JP4878468B2 - E-mail evaluation apparatus and e-mail evaluation method - Google Patents

Description

  The present invention relates to a technique for evaluating the contents of a document file, and more particularly to a technique for determining the suitability of the contents of an electronic mail.

  In recent years, with the spread of computers and the advancement of network technology, the exchange of electronic information via the network has become popular. E-mail is one of them, but most e-mails are said to be spam mails called spam mails.

In response to such a situation, a technique has been developed for determining the suitability of the contents of an electronic mail by natural language processing and automatically eliminating junk mail.
As an example, there is a method of comprehensively evaluating whether an e-mail corresponds to a junk e-mail by determining appropriateness of each word included in the e-mail. For example, out of 100 e-mails, 70 are junk mails and the remaining 30 are normal e-mails (hereinafter referred to as “regular mails”). Here, it is assumed that a word A is detected from 60 of 70 spam mails and 3 of 30 regular mails. In this case, since the word A is a word that easily appears in junk mail, it can be said that there is a high possibility that an e-mail containing the word A is a junk mail. From this point of view, the appropriateness or inappropriateness of each word is indexed into a database, and a comprehensive evaluation of the possibility that the email is spam from each word contained in the newly received email To do.
JP 2003-18324 A

  In order to accurately evaluate the suitability of e-mail content by such a method, it is important to enhance the database. The more emails you receive, the more word-by-word ratings will be. In addition, the number of words to be evaluated increases. On the other hand, an increase in the number of words to be evaluated leads to an enlargement of the database. In particular, when a junk mail of a type in which meaningless words are listed is received, the number of words registered in the database increases at a stretch.

  The present invention has been made in view of such circumstances, and a main object thereof is to provide a technique for efficiently suppressing the enlargement of a database used for evaluating the contents of an electronic mail.

One embodiment of the present invention is an electronic mail evaluation apparatus.
In order to determine whether or not the e-mail transmitted from the external device has appropriate contents for the user of the recipient, the degree-of-fit information holds the degree of relevance obtained by indexing the appropriateness of each word as the degree-of-fit information. A holding unit, a mail acquisition unit that acquires an e-mail to be evaluated, a word extraction unit that extracts a word included in the e-mail, and a fitness of each word included in the e-mail with reference to the fitness information And a suitability determination unit that determines whether or not the e-mail has appropriate content based on the degree of suitability thereof, and determination of the suitability for each word included in the e-mail to be judged with respect to the e-mail The relevance level update unit that updates the relevance level information by recalculating according to the result, and when a word that is not registered in the relevance level information is extracted from the e-mail, the relevance level information When the appearance frequency of a newly registered word is smaller than a predetermined threshold in a group of newly registered words and an email group further acquired after acquiring an email containing the newly registered word, the newly registered word A word deletion unit excluded from the fitness information.

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, and the like are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, the enlargement of the database used in order to evaluate the content of an email can be suppressed efficiently.

FIG. 1 is a schematic diagram showing the relationship between an electronic mail evaluation apparatus and a mail browser.
The client terminal 80 is an information device such as a personal computer or a portable terminal used by the user. The client terminal 80 is installed with a mail browser 90 for mail transmission / reception and browsing. In this embodiment, the email received by the client terminal 80 is first evaluated by the email evaluation device 100. The e-mail evaluation apparatus 100 transfers the e-mail to the mail browser 90 if the e-mail is not junk mail, and does not transfer it to the mail browser 90 if the e-mail is junk mail. In other words, the e-mail evaluation apparatus 100 functions as an e-mail filter.

The e-mail evaluation apparatus 100 according to the present embodiment evaluates the content of the e-mail based on the Bayesian filter method, and determines whether the e-mail is a junk mail.
The determination principle will be described.
As an example, it is assumed that 100 spam mail samples and 100 regular mail samples are prepared in advance. Here, it is assumed that the word “sweep award” appears 98 times in this spam mail group and twice in the regular mail group. In this case, it is highly probable that an e-mail containing the word “price” will be a spam mail. For each word, the e-mail evaluation apparatus 100 indexes “the probability that an e-mail containing the word is a junk mail” as a “spam word probability”.

In the case of the well-known Paul Graham method, the spam word probability P (w) of a word w is
P (w) = (m / M) / (2 × n / N + m / M)
Is defined by the expression
here,
m: Number of times the word w appeared in the spam mail group M: Total number of spam mails n: Number of times the word w appeared in the regular mail group N: Total number of regular mails
When calculating the spam probability of the word “price” just before using the Paul Graham method, m = 98, M = 100, n = 2, N = 100.
P (“Stakes Prize”) = (98/100) / (2 × 2/100 + 98/100)
Is calculated as about 96%.
The e-mail evaluation apparatus 100 creates a database of spam word probabilities for each word included in these 200 e-mails. In this embodiment, such a database is referred to as “fitness information”.

It is assumed that spam word probabilities of “prayer: 96%”, “frozen: 30%”, and “udon: 5%” are set in the fitness information.
It is assumed that after the above initial settings are made, the e-mail evaluation apparatus 100 newly receives an e-mail with the content “I often apply for sweepstakes.
The probability that this e-mail is spam (hereinafter referred to as “spam mail probability”) is (0.96 × 0.3 × 0.05) / {(0.96 × 0.3 × 0.05). It is calculated as + (1−0.96) × (1−0.3) × (1−0.05)} = 35%.
The e-mail evaluation apparatus 100 determines an e-mail having a spam e-mail probability of 90% or more as a junk e-mail. At this time, since the total number of spam mails is 101, the spam word probability of each word in the fitness information is recalculated accordingly.
On the other hand, if it is less than 90%, the e-mail evaluation apparatus 100 transfers the e-mail to the mail browser 90 as not being a spam mail. The user of the mail browser 90 determines whether the transferred electronic mail is indeed a regular mail or is also a junk mail. The determination result is fed back to the electronic mail evaluation apparatus 100. Reflecting this determination result, the e-mail evaluation apparatus 100 updates the fitness information. The e-mail evaluation apparatus 100 updates and enhances the fitness information every time an e-mail is received.
Note that the user can also change various determination conditions in the e-mail evaluation apparatus 100. This will be described later.

FIG. 2 is a functional block diagram of the electronic mail evaluation apparatus.
Each block shown here can be realized in hardware by an element such as a CPU of a computer or a mechanical device, and in software it is realized by a computer program or the like. Draw functional blocks. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software. In the present embodiment, the e-mail evaluation apparatus 100 will be described assuming that the function is exhibited by application software installed in the client terminal 80.
In addition, here, the functions that should be exhibited by each block will be described with reference to FIG.

The e-mail evaluation apparatus 100 includes a user interface processing unit 110, a mail acquisition unit 112, a mail transfer unit 114, a data processing unit 116, and a data storage unit 118.
The user interface processing unit 110 is in charge of processing related to the entire user interface such as input processing from the user and information display for the user. The mail acquisition unit 112 acquires an e-mail from an external mail server (not shown). The mail transfer unit 114 transfers, to the mail browser 90, an e-mail that is determined not to be a junk mail by the data processing unit 116 among the acquired e-mails.

The data processing unit 116 executes various types of data processing based on data acquired from the user interface processing unit 110 and the mail acquisition unit 112. The data processing unit 116 also serves as an interface among the user interface processing unit 110, the mail acquisition unit 112, the mail transfer unit 114, and the data storage unit 118.
The data storage unit 118 stores various setting data prepared in advance and data received from the data processing unit 116.

  The data storage unit 118 includes a fitness information holding unit 138. The goodness-of-fit information holding unit 138 holds goodness-of-fit information in which a word is associated with its spam word probability.

The data processing unit 116 includes a fitness information processing unit 120 and a mail evaluation unit 122.
When the mail acquisition unit 112 acquires an email, the mail evaluation unit 122 determines whether the email is appropriate by calculating a spam mail probability of the email. The fitness information processing unit 120 updates the fitness information in the fitness information holding unit 138 according to the determination result.

The mail evaluation unit 122 includes a word extraction unit 134 and a match determination unit 136.
The word extraction unit 134 extracts words included in the e-mail. The word here may be a word group or a byte stream, and is not necessarily limited to a “word” as a minimum unit of sentence structure. The suitability determining unit 136 reads the spam word probability of the extracted word from the suitability information holding unit 138 and calculates the spam mail probability. As already described, the conformity determination unit 136 causes the e-mail to be transferred from the mail transfer unit 114 to the mail browser 90 if the spam mail probability is less than 90%, and does not transfer it if it is 90% or more.
The regular mail is an electronic mail having a spam mail probability of less than 90% and determined to be appropriate by the user at the client terminal 80. The junk mail is an e-mail that is determined to be inappropriate by the user at the client terminal 80 with a spam mail probability of 90% or more or a spam mail probability of less than 90%. As described above, whether or not the e-mail is appropriate is determined by both or one of the mail evaluation unit 122 of the e-mail evaluation apparatus 100 and the user of the mail browser 90.
Note that the user can arbitrarily change the numerical value of 90%, which is an e-mail determination criterion, via the user interface processing unit 110.

The fitness information processing unit 120 includes an updating unit 124, a word registration unit 126, a word deletion unit 128, a counting unit 130, and a threshold setting unit 132.
The update unit 124 updates the fitness level information. That is, the spam word probability of each word included in the fitness information is recalculated according to Paul Graham's formula according to the determination result for the new e-mail. If there is an unregistered word in the fitness information among the words included in the e-mail, the word registration unit 126 newly registers this in the fitness information. Thereafter, the calculation of the spam word probability for the newly registered word is started.

The word deletion unit 128 deletes words that satisfy the deletion condition from the fitness information. Specifically, when a word w detected from a certain e-mail M is newly registered,
(R ≧ R) ∩ [{(s / r) <T} ∪ {0.5−P _t ≦ p ≦ 0.5 + P _t }]
When the deletion condition is established, the word w is deleted from the fitness information.
here,
r: The number of e-mails further acquired after the e-mail M is acquired.
R: 1st threshold value. It is an integer of 100 or more and is set by the user. The default value is 1000.
s: The number of e-mails including the word w among the r e-mails acquired after the e-mail M is acquired.
T: Second threshold value. It is set by the user in the range of 0.01 or more and less than 1.0. The initial value is 0.1
p: Spam word probability of word w calculated based on r emails further acquired after email M is acquired P _t : third threshold. It is set by the user in the range of 0 to 0.5. The initial value is 0.2
It is.

The meaning of each item will be described.
1. (S / r) <T... First deletion condition In r e-mails after the e-mail M is acquired, if the frequency of appearance of the word w is low, the e-mail is considered to be deleted. If the word w does not appear so much after the word w is newly registered in the fitness information by the electronic mail M, it is considered that the word w is not an important judgment material in calculating the spam mail probability. For this reason, in such a case, the word w is to be deleted.
2.0.5−P _t ≦ p ≦ 0.5 + P _t ... Second deletion condition When the spam word probability of the word w is near 0.5, it is determined as a deletion target. When the spam word probability of the word w is close to 0.5, that is, the word w having neutral suitability is considered not to be an important judgment material in calculating the spam mail probability. Therefore, in such a case, the word w is a deletion target.
3. r ≧ R... Third deletion condition This is a condition for ensuring statistical stability in determining whether or not the word w can be deleted. The word w can be a deletion target on condition that the third deletion condition is satisfied.
In summary, when a certain amount of e-mail is acquired after the word w is newly registered, if the appearance frequency of the word w is small or the spam word probability of the word w is neutral, the word w is a goodness of fit. It will be deleted from the information. By such processing, measures are taken so that the number of words to be evaluated included in the fitness information is not excessively large.

The counting unit 130 counts the number of emails r received after a word is newly registered. The count value at this time is used in determining whether the deletion condition is successful. The threshold setting unit 132 changes the first to third thresholds according to the setting input from the user.
Next, a process when the e-mail evaluation apparatus 100 newly receives an e-mail will be described.

FIG. 3 is a flowchart showing the basic processing steps of the e-mail evaluation apparatus when receiving e-mail.
First, the mail acquisition unit 112 acquires an electronic mail transmitted from an external device (S10). A mail evaluation process is executed by calculating the spam mail probability of this e-mail (S12), and a word deletion determination process for determining whether word deletion can be executed from the fitness information is executed as necessary (S12). S14).
The processing contents of S12 and S14 will be described in detail later.

FIG. 4 is a flowchart showing in detail the contents of the mail evaluation process in S12 of FIG.
The word extraction unit 134 extracts words included in the email (S16). If there is a word that is not registered in the fitness information (Y in S18), the word registration unit 126 newly registers the unregistered word in the fitness information (S20). The counting unit 130 starts counting the number of e-mails acquired thereafter for this newly registered word. The counting unit 130 counts the number of emails r for each newly registered word. If there is no unregistered word among the words extracted from the e-mail (N in S18), S20 is skipped. Thus, the spam mail probability is calculated (S22).

If the spam mail probability is equal to or higher than a predetermined threshold (N in S24), the conformity determination unit 136 determines that the electronic mail is a spam mail (S29). In this embodiment, the threshold is set as 90%, but can be changed by a setting input from the user. On the other hand, if the spam mail probability is less than this threshold (Y in S24), the conformity determination unit 136 temporarily determines that the mail is a regular mail. The mail transfer unit 114 transfers the e-mail to the mail browser 90 (S26). When it is determined by the user that the transferred electronic mail is a junk mail (Y in S27), this mail is treated as a junk mail (S29). When the user determines that the transferred electronic mail is a regular mail (N in S27), the electronic mail is treated as a regular mail (S28).
The update unit 124 recalculates the spam word probability of each word in the fitness information according to the determination result for the email (S30).

FIG. 5 is a flowchart showing in detail the contents of the word deletion determination process in S14 of FIG.
For the newly registered word, the word deletion unit 128 determines whether there is a word whose number of e-mails r acquired after the registration is equal to or greater than the first threshold value R, that is, a word that satisfies the third deletion condition. It is determined whether it exists (S34). If it does not exist (N of S34), the process of S14 is ended as it is. If it exists (Y in S34), the word deletion unit 128 determines whether the appearance frequency of the word w is smaller than a predetermined threshold in the r email groups acquired after the word w is registered, that is, It is determined whether the second deletion condition is satisfied (S36). If the second deletion condition is satisfied (Y in S36), the word deletion unit 128 deletes the word w from the fitness information (S40). On the other hand, if not established (N in S36), the word deletion unit 128 determines the second deletion condition (S38). If established (Y in S38), the word deletion unit 128 deletes the word w from the fitness information (S40). If not established (N in S38), the process in S14 ends.

The present invention has been described above based on the embodiments.
According to the e-mail evaluation apparatus 100 shown in the present embodiment, when the spam mail probability is obtained by the Bayesian filter method, the enlargement of the data amount of the fitness information that is the basis of the determination can be effectively suppressed.

Some junk emails use words that are meaninglessly enumerated to disrupt the Bayesian filter. In the case of the conventional e-mail filtering method based on the Bayesian filter, when such a type of junk mail is received, the number of words included in the fitness information greatly increases. The enlargement of the fitness information increases the load accompanying the update processing of fitness information.
On the other hand, the e-mail evaluation apparatus 100 according to the present embodiment takes measures so that the data amount of the fitness information does not increase unlimitedly by appropriately deleting words registered as fitness information. In order to eliminate the words that are not very useful while keeping the words that are useful in calculating the spam mail probability, while suppressing the enlargement of the data amount of the fitness information, changes in the judgment criteria for suitability and inconvenience Respond to changes in email types. As described above, the e-mail evaluation device 100 can effectively solve the problems that may occur due to the word learning function.
In the present embodiment, the description has been made on the premise of the Bayesian filter, particularly, the Paul Graham method. In the present embodiment, an embodiment has been shown in which electronic mail is classified into regular mail and spam mail based on words and fitness. In addition, the data classification method is not limited to words, and a classification method based on the appropriateness of various attributes is also conceivable. For example, when classifying document data, the appearance frequency, author, creation date, etc. of the word in the document data can be used as attributes. Further, when classifying image data, color frequency, brightness frequency, or the like can be used as an attribute.

Note that the function of the threshold value input unit described in the claims is realized by the user interface processing unit 110 in this embodiment.
It should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by a single function block or a combination of the functional blocks shown in the present embodiment.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are within the scope of the present invention. is there.

In this embodiment, in the first deletion condition (s / r) <T, s is described as the number of e-mails in which the word w to be determined appears among r e-mails. did. Therefore, the relationship of s ≦ r is established.
On the other hand, as another example, s may be the number of words w included in r emails. In this case, s can be greater than r. Correspondingly, the possible range of the second threshold T may also be set to a numerical value of 1 or more, for example, 1000.

In addition to the present embodiment, a modification in which the importance of all attributes is calculated by the following formula and only the attributes corresponding to the top n importances are left is also conceivable.
First,
Importance (attribute) = f (attribute appearance frequency) × g (attribute determination contribution)
f: Arbitrary monotonically increasing function g: Importance is defined as an arbitrary monotonically increasing function.

Based on the above, the following formula is defined as a formula for specifying the importance for each word.
Importance (w) = √ {Max (n / N, m / M)} × abs (p-0.5)
m: Number of times the word w appeared in the spam mail group M: Total number of spam mails n: Number of times the word w appeared in the regular mail group N: Total number of regular mails p: Spam word probability of the word w (the one far from 0.5 (Decision contribution is high)
Here, “Max (n / N, m / M)” is a function that selects the larger one of the variables n / N and m / M. “Abs (p-0.5)” indicates the absolute value of p-0.5. In the case of the method shown in this modification, it is possible to select words to be reduced in consideration of the importance of words. For example, even a word that satisfies the deletion condition may not be deleted when its importance is greater than a predetermined threshold. The data amount of the fitness information can be reduced more efficiently by setting the high word so that it is difficult to be deleted and the low word is likely to be deleted.

It is a schematic diagram which shows the relationship between an electronic mail evaluation apparatus and a mail browser. It is a functional block diagram of an electronic mail evaluation apparatus. It is a flowchart which shows the basic process of an e-mail evaluation apparatus at the time of e-mail reception. It is a flowchart which shows the content of the mail evaluation process in S12 of FIG. 3 in detail. It is a flowchart which shows the content of the word deletion determination process in S14 of FIG. 3 in detail.

Explanation of symbols

  80 client terminal, 90 mail browser, 100 electronic mail evaluation device, 110 user interface processing unit, 112 mail acquisition unit, 114 mail transfer unit, 116 data processing unit, 118 data storage unit, 120 fitness information processing unit, 122 mail evaluation Part, 124 update part, 126 word registration part, 128 word deletion part, 130 counting part, 132 threshold value setting part, 134 word extraction part, 136 conformity determination part, 138 conformity information holding part.

Claims (7)

In order to determine whether or not the e-mail transmitted from the external device has appropriate contents for the user of the recipient, a fitness information holding unit that holds the fitness that indexes the appropriateness of each word as fitness information,
An email acquisition unit for acquiring emails to be evaluated;
A word extractor for extracting words contained in the email;
A fitness determination unit that detects the fitness of each word included in the e-mail with reference to the fitness information, and determines whether the e-mail has appropriate content from the fitness; and
A relevance level update unit that updates the relevance level information by recalculating the relevance level for each word included in the e-mail to be determined according to the determination result for the e-mail;
When a word that is not registered in the fitness information is extracted from an email, a word registration unit that newly registers the word in the fitness information;
Further acquisition after acquisition of an e-mail containing the newly registered word, provided that the number of e-mails acquired after acquisition of the e-mail including the newly registered word exceeds a predetermined first threshold. A word deletion unit that excludes the newly registered word from the fitness information when the appearance frequency of the newly registered word is smaller than a predetermined second threshold in the group of emails
A threshold value input unit for detecting an instruction input by a user for setting the first threshold value and the second threshold value;
A threshold value setting unit for setting a value designated by an instruction input as the first threshold value or the second threshold value;
An e-mail evaluation apparatus comprising:   The e-mail evaluation apparatus according to claim 1, wherein the fitness level update unit recalculates the fitness level for each word included in the e-mail based on a Bayesian Filtering method.   The word deletion unit is configured to exclude the newly registered word from the fitness level information when the fitness level calculated by the fitness level update unit is within a predetermined range for the newly registered word. The electronic mail evaluation apparatus according to claim 1 or 2.   The word deletion unit excludes the newly registered word from the fitness level information when the fitness level of the newly registered word is included in a predetermined range including a median value of the range of possible fitness levels. 4. The e-mail evaluation apparatus according to claim 3, wherein   The threshold value input unit detects an instruction input by a user for setting the predetermined range,
  The threshold setting unit sets a value designated by an instruction input as the predetermined range.
  The e-mail evaluation apparatus according to claim 3 or 4, characterized by the above. A step of acquiring an email to be evaluated by a mail acquisition unit provided in the computer ;
A word extraction unit provided in the computer for extracting words included in the e-mail;
The matching determination unit provided in the computer refers to the matching level information indicating the matching level obtained by indexing the appropriateness of each word, detects the matching level of each word included in the acquired e-mail, and Determining whether the email obtained from the fitness is appropriate content;
A fitness level update unit provided in the computer updates the fitness level information by recalculating the fitness level of each word included in the email to be determined according to the determination result for the email. Steps,
A word registration unit provided in the computer, when a word not registered in the fitness information is extracted from an e-mail, newly registering the word in the fitness information;
The word deletion unit provided in the computer is newly registered on the condition that the number of e-mails further acquired after acquiring e-mails including the newly registered words exceeds a predetermined first threshold . A step of excluding the newly registered word from the fitness information when the appearance frequency of the newly registered word is smaller than a predetermined second threshold in the group of e-mails acquired after acquiring the e-mail including the word When,
Detecting a command input by a user for setting the first threshold and the second threshold by a threshold input unit provided in the computer;
A threshold setting unit provided in the computer sets a value designated by an instruction input as the first threshold or the second threshold;
An e-mail evaluation method comprising: Computer
A function of holding a fitness indexed by the appropriateness of each word as fitness information in order to determine whether the email sent from the external device is appropriate for the recipient user;
Email acquisition means for acquiring emails to be evaluated,
Word extraction means for extracting words contained in the e-mail;
A match determination unit that detects the match of each word included in the e-mail with reference to the match information, and determines whether the e-mail has an appropriate content from the suitability;
Relevance level update means for updating the relevance level information by recalculating the relevance level for each word included in the e-mail to be determined according to the determination result for the e-mail;
When a word that is not registered in the fitness information is extracted from an e-mail, a word registration unit that newly registers the word in the fitness information,
Further acquisition after acquisition of an e-mail containing the newly registered word, provided that the number of e-mails acquired after acquisition of the e-mail including the newly registered word exceeds a predetermined first threshold. A word deletion means for excluding the newly registered word from the fitness information when the frequency of appearance of the newly registered word in the group of emails is less than a predetermined second threshold;
Threshold input means for detecting an instruction input by a user for setting the first threshold and the second threshold;
Threshold setting means for setting a value designated by an instruction input as the first threshold or the second threshold;
E-mail evaluation program to function as .

Images