboard) for receiving an administrator's operation performed according to the displayed information.

  The data stored in the storage unit 120 includes a mailbox, a black list, an excluded domain list, and a heavy user list. The mailbox stores message data addressed to the destination terminal 300 for each destination. The black list is a list in which transmission source information that restricts transmission of electronic mail is described. The black list includes an individual list for each transmission destination and a common list common to all transmission destinations. The excluded domain list is a list in which predetermined domains (hereinafter referred to as “excluded domains”) are described. The heavy user list is a list in which transmission information of heavy users is described. Here, the heavy user refers to a user who satisfies a predetermined condition. The predetermined condition is determined based on the number and timing of spam mail reports to be described later. For example, a user whose reporting frequency and frequency are greater than a predetermined number or a user who has reported in the most recent predetermined period is determined as a heavy user. A heavy user's judgment may be performed combining a plurality of conditions. The mail server 100 may determine which user is a heavy user, but the administrator of the mail server 100 can also determine and update the heavy user list.

  FIG. 3 is a functional block diagram illustrating functions realized by the control unit 110. The control unit 110 implements functions corresponding to the message acquisition unit 111, the report acquisition unit 112, the determination unit 113, the classification unit 114, the evaluation unit 115, and the message distribution unit 116 illustrated in FIG. .

  The message acquisition unit 111 is an example of a transmission source acquisition unit of the present invention, and acquires message data from the transmission source terminal 200 via the first communication unit 130. The message acquisition unit 111 recognizes the transmission source information from the character string described in the “From” field of the mail header included in the message data, and the character string described in the “To” field of the mail header. To recognize the destination information. For the destination information, a character string described in the “Cc” field or the “Bcc” field can be used instead of the character string described in the “To” field.

  The report acquisition unit 112 is an example of a report acquisition unit of the present invention, and acquires a junk mail report from the transmission destination terminal 300 via the second communication unit 140. Here, the junk mail is an e-mail transmitted from a transmission source that the user of the transmission destination does not want to receive (or is highly likely not to receive). The junk mail includes, for example, e-mails for advertisements and promotions that are not desired by the user (particularly for unspecified majority) and fraudulent mails such as fictitious requests. In addition, when the transmission destination user reports a junk mail, the transmission source information of the corresponding electronic mail is included in the report. In addition, in order to identify the reporting user, the destination information of the user is added to the spam mail report.

  The determination unit 113 is an example of a determination unit (and similarity determination unit) of the present invention, and performs determination on transmission source information received from a transmission destination user. The determination by the determination unit 113 is for grouping transmission source information. The group here is a type in which the transmission source information is collected by common features. Source information belonging to the same group has a common part in the upper domain. The determination by the determination unit 113 is performed by comparing the character string patterns included in the domain information using the excluded domain list.

  The classification unit 114 is an example of a classification unit according to the present invention, and classifies users who have reported spam mails. The classification unit 114 classifies users who have reported spam mails into “heavy users” and “normal users (non-heavy users)”. Classification by the classification unit 114 is performed using a heavy user list. The classification unit 114 may perform classification not only by using the heavy user list but also by determining whether or not the user should be a heavy user every time a report is received from a transmission destination user. .

  The evaluation unit 115 is an example of an evaluation unit of the present invention, evaluates the transmission source information of the message data transmitted from the transmission source terminal 200, and gives an evaluation value corresponding to the evaluation result to the transmission source information. The evaluation by the evaluation unit 115 is performed using the determination result by the determination unit 113 and the classification result by the classification unit 114. That is, the evaluation by the evaluation unit 115 is performed based on a report received from a transmission destination user.

  The message distribution unit 116 is an example of a transmission control unit of the present invention, and distributes message data from the transmission source terminal 200. In the present embodiment, the message data distribution by the message distribution unit 116 includes a first mode in which message data is not stored in the mailbox, and a predetermined additional information added to the message data, which is then stored in the mailbox. There are a second mode of storing and a third mode of storing message data to which the additional information is not added in the mailbox. The first aspect and the second aspect are aspects that are applied to message data that is regarded as spam mail, and the third aspect is message data that is regarded as normal electronic mail that is not spam mail. It is the aspect applied with respect to. The difference between the first aspect and the second aspect lies in the possibility of being regarded as spam mail. The distribution by the message distribution unit 116 is performed using the evaluation result by the evaluation unit 115. Further, the message distribution unit 116 may perform distribution using a black list without using the evaluation result by the evaluation unit 115.

  The configuration of the mail transmission / reception system 10 of this embodiment is as described above. Under this configuration, an electronic mail transmitted from the transmission source terminal 200 is received by the transmission destination terminal 300 via the mail server 100. The mail server 100 determines whether or not the e-mail addressed to the destination terminal 300 is a junk mail, and sorts the e-mail according to the determination result. The mail server 100 according to the present embodiment controls the transmission so as not to be performed when the electronic mail to be transmitted is regarded as a junk mail, or the e-mail may be a junk mail. Control is performed so that the user can recognize that the value is high.

  Further, the mail server 100 accepts a junk mail report from each user of the destination terminal 300 while performing such control. When the mail server 100 accepts the report of the spam mail, the mail server 100 evaluates the transmission source information based on the report, and updates the black list stored in the storage unit 120 as necessary.

  FIG. 4 is a flowchart showing the sender information evaluation process executed by the mail server 100. In the evaluation process, the control unit 110 first obtains a junk mail report from the transmission destination user (step S101). When the spam mail report is acquired, the control unit 110 determines whether or not the reported transmission source information belongs to one of the predetermined groups (step S102). The processing in step S102 is hereinafter referred to as “group determination processing”.

  FIG. 5 is a flowchart showing the group determination process. In the group determination process, the control unit 110 compares the reported transmission source information with the exclusion domain described in the exclusion domain list, and determines whether or not there is a part in the transmission source information that matches the exclusion domain (Step S110). S201). The comparison in step S201 is performed by backward matching. When there is a part that matches the excluded domain in the transmission source information, the control unit 110 treats the part of the domain information as an upper domain and treats the part of the domain information other than the upper domain as a lower domain. When the reported transmission source information does not match any excluded domain, the control unit 110 determines that the transmission source information does not belong to any existing group, and ends the group determination process.

  FIG. 6 is a diagram illustrating an upper domain and a lower domain. In the example shown in the figure, “aaa.ne.jp” corresponds to the excluded domain (that is, the upper domain), and “cc.bbb.” Corresponds to the lower domain. The excluded domain is, for example, a domain assigned to a prominent ISP. The delimiter between the upper domain and the lower domain is determined based on the excluded domain, and the domain level (the section delimited by dots) is indefinite.

  When a portion matching the excluded domain is found by the process of step S201 and the upper domain and the lower domain are specified, the control unit 110 determines the lower domain of the reported transmission source information, the transmission source information, and the upper domain. Are compared with lower domains of other transmission source information that match, and the similarity is calculated (step S202). The similarity referred to here indicates the degree of similarity of the lower domains, and it is assumed that the larger the value, the better the similarity.

  FIG. 7 is a diagram for illustrating a method of calculating the similarity of the lower domain. The similarity of the lower domain is determined for each level of the lower domain, and is also determined for the entire lower domain. As shown in the figure, if the lower domain of one source information is “cc.bbb.” And the lower domain of the other source information is “cc.abc.”, The control unit 110 “Cc” and “cc”, “bbb” and “abc”, “cc.bbb.” And “cc.abc.” Are respectively compared to calculate the similarity. Here, as the similarity, a percentage indicating the degree of matching of characters is used.

  When calculating the degree of similarity, the patterns of character strings may be compared by either forward matching or backward matching, and the patterns are compared depending on how many of the same characters are included regardless of the order in the character strings. May be. Further, the control unit 110 may calculate the similarity by using some of these methods, and may employ the average value as the similarity, or may employ the maximum value or the minimum value of the plurality of calculated similarities. Good. For example, when “cc” and “cc” are compared, they are completely the same no matter how they are compared, so the degree of similarity is “100%”. Further, when “bbb” and “abc” are compared, one of the three characters matches (regardless of the order), so the similarity is “33%”.

In addition, when there are a plurality of pieces of transmission source information belonging to the same group, the control unit 110 determines the similarity with each piece of transmission source information, and either the average value, the maximum value, or the minimum value of each similarity degree Is adopted as the similarity. In addition, when calculating the similarity for each level of the lower domain and the similarity for the entire lower domain, the control unit 110 has a higher degree of similarity for the lower domain than for each level of the lower domain. It is good to give a large weight. That is, it is desirable that the controller 110 acts so that the similarity of the entire lower domain acts more than the similarity for each level of the lower domain when compared with a threshold value Th _a described later.

When the similarity is calculated in step S202, the control unit 110 determines whether or not the calculated similarity exceeds _a predetermined threshold value Th _a (step S203). When the calculated similarity exceeds the threshold Th _a , the control unit 110 determines that a plurality of pieces of transmission source information compared with the similarity are in the same group (step S204). On the other hand, if the calculated similarity is equal to or less than the threshold Th _a , the control unit 110 determines that the reported transmission source information does not belong to any existing group, and ends the group determination process.

  As described above, when the group determination process in step S102 is performed, the control unit 110 determines whether or not the user who made the report is a heavy user (step S103). The count value to which weighting is given than in the case of the user (step S104) is set in the acquired transmission source information (step S105). In the present embodiment, the count value when the user is a normal user is “1”, and the count value when the user is a heavy user is “1.5”. Note that the weighting here may be, for example, based on a count value of a heavy user as a reference (that is, “1”) and a count value of a normal user smaller than a reference (eg, “0.7”).

  Subsequently, the control unit 110 calculates the evaluation value of the acquired transmission source information using the count value set in step S104 or S105 (step S106). The evaluation value here is the count value itself set in step S104 or S105 when the acquired transmission source information does not belong to any group. On the other hand, when the acquired transmission source information belongs to any group, the evaluation value is a total value of evaluation values given to the transmission source information belonging to the same group. That is, the evaluation value when the acquired transmission source information belongs to any group is set to the count value set in the acquired transmission source information and the other transmission source information of the group to which the transmission source information belongs. It is a value obtained by adding the count value.

After calculating the evaluation value, the control unit 110 compares the evaluation value with predetermined threshold values Th ₁ and Th ₂ (steps S107 and S108). Here, the threshold values Th ₁ and Th ₂ are values determined based on the total number of users (transmission destination users) who have reported spam mails, and satisfy Th ₁ <Th ₂ . For example, the threshold value Th ₁ is “2%” of the total number of users, and the threshold value Th ₂ is “5%” of the total number of users. The thresholds Th ₁ and Th ₂ are “the ratio of the number of users determined that the email having the acquired transmission source information is spam” to the total number of users if the users are both normal users. If a heavy user is included in the user who reported, it will differ from this ratio. The threshold values Th ₁ and Th ₂ may be changed as appropriate by the administrator of the mail server 100.

When the evaluation value is equal to or less than the threshold Th ₁ , the control unit 110 determines that the e-mail having the transmission source information related to the calculation of the evaluation value is a junk mail (step S109), and determines this as an individual in the black list It adds to the list (step S110). That is, when the evaluation value is equal to or less than the threshold value Th ₁ , the control unit 110 applies the junk mail determination to a specific transmission destination (the transmission destination that made the report) and does not apply to the entire transmission destination. “Source information related to calculation of evaluation value” refers to all the source information belonging to the group when the acquired source information belongs to any group, and the acquired source information If it does not belong to any other group, only the source information is indicated.

On the other hand, when the evaluation value exceeds the threshold values Th ₁ and Th ₂ , the control unit 110 determines that the e-mail having the transmission source information related to the calculation of the evaluation value is a junk mail (step S112). It adds to the common list of the black lists (step S113). That is, when the evaluation value exceeds the threshold values Th ₁ and Th ₂ , the control unit 110 applies the junk mail determination to the entire transmission destination.

When the evaluation value exceeds the threshold Th ₁ and is equal to or less than the threshold Th ₂ , the control unit 110 determines that the e-mail having the transmission source information related to the evaluation value calculation is provisional spam mail ( In step S111, this is added to the common list in the black list (step S113). Here, provisional junk mail refers to e-mail that has not been determined to be junk mail common to users but is relatively likely to be.

  When the evaluation process is completed, the control unit 110 stores the evaluation value in association with each piece of transmission source information (or a group to which the transmission source information belongs). The stored evaluation value is used when the evaluation process is executed next.

  FIG. 8 is a flowchart showing a transmission control process executed by the mail server 100. This transmission control process is a process performed using the evaluation result of the evaluation process (see FIG. 4), that is, the black list updated by the evaluation process. In the transmission control process, the control unit 110 acquires message data to be transmitted from the transmission source (step S301), and recognizes the mail header of the acquired message data (step S302). In step S302, the control unit 110 recognizes e-mail transmission source information and transmission destination information. Then, the control unit 110 collates the mail header and the black list, changes the processing related to the transmission of the e-mail according to the collation result, and changes the distribution mode of the message data as follows.

  The control unit 110 determines whether or not the recognized transmission source information is included in the common list (step S303). If the transmission source information is included in the common list, the transmission source information is included in the common list as provisional junk mail. (Step S304). When the recognized transmission source information corresponds to provisional junk mail, the control unit 110 adds additional information to the acquired message data and stores it in the mailbox (step S305). The additional information is data for allowing the transmission destination user to recognize that the electronic mail to be transmitted is provisional spam mail. The additional information is, for example, a predetermined character string (for example, “* Possibility of spam mail *”) added to the beginning of the character string (that is, the subject) described in the “Subject” field of the mail header. . Further, the additional information may be voice data for generating a warning sound and may be added as an attached file of an electronic mail.

  On the other hand, when the recognized transmission source information is included in the common list and is not included as provisional spam mail, the control unit 110 does not save the acquired message data in the mailbox (step S307). That is, at this time, the control unit 110 prevents the email from being transmitted to the transmission destination.

  Further, when the recognized transmission source information is not included in the common list, the control unit 110 determines whether or not the transmission source information is included in the individual list corresponding to the recognized transmission destination information ( Step S306). When the recognized transmission source information is included in the individual list of transmission destinations, the control unit 110 does not save the acquired message data in the mailbox (step S307). In addition, when the recognized transmission source information is not included in either the common list or the individual list, the control unit 110 stores the acquired message data in the mailbox (step S308). Note that additional information is not added to the message data in this case.

  After the message data is distributed in this way, the control unit 110 determines whether or not there is a request for acquiring the message data from the transmission destination terminal 300 (step S309). The message data stored in the mailbox corresponding to the destination terminal 300 is transmitted (step S310).

  As described above, according to the mail transmission / reception system 10 of the present embodiment, since the sender information is evaluated, the user's reporting action is made more effective than when the number of emails and the sender information are simply used. Distribution of the reflected message data is performed. For example, according to the mail server 100 of this embodiment, in order to calculate the similarity of the lower domains and group the transmission source information, it is repeatedly transmitted using a mail address with slightly different lower domains. It is easy to deal with spam. In calculating the similarity, it is possible to improve the accuracy of the determination of whether or not they are similar by making a determination by excluding the upper domain.

  In addition, according to the mail server 100 of the present embodiment, since the evaluation value is calculated by giving a weight to the report by the heavy user, it is evaluated more than the report by the normal user, that is, the user who does not often report junk mail. The effect on the value is increased. This is based on the prediction that a heavy user reacts more quickly to spam mails and is more reliable in reporting than a normal user.

  Further, according to the mail server 100 of the present embodiment, the provisional spam mail is transmitted in a mode in which additional information is added. Therefore, it is possible to make the judgment of the spam mail by the user easier. The user recognizes the additional information when receiving the e-mail, and reports if the received e-mail is a junk mail. Therefore, according to the mail server 100 of the present embodiment, when the provisional junk mail is truly junk mail, it is possible to promote an increase in the evaluation value and to be added to the common list earlier. .

[Modification]
The present invention is not limited to the above-described embodiment, and can be implemented by other aspects. The present invention can also be implemented by, for example, embodiments of the following examples. Note that the present invention may be applied in combination of these modifications.

(Modification 1)
The mail server according to the present invention may have a function corresponding to MTA without having a function corresponding to MDA. That is, the mail server according to the present invention only needs to perform distribution necessary for transmitting the message data, and it does not matter whether the message data is transmitted to the transmission destination.
In addition, although the above-described embodiment has been described by exemplifying electronic mail, the message data of the present invention is not limited to electronic mail, and is transmitted / received using a protocol other than SMTP. May be included.

(Modification 2)
The present invention can be implemented not as a mail server but also as a message processing apparatus that exchanges data with a mail server for distributing message data.
FIG. 9 is a functional block diagram showing a configuration when the present invention is implemented as a message processing device. In addition, the component which attached | subjected the code | symbol same as embodiment mentioned above in the figure has a function similar to the component demonstrated in embodiment mentioned above.

  The mail server 100 a includes a message acquisition unit 117 and a message distribution unit 116. The message acquisition unit 117 has a function of supplying transmission source information to the message processing device 100b in addition to the function of the message acquisition unit 111 of the embodiment described above. The message processing device 100b includes a transmission source acquisition unit 118 and an output unit 119. The transmission source acquisition unit 118 is an example of a transmission source acquisition unit of the present invention, and acquires transmission source information supplied from the message acquisition unit 117. The output unit 119 is an example of the transmission control means of the present invention. The output unit 119 transmits transmission control information describing whether or not to restrict transmission of message data having the transmission source information acquired by the transmission source acquisition unit 118 to the message distribution. Output to the dividing unit 116. The output unit 119 generates transmission control information corresponding to the evaluation result by the evaluation unit 115 and outputs the transmission control information to the message distribution unit 116. The message distribution unit 116 distributes message data in a manner corresponding to the transmission control information.

  As shown in FIG. 9, the message processing device 100b can operate without acquiring the message data itself as long as the transmission source information can be acquired. According to this message processing device 100b, it becomes possible to perform evaluations and judgments necessary for distributing message data with a device different from the mail server 100a, and to reduce the load on the mail server 100a.

(Modification 3)
Moreover, this invention can employ | adopt the aspect that a predetermined user is not considered in an evaluation process as an aspect in the case of classifying a user and performing the weighting according to the classification result. For example, in the setting of the count value in steps S104 and S105 described above, if the count value of the heavy user is “1” and the count value of the normal user is “0”, the evaluation value calculated in step S106 is “ A value indicating “how many heavy users have reported the sender information as spam mail”, and normal users are not considered in determining whether or not to add to the common list. Note that the thresholds Th ₁ and Th ₂ in this case may be determined based on the total number of heavy users who have reported spam mail, rather than the total number of users who have reported spam mail. Such an aspect is particularly effective when the number of users is large.

  In addition, the user classification in the present invention is not limited to two (heavy user or normal user), and may be three or more. In addition, the present invention can be implemented in a mode in which the user is not classified, that is, in a mode in which the evaluation value is not weighted. Therefore, the evaluation process of the present invention may be a process in which steps S103 to S105 are omitted from the evaluation process shown in FIG.

(Modification 4)
In the group determination process of the present invention, a part of the process shown in FIG. 5 can be omitted. For example, the group determination process of the present invention may be a process in which steps S202 and S203 are omitted from the process shown in FIG. In this case, a plurality of pieces of transmission source information whose upper domains match and whose lower domains are different belong to the same group, and the similarity of the lower domains is not questioned.

(Modification 5)
The report in the present invention may be performed by another device different from the transmission destination terminal. For example, if the destination terminal is a mobile phone and the user who is the destination owns a personal computer, instead of sending a report of junk mail with the mobile phone, the junk mail is reported by the personal computer. May be. In this case, it is desirable that processing for identifying the user as the transmission destination, such as input of an ID or password, be performed in advance.
In addition, the administrator establishes a contact point for reporting spam, and the user who is the destination communicates necessary information (spam email sender information, etc.) verbally or in the document, and manages the transmitted matter. It is also possible for a person to transmit to a mail server using a personal computer or the like.

(Modification 6)
The mode of processing for provisional junk mail in the present invention is not limited to adding additional information. For example, when provisional junk mail is stored in a mailbox, the mail server according to the present invention inquires of the destination user whether or not to receive it, and transmits it when the user consents. May be. Alternatively, the mail server according to the present invention transmits all of the message data for normal e-mail (not junk mail), and for temporary junk mail, a part of the message data (for example, a mail header excluding the message body) Only) may be transmitted first, and when there is a request from the user, the remaining message data may be transmitted continuously.
In short, in the present invention, the transmission control for junk mail and provisional junk mail need only be a mode given some restrictions different from the mode of normal e-mail transmission, and its specific mode is not limited. .

DESCRIPTION OF SYMBOLS 10 ... Mail transmission / reception system, 100, 100a ... Mail server, 110 ... Control part, 111, 117 ... Message acquisition part, 112 ... Report acquisition part, 113 ... Determination part, 114 ... Classification part, 115 ... Evaluation part, 116 ... Message Sorting unit, 118 ... transmission source acquisition unit, 119 ... output unit, 120 ... storage unit, 130 ... first communication unit, 140 ... second communication unit, 200 ... transmission source terminal, 300 ... transmission destination terminal, 100b ... message Processing equipment

Claims (9)

Transmission source acquisition means for acquiring the transmission source information of message data having transmission source information that is a character string that identifies the transmission source and transmission destination information that is a character string that identifies the transmission destination;
Report acquisition means for acquiring reports of the transmission source information by a plurality of users;
Evaluation means for evaluating the transmission source information based on the report acquired by the report acquisition means, and giving an evaluation value to the transmission source information;
When the evaluation value given by the evaluation unit exceeds the predetermined threshold with respect to the transmission source information acquired by the transmission source acquisition unit, processing related to transmission of message data having the transmission source information is performed as the evaluation A message processing apparatus comprising: a transmission control unit that restricts a value so as to be different from a process related to transmission of message data having the transmission source information whose value does not exceed the threshold value. A determination unit that determines a group to which the transmission source information from which the report has been acquired by the report acquisition unit belongs, based on a pattern included in a character string of the transmission source information;
The message according to claim 1, wherein the transmission control unit compares a total value of the evaluation values given to the transmission source information belonging to the group determined by the determination unit with the threshold value. Processing equipment. The transmission source information includes an upper domain that classifies the transmission source according to a determined attribute, and a lower domain that further classifies the attribute that is classified by the upper domain,
The determination means is
The said upper domain is a predetermined | prescribed character string, The said upper domain corresponds, It determines with the said several source information from which the said lower domain differs being the same group. The Claim 2 characterized by the above-mentioned. The message processing device described. The transmission source information includes an upper domain that classifies the transmission source according to a determined attribute, and a lower domain that further classifies the attribute that is classified by the upper domain,
The determination means is
Similarity determination means for determining the similarity of the lower domains of a plurality of the transmission source information,
When the higher domain matches with a predetermined character string and the similarity between the first transmission source information and the second transmission source information with different lower domains exceeds a predetermined threshold, the first domain The message processing device according to claim 2, wherein the transmission source information and the second transmission source information are determined to be in the same group. Classifying means for classifying users based on the number or timing of the reports,
5. The message processing device according to claim 1, wherein the evaluation unit gives a weight for each user according to a classification result by the classification unit to the evaluation value. A processing method for message data having transmission source information that is a character string that identifies a transmission source and transmission destination information that is a character string that identifies a transmission destination,
An acquisition step of acquiring reports of the transmission source information by a plurality of users;
An evaluation step of evaluating the transmission source information based on the acquired report and giving an evaluation value to the transmission source information;
When the evaluation value given to the transmission source information of the message data to be transmitted exceeds a predetermined threshold, the transmission related to the transmission of the message data is performed with the transmission in which the evaluation value does not exceed the threshold. A message control method comprising: a transmission control step that constrains the message data so as to be different from a process related to transmission of message data having original information. A determination step of determining a group to which the transmission source information from which the report has been acquired belongs based on a pattern included in a character string of the transmission source information;
The total value of the evaluation values given to the transmission source information belonging to the group determined in the determination step is compared with the threshold value in the transmission control step. Message processing method. In the transmission control step,
Using an individual list in which the transmission source information that restricts a specific transmission destination is described, and a common list in which the transmission source information that performs common restriction for a plurality of transmission destinations is described,
When the transmission source information of the message data to be transmitted is described in the individual list, message data having the transmission source information whose evaluation value does not exceed the threshold To be different from the process related to
When the transmission source information of the message data to be transmitted is described in the common list, the evaluation value given to the transmission source information exceeds a first threshold, and the first The mode of restriction is different depending on whether the evaluation value given to the transmission source information exceeds the second threshold or not when the second threshold is less than or equal to a second threshold. Item 8. The message processing method according to Item 6 or 7. Computer
Transmission source acquisition means for acquiring the transmission source information of message data having transmission source information that is a character string that identifies the transmission source and transmission destination information that is a character string that identifies the transmission destination;
Report acquisition means for acquiring reports of the transmission source information by a plurality of users;
Evaluation means for evaluating the transmission source information based on the report acquired by the report acquisition means, and giving an evaluation value to the transmission source information;
When the evaluation value given by the evaluation unit exceeds the predetermined threshold with respect to the transmission source information acquired by the transmission source acquisition unit, processing related to transmission of message data having the transmission source information is performed as the evaluation A program for functioning as transmission control means for restricting a value so as to be different from processing related to transmission of message data having the transmission source information whose value does not exceed the threshold.

Images