KR100496771B1 - Email blocking algorithm and system based on phone number pattern matching method - Google Patents

Abstract

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system and method for blocking advertisement mail or spam mail transmitted indiscriminately regardless of the intention of a recipient among electronic mails transmitted through a communication network such as the Internet and a wireless network. Analyze the phone number and extract the phone number, and if it contains the matching contents by referring to the database or external database already stored, it is classified as an e-mail that the recipient does not want to receive and blocks the reception.

Description

Email blocking algorithm and system based on phone number pattern matching method

The present invention relates to an electronic mail blocking system and method, and more particularly, to a system and method for distinguishing spam mail, which is mail sent without a user's consent, through an internet communication network, and filtering or blocking it according to a user's purpose.

1 shows a method of delivering an email between a sender and a receiver on the Internet. When the sender sends an email to MUA (Mail User Agent), the mail client used by the sender, the sender sends the mail to the recipient by using the MTA (Mail Transfer Agent), which is the sending mail server, and the sending mail server sends the mail to the recipient. It is delivered to the receiving mail server by using the receiver, and the recipient's mail client retrieves the mail received from the recipient's mail mailbox through the POP3 / IMAP / CGI protocol.

2 is a process conceptual diagram of a spam mail filtering method used in the related art. First, the header and body are separated from the received mail 201 (202), and the header pattern check (203) for analyzing the sender address, transmission path and the like in the separated header information is compared with the pattern DB (M220). . Next, the content included in the body is separated (204) and the body pattern check (205) is performed to determine whether there is a matching phrase in the pattern DB (M220) in each content part. Then, after extracting the text part from the content part of the body (206) and converting this part into a character that can be interpreted, the process of decoding (207) and character set conversion (208) is performed. A text pattern test 209 is performed for comparison with (M220). If a matching phrase is found in the pattern DB (M220) in each of the condition checking patterns (203, 205, and 209), the message is classified as an unsolicited mail and blocked from receiving (211). If there is no mail, the mail is received 210 normally and brought to the recipient's MUA.

In this conventional method, it is fundamentally impossible to effectively block or distinguish spam mails from spammers because of the following reasons. In the case of a pattern inspection method using information included in the header, the header itself recorded in a format described in RFC822: Standard for ARPA Internet Text Messages prescribed by IETE (Internet Engineering Task Force) has low reliability. That is, since the sender can change the content as desired, it is difficult to accurately filter spam mail by a simple pattern checking method. For example, if you classify with the From: on the header, there is no way to classify if the sender keeps changing the contents. Similarly, the method of classifying or blocking mail by the outgoing route recorded in the header information is also a standard protocol related to the delivery of the sender's address, the address of the mail server used by the sender, or the server address on the delivery route. 821: Difficult to apply, as can be changed according to Simple Mail Transfer Protocol (SMTP). Even when blocking certain phrases (e.g. advertisements) in the body information such as the title or body, if characters are inserted in the middle (e.g., wide ***) and Chinese characters so that such phrases are not easily detected. The expressions are diverse, such as writing, so it is not easy to detect all of these cases. In the case of checking the text of the text, it is difficult to block because it is replaced by a word having a similar or reminiscent meaning, and nowadays, the text can be included in the text. Therefore, it is difficult to block spam mail.

The present invention is an efficient e-mail blocking method devised in consideration of the essential aspect of spam mail, that is, the spam mail is intended to be connected to the recipient through the sender's wired or wireless telephone by informing the sender of the intention of the sender. In other words, the wired / wireless telephone, which is one of information that the sender of spam mail must include in the mail, not the existing spam mail blocking method that filters information that can be manipulated according to the sender's intention by checking a pattern of simple syntax. The key principle of the present invention is to use a method of extracting a number, a fax number, etc. and comparing it with a block list, and the number of spam mails received by the receiver by applying the spam blocking technology using the same to the receiving MTA or MUA. It is an object of the present invention to drastically reduce.

If there are certain parts in the e-mail sent to spam that cannot be manipulated by the sender by changing the phrase, and can extract these parts and perform pattern matching to classify them as spam, protect the recipients of the mail from spam. You can do it.

Fig. 3 shows the structure of a general e-mail presented to understand the principles of the present invention. When the received email 300 is analyzed as a part, it can be largely divided into a header 310 and a body 320, and the body 320 is again a message part 321 and a contents part 322 having a plurality of contents. Can be divided. The contents part 322 mainly means an attached file or the like and may have a plurality of contents. The message part 321 is configured in a text / plain 331 format or a text / html 332 format. Depending on the mail, the Contents section 322 may not be present, and it may contain text / plain (331) and text / html (332) at the same time, or may be in the form of text / plain (331) or text / html (332). It may be comprised only by any one. The present invention begins by extracting and analyzing the text / plain portion 331 and the text / html portion 332 shown in FIG. 1 from the received mail.

Spam mail also includes a Message part in text / html format or text / plain form, which contains a variety of contacts that can be contacted with the company or individual sender for the purpose of spam mail. If such contacts are extracted and recognized as specific phrases and used to block spam mails, the spam blocking rate can be dramatically improved due to the fact that contact phrases are generally not selected for the syntax change or manipulation.

The present invention has been made in view of the above, and based on this, the e-mail blocking system according to the present invention is a header / body separator, separated body to separate the header and body from the e-mail received by the mail server of the recipient side Message / Contents separator that separates message and contents from, Decode executor that decodes extracted message part, Character Set converter that converts decoded message set character set, html syntax when message is text / html format The valid text extractor extracts the remaining valid text parts after removing the html tag part by analyzing, the phone number pattern extractor extracting a specific phone number pattern from the obtained text, and the contact number of the spam mail sender. If there is a matching phrase compared to the phone number pattern DB, the receiver will receive the mail normally. If you have reotji to classify messages as spam it includes pattern matching analyzer for the ability to block incoming email to the recipient. The electronic mail blocking system of the present invention protects the user from spam mail by processing the spam mail according to the request of the pattern matching analyzer.

Hereinafter, with reference to the accompanying drawings the principles and embodiments of the present invention will be described in more detail.

Figure 4 shows the operation principle and configuration of the functional module of the electronic mail blocker according to an embodiment of the present invention.

The header / body separator 401 functions to separate the header and the body of the received mail 400 when the mail arrives at the receiving MTA or the MUA.

The message / contents separator 402 functions to separate the body part of the mail obtained by the header / body separator 401 back into the message part and the content part.

In the step (403) of checking whether the separated message part is composed of text / plain format only, if the text / plain format is included and if the text / html format is included, the message part is passed to the next step. It performs conditional execution.

Decode executors 410 and 411 function to decode the encoded email into a readable form. In general, when an e-mail is sent by the sender, the MTA is converted and sent according to 8 bit, quoated-printable, base64, etc., and it is called encode. It is decoded by the recipient to re-analyze it in order to reinterpret it. It is called.

The character set converters 420 and 421 convert a character set of a decoded email to identify them as readable characters. If the e-mail contains non-English characters, the e-mail contains unreadable parts after the decode process. For example, in the case of Hangul, mail is transmitted using a character set such as euc-kr, iso-2022kr, and the like, so that it can be identified as a readable character only by converting the character set of the transmitted and unreadable email again.

The effective text extractor 430 reads and interprets the html sentence present in the message part of the e-mail including the text / html format converted into readable characters through the decode process and the character set conversion process, and then includes a tag included in the html sentence. It finds the part and separates the tag part from the text part.

The phone number pattern extractor 440 removes the html tag portion from the message portion of the decoded and character set converted text / plain format or the decoded and character set converted text / html formatted message portion, and calls the phone specific to the remaining text portion. It checks whether a number pattern exists and extracts a phrase that is supposed to be a telephone number. Examples of the phone number syntax detected by the phone number pattern extractor 440 include phone, call, fax, phone, country code, area code, service number, and the like, or phone numbers containing special characters such as ☎ and ☏. All phrases in the form or phrases having various telephone number forms such as 1-000-000-0000 and (000) 000-0000.

The pattern matching analyzer 450 compares the phone number estimation phrase extracted from the phone number pattern extractor 440 with the phone number syntax that is already registered. If the same pattern exists, the pattern matching analyzer 450 blocks reception of the corresponding mail. It delivers mail to MTA or MUA to receive mail normally.

Pre-made DB (451) is a database that stores the telephone number pattern of spammers, and means a list provided by an institution, corporation or individual. Custom DB (452) is a database that stores the phone number pattern of spammers, and means a list directly created by an administrator of a server on which an email blocker is installed or a user subject to the email blocker. The pre-made DB 451 and the custom DB 452 are used as search criteria for comparing the telephone number pattern extracted from the mail by the telephone number pattern extractor 440.

5 is a block diagram illustrating an installation of an e-mail blocker in an MTA or a MUA according to a preferred embodiment of the present invention. When the mail is received 500 at the receiving MTA, the receiving MTA 510 notifies the e-mail blocker 520 of the arrival of the new mail and requests the analysis at the same time (511). The e-mail blocker 520 analyzes the contents of the mail and extracts a phone number pattern. The e-mail blocker 520 performs pattern matching with the existing DB. If there is a matching phone number pattern, the mail is regarded as spam mail and classified as a spam mail (530). If there is no matching phone number pattern, the mail is normally returned to the MTA (510). Returns it for processing. Then, when the MUA used by the recipient requests the MTA 510 to retrieve the mail, the mail is transmitted to the mail deposit box of the MUA according to a protocol such as POP3 / IMAP / CGI. In addition, the e-mail blocker may be installed in the MUA 540. The e-mail blocker U511 thus installed performs the same function as the e-mail blocker 511 installed in the MTA. The recipient finally checks the mail list from which spam mail has been removed by the e-mail blocker 511 installed in the MTA or the e-mail blocker U511 installed in the MUA. In order to better understand the scope, the features and technical advantages of the present invention have been outlined somewhat broadly. Additional features and advantages that make up the claims of the present invention will be described below. It should be appreciated by those skilled in the art that the conception and specific embodiment of the invention disclosed can be readily used as a basis for designing or modifying other structures for carrying out similar purposes to the invention. The inventive concepts and embodiments disclosed herein can be used by those skilled in the art as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. In addition, such modifications or altered equivalent structures by those skilled in the art may be variously changed, substituted, and changed without departing from the spirit or scope of the invention described in the claims.

According to the present invention, since it is determined whether spam mail is obtained by extracting and comparing the wired / wireless telephone number of the sender side included in the spam mail, the accuracy and reliability are higher than that of the conventional method of extracting and comparing other operable phrases. If the phone number is included in the e-mail, spam mail blocking results are high.

1 is a conceptual diagram of email communication.

Figure 2 is a conceptual diagram of the e-mail blocking process of the conventional phrase filtering method.

3 is a conceptual diagram of components of an email.

Figure 4 is a functional module configuration of the email blocker applying the phone number extraction and pattern matching analysis.

5 is a server installation configuration diagram of an email blocker.

Claims (3)

In a method of spam filtering on email sent over a network, (a) The received email is identified and separated into a header 310 and a body 320 through a parsing process, and the body 320 is separated into a message 321 and a content 322 again. Extracting; (b) checking and separating the message 321 portion for text / plain format 331 or / and text / html format 332 and dividing the content 322 portion into a plurality of contents; And (c) converting the message 321 into a character set and converting the decoded text into a readable string to separate the text portion, and the text portion includes any of phone, call, fax, country code, area code or service number. Parses and checks whether there is a selected phone number pattern with one phone related character or a special character such as ☏, ☎, or whether the selected phone number pattern exists in the pattern database, and if so exists. Steps to filter this email Email filtering method comprising a. delete delete