JP4720251B2 - Email attachment virus detection method and email server - Google Patents

Description

  The present invention relates to a computer virus detection method, and more particularly to a mail attachment type virus detection method and a mail server for detecting and treating a virus attached to an electronic mail (hereinafter simply referred to as an email) at an early stage.

  A computer virus is a program created for the purpose of intentionally causing some damage to another person's software or database. It repeats “infection” via the network or floppy disk (FD), “latents” until certain conditions are met, and suddenly “attempts” at some point. Such computer viruses are often attached to e-mails. Therefore, in order for a computer to always operate normally without being "infected" with such a virus, the received mail is "infected" by detecting and checking whether the received mail is "infected" or not. It is necessary to delete emails.

  Such a virus is detected using anti-virus software (hereinafter referred to as anti-virus software). For a new type of mail-attached virus, it is necessary to constantly update the definition data file of the anti-virus software in the client PC (personal computer). Care must be taken to ensure that the latest virus has no outbreak or latest DAT file.

  Major network devices such as firewalls have a function of automatically updating the definition DAT file of anti-virus software. However, analysis after virus outbreaks and creation of the latest definition file take time, sometimes after the virus “spreads” in the company, and pressures the in-house IT infrastructure. Thus, it is desirable to detect viruses early without a corresponding definition DAT file.

  Prior art relating to or relating to the detection of computer viruses is disclosed in several technical literatures. A virus removal method for a communication system that detects viruses by monitoring whether or not an illegal command is used after storing a received mail is disclosed (for example, see Patent Document 1). E-mail transmission method that prevents the spread of e-mails with viruses by sending back e-mails sent to the original terminal since the e-mail server sent, and performing e-mail transmission processing after obtaining user permission Is disclosed (for example, see Patent Document 2). Also disclosed are an abnormality detection method, an abnormality detection program, a server, and a computer that detect virus infection based on difference information between transmission history information of a mail server and a client (see, for example, Patent Document 3).

Japanese Unexamined Patent Publication No. 2003-162423 (page 4, FIG. 2) JP 2003-178007 A (page 3, FIG. 1) Japanese Unexamined Patent Publication No. 2004-260575 (page 6, FIG. 1)

  The above-described prior art uses a mail server internal detection function or client-side virus detection software for mail-attached viruses that have been attached to e-mails and transferred from the outside or have begun to spread. It automatically searches and detects internal information in sentences and attachments, and reports and disinfects them. However, since it is based on “signature of definition DAT file corresponding to virus”, in the case of a new type of virus, since there is no corresponding definition DAT file, it is impossible to detect it.

  In the prior art, anti-virus measures can be surely taken when a “definition DAT file signature corresponding to a new virus” is created. However, it takes time until the above-described definition DAT file is created and distributed, and a virus damage is encountered. In addition, if the administrator neglects to collect new virus information and neglects to update the latest definition DAT file, there is a problem that the virus rapidly spreads in the in-house LAN. Furthermore, the virus attached to an e-mail is not known even if the first infected PC occurs in the company, and a new virus may be noticed only when the virus spreads in the company.

  The present invention has been made in view of the above-described problems of the prior art, and a main object of the present invention is to provide a file attachment type virus detection method and a mail server that can overcome or reduce such problems.

  In order to solve the above-described problems, the file attachment type virus detection method and the mail server according to the present invention adopt the following characteristic configuration.

(1) A mail attachment type virus detection method for detecting a virus that propagates on a mail server that relays mail,
Using one of history information when the mail server relays a plurality of outgoing mails from the client and history information when the mail server relays a plurality of received mails addressed to the client, the same title or sender A first ranking step that counts mails with addresses at regular intervals and ranks them in descending order, and is ranked from the top to a predetermined rank in succession on the time axis. An email attachment type virus detection method comprising: a detection step of detecting an email as an email with a virus attached.
(2) further comprising a second ranking step of counting mails having the same title or transmission source address every other fixed time using the other history information and ranking in descending order of the counted values, In the detection step, mails ranked from the highest level to a predetermined rank in succession on the time axis in both the first and second ranking steps are detected as mails with the virus attached. The method for detecting a virus attached to an email according to (1) above.
(3) The first ranking step counts emails having the same title or source address and having a difference between the sizes of attached files within a predetermined range at regular intervals and (1) Email attachment type virus detection method of the above (1) which ranks in descending order.
(4) Each of the first and second ranking steps counts emails having the same title or source address and having a difference between attachment sizes within a predetermined range at regular intervals. And the virus attached virus detection method according to the above (2), which ranks the counted values in descending order.
(5) Corresponding to a mail sending box for processing a plurality of outgoing mails from the client, a mail receiving box for processing a plurality of received mails addressed to the client, and one of the mail sending box and the mail receiving box A first check module provided, and the first check module counts mails processed in the one box and having the same title or source address at regular intervals and the count value. A mail server that ranks in descending order and detects e-mails ranked from the top to a predetermined rank on the time axis as e-mails with viruses or worms attached.
(6) A second check module provided corresponding to the other box is further provided, and the second check module receives a mail processed in the other box and having the same title or source address. Counting every fixed time and ranking in descending order of the count value, one of the first and second check modules is continuously on the time axis by both the first and second check modules , The mail server according to (5), wherein mail ranked from the top to a predetermined rank is detected as a mail with the virus or worm attached.
(7) The first check module counts mails having the same title or source address and having a difference between the sizes of the attached files within a predetermined range at regular intervals, and in descending order of the counted values. (5) The mail server ranked above
(8) Each of the first and second check modules counts emails having the same title or source address and having a difference between the sizes of attached files within a predetermined range at regular intervals. The mail server according to the above (6) that ranks in descending order of the counted values.
(9) The mail server according to any one of (5) to (8), further comprising a weighting / deleting mailbox that temporarily stores the mail with the virus or worm attached and issues a warning mail to an administrator.

According to the mail-attached virus detection method of the present invention, the following significant effects can be obtained. In other words, a new kind of e-mail attachments type virus, it is possible to automatically carry out high-precision initial measures without a corresponding virus definition file. In addition, according to the present invention, it is possible to prevent a new virus-type mail from being sent from inside the company, received from outside the company, and spread to the inside of the company, and it is possible to avoid the worst situation in which the network is disconnected.

  Hereinafter, the configuration and operation of a preferred embodiment of a mail attachment type virus detection method according to the present invention will be described in detail with reference to the accompanying drawings.

  First, FIG. 1 is an explanatory diagram of a first embodiment of a mail attachment type virus detection method according to the present invention. This mail attachment type virus detection method is provided at the mail transmission box 11, the check module (or virus detection module) 14 provided at the entrance of the mail transmission box 11, the mail reception box 16 and the entrance of the mail reception box 16. This is implemented by the mail server 10A provided with the check module 19. The check modules 14 and 19 are configured to receive electronic mail by SMTP (Simple Mail Transfer Protocol).

  The mail attachment type virus detection method shown in FIG. 1 is an example in the case of using a mail server system configuration. The mail transmission box 11 processes mail transmitted from the company. The check module 14 detects a mail-attached virus or worm included in an outgoing mail from the company. The mail receiving box 16 processes mail received from outside (external). The check module 19 detects a mail-attached virus or worm included in an incoming mail from the outside.

  In the mail attachment type virus detection method shown in FIG. 1, for convenience of explanation, the check modules 14 and 19 are arranged in front of the corresponding mail transmission box 11 and mail reception box 16, respectively. However, these check modules 14 and 19 may be either before or after the corresponding mailbox 11 or 16.

  Next, an outline of the overall operation of the mail attached virus detection method shown in FIG. 1 will be described. First, the case of mail transmission will be described. The outgoing mail passes through the check module 14 and “quarantines” the mail using the already defined definition DAT file, and “removes” the existing virus or worm. Thereafter, the transmission mail ranking list 13 is created at regular intervals and held in the mail transmission box 11. This transmission mail ranking list 13 is created at a constant time interval (however, the interval can be changed by setting), and indicates the mail transmission status of time transition.

Next, the case of mail reception will be described. In the case of mail reception, as in the case of mail transmission described above, the received mail passes through the check module 19 and “quarantines” the mail using the definition DAT file that has already been set, and an existing virus or worm is removed. "Remove. Then held in the mail receiving box 16 while creating a received mail ranking list 17 for a predetermined time interval. The received mail ranking list 17 is created at regular time intervals (however, the interval can be changed by setting), and indicates the time-shifted mail reception status.

  FIG. 2 is an explanatory diagram of a second embodiment of the mail attachment type virus detection method according to the present invention. In this embodiment, for convenience of explanation, the same reference numerals are used for components corresponding to those in the embodiment of FIG. The mail server 10B includes a mail transmission box 11, a check module 14, a mail reception box 16, and a check module 19. The check modules 14 and 19 create a transmission mail ranking list 13 and a reception mail ranking list 17, respectively. The correlation lists 15 and 18 of the ranking lists 13 and 17 are created in the same manner as in the first embodiment.

  However, in the second embodiment, the recorrelation 20 of both correlation results of the correlation lists 15 and 18 described above is added. Furthermore, a weighting / deletion mail box 21 for temporarily storing a mail determined to be a mail-attached virus is provided. The added mailbox 21 is separated into a transmission side 22 and a reception side 23.

  Hereinafter, the operation of the first embodiment of the mail attachment type virus detection method according to the present invention shown in FIG. 1 will be described in detail. Assume that an employee (a PC used by an employee) is "infected" with an email attachment virus. As this “infection” spreads, first, the number of emails with several identical titles in outgoing emails begins to increase. It becomes a state of “infestation” to other employees one after another while causing “secondary infection” and “tertiary infection”. Since it is a self-propagating virus, the number of mails “infected” with the virus on both the incoming mail side and the outgoing mail side is exponential (or increases rapidly at a certain point) as shown in FIG. Draw.

  In FIG. 4, the horizontal axis indicates the elapsed time, and the vertical axis indicates the number of virus propagation cases (or mail infected with a virus: the number of transmitted / received mail A with virus). The time indicates the state of 10 minutes, 20 minutes, 30 minutes,... Every 10 minutes, which is a fixed time from the current time point when a large number of viruses are growing. As shown in FIG. 4, the self-propagating virus has a feature that it occurs in a burst manner at a certain time. For this reason, virus-attached mail that is automatically sent comes to the top in the unit time ranking. Also, viruses are not necessarily single titles, and are sent with multiple titles (eg title A, title B and title C) to reduce the probability of being found (making discovery difficult) In some cases.

  As shown in FIG. 4B, a “formal simultaneous delivery” mail that is not infected with a virus also comes to the top only in the unit time ranking. For this reason, it is necessary to appropriately cancel such formal mail from being canceled or automatically deleted. For this purpose, an appropriate judgment is made by performing a judgment of linking a ranking higher rank of one unit time with a ranking higher rank of another time. The number of mails with viruses sent automatically increases with time. However, although formal broadcast mail temporarily increases in a burst manner, it cannot increase thereafter. That is, it becomes 0 in the ranking list of other unit times. Even if it is divided into two ranking lists, it becomes a movement different from a virus-infected mail that always becomes 0 on the third ranking list and increases in number. In other words, by using a correlation in which a plurality of ranking lists are weighted to the current ranking list, it becomes possible to separate “mail with virus” and “formal simultaneous delivery”.

  Next, FIG. 3 shows a specific example of the received mail ranking list 17 at a specific time in the received mail ranking list 17. The specific example of the received mail ranking list 17 shown in FIG. 3 includes a ranking (ranking), items or titles of mails, the number of cases, a transmission source address, and an attached file (file name and size). In this specific example, 35 mails having the same title, for example, “Hello”, are ranked at the top (first place) at regular time intervals (for example, 10 minutes). As described above, the transmitted / received mail ranking lists 13 and 17 are classified according to the items as described above and are made into a ranking list. The source address may be the same or may be different.

  In order to reduce the discovery rate, a self-propagating virus attached to a mail generally takes a plurality of titles instead of sending the same title. Therefore, such a case is dealt with by ranking with a plurality of titles. Further, the mail destination and the mail address of the mail sender are often random from the registered mail address book of the user, but “sender mail address” is inserted so as to identify a mass mail distributed to a large number.

  Moreover, the virus body is often distributed in the form of an attachment to an e-mail. For this reason, it is possible to increase the accuracy of virus identification by classifying according to the feature of attachment. Therefore, in this specific embodiment, “attached file size” is added.

  In the present invention, it is also considered to properly separate formal broadcast mails sent in bursts. For the time being, official simultaneous distribution will also be ranked high, but it is almost always kept in the high rank in each ranking list 20 minutes ago, 10 minutes ago, 10 minutes after the present and the future, and 20 minutes later. Nearly nothing. For this reason, a method is used in which the rank of each time interval is used for each incoming mail and outgoing mail, and the correlation is taken on the time axis. In addition, since simultaneous delivery or the like often comes from the same transmission source, it has “transmission source address” as an item, and simple determination may be made on this condition.

  As a result, it is possible to create ranking lists 15 and 18 for detecting the virus or worm as a correlation result on the reception side and the transmission side. The correlation result ranking lists 15 and 18 are a system that uses a weighting coefficient between the time interval lists and a weight value of the ranking order. It can be changed from the default setting value according to the setting value and mail environment.

  When a virus “spreads”, it becomes higher in the sent mail correlation result list 15 and the received mail correlation result list 18, and the discrimination accuracy can be improved by creating and discriminating the recorrelation list of both the result correlation lists 15 and 18. Is possible. However, the detection method that detects viruses by introducing them into the check modules 14 and 19 for detecting viruses from the result correlation list in only one direction is fast. To do.

  Further, when the measurement time interval of the transmission / reception ranking list is small, an additional time correlation may be taken as a result of the recorrelation. The correlation type detection data of each virus detection module 14 and 19 is replaced when a new correlation result is obtained. As a result, the mail determined as the mail-attached virus is temporarily stored in the receiving side 23 and the transmitting side 22 of the weighting / deleting mailbox 21. As a result, a warning mail is issued to the administrator. Then, the administrator determines the mail in the deletion box based on the latest information provided by each security company in the mail header or the attached file, and takes action.

  The preferred embodiments of the mail-attached virus detection method and mail server according to the present invention have been described in detail above. However, it should be noted that such examples are merely illustrative of the invention and do not limit the invention in any way. Those skilled in the art will readily understand that various modifications and changes can be made in accordance with a specific application without departing from the gist and spirit of the present invention.

  For example, in the above-described embodiment, the result derived from the correlation of the transmission mail list at each time interval of the transmission mailbox and the result derived from the correlation of the reception mail list at each time interval of the reception mailbox are reproduced. Although the correlation method is used, it is also possible to take anti-virus measures by independent determination of the time correlation of the reception and transmission mailboxes. This is a faster way to deal with the spread of viruses in the company than the recorrelation of the time correlation lists of both mailboxes.

  Also, for the description of the mail server having the reception and transmission mailboxes, the concept of the reception time correlation list and the transmission time correlation list was used. However, when the basic concept is applied to IDS (intrusion detection system). Can add the sender IP address to the time correlation list item to specify the client PC of the virus sensitive person.

It is explanatory drawing of 1st Example of the mail attachment type | mold virus detection method by this invention. It is explanatory drawing of 2nd Example of the mail attachment type | mold virus detection method by this invention. It is a figure which shows an example of the transmission mail ranking list | wrist in this invention. It is a figure which shows the characteristic of a self-propagating virus.

Explanation of symbols

10A, 10B Mail server 11 Mail transmission box 13 Transmission mail ranking list 14, 19 Check module 15, 18 Correlation list 16 Mail reception box 17 Reception mail ranking list 20 Recorrelation list 21 Waiting / deletion mailbox

Claims (9)

An email attachment type virus detection method for detecting a self-propagating virus in a mail server that relays email,
Using one of history information when the mail server relays a plurality of outgoing mails from the client and history information when the mail server relays a plurality of received mails addressed to the client, the same title or sender A first ranking step that counts emails with addresses at regular intervals and ranks them in descending order;
A detection step of detecting e-mails ranked from the highest level to a predetermined order on the time axis as e-mails with viruses attached;
An email attachment type virus detection method comprising: A second ranking step of counting mails having the same title or source address using the other history information at regular intervals and in descending order of the counted values;
In the detection step, mails ranked from the top to a predetermined rank in succession on the time axis in both the first and second ranking steps are detected as mails to which the virus is attached. The mail attachment type virus detection method according to claim 1, wherein: The first ranking step counts emails having the same title or source address and having a difference between the sizes of attached files within a predetermined range at regular intervals, and ranks them in descending order of the count values. The method for detecting a virus attached to a mail according to claim 1, wherein: Each of the first and second ranking steps counts and counts emails having the same title or source address and having a difference between attachment sizes within a predetermined range at regular intervals. The virus attachment method according to claim 2, wherein ranking is performed in descending order of numerical values. An email outbox that handles multiple outgoing emails from clients,
An email inbox that handles multiple incoming emails addressed to clients;
A first check module provided corresponding to one of the mail sending box and the mail receiving box,
The first check module includes:
Mails processed in the one box and having the same title or source address are counted at regular intervals and ranked in descending order of the counted values,
A mail server characterized in that it continuously detects mail ranked from the top to a predetermined rank on the time axis as mail with a virus or worm attached. A second check module provided corresponding to the other box;
The second check module includes
Mails processed in the other box and having the same title or source address are counted at regular intervals and ranked in descending order of the counted values,
One of the first and second check modules is
E-mails ranked from the highest level to a predetermined rank in succession on the time axis by both the first and second check modules are detected as e-mails with the virus or worm attached thereto. The mail server according to claim 5. The first check module counts emails having the same title or source address and having a difference between the sizes of attached files within a predetermined range at a predetermined time and ranks them in descending order. The mail server according to claim 5, wherein: Each of the first and second check modules counts mails having the same title or source address and having a difference between the sizes of attached files within a predetermined range at regular intervals and the count value. The mail server according to claim 6, wherein the mail server is ranked in descending order.   The mail server according to any one of claims 5 to 8, further comprising a weighting / deleting mailbox for temporarily storing the mail with the virus or worm attached thereto and issuing a warning mail to an administrator. .

Images