JP2017142568A - Communication system, server, and recipient terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique capable of determining whether an e-mail is a normal mail or not with higher accuracy.SOLUTION: A storage unit 100 stores sender information indicating a sender of an e-mail and user determination information indicating a determination result from a user of a recipient terminal who has determined whether the e-mail sent from a sending source host is a normal mail or not, in association with each other. A server communication unit 101 receives an e-mail including sender information from a sending source host and sends the e-mail and a server determination information indicating a determination result from a server processing unit 102 which has determined whether the e-mail is a normal mail or not, to the recipient terminal and receives user determination result from the recipient terminal. The server processing unit 102 generates server determination information on the basis of user determination information corresponding to the sender information included in the e-mail received by the server communication unit 101 out of user determination information stored in the storage unit 100.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a technique for determining the normality of electronic mail.

Spam emails that are sent indiscriminately and in large quantities ignoring the recipient's intention, despite the lack of prior request or consent from the recipient, have become a problem. Such spam mail can be a threat regardless of individuals or organizations in the following respects.
(1) Virus infection due to attachments, etc. (2) Decrease in business productivity and efficiency of recipients due to increase in unnecessary emails (3) Increase in load on servers and networks due to increase in traffic (4) Access to fraudulent sites Leakage of personal information and confidential information by guidance

  Therefore, various measures are taken to eliminate such spam mail. For example, there is a filter for mail that reaches a mail account of a PC (Personal Computer). This filter performs sorting (see Non-Patent Document 1) based on sender information (black address and white list of mail address and host information) or parsing mail text (see Non-Patent Documents 1 and 2). Further, a black list (see Non-Patent Document 3) and a white list (see Non-Patent Document 4) relating to an IP address of a transmission source that sends spam mails are used.

“17 types of filtering functions”, [online], TransWare, [searched on December 18, 2015], Internet <URL: http: // www. transware. co. jp / product / ah / filter. html> “Welcome to Spam Assassin!”, [Online], The Apache Software Foundation, [Searched on December 18, 2015], Internet <URL: https: // svn. apache. org / repos / asf / spamassin / branches / 3.3 / README> “Spamhaus DNSBL Usage Terms”, [online], SPAMHAUS, [searched on December 18, 2015], Internet <URL: https: // www. spamhaus. org / zen /> “Policy of ips.whitelisted.org”, [online], UCPROTECT-Network, [searched on December 18, 2015], Internet <URL: http: // www. whitelisted. org /? go = policy>

  Spam mail is sent indiscriminately. On the other hand, there is a target-type attack email that is sent by spoofing the content and the sender of a group or organization such as a specific company. When the prior art is applied to such a targeted attack mail, the following problems occur. Targeted attack emails target organizations or organizations in a pinpoint manner. For this reason, targeted attack emails are often sent from a specially constructed server that disguises limited emails sent to the organization or organization. There is a high possibility that the parsing of the mail body will not work for mail that spoofs mail that is sent exclusively to a group or organization. Also, because it is difficult to cover information about specially constructed servers with blacklists and whitelists, traditional blacklists and whitelists may not work for emails sent from specially constructed servers High nature.

  The present invention provides a technique capable of determining with high accuracy whether or not an electronic mail is a regular mail.

  The present invention includes a server and a recipient terminal, and the server is configured to send sender information indicating a sender of an email and the email sent from a sender host that is the sender's terminal. A storage unit that associates and stores user determination information indicating a determination result determined by a user of the recipient terminal as to whether or not the message is a mail, and receives the e-mail including the sender information from the transmission source host. And the server and the server determination information indicating the result of the server processing unit determining whether or not the email is a legitimate mail, and the user determination information is transmitted to the receiver. Corresponds to the sender information included in the e-mail received by the server communication unit among the server communication unit received from the terminal and the user determination information stored in the storage unit The server determination information is generated based on the user determination information, and the generated server determination information is output to the server communication unit, and based on the user determination information received by the server communication unit, the The server processing unit that updates the user determination information stored in a storage unit, and the recipient terminal receives the electronic mail and the server determination information from the server, and the user determination information. A receiver communication unit for transmitting to the server, a presentation unit for presenting the server determination information to a user of the receiver terminal, and the user determination information generated based on an instruction from the user A receiver processing unit that outputs the user determination information to the receiver communication unit.

  In addition, the present invention includes a server and a recipient terminal, and the server sends sender information indicating a sender of the email and the email sent from a sender host that is the sender's terminal. A storage unit that associates and stores user determination information indicating a determination result determined by a user of the receiver terminal as to whether or not the message is a legitimate mail; receives the sender information from the receiver terminal; and A server communication unit that transmits server determination information indicating a result of determination by the server processing unit to determine whether or not the e-mail is a regular mail, and receives the user determination information from the recipient terminal; and Generating the server determination information based on the user determination information corresponding to the sender information received by the server communication unit among the user determination information stored in the storage unit; and The server processing for outputting the server determination information formed to the server communication unit and updating the user determination information stored in the storage unit based on the user determination information received by the server communication unit And the receiver terminal receives the electronic mail including the sender information from the transmission source host, and the sender information and the user determination information included in the received electronic mail. Based on an instruction from the user, a receiving unit that transmits the server determination information from the server, a presentation unit that presents the server determination information to the user of the receiver terminal And a receiver processing unit that generates the user determination information and outputs the generated user determination information to the receiver communication unit. It is a stem.

  In the communication system of the present invention, the sender information includes at least one of sender name information indicating a sender's name and address information indicating the sender's mail address.

  In the communication system of the present invention, the sender information includes domain information indicating a domain of the source host.

  In the communication system of the present invention, the storage unit further includes related domain information indicating at least one of a domain related to the sender mail address domain and a domain related to the sender host domain. The server processing unit stores the sender information and the user determination information in association with each other, and the server processing unit stores the sender information included in the e-mail received by the server communication unit and the sender stored in the storage unit. The result of comparing the information, the domain of the email address of the sender of the email received by the server communication unit and the domain of the source host of the email and the storage unit stored in the storage unit Based on the result of comparison with related domain information, the user determination information stored in the storage unit. Select one of and and generates the server determination information based on the selected user decision information.

  Further, the present invention provides a sender terminal user indicating whether or not the sender information indicating the sender of the email and whether the email sent from the sender host which is the sender's terminal is a regular email. A storage unit that associates and stores user determination information indicating the determined determination result, the electronic mail that includes the sender information is received from the transmission source host, and the electronic mail and the electronic mail are regular mails. Server determination information indicating a result of determination by the server processing unit as to whether or not there is, is transmitted to the receiver terminal, and the user determination information is received from the receiver terminal, and stored in the storage unit The server determination based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit among the determined user determination information The user determination information stored in the storage unit is generated based on the user determination information received by the server communication unit. And a server processing unit for updating the server.

  Further, the present invention provides a sender terminal user indicating whether or not the sender information indicating the sender of the email and whether the email sent from the sender host which is the sender's terminal is a regular email. A storage unit that stores user determination information indicating the determined determination result in association with each other, and a server processing unit that receives the sender information from the receiver terminal and determines whether the email is a regular mail A server communication unit that transmits server determination information indicating the result of the determination to the receiver terminal and receives the user determination information from the receiver terminal, and the server communication among the user determination information stored in the storage unit. The server determination information is generated based on the user determination information corresponding to the sender information received by the unit, and the generated server determination information is transmitted to the server communication unit. And the server processing unit that updates the user determination information stored in the storage unit based on the user determination information received by the server communication unit. .

  Further, the present invention provides a sender terminal user indicating whether or not the sender information indicating the sender of the email and whether the email sent from the sender host which is the sender's terminal is a regular email. A storage unit that associates and stores user determination information indicating the determined determination result, the electronic mail that includes the sender information is received from the transmission source host, and the electronic mail and the electronic mail are regular mails. Server determination information indicating a result of determination by the server processing unit as to whether or not there is, is transmitted to the receiver terminal, and the user determination information is received from the receiver terminal, and stored in the storage unit The server determination based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit among the determined user determination information The user determination information stored in the storage unit is generated based on the user determination information received by the server communication unit. The receiver processing unit that communicates with a server having the server processing unit for updating the server, receiving the electronic mail and the server determination information from the server, and transmitting the user determination information to the server A receiver communication unit, a presentation unit for presenting the server determination information to a user of the receiver terminal, the user determination information based on an instruction from the user, and the generated user determination information A receiver processing unit for outputting to the receiver communication unit.

  Further, the present invention provides a sender terminal user indicating whether or not the sender information indicating the sender of the email and whether the email sent from the sender host which is the sender's terminal is a regular email. A storage unit that stores user determination information indicating the determined determination result in association with each other, and a server processing unit that receives the sender information from the receiver terminal and determines whether the email is a regular mail A server communication unit that transmits server determination information indicating the result of the determination to the receiver terminal and receives the user determination information from the receiver terminal, and the server communication among the user determination information stored in the storage unit. The server determination information is generated based on the user determination information corresponding to the sender information received by the unit, and the generated server determination information is transmitted to the server communication unit. And the server processing unit that updates the user determination information stored in the storage unit based on the user determination information received by the server communication unit, and communicates with a server having the server processing unit A terminal that receives the e-mail including the sender information from the transmission source host, and transmits the sender information and the user determination information included in the received e-mail to the server; And a receiver communication unit that receives the server determination information from the server, a presentation unit that presents the server determination information to a user of the receiver terminal, and generates the user determination information based on an instruction from the user. And a receiver processing unit that outputs the generated user determination information to the receiver communication unit.

  According to the present invention, it is possible to determine with high accuracy whether or not an electronic mail is a regular mail.

It is a block diagram which shows the structure of the communication system by the 1st Embodiment of this invention. It is a block diagram which shows the structure of the server by the 1st Embodiment of this invention. It is a block diagram which shows the structure of the receiver terminal by the 1st Embodiment of this invention. It is a reference figure which shows the BW list | wrist in the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement of the server by the 1st Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the receiver terminal by the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement of the server by the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement of the server by the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement of the server by the 1st Embodiment of this invention. It is a state figure of the 1st case in a 1st embodiment of the present invention. It is a state figure of the 2nd case in the 1st embodiment of the present invention. It is a state figure of the 3rd case in a 1st embodiment of the present invention. It is a state figure of the 4th case in a 1st embodiment of the present invention. It is a state figure of the 5th case in a 1st embodiment of the present invention. It is a block diagram which shows the structure of the communication system by the 2nd Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement of the server by the 2nd Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the receiver terminal by the 2nd Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 shows a configuration of a communication system 1 according to the first embodiment of the present invention. As shown in FIG. 1, the communication system 1 includes a server 10 and a recipient terminal 20.

  For example, the server 10 is a server managed by an organization or organization in which the recipient terminal 20 is used. The server 10 functions as a mail server. The server 10 is arranged on a transfer path of electronic mail received by the recipient terminal 20. The server 10 manages the distribution of electronic mail in a group or organization network. The server 10 receives an e-mail transmitted from the transmission source host 30 which is a sender's terminal to the receiver terminal 20 and transfers the received e-mail to the receiver terminal 20. For example, the receiver terminal 20 is a terminal used by a person belonging to a specific group or organization.

  FIG. 2 shows the configuration of the server 10. As illustrated in FIG. 2, the server 10 includes a storage unit 100, a server communication unit 101, and a server processing unit 102.

  The storage unit 100 is a nonvolatile recording medium. The storage unit 100 indicates the sender information indicating the sender of the email, and the determination result determined by the user of the recipient terminal 20 whether or not the email transmitted from the transmission source host 30 is a regular email. The determination information is associated and stored. Specifically, the storage unit 100 stores a BW list including sender information and user determination information. The BW list corresponds to a black list and a white list.

  The server communication unit 101 is a communication interface. The server communication unit 101 receives an email including sender information from the transmission source host 30. The server communication unit 101 transmits to the recipient terminal 20 e-mail and server determination information indicating the result of the server processing unit 102 determining whether or not the e-mail is a regular mail. For example, an e-mail with server determination information added is transmitted to the recipient terminal 20. The e-mail and the server determination information may be transmitted to the recipient terminal 20 separately. The server communication unit 101 receives user determination information from the receiver terminal 20.

  The server processing unit 102 is a control device such as a CPU (Central Processing Unit). The server processing unit 102 generates server determination information based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit 101 among the user determination information stored in the storage unit 100. The server processing unit 102 outputs the generated server determination information to the server communication unit 101. The server processing unit 102 updates the user determination information stored in the storage unit 100 based on the user determination information received by the server communication unit 101.

  For example, the functions of the server communication unit 101 and the server processing unit 102 are realized by the CPU of the server 10 reading a program stored in the storage unit 100 and executing the read program. This program may be provided by a “computer-readable recording medium” such as a flash memory. Further, the above-described program may be transmitted to the server 10 from a computer having a storage device or the like in which the program is stored via a transmission medium or by a transmission wave in the transmission medium. A “transmission medium” for transmitting a program is a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may realize a part of the functions described above. Further, the above-described program may be a difference file (difference program) that can realize the above-described function in combination with a program already recorded in the computer.

  For example, the sender information includes at least one of sender name information indicating the name of the sender and address information indicating the mail address of the sender. The sender information may include domain information indicating the domain of the transmission source host 30.

  The storage unit 100 further associates related domain information indicating at least one of a domain related to the domain of the sender's mail address and a domain related to the domain of the transmission source host 30 with the sender information and the user determination information. You may remember. The server processing unit 102 compares the sender information included in the email received by the server communication unit 101 with the sender information stored in the storage unit 100 and the email received by the server communication unit 101. The user stored in the storage unit 100 based on the result of comparing at least one of the domain of the sender's email address and the domain of the email transmission source host 30 with the related domain information stored in the storage unit 100 Any one of the determination information may be selected, and the server determination information may be generated based on the selected user determination information.

  FIG. 3 shows the configuration of the recipient terminal 20. As illustrated in FIG. 3, the recipient terminal 20 includes a recipient communication unit 200, a recipient processing unit 201, a presentation unit 202, and an operation unit 203.

  The receiver communication unit 200 is a communication interface. The recipient communication unit 200 receives e-mail and server determination information from the server 10. The receiver communication unit 200 transmits user determination information to the server 10.

  The receiver processing unit 201 is a control device such as a CPU. The receiver processing unit 201 generates user determination information based on an instruction from the user of the receiver terminal 20, and outputs the generated user determination information to the receiver communication unit 200.

  The presentation unit 202 presents server determination information to the user of the recipient terminal 20. For example, the presentation unit 202 is a display device such as a liquid crystal display. When the presenting unit 202 is a display device, the presenting unit 202 presents the server determination information to the user by displaying the server determination information. The presentation unit 202 may display information such as an email received by the recipient communication unit 200. The presentation unit 202 may be an audio output device such as a speaker. When the presenting unit 202 is an audio output device, the presenting unit 202 presents the server determination information to the user by outputting a sound corresponding to the server determination information. The user can know whether the electronic mail is a regular mail or an attack mail based on the server determination information presented by the presentation unit 202.

  The operation unit 203 is an input device such as a keyboard and a mouse. The operation unit 203 receives an operation by a user of the recipient terminal 20. When the operation unit 203 receives an input operation of a user's determination result for an e-mail, the operation unit 203 outputs information corresponding to the determination result to the recipient processing unit 201. The receiver processing unit 201 generates user determination information based on this information.

  The user of the recipient terminal 20 can refer to the server determination information presented by the presentation unit 202. However, the user can also determine for himself whether the email is a regular email or an attack email. For example, when a URL (Uniform Resource Locator) is described in the e-mail, the user accesses a website indicated by the URL and makes a determination based on the information on the website. If there is no particular suspicious point on the website, the user can determine that the email is a legitimate email. If the website is a suspicious site, the user can determine that the email is an attack email. When an attached file is attached to the e-mail, the user may make a determination based on the information of the attached file. When the attached file is a safe file, the user can determine that the electronic mail is a regular mail. When the attached file is a dangerous file, such as when the attached file includes a computer virus, the user can determine that the electronic mail is an attack mail. The user inputs the determination result through the operation unit 203.

  For example, the functions of the receiver communication unit 200, the receiver processing unit 201, the presentation unit 202, and the operation unit 203 are realized by the CPU of the receiver terminal 20 executing the program. The implementation form of this program is the same as the implementation form of the program that implements the functions of the server 10.

  In the first embodiment, the server 10 manages the result of the user's determination on the email including the target-type attack mail as user determination information. As a result, the server 10 can make a determination based on the user determination information for an email from a sender that is difficult to be covered by the conventional black list and white list. That is, the server 10 can determine with high accuracy whether or not the electronic mail is a regular mail.

  FIG. 4 shows an example of the BW list stored in the storage unit 100 of the server 10. As shown in FIG. 4, the BW list has four entries E1, E2, E3, and E4. Each entry includes nine items. Each item includes a sender name, a mail address, a source host domain, a related domain, a regular judgment number, a non-regular judgment number, a reception number, a judgment flag, and an update date.

  The sender name, mail address, and domain of the sender host are sender information. The electronic mail received by the server 10 includes a sender name, a mail address, and a source host domain. The sender name indicates the sender of the electronic mail. The sender name is sender name information. The mail address is the mail address of the transmission source host 30 that sent the e-mail. The mail address is address information. Instead of the email address, the domain of the email address may be used. The domain of the transmission source host is the domain of the transmission source host 30 that has transmitted the e-mail.

  The related domain indicates the domain of the server through which the electronic mail passes. The related domain indicates at least one of a domain related to the domain of the sender's mail address and a domain related to the domain of the source host 30. For example, the server processing unit 102 collects related domains by web crawl based on the domain of the mail address or the domain of the transmission source host 30. The related domain is related domain information. The sender name, mail address, source host domain, and related domain are extracted from the email.

  The normal determination number and the non-normal determination number are user determination information. The regular determination number is the number of users who have determined that the e-mail is a regular mail. The non-regular determination number is the number of users who have determined that the e-mail is not a regular mail. The number of irregular determinations may include the number of users who have determined that the email is an attack email and the number of users who have determined that the email is either a regular email or an attack email. In the first embodiment, the user determination information received from the recipient terminal 20 is stored in the storage unit 100 as frequency information.

  The number of receptions is the number of received emails. Since the user of the recipient terminal 20 can arbitrarily determine whether or not to perform the determination for the e-mail by himself, the user determination information may not be obtained for the received e-mail. For this reason, the sum of the number of normal determinations and the number of non-normal determinations does not necessarily match the number of receptions.

  The determination flag is server determination information. The determination flag indicates whether or not the electronic mail corresponding to each entry is a regular mail. The server processing unit 102 periodically determines whether the e-mail is a regular mail based on the normal determination number and the non-normal determination number, and updates the determination flag based on the determination result. For example, the server processing unit 102 calculates the probability that the e-mail is a regular mail by dividing the normal determination number by the sum of the normal determination number and the non-normal determination number. The server processing unit 102 determines that the e-mail is a regular mail when the probability is equal to or greater than a predetermined threshold. When this probability is less than the predetermined threshold, the server processing unit 102 determines that the e-mail is not a regular mail. The server processing unit 102 may regard the number of receptions as a coefficient of importance, and may make a determination based on the probability and the number of receptions. For example, when the number obtained by dividing the above probability by the number of receptions is equal to or greater than a predetermined threshold, the server processing unit 102 determines that the electronic mail is a regular mail. When the number obtained by dividing the above probability by the number of receptions is less than a predetermined threshold, the server processing unit 102 determines that the electronic mail is not a regular mail.

  Instead of the determination flag, the e-mail may be registered in a BW list such as the probability that the e-mail is a regular mail. The BW list may not include the determination flag. For example, when the e-mail is received, the server processing unit 102 may determine whether or not the e-mail corresponding to each entry is a regular mail based on the normal determination number and the non-normal determination number. . As a result, server determination information corresponding to the determination flag is generated.

  The update date is the date when each entry was last updated. The server processing unit 102 matches at least one of the sender name, the mail address, the source host domain, and the related domain extracted from the newly received e-mail with the information registered in the BW list. If not, create a new entry in the BW list. When only the related domain does not match among these four items, the related domain may be added to the related domain of the entry existing in the BW list.

  The operation of the server 10 will be described. FIG. 5 shows an operation procedure of the server 10.

(Step S100)
The server communication unit 101 receives an e-mail from the transmission source host 30 and outputs the received e-mail to the server processing unit 102. The electronic mail transmitted from the transmission source host 30 passes through the server 10 in the middle of the route transferred to the recipient terminal 20.

(Step S101)
After the email is received, the server processing unit 102 extracts sender information from the email.

(Step S102)
After the sender information is extracted, the server processing unit 102 determines whether the electronic mail is a regular mail through mail determination processing, and generates server determination information. Details of the mail determination process will be described later. For example, the server determination information indicates any one of regular mail, attack mail, and unknown mail. Unknown mail is mail that cannot be specified as either one of regular mail or attack mail. The server processing unit 102 outputs an email with the server determination information added to the server communication unit 101.

(Step S103)
After the mail determination process is performed, the server communication unit 101 transmits an e-mail with the server determination information added to the recipient terminal 20. As a result, the server communication unit 101 transmits the e-mail and the server determination information to the recipient terminal 20. The server processing unit 102 may transmit the e-mail and the server determination information to the recipient terminal 20 separately.

(Step S104)
After the e-mail and the server determination information are transmitted, the server communication unit 101 receives the user determination information from the recipient terminal 20 and outputs the received user determination information to the server processing unit 102.

(Step S105)
The server processing unit 102 updates the BW list stored in the storage unit 100 based on the user determination information. That is, the server processing unit 102 increases the normal determination number or the non-normal determination number in the BW list by 1 according to the content of the user determination information. The server processing unit 102 further increases the number of receptions in the BW list by one. The server 10 repeatedly performs a series of processes from step S100 to step S105.

  The operation of the recipient terminal 20 will be described. FIG. 6 shows an operation procedure of the recipient terminal 20.

(Step S200)
The recipient communication unit 200 receives an email with the server determination information added from the server 10. Thereby, the recipient communication unit 200 receives the e-mail and the server determination information from the server 10. The recipient communication unit 200 outputs the received electronic mail and server determination information to the recipient processing unit 201.

(Step S201)
The recipient processing unit 201 outputs server determination information to the presentation unit 202. The presentation unit 202 presents server determination information to the user of the recipient terminal 20. Thereby, the user can know the result of the server 10 determining whether or not the electronic mail is a regular mail.

(Step S202)
After the server determination information is presented to the user, the operation unit 203 accepts an input operation of the user's determination result for the e-mail, and outputs information corresponding to the determination result to the recipient processing unit 201. The receiver processing unit 201 generates user determination information based on this information. For example, when the determination result indicates regular mail, the recipient processing unit 201 generates user determination information indicating that the electronic mail is regular mail. When the determination result indicates an attack mail, the recipient processing unit 201 generates user determination information indicating that the electronic mail is an attack mail. The receiver processing unit 201 outputs the generated user determination information to the receiver communication unit 200. At this time, the presentation unit 202 may present an email to the user. For example, the presentation unit 202 may display an e-mail. The user makes a determination on the e-mail based on the URL described in the e-mail or an attached file attached to the e-mail.

(Step S203)
After the user determination information is generated, the receiver communication unit 200 transmits the user determination information to the server 10 (step S203). The recipient terminal 20 repeatedly performs a series of processes from step S200 to step S203.

  It is not necessary for the user to make the above determination for all e-mails. For this reason, the process in step S202 and step S203 may not be performed. When the receiver terminal 20 does not perform the processes in steps S202 and S203, the server 10 does not perform the processes in steps S104 and S105.

  The mail determination process in step S102 will be described. 7, 8 and 9 show the procedure of the mail determination process.

(Step S300)
The server processing unit 102 determines whether there is an entry whose sender name matches the sender name of the e-mail among the entries in the BW list. If there is an entry whose sender name matches the sender name of the electronic mail, the process in step S301 is performed. If there is no entry whose sender name matches the sender name of the e-mail, the process in step S306 is performed.

(Step S301)
As a result of the determination in step S300, the BW list entry partially matches the information included in the e-mail. The server processing unit 102 determines whether there is an entry whose mail address matches the mail address of the e-mail among the partially matching entries. If there is an entry whose mail address matches the mail address of the electronic mail, the process in step S302 is performed. If there is no entry whose email address matches the email address of the email, the process in step S303 is performed.

(Step S302)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the e-mail among the partially matched entries. If there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the electronic mail, the processing in step S308 is performed. If there is no entry in which the domain of the sender host 30 matches the domain of the sender host 30 of the e-mail, the process in step S305 is performed.

(Step S303)
As a result of the determination in step S300, the BW list entry partially matches the information included in the e-mail. The server processing unit 102 determines whether or not there is an entry whose mail address domain is similar to the domain of the email sender address among the partially matching entries. If there is an entry whose email address domain is similar to the email sender address domain, the processing in step S304 is performed. If there is no entry whose email address domain is similar to the domain of the email sender email address, the processing in step S307 is performed.

(Step S304)
As a result of the determination in step S300, the BW list entry partially matches the information included in the e-mail. The server processing unit 102 determines whether or not the related domain of the partially matching entry matches the domain of the email sender email address. If the related domain of the partially matching entry matches the domain of the email sender email address, the process in step S302 is performed. If the related domain of the partially matching entry does not match the domain of the e-mail sender mail address, the process in step S307 is performed.

(Step S305)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether or not the related domain of the partially matching entry matches the domain of the email transmission source host 30. If the related domain of the partially matching entry matches the domain of the e-mail transmission source host 30, the process in step S308 is performed. If the related domain of the partially matching entry does not match the domain of the e-mail transmission source host 30, the process in step S311 is performed.

(Step S306)
The server processing unit 102 determines whether there is an entry whose email address matches the email address of the email. If there is an entry whose mail address matches the mail address of the electronic mail, the process in step S308 is performed. If there is no entry whose email address matches the email address of the email, the process in step S313 is performed.

(Step S307)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the e-mail among the partially matched entries. If there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the electronic mail, the processing in step S308 is performed. If there is no entry whose sender host domain matches the domain of the email sender host 30, the process in step S310 is performed.

(Step S308)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether or not the partially matching entry is a regular mail entry. When the determination flag indicates regular mail, the entry is a regular mail entry. If the determination flag indicates non-regular mail, the entry is not a regular mail entry. If the partially matching entry is a regular mail entry, the process in step S309 is performed. If the partially matching entry is not a regular mail entry, the process in step S312 is performed.

(Step S309)
The server processing unit 102 determines that the electronic mail is a regular mail. The server processing unit 102 generates server determination information indicating the determination result, and outputs an electronic mail to which the server determination information is added to the server communication unit 101.

(Step S310)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether or not the related domain of the partially matching entry matches the domain of the email transmission source host 30. If the related domain of the partially matching entry matches the domain of the e-mail transmission source host 30, the process in step S308 is performed. If the related domain of the partially matching entry does not match the domain of the e-mail transmission source host 30, the process in step S311 is performed.

(Step S311)
As a result of the determination in step S300 or the like, the entry in the BW list partially matches the information included in the e-mail. The server processing unit 102 determines whether or not the partially matching entry is a regular mail entry. If the partially matching entry is a regular mail entry, the process in step S312 is performed. If the partially matching entry is not a regular mail entry, the process in step S317 is performed.

(Step S312)
The server processing unit 102 determines that the electronic mail is an attack mail. The server processing unit 102 generates server determination information indicating the determination result, and outputs an electronic mail to which the server determination information is added to the server communication unit 101.

(Step S313)
The server processing unit 102 determines whether there is an entry whose mail address is similar to the mail address of the e-mail. If there is an entry whose email address is similar to the email address of the email, the process in step S314 is performed. If there is no entry whose mail address is similar to the mail address of the electronic mail, the process in step S317 is performed.

(Step S314)
As a result of the determination in step S313, the entry in the BW list is partially similar to the information included in the e-mail. The server processing unit 102 determines whether or not the related domain of the partially similar entry matches the email sender email address domain. If the related domain of the partially similar entry matches the sender mail address domain of the email, the process in step S302 is performed. If the related domain of the partially similar entry does not match the sender email address domain of the email, the process in step S315 is performed.

(Step S315)
As a result of the determination in step S313, the entry in the BW list is partially similar to the information included in the e-mail. The server processing unit 102 determines whether or not there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the email among the partially similar entries. When there is an entry in which the domain of the transmission source host matches the domain of the transmission source host 30 of the e-mail among the partially similar entries, the process in step S308 is performed. If there is no entry whose domain of the transmission source host matches the domain of the transmission source host 30 of the e-mail among the partially similar entries, the process in step S316 is performed.

(Step S316)
As a result of the determination in step S313, the entry in the BW list is partially similar to the information included in the e-mail. The server processing unit 102 determines whether or not the related domain of the partially similar entry matches the domain of the email transmission source host 30. If the related domain of the partially similar entry matches the domain of the e-mail transmission source host 30, the process in step S308 is performed. If the related domain of the partially similar entry does not match the domain of the e-mail transmission source host 30, the process in step S311 is performed.

(Step S317)
The server processing unit 102 determines that the electronic mail is an unknown mail. The server processing unit 102 generates server determination information indicating the determination result, and outputs an electronic mail to which the server determination information is added to the server communication unit 101.

  If the result of the determination in step S316 is negative, the server processing unit 102 determines the source host of the entry that is partially similar to the domain of the email address of the email and the domain of the source host 30 and the BW list. The whois information of the domain and related domains may be searched. If each registrant has a commonality between each domain of the e-mail and each domain of a partially similar entry in the BW list, transmission belonging to the same organization or organization as the sender of the regular mail in the BW list There is a high possibility that an e-mail from the person has been received. In this case, the server processing unit 102 may determine that the electronic mail is a regular mail.

  A specific example of the mail determination process will be described. Hereinafter, five cases will be described. 10 to 14 show the state of each case. In each figure, items of the BW list excluding the normal determination number, the non-normal determination number, the reception number, and the update date are shown.

(First case)
FIG. 10 shows a state in the first case. The sender name of the e-mail received by the server 10 is “no to momoji”, the mail address is “henoheno@A.com”, and the domain of the source host 30 is “mail. A.com ".

  The sender name of the e-mail “Momoji” is the same as the sender name of the entry E1 in the BW list (step S300). “Henoheno@A.com”, which is the e-mail address of the e-mail, matches with “henoheno@A.com”, which is the e-mail address of the entry E1 in the BW list (step S301). “Mail.A.com”, which is the domain of the sender host 30 of the e-mail, matches “mail.A.com”, which is the domain of the sender host of the entry E1 in the BW list (step S302). The determination flag of the entry E1 in the BW list indicates that the electronic mail corresponding to the entry E1 is a regular mail (step S308). Therefore, the server processing unit 102 determines that the electronic mail is a regular mail and generates server determination information indicating the regular mail (step S309).

  In the first case, regarding the combination of the sender name, the mail address, and the domain of the transmission source host, the e-mail information matches the regular mail information in the BW list. In this case, the electronic mail received by the server 10 is determined to be a regular mail.

(Second case)
FIG. 11 shows a state in the second case. The sender name of the e-mail received by the server 10 is “no to moji”, the mail address is “henoheno@ya--huhu.com”, and the domain of the source host 30 is “Mail.du--mmy.com”.

  The sender name of the e-mail “Momoji no Nihongo” coincides with the name of the sender of the entry E1 of the BW list “Momoji no Niji” (step S300). The email address “henoheno@ya--huhu.com”, which is the e-mail address, does not match “henoheno@A.com”, which is the mail address of the entry E1 in the BW list (step S301). “Ya--huhu.com” that is the domain of the email address of the electronic mail is not similar to “A.com” that is the domain of the email address of the entry E1 of the BW list (step S303).

  "Mail.du--mmy.com", which is the domain of the e-mail transmission source host 30, does not match "mail.A.com", which is the domain of the transmission source host of the entry E1 in the BW list (step S307). . “Mail.du--mmy.com”, which is the domain of the e-mail source host 30, is “A--another.com” and “A--test.com”, which are related domains of the entry E1 of the BW list. (Step S310). The determination flag of the entry E1 in the BW list indicates that the electronic mail corresponding to the entry E1 is a regular mail (step S311). Therefore, the server processing unit 102 determines that the electronic mail is an attack mail and generates server determination information indicating the attack mail (step S312).

  In the second case, the sender name of the electronic mail matches the sender name of the regular mail in the BW list. However, regarding the combination of the email address of the email and the domain of the sender host, the email information and the regular email information in the BW list do not match. In this case, there is a high possibility that the sender name of the e-mail is forged. For this reason, the electronic mail received by the server 10 is determined to be an attack mail.

(Third case)
FIG. 12 shows a state in the third case. The sender name of the e-mail received by the server 10 is “no to momoji”, the mail address is “henoheno@A.com”, and the domain of the source host 30 is “mail. du--mmy.com ".

  The sender name of the e-mail “Momoji” is the same as the sender name of the entry E1 in the BW list (step S300). “Henoheno@A.com”, which is the e-mail address of the e-mail, matches with “henoheno@A.com”, which is the e-mail address of the entry E1 in the BW list (step S301). “Mail.du--mmy.com”, which is the domain of the e-mail transmission source host 30, does not match “mail.A.com”, which is the domain of the transmission source host of the entry E1 in the BW list (step S302). . “Mail.du--mmy.com”, which is the domain of the e-mail source host 30, is “A--another.com” and “A--test.com”, which are related domains of the entry E1 of the BW list. (Step S305). The determination flag of the entry E1 in the BW list indicates that the electronic mail corresponding to the entry E1 is a regular mail (step S311). Therefore, the server processing unit 102 determines that the electronic mail is an attack mail and generates server determination information indicating the attack mail (step S312).

  In the third case, the sender name of the electronic mail matches the sender name of the regular mail in the BW list. Also, the e-mail address matches the e-mail address of the regular mail in the BW list. However, the domain of the e-mail transmission source host 30 does not match the domain of the regular mail transmission source host in the BW list. In this case, there is a high possibility that the sender name of the e-mail is forged. For this reason, the electronic mail received by the server 10 is determined to be an attack mail.

(Fourth case)
FIG. 13 shows a state in the fourth case. The sender name of the email received by the server 10 is “pekepeke pon”, the email address is “henoheno@A-test.com”, and the domain of the source host 30 is “A--”. another.com ".

  The sender name of the e-mail “pekepeke pon” does not match the sender name of any entry in the BW list (step S300). The email address “henoheno@A-test.com” which is the email address does not match the email address of any entry in the BW list (step S306). “Henoheno@A-test.com”, which is the e-mail address of the e-mail, is similar to “henoheno@A.com”, which is the e-mail address of the entry E1 in the BW list (step S313). “A-test.com”, which is the domain of the email address of the electronic mail, matches “A--test.com”, which is the related domain of the entry E1 in the BW list (step S314).

  “A-another.com”, which is the domain of the e-mail transmission source host 30, does not match “mail.A.com”, which is the domain of the transmission source host of the entry E1 in the BW list (step S302). “A-another.com” that is the domain of the e-mail transmission source host 30 matches “A-another.com” that is the related domain of the entry E1 of the BW list (step S305). The determination flag of the entry E1 in the BW list indicates that the electronic mail corresponding to the entry E1 is a regular mail (step S308). Therefore, the server processing unit 102 determines that the electronic mail is a regular mail and generates server determination information indicating the regular mail (step S309).

  In the fourth case, regarding the combination of the sender name and email address of the email, the email information does not match the regular email information in the BW list. The e-mail address is similar to the regular e-mail address in the BW list. In this case, the electronic mail may be a targeted attack mail. The domain of the e-mail address matches the related domain of regular mail in the BW list. Further, the domain of the e-mail transmission source host 30 matches the related domain of the regular mail in the BW list. In this case, it is highly likely that an e-mail has been received from a sender belonging to the same group or organization as the sender of the regular mail in the BW list. For this reason, the electronic mail received by the server 10 is determined to be a regular mail.

(Fifth case)
FIG. 14 shows a state in the fifth case. The sender name of the email received by the server 10 is “pekepeke pon”, the email address is “henoheno@A-du--mmy.com”, and the domain of the source host 30 is “mail”. .Du--mmy.com ".

  The sender name of the e-mail “pekepeke pon” does not match the sender name of any entry in the BW list (step S300). The e-mail address “henoheno@A-du--mmy.com” does not match the e-mail address of any entry in the BW list (step S306). “Henoheno@A-du--mmy.com”, which is the e-mail address of the e-mail, is similar to “henoheno@A.com”, which is the e-mail address of the entry E1 in the BW list (step S313). “A-du--mmy.com” that is the domain of the email address of the electronic mail does not match “A-test.com” that is the related domain of the entry E1 of the BW list (step S314).

  “Mail.du--mmy.com”, which is the domain of the email transmission source host 30, does not match “mail.A.com”, which is the domain of the transmission source host of the entry E1 in the BW list (step S315). . “Mail.du--mmy.com”, which is the domain of the e-mail source host 30, is “A--another.com” and “A--test.com”, which are related domains of the entry E1 of the BW list. (Step S316). The determination flag of the entry E1 in the BW list indicates that the electronic mail corresponding to the entry E1 is a regular mail (step S311). Therefore, the server processing unit 102 determines that the electronic mail is an attack mail and generates server determination information indicating the attack mail (step S312).

  In the fifth case, regarding the combination of the sender name and email address of the email, the email information does not match the regular email information in the BW list. The e-mail address is similar to the regular e-mail address in the BW list. In this case, the electronic mail may be a targeted attack mail. The domain of the e-mail address does not match the related domain of the regular mail in the BW list. Further, the domain of the e-mail transmission source host 30 does not match the domain of the regular mail transmission source host and the related domain in the BW list. In this case, there is a high possibility that the electronic mail is a targeted attack mail. For this reason, the electronic mail received by the server 10 is determined to be an attack mail.

  In the first embodiment, the storage unit 100 may store URL information indicating a URL described in an e-mail in association with sender information and user determination information. For example, a URL may be added to each entry in the BW list. The server processing unit 102 compares the sender information included in the email received by the server communication unit 101 with the sender information stored in the storage unit 100 and the email received by the server communication unit 101. Based on the result of comparing the URL included in the URL and the URL information stored in the storage unit 100, and selecting one of the user determination information stored in the storage unit 100, and the selected user determination information The server determination information may be generated based on the above. For example, a URL described in an e-mail transmitted from a true sender is registered in the BW list. There is a high possibility that the user determination information for this electronic mail indicates a regular mail. When an attack mail is transmitted from a sender disguised as a true sender, a URL different from the URL described in the regular electronic mail is described in the attack mail. The user determination information for the attack mail has a high possibility of indicating the attack mail. For example, when the email determination process determines that the email is an unknown email, the server processing unit 102 may generate server determination information based on the user determination information corresponding to the URL included in the email. By using the URL information in addition to the sender information for the determination, the server 10 can determine with high accuracy whether or not the electronic mail is a regular mail.

  In the first embodiment, the storage unit 100 may store file information indicating an attached file attached to an e-mail in association with sender information and user determination information. For example, file information may be added to each entry in the BW list. For example, the file information is a hash value of the attached file. The server processing unit 102 compares the sender information included in the email received by the server communication unit 101 with the sender information stored in the storage unit 100 and the email received by the server communication unit 101. One of the user determination information stored in the storage unit 100 is selected and selected based on the result of comparing the information of the attached file included in the file and the file information stored in the storage unit 100 The server determination information may be generated based on the user determination information. For example, information on an attached file attached to an e-mail transmitted from a true sender is registered in the BW list. There is a high possibility that the user determination information for this electronic mail indicates a regular mail. When an attack mail is transmitted from a sender disguised as a true sender, a file different from the file attached to the regular electronic mail is attached to the attack mail. The user determination information for the attack mail is highly likely to indicate the attack mail. For example, when the email determination process determines that the email is an unknown email, the server processing unit 102 may generate server determination information based on the user determination information corresponding to the attached file attached to the email. By using the file information for determination in addition to the sender information, the server 10 can determine whether or not the electronic mail is a regular mail with higher accuracy.

  As described above, in the first embodiment, the server 10 determines whether or not the email is a regular email based on the user determination information corresponding to the sender information included in the email. For this reason, the server 10 can determine whether or not the electronic mail is a regular mail with higher accuracy. It is possible to determine that the server 10 is an attack mail not only for a target-type attack mail but also for a spam mail and a phishing mail. By using the mail determination technology provided in the first embodiment in combination with the conventional filter, it is possible to perform mail determination with higher completeness.

  Based on the user determination information transmitted from the recipient terminal 20, the user determination information stored in the storage unit 100 of the server 10 is automatically updated. For this reason, management of user determination information is easy.

  Since it is easy to disguise the sender name and the mail address, the reliability of the white list for such information is low in the prior art. However, since it is difficult to impersonate the domain of the transmission source host 30, by making a determination by combining this information with the sender information, the server 10 can determine whether or not the electronic mail is a legitimate mail. The accuracy can be determined.

  In a filtering technique such as spam mail, information related to an electronic mail reaching a group or organization is often transmitted to a security vendor that provides the filter and analyzed within the security vendor. However, for an organization or organization that owns a mail server, there is a case where a business partner's mail address, mail text, etc. can be confidential information. For this reason, it is difficult to provide information on electronic mail to the outside or to share blacklist and whitelist information between different organizations. For this reason, the server 10 is preferably a server managed by an organization or organization in which the recipient terminal 20 is used. This solves the problem of providing or sharing information.

(Second Embodiment)
FIG. 15 shows the configuration of the communication system 2 according to the second embodiment of the present invention. As illustrated in FIG. 15, the communication system 2 includes a server 11 and a receiver terminal 21.

  For example, the server 11 is a server managed by an organization or organization in which the recipient terminal 21 is used. The server 11 does not have to have a mail server function. For example, the receiver terminal 21 is a terminal used by a person belonging to a specific group or organization. The e-mail transmitted from the transmission source host 30 is received by the receiver terminal 21 via the mail server 40.

  The configuration of the server 11 is the same as the configuration of the server 10 shown in FIG. The storage unit 100 shows sender information indicating the sender of the email and a determination result determined by the user of the recipient terminal 21 whether or not the email sent from the sender host 30 is a regular email. The determination information is associated and stored. The server communication unit 101 receives sender information from the receiver terminal 21. The server communication unit 101 transmits server determination information indicating the result of the server processing unit 102 determining whether or not the electronic mail is a regular mail to the recipient terminal 21. The server communication unit 101 receives user determination information from the receiver terminal 21. The server processing unit 102 generates server determination information based on the user determination information corresponding to the sender information received by the server communication unit 101 among the user determination information stored in the storage unit 100. The server processing unit 102 outputs the generated server determination information to the server communication unit 101. The server processing unit 102 updates the user determination information stored in the storage unit 100 based on the user determination information received by the server communication unit 101.

  The configuration of the recipient terminal 21 is the same as that of the recipient terminal 20 shown in FIG. The receiver communication unit 200 receives an email including sender information from the transmission source host 30. The receiver communication unit 200 transmits the sender information and user determination information included in the received e-mail to the server 11. The receiver communication unit 200 receives server determination information from the server 11. The receiver processing unit 201 generates user determination information based on an instruction from the user of the receiver terminal 21, and outputs the generated user determination information to the receiver communication unit 200. The presentation unit 202 presents server determination information to the user of the recipient terminal 21. The operation unit 203 receives an operation by a user of the recipient terminal 21.

  The operation of the server 11 will be described. FIG. 16 shows an operation procedure of the server 11. Hereinafter, differences from the operation of the server 10 illustrated in FIG. 5 will be described.

(Step S110)
The server communication unit 101 receives sender information from the receiver terminal 21.

  After the sender information is received, the mail determination process in step S102 is performed. The mail determination process in step S102 shown in FIG. 16 is the same as the mail determination process in step S102 shown in FIG.

(Step S111)
After the mail determination process is performed, the server communication unit 101 transmits server determination information to the recipient terminal 21.

  After the server determination information is transmitted, processing in each of step S104 and step S105 is performed. The process in each of step S104 and step S105 shown in FIG. 16 is the same as the process in each of step S104 and step S105 shown in FIG.

  The operation of the receiver terminal 21 will be described. FIG. 17 shows an operation procedure of the receiver terminal 21. Hereinafter, differences from the operation of the receiver terminal 20 illustrated in FIG. 6 will be described.

(Step S210)
The recipient communication unit 200 receives an e-mail from the transmission source host 30 and outputs the received e-mail to the recipient processing unit 201. This e-mail is an e-mail that passes through the mail server 40.

(Step S211)
After the e-mail is received, the recipient processing unit 201 extracts sender information from the e-mail. The receiver processing unit 201 outputs the extracted sender information to the receiver communication unit 200.

(Step S212)
After the sender information is extracted, the receiver communication unit 200 transmits the sender information to the server 11.

(Step S213)
After the sender information is transmitted, the receiver communication unit 200 receives the server determination information from the server 11 and outputs the received server determination information to the receiver processing unit 201.

  After the server determination information is received, the processing in each of steps S201 to S203 is performed. The processes in steps S201 to S203 shown in FIG. 17 are the same as the processes in steps S201 to S203 shown in FIG.

  The receiver terminal 21 may transmit the sender information to the server 11 by transferring the email received from the transmission source host 30 to the server 11.

  In the second embodiment, the server 11 can determine with high accuracy whether or not the electronic mail is a regular mail.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. .

  1, 2 communication system 10, 11 server, 20, 21 recipient terminal, 30 sender host, 40 mail server, 100 storage unit, 101 server communication unit, 102 server processing unit, 200 recipient communication unit, 201 recipient Processing unit 202 Presentation unit 203 Operation unit

Claims (9)

A server and a recipient terminal;
The server
The sender information indicating the sender of the e-mail and the determination result of the user of the receiver terminal determining whether or not the e-mail transmitted from the sender host that is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information to be displayed;
The electronic mail including the sender information is received from the transmission source host, and the electronic mail and server determination information indicating a result of determination by a server processing unit as to whether or not the electronic mail is a regular mail. A server communication unit that transmits to the recipient terminal and receives the user determination information from the recipient terminal;
Generating the server determination information based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit among the user determination information stored in the storage unit; and The server process for outputting the generated server determination information to the server communication unit and updating the user determination information stored in the storage unit based on the user determination information received by the server communication unit And
Have
The recipient terminal is
A receiver communication unit that receives the electronic mail and the server determination information from the server and transmits the user determination information to the server;
A presentation unit for presenting the server determination information to a user of the recipient terminal;
A receiver processing unit that generates the user determination information based on an instruction from the user, and outputs the generated user determination information to the receiver communication unit;
A communication system characterized by comprising: A server and a recipient terminal;
The server
The sender information indicating the sender of the e-mail and the determination result of the user of the receiver terminal determining whether or not the e-mail transmitted from the sender host that is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information to be displayed;
The server information is received from the receiver terminal, and server determination information indicating a result of the server processing unit determining whether the electronic mail is a regular mail is transmitted to the receiver terminal, and the user A server communication unit for receiving determination information from the recipient terminal;
The server determination information is generated based on the user determination information corresponding to the sender information received by the server communication unit among the user determination information stored in the storage unit, and the generated server determination The server processing unit that outputs information to the server communication unit and updates the user determination information stored in the storage unit based on the user determination information received by the server communication unit;
Have
The recipient terminal is
Receiving the e-mail including the sender information from the transmission source host, transmitting the sender information and the user determination information included in the received e-mail to the server, and the server determination information. A receiver communication unit that receives from the server;
A presentation unit for presenting the server determination information to a user of the recipient terminal;
A receiver processing unit that generates the user determination information based on an instruction from the user, and outputs the generated user determination information to the receiver communication unit;
A communication system characterized by comprising:   3. The sender information according to claim 1, wherein the sender information includes at least one of sender name information indicating a sender name and address information indicating a mail address of the sender. Communications system.   The communication system according to any one of claims 1 to 3, wherein the sender information includes domain information indicating a domain of the transmission source host. The storage unit further includes related domain information indicating at least one of a domain related to the domain of the sender's mail address and a domain related to the domain of the source host, the sender information and the user determination information. Associated with and remembers
The server processing unit is received by the server communication unit as a result of comparing the sender information included in the e-mail received by the server communication unit with the sender information stored in the storage unit. The storage based on the result of comparing at least one of the domain of the email address of the sender of the email and the domain of the sender host of the email with the related domain information stored in the storage unit The server determination information is generated based on the selected user determination information and any one of the user determination information stored in the section is selected. A communication system according to claim 1. The sender information indicating the sender of the e-mail and the determination result determined by the user of the receiver terminal whether or not the e-mail transmitted from the sender host which is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information;
The electronic mail including the sender information is received from the transmission source host, and the electronic mail and server determination information indicating a result of determination by a server processing unit as to whether or not the electronic mail is a regular mail. A server communication unit that transmits to the recipient terminal and receives the user determination information from the recipient terminal;
Generating the server determination information based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit among the user determination information stored in the storage unit; and The server process for outputting the generated server determination information to the server communication unit and updating the user determination information stored in the storage unit based on the user determination information received by the server communication unit And
The server characterized by having. The sender information indicating the sender of the e-mail and the determination result determined by the user of the receiver terminal whether or not the e-mail transmitted from the sender host which is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information;
The server information is received from the receiver terminal, and server determination information indicating a result of the server processing unit determining whether the electronic mail is a regular mail is transmitted to the receiver terminal, and the user A server communication unit for receiving determination information from the recipient terminal;
The server determination information is generated based on the user determination information corresponding to the sender information received by the server communication unit among the user determination information stored in the storage unit, and the generated server determination The server processing unit that outputs information to the server communication unit and updates the user determination information stored in the storage unit based on the user determination information received by the server communication unit;
The server characterized by having. The sender information indicating the sender of the e-mail and the determination result determined by the user of the receiver terminal whether or not the e-mail transmitted from the sender host which is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information;
The electronic mail including the sender information is received from the transmission source host, and the electronic mail and server determination information indicating a result of determination by a server processing unit as to whether or not the electronic mail is a regular mail. A server communication unit that transmits to the recipient terminal and receives the user determination information from the recipient terminal;
Generating the server determination information based on the user determination information corresponding to the sender information included in the e-mail received by the server communication unit among the user determination information stored in the storage unit; and The server process for outputting the generated server determination information to the server communication unit and updating the user determination information stored in the storage unit based on the user determination information received by the server communication unit And
A receiver terminal that communicates with a server comprising:
A receiver communication unit that receives the electronic mail and the server determination information from the server and transmits the user determination information to the server;
A presentation unit for presenting the server determination information to a user of the recipient terminal;
A receiver processing unit that generates the user determination information based on an instruction from the user, and outputs the generated user determination information to the receiver communication unit;
A receiver terminal characterized by comprising: The sender information indicating the sender of the e-mail and the determination result determined by the user of the receiver terminal whether or not the e-mail transmitted from the sender host which is the sender's terminal is a regular mail. A storage unit that associates and stores user determination information;
The server information is received from the receiver terminal, and server determination information indicating a result of the server processing unit determining whether the electronic mail is a regular mail is transmitted to the receiver terminal, and the user A server communication unit for receiving determination information from the recipient terminal;
The server determination information is generated based on the user determination information corresponding to the sender information received by the server communication unit among the user determination information stored in the storage unit, and the generated server determination The server processing unit that outputs information to the server communication unit and updates the user determination information stored in the storage unit based on the user determination information received by the server communication unit;
A receiver terminal that communicates with a server comprising:
Receiving the e-mail including the sender information from the transmission source host, transmitting the sender information and the user determination information included in the received e-mail to the server, and the server determination information. A receiver communication unit that receives from the server;
A presentation unit for presenting the server determination information to a user of the recipient terminal;
A receiver processing unit that generates the user determination information based on an instruction from the user, and outputs the generated user determination information to the receiver communication unit;
A receiver terminal characterized by comprising:

Images