KR20060106428A - Method for managing email with ananyzing mail behavior - Google Patents

Abstract

The present invention discloses a method of managing an email using an email behavior analysis. The method uses one mail policy such as envelope information and header information to verify transmission data when an agent receives an email. The method then executes the corresponding action according to the verified result. If the mail policy is defined as the act of spam, then the email will be blocked if it matches; If a mail policy is specified as the act of an exempted mail, then the email will be forwarded if it matches. The present invention can achieve the purpose of email communication management and spam blocking, improve communication efficiency and reduce operating costs.

Email, Email, Behavior Analysis, Mail Policy, Spam, Garbage, Blocking, Filtering

Description

How to manage email using mail behavior analysis {METHOD FOR MANAGING EMAIL WITH ANANYZING MAIL BEHAVIOR}

1 is a schematic diagram of an email management method using mail behavior analysis according to the present invention.

2 is a flow chart for verifying email using rules of the mail policy of the present invention.

3 is a flowchart of verifying an email using a predetermined mail policy according to the present invention.

* Description of the major symbols in the drawings *

10: mail policy 12: rule

The present invention relates to an email management method, and more particularly, to an email management method using mail behavior analysis.

Viruses, hackers and spam are serious problems in the security of corporate email information. Most mail filtering, virus research, and anti-spam software companies use huge databases to process and analyze email, and collect a large number of "mail content" for numerical analysis to achieve spam protection. . Conventional methods also have the disadvantage of misjudging some subjects, such as pornography, wealth, drugs and commerce, and e-mail filters can consume system resources and reduce communication efficiency. The international common consensus divides spam into trash mail and advertisement mail, and the difference must be distinguished before explaining spam prevention. In the United States, under the Can-Spam law, junk mail is sent using anonymity, counterfeit, misuse, or illegality (change or conceal information). Means that you can't keep track of the source (the source), 2. change the communication method, 2. mislead the recipient to be a colleague or friend, 4. be curious to read the mail. It can cause. Since junk mail has unidentifiable sources or cannot be successfully rejected, special techniques are needed to block them. Advertising mail means that the sender gets the recipient's email address in a specific way and sends the email in the usual way. Recipients can track the email source and delete it.

Conventional spam blocking techniques can be divided into three methods: content filtering, numerical calculation and enlightenment. The content filtering method provides a block list including sender, recipient, message header, message content, extension name, file name, and file content before blocking spam. This is a waste of time, very low blocking rate and misleading. Numerical calculation methods use a huge database for calculation and analysis. By collecting and counting the "mail content" of many spams, you can block spam, the disadvantages of which can be undetermined or misleading in determining subjects (such as pornography, wealth, drugs and trade) and system resources. Consumption and communication efficiency is reduced. The method of enlightenment technology also uses a large database to calculate and analyze the "mail content" of many spams, the same as the numerical method. In addition to numerical calculations, intelligent enlightenment methods are also used, the disadvantages of which include the disadvantages of numerical calculation methods, including more false positives and larger databases.

Accordingly, the present invention discloses an email management method using mail behavior analysis to overcome these disadvantages.

Accordingly, an object of the present invention is to provide an email management method using mail behavior analysis to achieve the purpose of managing email communication.

Another object of the present invention is to provide an email management method using an analysis of mail behavior that effectively blocks spam.

It is still another object of the present invention to provide an email management method using mail behavior analysis that has an advantage of accurately managing email and saving network bandwidth, system resources, and hard disk space in consideration of both network security and communication efficiency. .

Still another object of the present invention is to provide an e-mail management method using an e-mail behavior analysis that can reduce operating costs.

According to the present invention, an email management method using mail behavior analysis includes: defining a plurality of different mail policies with envelope information and header information; Comparing mail transmission data of an email with the mail policy, one by one, to determine whether the behavior of the email matches the mail policy when the agent receives the mail; And performing a corresponding blocking / transmitting operation according to the comparison result.

These and other objects of the present invention will no doubt become apparent to those skilled in the art after reading the following detailed description of the preferred embodiment shown in the various figures.

The present invention verifies true and false values for the transmission data of an email using a predetermined mail policy in an execution step of a mail transfer agent (MTA). By analyzing the transmission data of the mail envelop and the mail header, the present invention can determine whether the e-mail matches the allowed behavior, and achieve the purpose of controlling e-mail communication and blocking spam. .

The completed email is called mail text. In general, mail text includes mail envelopes, mail headers, and mail content. The default delivery mode of the completed email has a processing procedure for a mail transfer agent (MTA) and a mail user agent (MUA) between the server and the user. The invention utilizes the features and principles of email to analyze and test true and false values of transmitted data, such as mail envelopes and mail headers, and determines hundreds of mail behaviors to manage mail communication and block spam. .

Since the present invention uses the envelope information of the e-mail to define the mail policy, the contents of the envelope information must be explained in advance. Typically, envelope information includes sender address, recipient address, sender host address, recipient host address, response address, domain name server (DNS), and e-postmark. Email stamps include sender server, Added when passing through a central office server and an ISP server, respectively.

1 is a schematic diagram of an email management method using mail behavior analysis according to the present invention. The method first includes defining a plurality of different mail policies 10 using envelope information, each mail policy 10 including a plurality of rules 12. FIG. 2 shows the rules of each mail policy 10 including three rules 12, envelope sender, envelope recipient and mail header, and the system will execute only if all three rules 12 match. Using the provisions of rule 12, the user can specify one of the conditions that are matched, inconsistent, and ignored, which means that the user may not specify for the envelope sender or the envelope recipient or any selection. The user can also choose to validate or ignore the mail header, and the relationship of all rules 12 is " logical ", and the system will execute if all matches with the condition applied. Likewise, when defining the mail policy 10, the user can specify one of the conditions that are matched, inconsistent and ignored. After defining the mail policy 10 and the rule 12, when an email is received, the agent verifies the transmission data of the email using the mail policy 10 one by one. The sent data also includes envelope information and header information, content, or attachments of the email, which are determined by the mail policy 10 and the rule 12 to verify whether the email behavior is consistent with the mail policy 10. It is prescribed. Corresponding transmission or blocking operation will continue according to the verification result.

The user can define a mail policy 10 and a rule 12 for the behavior of spam or exempted mail to verify email. If the mail policy 10 and the rule 12 are defined as the act of spam, the step after the agent receives the email compares the transmission data of the email with the mail policy 10 one by one so that the behavior of the email is determined by the mail policy 10. ), If it matches it means that the email is spam and will block it and if it does not match it will be sent.

Conversely, if the mail policy 10 and the rule 12 are defined as exempt mail, the step after the agent receives the email compares the email's transmission data with the mail policy 10 one by one so that the behavior of the email is determined by the mail policy ( 10), if it matches, it means that the email is exempt and will send it, and if it does not match it will be blocked. As a rule of exemption mail, the exemption user can be defined. The sender of the exemption mail includes the parent company, subsidiary company, key customer, supplier, e-paper domain name, and static IP. In addition, authorized internal users can access email from outside the company intranet (such as homes, suppliers, or certain branch offices), and exempt users can have a high priority.

Based on the policy of the mail policy 10, the agent's action will block the corresponding mail if the mail policy is defined as the act of spam. Will be passed, contrary. Since the principle of operation is the same, the following embodiment describes only the management of spam and omits the exemption mail.

With regard to the management of spam, the detailed procedure when verifying whether an email matches the mail policy 10 is shown in FIG. When the agent receives the email, the first mail policy is used to verify the transmission data of the email to determine whether the email matches the first mail policy. If there is a match, step S12 is executed to allow transmission of the email, and if there is a mismatch, step S14 will be executed.

In step S14, the agent continuously tracks the behavior of the email using the first mail policy to determine whether the email matches the second mail policy. If there is a match, the transmission of the email is permitted and step S12 is executed, if there is a mismatch, step S16 is executed to track the behavior of the email using the next mail policy until the final mail policy is used. As shown in step S18, if the final mail policy is used, step S12 will be executed if the corresponding e-mail matches the mail policy, and if it is inconsistent, the e-mail will be determined to be undeliverable and step S20 will be executed.

If the email is not allowed, the agent can reject the email and send back an error code and error message or delete the email immediately. When defining the mail policy, the operation of not sending the corresponding email may be determined in advance.

In addition, when verifying transmission data of an email using one of the mail policies, the detailed procedure of FIG. 3 may be described as follows with reference to FIG. 2.

(a) First, perform an authenticity check on the transmission data of the email using the first rule to determine whether the email matches the first rule, and if so, step (b) will be executed; (c) will be executed.

(b) perform an authenticity check on the transmission data of the email using the second rule to determine whether the email matches the second rule, if not, step (c) will be executed, and if the final rule is used, Keep track of email behavior by running the following rules until According to the verification result of the final rule, it is determined whether the corresponding e-mail policy matches the mail policy, and if the e-mail is matched, the e-mail is allowed to be sent, and if the e-mail does not match, step (c) will be executed.

(c) use the next mail policy to keep track of the behavior of the email to determine whether the email matches the mail policy, if so, then the email is allowed to be sent, and if not, the next mail until the final mail policy is used. Use policies to track the behavior of email.

Therefore, the present invention manages important information for controlling email communication by accurately defining email behavior and processing procedures.

Spam is transmitted using anonymity, forgery, misuse, or offense (change or conceal information) and cannot be tracked or deleted. If an effort is made to verify the sender who sends the email using anonymity, forgery, misuse or illegal (change or conceal information), the sender can be identified as a spammer.

The mail policy described above allows a user to verify whether an email is spam and to determine abnormal behavior such as anonymous, forgery, misuse or illegality. After verification, if the email is abnormal, the email can be determined to be spam. For example, the anonymous behavior may be that the header information is unclear, the sender and the response host are different, or the response host is an ISP host. The forgery may be to trick the source host into something internal but to be inaccurate in the DNS. Misuse is an unusual and varied way of delivery. Offenses are rented by the responding host.

Using the analysis of anonymous behaviors, the present invention can verify the behavior described above and be sent by a device, hacker or person, such as validation of an email sent by a postmaster, mailerdemon or list server. You can verify an email.

The email management method of the present invention using the analysis of the mail behavior is always executed in the agent, and the most used is the MTA. When executed in the MTA, spam simulation controls email envelopes and mailheads to validate email by analyzing true and false values of the transmitted data. Whether the email matches spam behavior can be correctly verified, and the MTA can be a router.

The email management method using the analysis of the mail behavior has been described above, and three examples will be described below. Those skilled in the art can thus practice.

Example 1: Control email communication-A specific internal user can only send email to specific internal users.

Example 2: Anti-Spam-Anonymously explains the difference between the originating host and the responding host.

Example 3: Forgery explains that the source host is external and impersonates the source address as internal.

Unlike the prior art, the present invention utilizes the features and principles of the e-mail to analyze the mail envelope and the mail header to determine whether to send the e-mail, it is possible to effectively manage e-mail communication and information security. The present invention can not only prevent spam in order to accurately manage e-mail and guarantee network security, but also can save e-mail communication efficiency and reduce operating costs by saving network bandwidth, system resources and hard disk space.

Those skilled in the art can make various changes and modifications to the apparatus while retaining the teachings of the present invention. Accordingly, the above disclosure should be construed as limited only by the scope and scope of the appended claims.

Claims (21)

An email management method using mail behavior analysis, Defining a plurality of different mail policies using envelope information and header information, and When the agent receives the email, the mail transmission data of the email is compared with the mail policy one by one to determine whether the behavior of the email matches the mail policy, and the corresponding blocking / sending operation is performed according to the comparison result. Step to run Email management method comprising a. The method of claim 1, The mail policy is used to determine whether the email is spam, The method for determining the email after the agent receives the email, Comparing the mail transmission data of the email with the mail policy one by one to determine whether the behavior of the email matches the mail policy, and if so, blocking the email because it means spam; and Sending the email if there is a mismatch Email management method comprising a. The method of claim 1, The mail policy is a guard policy for defining the behavior of exempted mail. The method for determining the email after the agent receives the email, Comparing mail transmission data of the email with the mail policy one by one to determine whether the behavior of the email matches the mail policy, and if it matches, the email means that the email is an exempt mail; Blocking the email if there is a mismatch Email management method comprising a. The method of claim 3, The sender of the exemption mail includes at least one group consisting of a parent company, a subsidiary company, an important customer, a supplier, a domain name of an e-paper, and a fixed IP. The method of claim 1, The defining of the mail policy includes defining a verification criterion of each mail policy, wherein the verification criterion is selected from one of a match, a mismatch, and an exemption. The method of claim 1, And the mail transmission data includes the envelope information and the header information of the email. The method of claim 2, Determining whether the email matches the spam activity of the mail policy (a) when the agent receives the email, compare mail transmission data of the email with a first mail policy to determine whether the email matches the first mail policy, and if so, step (b) Running; if there is a mismatch, executing step (c), (b) authorizing the transmission of the email, and (c) track the path of the email with a second mail policy to determine whether the email matches the second mail policy, if so, perform step (b), and if not, the final mail policy is used. Tracking the email using a next mail policy until the agent blocks the email if the email does not match the final mail policy Email management method further comprising. The method of claim 2, Each mail policy further includes a plurality of rules, Comparing the mail transmission data of the email with one of the mail policy (a) comparing the mail transmission data of the e-mail with a first rule to determine whether the e-mail matches the first rule, executing step (b) if there is a match, and performing step (c) if there is a mismatch step, (b) verifying the mail transmission data of the email with a second mail rule to determine whether the email matches the second rule, if not, execute step (c), if the final mail rule is to be used; Track the email using the next mail rule until, determining whether the email matches the mail rule according to the validation result of the final rule, if the email is matched, send the email, if mismatch executing (c), and (c) tracking the path of the email with a next mail policy to determine whether the email matches the next mail policy, and repeating steps (a) and (b) Email management method further comprises. The method of claim 8, Validation criteria for each rule that validates the email are selected from matches, discrepancies, and exemptions. And said verification criteria are defined in the step of defining said mail policy. The method of claim 1, The mail policy is used to determine whether the mail has an unusual behavior, And wherein the unusual action comprises at least one action selected from anonymity, counterfeit, misuse, or illegal-composed group. The method of claim 10, And wherein the anonymous action comprises at least one action selected from among which the header information is unclear, the difference between the originating mail host and the response mail host, and the response host being a group of ISP hosts. The method of claim 10, Wherein the forgery includes one of the source host being an external domain but the sender address being impersonated as an internal host and the domain name server (DNS) of the domain being incorrect. The method of claim 10, The misuse act includes an e-mail transmission method that is abnormal and frequently changed. The method of claim 10, The offense comprises an answering address being a leased host. The method of claim 1, The contents defining the mail policy further include contents and an attachment of the email. The method of claim 1, And the agent is a mail transmission agent (MTA). The method of claim 16, And the MTA is a router. The method of claim 1, And the envelope information is selected from a group consisting of a sender account, a recipient account, a recipient mail host address, a sender mail host address, a reply address, a DNS, and an e-postmark. The method of claim 18, And at least one of a group consisting of a sender server, a central office server, and an ISP server is selected. The method of claim 1, The blocking of the email may include selecting one of an email rejection and an email deletion. The method of claim 20, When rejecting the email, returning an error code and an error message.

Images