JP2021005348A - Suspicious mail management system - Google Patents

Abstract

To provide a suspicious mail management system which can increase the level of management against suspicious mails in management units such as companies or organizations.SOLUTION: The suspicious mail management system includes: a mail server 1 for receiving mails in management units; a suspicion level determination unit 10 for determining the suspicion level of received mails from suspicious mail-related information; a suspicious mail sending target person specification unit 11 for specifying a suspicious mail sending target person; an attention attraction information notification unit 12 for notifying a plurality of target persons selected in advance in management units without sending a suspicious mail if the suspicion level is high; a suspicious mail sending unit 14 for sending a suspicious mail along with the attention attraction information to the target persons if the suspicion level is low; and a suspicious mail management method notification unit 18 for showing information on how to manage a suspicious mail to the target persons; and a suspicious mail management information instruction display unit 19 for displaying the suspicious mail sending target person and the suspicious mail management information to each terminal.SELECTED DRAWING: Figure 1

Description

The present invention relates to a computer system that takes measures to reduce the risk of suspicious emails.

Conventionally, various computer software for selecting suspicious emails such as emails containing computer viruses have been developed. In addition, software and systems for removing suspicious emails have been developed and sold.

For example, the invention according to Patent Document 1 below is an invention made focusing on a problem that it is not possible to know what kind of data is contained in the selected e-mail unless it is reproduced, or all the data cannot be reproduced by one operation. ..

That is, the invention described in Patent Document 1 includes a means for selecting a specific e-mail from a list of stored e-mails, a means for analyzing the selected e-mail and presenting a structure to the user, and the selection. When the e-mail is selected again, when all the data contained in the e-mail is reproduced and the specific data contained in the e-mail is selected from the structure of the e-mail, the data is selected. A means for reproducing the data, a means for determining whether or not the data contains a computer virus before the reproduction, and as a result, if the data contains a computer virus, the reproduction of the data is stopped and the data is displayed. An e-mail device that has a means of presenting to a user that it contains a computer virus.
It is stated that by adopting such a configuration, it is possible to protect the user from computer viruses contained in the e-mail while maintaining the merit of being able to list a plurality of data contained in the e-mail.

JP-A-2004-355372

The present inventor has been working on the development of a practical suspicious e-mail countermeasure system by examining the suspicious e-mail countermeasures such as the above-mentioned prior art. In the development process, I came to realize that it is important to solve the following new problems (A) to (D).
(A) Conventional technology mainly detects viruses and the like attached to received emails, and when specific data is selected, means for reproducing the data, for example, decompression software for decompressing compressed data. Many configurations focus on finding viruses, etc. by starting display software.
However, in reality, suspicious emails are diverse and dangerous.
(A) Suspicious emails displaying information that leads to a phishing URL,
(B) Suspicious e-mails aimed at sending a large amount of e-mails and allowing some people in the company to inject viruses, etc. into the company's computer by receiving incorrect e-mails.
(C) Virus-free, suspicious emails that deceive customers in business, or suspicious emails that attempt to steal important information by "spoofing" that pretends to be internal or external personnel.
(E) There are suspicious e-mails that do not involve a computer trying to acquire inside information by inquiry e-mails created by humans.
The conventional technology has a problem that it cannot appropriately respond to such a wide variety of attacks.

(B) Conventionally, a commonly used method for dealing with suspicious emails is to execute antivirus software that analyzes, selects, and removes received emails that are considered dangerous in a computer space such as a server that can prevent infection by various viruses. It is a configuration to be used. In such a configuration, for example, when the structure of a suspicious email is complicated and sophisticated, it often takes a long time to analyze and judge the risk. In such a case, if the e-mail is a normal and legitimate customer contact e-mail, there is a problem that time loss and economic loss become large.

(C) As a countermeasure against suspicious emails using machine learning, a method of uniformly processing suspicious emails by an advanced artificial intelligence algorithm such as deep learning is often adopted. However, in the case of artificial intelligence software, the response by suspicious email is often so-called tacit knowledge, and there is a problem that it is difficult to feed back useful information for the company such as know-how on countermeasures against suspicious email. In addition, even if it is an excellent computer virus artificial intelligence search software, it is a risk for the company to leave all the judgment of suspicious mail response to artificial intelligence if the judgment of the computer virus artificial intelligence search software is wrong. There is also the problem that it is large.

(D) Many people are involved in mail processing within the company, and one external mail is often sent to multiple people within the company by group mail or the like. At present, taking measures against suspicious emails in response to such complicated internal organization and group activity status is a human response, so in the event of an abnormal situation or threat situation, we will respond. There was a problem that I was late.

An object of the present invention is to provide a suspicious email countermeasure system capable of solving the problems of the above-mentioned prior art.
An example of a specific purpose is as follows.
(A) Provide a suspicious email countermeasure system that can improve the response level to a wide variety of suspicious emails in the management unit of a company or various organizations.
(B) To provide a suspicious e-mail countermeasure system that can both process suspicious e-mails by a computer and perform human confirmation work and improve the response level to the threat of suspicious e-mails.
(C) Provide a suspicious e-mail countermeasure system that can deal with suspicious e-mails received by considering the balance between threat level countermeasure processing and economic loss.
The problems of the inventions other than those described above, the means for solving the problems, and the effects thereof will be described in detail in the description in the specification described later.

The present invention can be expressed in many ways. For example, a typical one is configured as follows.
The suspicious e-mail countermeasure system according to the first invention includes an e-mail receiving means for receiving an e-mail of a target management unit and an e-mail receiving means.
A suspicious level determination unit that determines the suspicious level of the received e-mail from the e-mail suspicious related information of the e-mail received by the e-mail receiving means, and
A suspicious email transmission target person identification unit that identifies a suspicious email transmission target person regarding the suspicious email that is determined to be a suspicious email by the suspicious level determination unit,
When the suspicious level is equal to or higher than the first set value, the suspicious e-mail is not sent, and the alert information notification unit that notifies the alert information to a plurality of preselected target persons of the management unit.
When the suspicious level is smaller than the first set value, the suspicious mail sending unit that sends the suspicious mail together with the warning information to the suspicious mail sending target person,
A suspicious e-mail coping method notification unit that conveys information on how to deal with the suspicious e-mail to the person to whom the suspicious e-mail is sent.
A suspicious email handling information instruction display unit that displays the suspicious email sending target person and its suspicious email handling information on each necessary terminal on the system.
It is characterized by having.

With this configuration, in the processing of the alert information notification unit, when the suspicious level is equal to or higher than the first set value, the suspicious email is not sent, and the alert information is sent to a plurality of preselected target persons in the management unit. Therefore, in the management unit of a company, various organizations, government agencies, etc., it is possible to call attention to suspicious emails to the management unit. In addition, when the suspicious mail sending unit sends a suspicious mail together with alert information to the person to whom the suspicious mail is sent when the suspicious level is smaller than the first set value, a quick response is made when the suspicious mail is a normal mail. Becomes possible.

In addition, the suspicious e-mail coping method notification unit conveys information on the suspicious e-mail coping method to the person to whom the suspicious e-mail is transmitted, so that the suspicious e-mail coping process can be performed accurately.
Furthermore, the suspicious email handling information instruction display unit displays the suspicious email sending target person and its suspicious email handling status information on each necessary terminal on the system, so that a person who has not completed suspicious email handling can judge at a glance. , The suspicious e-mail handling situation can be accurately grasped in each unit such as the person in charge of the company, section, department, group, etc., and the occurrence of the situation where the suspicious e-mail is not dealt with appropriately can be suppressed.
In this way, in this system, the computer processing of this system is constructed in consideration of the confirmation processing of each human being, so unlike the system in which all judgments are left to artificial intelligence etc., human judgments are taken into consideration. , Suspicious mail countermeasures can be taken accurately and promptly.

Another embodiment according to the first invention is characterized in that the suspicious level of the suspicious level determination unit is determined based on the number of recipients of the email.
With this configuration, in general, humans send one or two emails to humans, and it can be said that there are few cases where many emails are sent to a large number of recipients. Therefore, by using the number of email recipients as an important determination parameter of the suspicious level determination unit, it is possible to easily identify suspicious emails in which the computer automatically sends a large amount of emails to an unspecified number of recipients. , The discrimination accuracy of the suspicious level discrimination unit can be improved.

Another embodiment according to the first invention is characterized in that the plurality of preselected target persons are all mail recipients of the management unit.
With this configuration, if a plurality of target persons selected in advance are set to all the mail recipients of the management unit, the security against suspicious mail of the management unit can be enhanced.

Another embodiment according to the first invention is characterized in that it has a handling completion determination unit that determines that the handling processing of the suspicious mail of the suspicious mail transmission target person has been completed.
The response completion determination unit can be configured by the computer determining a state in which data, a signal, a process, or the like indicating that the countermeasure from the suspicious email transmission target person has been completed has been transmitted.
The response completion determination unit needs to be configured to be able to determine whether or not the response processing of each target person of the suspicious mail transmission target person has been completed.
With this configuration, by having a response completion determination unit, it is possible to determine that the response processing of the suspicious email has been completed for each target person, so that the processing that is costly for human response is fixed by the computer. It can be executed with a certainty above the standard.

In another embodiment of the present invention, the terminal is required only when the management of the suspicious email countermeasure has approved that the countermeasure processing of the suspicious email has been completed by the response completion determination unit. It is characterized by notifying that the handling process of suspicious mail has been completed.
With this configuration, it is possible to improve the accuracy of whether or not it may be finally determined that the handling process of the suspicious email is completed by using human resources as well as the determination of the computer.

In another embodiment according to the first invention, the suspicious e-mail transmission target person specifying unit has an internal e-mail address in the management unit, a group address in the management unit, and a forwarding address set by the suspicious e-mail transmission target person. It is characterized in that the suspicious mail transmission target person is specified based on at least one piece of information.
With this configuration, the suspicious email transmission target identification unit identifies the suspicious email transmission target person based on the internal email address, group address, and forwarding address in the management unit, so that the received suspicious email is spread. The risk of adverse effects can be reduced.

In another embodiment according to the first invention, when the suspicious level is the suspicious level to which the suspicious e-mail transmitting unit transmits an e-mail, the suspicious e-mail transmission target person specified by the suspicious e-mail transmission target person The specific process and the suspicious mail transmission process of the suspicious mail transmission unit are performed in parallel in time.
With this configuration, by performing the above two processes in parallel in time, it is possible to reduce the time loss when the suspicious mail is a normal mail when the suspicious level is low.

Another embodiment according to the first invention is characterized in that the suspicious mail coping method notification unit uses an automatic voice generation unit that expresses the coping method by automatic voice.
With this configuration, there is an advantage that the coping method can be explained in detail not only by e-mail means such as Internet mail but also by voice by performing the coping method by automatic voice. In addition, it has the advantage of being able to contact even in an environment where it can only be contacted by voice, and handling suspicious emails with high quality in an emergency.

The suspicious e-mail countermeasure system according to the second invention includes an e-mail receiving means for receiving an e-mail of a target management unit and an e-mail receiving means.
A suspicious level determination unit that determines the suspicious level of the received e-mail from the e-mail suspicious related information of the e-mail received by the e-mail receiving means, and
When the suspicious level determined by the suspicious level determination unit is smaller than the first set value, the suspicious mail transmission unit that sends the suspicious mail together with the alert information to the suspicious mail transmission target person,
It has a suspicious e-mail coping method notification unit that conveys information on how to deal with the suspicious e-mail to the person to whom the suspicious e-mail is transmitted.
The suspicious e-mail coping method notification unit is configured to express the coping method by automatic voice.
With this configuration, the suspicious mail sending unit sends a suspicious mail together with alert information to the person to whom the suspicious mail is sent when the suspicious level is smaller than the first set value. Therefore, if the suspicious mail is a normal mail. It is possible to respond quickly to.
In addition, by explaining the coping method using automatic voice, there is an advantage that the coping method can be explained in detail not only by e-mail means such as Internet mail but also by voice. In addition, there is an advantage that it is possible to contact even in an environment where only voice can be contacted, such as by telephone, and it is possible to handle suspicious emails at a high level in an emergency.

Another embodiment according to the second invention is characterized in that the suspicious e-mail coping method notification unit forms a functional unit for automatically reproducing the suspicious e-mail coping method in the transmitted suspicious e-mail. And.
With this configuration, a functional part can be formed in the suspicious mail to automatically play the coping method of the suspicious mail, so that the target person who confirmed the suspicious mail can easily play the voice related to the coping method. , The efficiency of dealing with suspicious emails can be improved.
In the suspicious mail countermeasure system according to the second invention, each configuration shown in the other embodiment of the first invention can be adopted as a subordinate concept.
The suspicious email countermeasure system of the present invention is also an invention of a suspicious email countermeasure method.

As described above, according to the present invention, it is possible to provide a suspicious email countermeasure system capable of improving the response level to a wide variety of suspicious emails in a management unit such as a company or an organization. We were able to provide a suspicious e-mail countermeasure system that can balance suspicious e-mail by computer and human confirmation work and improve the response level to the threat of suspicious e-mail. In addition, we were able to provide a suspicious email countermeasure system that can deal with suspicious emails received at both a threat level and an economic level.

In this embodiment, it is a block diagram which concerns on an example of the suspicious mail countermeasure system which concerns on 1st Embodiment. In this embodiment, it is a figure which shows an example of the suspicious mail including the alert information sent to the person to send the suspicious mail. In this embodiment, it is a figure which shows an example of suspicious mail correspondence information display. In this embodiment, it is a block diagram which concerns on an example of the suspicious mail countermeasure system which concerns on 2nd Embodiment. In this embodiment, it is a flowchart which shows the process which concerns on an example of the suspicious mail measures system. In this embodiment, it is a flowchart which shows the process which concerns on an example of the suspicious mail measures system. In this embodiment, it is a flowchart which shows an example of the notification processing other than the e-mail which concerns on a suspicious mail countermeasure system.

<First Embodiment>
Hereinafter, the suspicious email countermeasure system according to the first embodiment of the present invention will be described with reference to the drawings.
As shown in FIG. 1, the suspicious mail countermeasure system according to the present embodiment includes a mail server 1 that receives mail of a target management unit, and terminals 2 that are arranged in members of the management unit or in each department. , The display device 3 connected to each terminal 2, various networks 4 such as the Internet, the system unit 6, and the like are used. The network 4 may be connected to the cloud computing service 5.
The management unit is used to mean a unit having each e-mail address related to a group such as a company, various organizations, or a government agency.
In addition, the management unit managed by the system is not a terminal, but an e-mail address assigned to an employee in the case of a company, for example.
The system unit 6 may be provided in the mail server 1 or may be provided separately. The mail server 1 is a form of the mail receiving means. Various mail receiving means other than the mail server 1 can be adopted. The display device 3 may be equipped with an input means such as a touch screen.
The system unit 6 may be configured in cooperation with various notification units 7. Examples of the configuration of the various notification units 7 include telephones, faxes, various signals and encrypted transmissions for which specific processing is to be performed, and special individual networks.
Further, the system unit 6 shown in FIG. 1 has a configuration in which a transmission processing unit 15, a reception processing unit 16, and a control unit 17 are provided.

[Suspicious level determination unit 10]
As shown in FIG. 1, the system unit 6 has a suspicious level determination unit 10 that determines a suspicious level of an email received from an email receiving means such as a mail server 1. The suspicious level is often determined from the suspicious information related to the received email.
The e-mail suspicious information is various information that can grasp the degree of suspicion of the e-mail including the title of the received e-mail, the link URL in the body, the attached file, and the like. In general, the title of a suspicious email is not a specific title addressed to the person in charge, and it is often unclear because it does not get the point. In addition, there are often link URLs in the body of the email that lead to the home page for virus infection. In addition, since many attached files are unclear, the computer can be configured to automatically determine the suspicious level from the information.

[Suspicious email transmission target person identification unit 11]
As shown in FIG. 1, the system unit 6 has a suspicious email transmission target person identification unit 11 that identifies a suspicious email transmission target person.
The necessity of providing the suspicious mail transmission target person identification unit 11 is due to the fact that the mail possessed by the management unit often has an internal mail address and an external mail address. Examples of the internal e-mail address include an in-house e-mail address, a group address, and e-mail forwarding settings by each e-mail recipient. The problem is that one individual identified by an external e-mail address often becomes multiple in the internal e-mail address, and the suspicious e-mail transmission target person identification unit 11 is provided to solve the problem. ..
The suspicious mail transmission target person identification unit 11 is composed of a software unit that identifies a target person to send a suspicious mail from the outside to an internal mail or the like in the management unit.
The identification of the suspicious mail transmission target person by the suspicious mail transmission target person identification unit 11 is set corresponding to the suspicious level obtained by the suspicious level determination unit 10. In the normal processing of the system unit 6, the identification process of the suspicious mail transmission target person identification unit 11 is performed when the suspicious level value is smaller than the first set value and the safety is relatively high. On the other hand, if the suspicious level value is equal to or higher than the first set value, the external mail is not forwarded to the internal mail in the management unit as a dangerous mail, so the identification process of the suspicious mail transmission target person identification unit 11 is performed. Not necessary.

[Caution Information Notification Department 12]
As shown in FIG. 1, this system unit 6 does not send a suspicious e-mail when the suspicious level is equal to or higher than the first set value, and notifies a plurality of preselected target persons in the management unit of alert information. It has a warning information notification unit 12 to be used.
The alert information is, for example, an e-mail text or voice that informs all members that a very dangerous e-mail has been sent, and that each department, each section, each group, etc. in the management unit should take appropriate measures. .. Usually, the alert information notification unit 12 is often transmitted in the form of an e-mail. However, it is also possible to adopt a method in which the automatic voice generation unit 13 automatically generates a voice or a word to call attention, and uses various notification units 7 to notify a plurality of preselected target persons.

[Suspicious email sender 14]
As shown in FIG. 1, the system unit 6 has a suspicious mail transmitting unit 14 that transmits a suspicious mail together with a warning information to a person to whom the suspicious mail is transmitted when the suspicious level is smaller than the first set value. ..
The suspicious mail sending unit 14 creates a suspicious mail based on the information of various storage units 34, and sends the suspicious mail to the person to whom the suspicious mail is sent together with the warning information that this mail is a suspicious mail.
The suspicious mail sending unit 14 may also serve as a part of the mail sending function of the mail server 1.

FIG. 2 is a diagram showing an example of a suspicious email 51 with alert information transmitted by the suspicious email transmitting unit 14.
The suspicious mail 51 has at least a guidance information display field 42 and a normal mail section 43.
The guidance information display field 42 may have a warning information display field 38, a suspicious level display field 39, a suspicious mail handling information guide 40, and an internal mail information guide 41.
The alert information display field 38 is "This email is a suspicious email with a high risk level." In other words, it is an email that may be infected with a virus or the like. Please respond to this suspicious e-mail with a non-hazardous coping method based on the suspicious e-mail handling information guide 40. After taking action, please be sure to report according to the rules of your action information. It is composed of e-mail sentences such as ".
The suspicious mail coping information guide 40 is a column for guiding coping information.
The automatic voice can be configured so that when the suspicious mail handling information guide 40 is selected with the cursor and clicked, the corresponding page is opened and the automatic voice is played together with the explanation. The suspicious e-mail handling information guide 40 can be grasped as an example of the configuration of the second invention "forming a functional unit for reproducing the suspicious e-mail coping method by automatic voice in the suspicious e-mail". The voice file automatically created by the automatic voice generation unit 13 shown in FIG. 1 is automatically attached to the suspicious mail 51 as a configuration of "forming a functional unit for reproducing the suspicious mail coping method by automatic voice". Can also be adopted.

The suspicious level display column 39 indicates that the suspicious level of the suspicious mail 51 is high, normal, low, or the like. As a display form, it is conceivable to display the suspicious level with capital letters in a conspicuous color or to notify the recipient that the mail is not a normal mail by blinking.
The internal mail information guide 41 is a column for displaying a group of mails associated with and related to this suspicious mail, and can also display information extracted from the above-mentioned mail suspicious-related information.
Further, as the information other than the suspicious e-mail related information, an internal e-mail extracted based on the information based on the history of the e-mail sent / received by the recipient, a group e-mail, and the like can be exemplified.
The normal mail unit 43 is composed of a mail title, sender information "From: relationship display", sender information "To: relationship display", an attached file, a mail body, and the like.

[Suspicious email coping method notification unit 18]
As shown in FIG. 1, the system unit 6 has a suspicious e-mail coping method notification unit 18 that conveys information on a suspicious e-mail coping method to a suspicious e-mail transmission target person.
The suspicious e-mail coping method notification unit 18 can exemplify a sentence attached to the suspicious e-mail as shown in FIG. 2, a method of contacting a suspicious e-mail coping method by telephone by automatic voice, and the like. In addition, a method of selecting or generating software that instructs the target person to take action, automatically attaching it to an e-mail, and requesting that it be executed on the target person's personal computer can be exemplified.

[Suspicious email handling information instruction display unit 19]
As shown in FIG. 1, the system unit 6 has a suspicious mail handling information instruction display unit 19 that displays a suspicious mail transmission target person and its handling information on a necessary display device 6 on the system.
The suspicious mail handling information instruction display unit 19 is software that displays, for example, the suspicious mail handling information display 22 (see FIG. 3) on the display device 6 of each target person. The display by the suspicious mail handling information instruction display unit 19 may be displayed directly from the system unit 6 on each display device 6, or may be displayed via each terminal 2.

[Suspicious email handling information display 22 ((see Fig. 3))]
FIG. 3 is a diagram showing an example of handling information that is updated and displayed at any time on the display device 6 by the suspicious mail handling information instruction display unit 19 (see FIG. 1, the same applies hereinafter).
As shown as an example in FIG. 3, as suspicious mail handling information, a handling completion information column 24 indicating whether or not the handling is completed by the handling completion determination unit 21 described later, and a terminal-side handling completion described in the second embodiment. It has a software identification display field 25 by the software automatic determination unit 20.
For example, in FIG. 3, when the countermeasures of each target person are completed, the display of the countermeasure completion information column 24 is a circle display, and when the countermeasures are not completed, a cross display is shown.
In addition, an example in which employee number 26, name 27, telephone number 28 as contact information, email address 29, administrator contact information 30, presence / absence display 31, remarks (special notes 32), etc. are displayed. Is shown.
The special note 32 may include, for example, display of the risk level (suspicious level) for each suspicious email. Further, in the special note 32, a suspicious e-mail number automatically assigned by the system may be described.

[Countermeasure completion determination unit 21]
As shown in FIG. 1, the system unit 6 has a response completion determination unit 21 that determines that the response process for the suspicious email has been completed in the suspicious email transmission target person.
The response completion determination unit 21 sequentially receives the reply completion email from the incoming suspicious email transmission target person, telephone contact, transmission information, encryption, etc., and has the response of each target person completed? Determine if not. Based on the discrimination information, the suspicious e-mail handling information instruction display unit 19 displays the suspicious e-mail handling information shown in FIG. 3 so that the target person and the administrator can grasp the response status of each target person at a glance. ..

[Various storage units 34]
As shown in FIG. 1, the system unit 6 has various storage units 34 as memory means such as ROM and RAM. Various storage units 34 store various information necessary for this system, such as discrimination information of the suspicious level determination unit 10, information related to suspicious mail, information on how to deal with suspicious mail, and various template information.

<Second Embodiment>
A component of the system unit 6 according to the second embodiment will be described with reference to FIG.
In the following description, only the components added to each component of the first embodiment will be described.
[Terminal-side response completion software automatic discrimination unit 20]
The terminal-side handling completion software automatic determination unit 20 is a software unit provided as needed.
The terminal-side countermeasure completion software automatic determination unit 20 is a means for automatically determining whether or not the suspicious email countermeasure has been completed on each terminal 2 corresponding to the suspicious email transmission target person by software.
The terminal-side handling completion software automatic discrimination unit 20 can improve the accuracy related to handling suspicious emails by distributing or pre-arranging the discrimination software related to the terminal-side handling completion software automatic discrimination unit 20 to each necessary terminal. it can.
If necessary, it is possible to adopt a configuration in which the response completion determination unit 21 determines the determination in consideration of the determination of the terminal-side response completion software automatic determination unit 20.

[Suspicious email response information recognition unit 33]
The suspicious mail response information recognition unit 33 shown in FIG. 4 is a software unit provided as needed.
The suspicious mail response information recognition unit 33 includes means for automatically recognizing the response information from the suspicious mail transmission target person.
The suspicious email response information recognition unit 33 may also include an email text automatic analysis unit or a voice recognition unit (not shown). By providing the suspicious e-mail response information recognition unit 33, the system unit 6 can be configured to automatically and sequentially update the suspicious e-mail handling information by text or voice.
With this configuration, the suspicious mail response information recognition unit 33 automatically responds to the computer, so that the situation can be grasped at low cost.
In addition, by automatically updating and accumulating suspicious e-mail handling information, various information related to suspicious e-mail can be accumulated, and countermeasures against suspicious e-mail can be gradually improved as time and period elapse.

[Various storage units 34]
As shown in FIG. 4, as the components of the various storage units 34 according to the second embodiment, the suspicious mail handling information storage unit 35 and the suspicious mail response information storage unit 36 can be exemplified.
The suspicious mail handling information storage unit 35 stores the handling information of individual persons in the management unit for suspicious mail, the correspondence information as a group, the correspondence information for each suspicious level, etc. in chronological order, for each target category, and the like. It is a department.
The suspicious mail response information storage unit 36 is a storage unit that stores the response information collected by the suspicious mail response information recognition unit 33. For example, information on extracting key parts such as a reply sentence from a suspicious mail transmission target person and a reply response voice can be exemplified.

[Example of system processing]
The processing of the suspicious email countermeasure system having the configurations according to the first embodiment and the second embodiment will be briefly described mainly with reference to FIGS. 1, 4, 5, and 6.
As shown in FIG. 5, first, the mail server 1 receives all the mails of the management unit (SP1), and the suspicious level of the received mail is determined from the mail suspicious related information obtained from the received mails. The level determination unit 10 automatically determines (SP2). In addition, the suspicious mail transmission target person identification unit 11 identifies the suspicious mail transmission target person (SP3).
Then, it is determined whether or not the suspicious level is equal to or higher than the first set value (SP4), and if it is equal to or higher than the first set value, alert information such as alert mail or voice is transmitted to all members of the management unit (SP5). ). It is also possible to omit the processing of SP5 if necessary.
On the other hand, in the determination of SP4, if it is less than the first set value, the suspicious e-mail coping method notification unit 18 and the suspicious e-mail transmitting unit 15 can refer to the suspicious e-mail sending target person with the warning information and the suspicious e-mail handling information. The received e-mail is reconstructed, and the reconstructed e-mail is sent as a suspicious e-mail (SP6).
Further, even after the processing of SP5 is completed, the processing of SP6 is performed.

Then, the automatic voice created by the automatic voice generation unit 13 is sent to each terminal 2 together with or separately from the suspicious mail, or the automatic voice is notified by telephone (SP7), as shown in FIG. The suspicious mail handling information display 22 as shown is displayed on the required terminal 2 (SP8).
Then, as shown in FIG. 6, the terminal-side handling completion software automatic discrimination unit 20 performs discrimination processing (SP9), and the handling completion discrimination unit 21 performs discrimination processing (SP10), if necessary.
In addition, it is determined whether or not the person in charge of suspicious mail or the system administrator has approved the completion of the response (SP11), and if there is no approval, the process returns to step SP9, and if there is approval, the necessary terminal 2 is handled by suspicious mail. Notifies that has been completed (SP12). In addition, this completion notification may also be sent by telephone by automatic voice.

Further, the system stores the coping information in the suspicious mail correspondence information storage unit 35 (SP13), stores them as the discrimination data of the suspicious mail discrimination unit 10, and ends a series of processes. If necessary, the suspicious email response information can be stored in the suspicious email response information storage unit 36 and used as the determination data of the suspicious email determination unit 10.
The person in charge of the suspicious email may be the person in charge of each section or group. In that case, it is possible to determine that the approval has been obtained only when the majority of the plurality of managers or all the approvals are obtained. is there.

FIG. 7 is a flowchart showing an example of notification processing other than e-mail mainly performed by various notification units 7.
Acquires contact method data of the person to whom the suspicious email is sent (SP31), automatically sends an automatic voice notification to the telephone number (SP32), and determines whether there is another contact method if there is no response for a certain period of time. (SP33), if it is determined that there is another means of communication, an attempt is made to notify by other means of communication (SP34), and whether or not it succeeds is determined (SP35), and if it succeeds, a series of series. Return to system processing.
If there is no notification by other means of communication in SP33, the process returns to step SP32. Further, in SP35, if the notification by another communication means is not successful, the process returns to step SP32 and a series of processes is repeated.
As another means of communication, the simplest example is the telephone number of a family member or an acquaintance, or the fax of the person or a person concerned.

In addition to the above embodiments, the present invention can be modified in various ways without changing the gist of the present invention.
(A) It is clear that this system unit can manage not only desktop personal computers that perform various processes but also mobile terminals in the same manner.
(B) This system unit can provide a tendency grasping unit for each internal department of the management unit to grasp the tendency of suspicious mail for each management unit. For example, by classifying the tendency and form of suspicious emails sent to the research departments of companies and government agencies and the suspicious emails sent to the sales department by machine learning, etc., the resistance to suspicious emails is improved. be able to.
(C) A suspicious level discrimination adjustment unit may be provided to adjust the discrimination level of the suspicious level discrimination unit based on information such as progress information stored in the various storage units.
For example, based on the adjusted suspicious level adjustment value, a second set value smaller than the first set value can be set separately from the first set value. Then, the coping process when the value is a suspicious level smaller than the second set value is simpler than the coping process when the value is a suspicious level between the first set value and the second set value. A changing configuration can also be adopted.

1 ... Mail server (an example of mail receiving means)
10 ... Suspicious level determination unit 11 ... Suspicious email transmission target person identification unit 12 ... Alert information notification unit 13 ... Automatic voice generation unit 14 ... Suspicious email transmission unit 18 ... Suspicious email coping method notification unit 19 ... Suspicious email coping information instruction display Part 21 ... Countermeasure completion determination unit

Claims (10)

An email receiving means for receiving emails of the target management unit,
A suspicious level determination unit that determines the suspicious level of the received e-mail from the e-mail suspicious related information of the e-mail received by the e-mail receiving means, and
A suspicious email transmission target person identification unit that identifies a suspicious email transmission target person regarding the suspicious email that is determined to be a suspicious email by the suspicious level determination unit,
When the suspicious level is equal to or higher than the first set value, the suspicious e-mail is not sent, and the alert information notification unit that notifies the alert information to a plurality of preselected target persons of the management unit.
When the suspicious level is smaller than the first set value, the suspicious mail sending unit that sends the suspicious mail together with the warning information to the suspicious mail sending target person,
A suspicious e-mail coping method notification unit that conveys information on how to deal with the suspicious e-mail to the person to whom the suspicious e-mail is sent.
A suspicious email handling information instruction display unit that displays the suspicious email sending target person and its suspicious email handling information on each necessary terminal on the system.
A suspicious e-mail countermeasure system characterized by having. The suspicious email countermeasure system according to claim 1, wherein the suspicious level of the suspicious level determination unit is determined based on the number of recipients of the email. The suspicious email countermeasure system according to any one of claims 1 to 2, wherein the plurality of preselected target persons are all email recipients of the management unit. The suspiciousness according to any one of claims 1 to 3, wherein it has a handling completion determination unit for determining that the handling processing of the suspicious mail of the suspicious mail transmission target person has been completed. Email countermeasure system. Only when the approval of the suspicious mail countermeasure administrator is obtained that the suspicious mail handling process has been completed by the handling completion determination unit, the necessary terminal is notified that the suspicious mail handling process has been completed. The suspicious email countermeasure system according to claim 4, characterized in that. The suspicious email transmission target person identification unit transmits the suspicious email based on at least one information of an internal email address in the management unit, a group address in the management unit, and a forwarding address set by the suspicious email transmission target person. The suspicious email countermeasure system according to any one of claims 1 to 5, characterized in that the target person is specified. When the suspicious level is the suspicious level to which the suspicious e-mail transmitting unit transmits an e-mail, the suspicious e-mail transmission target person identification unit identifies the suspicious e-mail transmission target person and the suspicious e-mail transmission unit transmits the suspicious e-mail. The suspicious email countermeasure system according to any one of claims 1 to 6, wherein the processing is performed in parallel in time. The suspicious email countermeasure system according to any one of claims 1 to 7, wherein the suspicious email coping method notification unit uses an automatic voice generation unit that expresses the coping method by automatic voice. An email receiving means for receiving emails of the target management unit,
A suspicious level determination unit that determines the suspicious level of the received e-mail from the e-mail suspicious related information of the e-mail received by the e-mail receiving means, and
When the suspicious level determined by the suspicious level determination unit is smaller than the first set value, the suspicious mail transmission unit that sends the suspicious mail together with the alert information to the suspicious mail transmission target person,
It has a suspicious e-mail coping method notification unit that conveys information on how to deal with the suspicious e-mail to the person to whom the suspicious e-mail is transmitted.
A suspicious e-mail countermeasure system characterized in that the suspicious e-mail coping method notification unit is configured to express the coping method by automatic voice. The suspicious e-mail countermeasure system according to claim 9, wherein the suspicious e-mail coping method notification unit forms a functional unit for automatically reproducing the suspicious e-mail coping method in the transmitted suspicious e-mail. ..

Images