JP2003067307A - Electronic mail monitoring system, electronic mail monitoring method, electronic mail monitoring program and recording medium recorded therewith - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently monitor reception mails or transmission mails of a monitor target user by an operation manager of an electronic mail system. SOLUTION: This electronic mail system has a monitor target mail extraction means 1 executing word analysis to a large number of the transmission mails or the reception mails, referring to a weighted word list 11 to find a weight of each appearing word, comparing the sum total with a threshold value to decide a monitor target mail/a general mail, and extracting the monitor target mail; a monitor target mail storage means 21 storing an electronic mail group extracted by the monitor target mail extraction means 1; and a general mail storage means 22 storing a general mail group except the extracted mail group. The system executes the word analysis of the electronic mail groups stored in the monitor target mail storage means 21 and the general mail storage means 22, finds the weight used for the decision of the monitor target mail/the general mail in each the word, and reconfigures the weighted word list 11.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic mail monitoring system, an electronic mail monitoring method, an electronic mail monitoring program, and a recording medium having the program recorded therein.

[0002]

2. Description of the Related Art In most conventional e-mail monitoring systems, the operation manager of the e-mail system refers to all the e-mails sent from the e-mail transmission server to be monitored. Further, there is also known a system in which only mails frequently appearing with keywords registered in a keyword list prepared in advance are extracted and monitored. In the latter system, the user (that is, the operation manager of the electronic mail system) often has a customization function of registering an arbitrary keyword.

[0003]

However, in the case of the former system, the operation manager needs to read all the mails in order to strictly monitor the electronic mails, but it is impossible to read all the mails. Close to. This is especially true of companies, organizations, schools, etc., where the number of users connected to the system is enormous.

Further, in the latter system, since the keywords registered in advance become the standard, it is difficult to customize the system according to the usage pattern of the system such as a company or school, and it is possible to monitor the mail according to the usage pattern. There was a problem that I could not do. Furthermore, in the latter system,
If you can customize the keyword registration,
Since the operation manager himself must devise and register an appropriate keyword according to the usage pattern of the system, it is not always possible to register a keyword with a high hit rate, and there is a problem that the operation manager has a heavy burden. there were.

The present invention has been made in view of the above conventional problems, and it is an object of the present invention to provide an e-mail monitoring technique capable of efficiently monitoring sent mails or received mails of a monitored user by an operation manager. To aim.

[0006]

According to another aspect of the present invention, there is provided an electronic mail monitoring system which analyzes a word for each of a large number of outgoing mails or incoming mails and refers to a weighted word list for each word that appears. E-mail extracted by the monitoring target e-mail extracting unit for extracting the weight, comparing the total with the threshold value, determining the monitoring target e-mail / general e-mail, and extracting the monitoring target e-mail A monitoring target mail storage unit for storing a group, a general mail storage unit for saving a general mail group not extracted by the monitoring target mail extraction unit, and a monitoring target mail group stored in the monitoring target mail storage unit. Warning mail saving means for saving warning mail selected from the above, and saving in the warning mail saving means and general mail saving means E-mail group analysis is performed to analyze the words in a group of e-mails, obtain a weight to be used for determining whether the mail is a monitored mail / general mail, and reorganize the weighted word list. It is a thing.

According to a second aspect of the present invention, in the electronic mail monitoring system according to the first aspect, the monitored mail learning means reorganizes the weighted word list by the PLA method.

The electronic mail monitoring method according to the invention of claim 3 is
Word analysis is performed on each of a large number of outgoing mails and incoming mails sent and received via the Internet, and the weight of each word that appears appears with reference to the weighted word list,
A step (1) of comparing the total with a threshold value to determine whether the mail is a monitoring target mail / general mail, and the electronic mail determined to be the monitoring target mail in the step (1) is stored in the monitoring target mail storage means. A step (2); a step (3) of saving the e-mail determined to be a general mail in the step (1) in the general mail storage means; and a monitoring target mail group stored in the monitoring target mail storage means. The step (4) of saving the warning-requiring e-mail selected from among the warning-requiring e-mails in the warning-requiring e-mail storing means, and the word analysis of the e-mail groups stored in the warning-requiring e-mail saving means and the general mail saving means The step (5) of obtaining a weight to be used for determining mail / general mail for each word and reorganizing the weighted word list.

According to a fourth aspect of the present invention, in the electronic mail monitoring method according to the third aspect, in the step (5), the weighted word list is reorganized by the PLA method.

An electronic mail monitoring program according to a fifth aspect of the present invention performs word analysis on each of a large number of outgoing mails or incoming mails sent and received via the Internet,
The weight of each word that appears is calculated by referring to the weighted word list, and the total sum is compared with a threshold value to be monitored mail /
Process (1) for determining general mail and the process (1)
The process (2) of saving the electronic mail determined as the monitoring target mail in the monitoring target mail storage means, and the process (1)
A process (3) of saving an e-mail determined to be a general mail in the general mail storage means, and a warning message requiring warning selected from the monitoring target mail group stored in the monitoring target mail storage means are required. Process (4) of storing in the mail storage means and word analysis of the electronic mail group stored in the warning mail storage means and the general mail storage means, and used for judging the mail to be monitored / general mail It is characterized by causing a computer to execute a process (5) of obtaining a weight to be performed for each word and reorganizing the weighted word list.

According to a sixth aspect of the present invention, in the electronic mail monitoring program according to the fifth aspect, in the processing (5), the PLA is used.
According to the method, the weighted word list is reorganized.

A recording medium according to a seventh aspect of the present invention analyzes a word for each of a large number of outgoing mails or incoming mails sent and received via the Internet, and refers to a weighted word list to obtain a weight for each word that appears. , A process (1) of comparing the total with a threshold value to determine whether the mail is a monitoring target mail / general mail, and the electronic mail determined to be the monitoring target mail in the processing (1) is stored in the monitoring target mail storage means. Processing (2), processing (3) of storing the e-mail determined as general mail in the processing (1) in the general mail storage means, and monitoring target mail group stored in the monitoring target mail storage means A process (4) of saving the warning mail requiring warning selected from the warning mail saving means, and the electronic mail stored in the warning mail saving means and the general mail saving means. An electronic mail monitoring program for executing a process (5) of performing word analysis of a group, obtaining a weight used for judging monitored mail / general mail for each word, and reorganizing the weighted word list. It was recorded.

According to an eighth aspect of the present invention, in the recording medium of the seventh aspect, in the processing (5), an electronic mail monitoring program is recorded, wherein the weighted word list is reorganized by the PLA method. It is a thing.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. The electronic mail monitoring system according to the first embodiment shown in FIG. 1 uses the weighted word list 11 to send the monitored mail M1 / general mail M2 from the sent / received mails SM and RM transmitted / received through the Internet 100. A monitoring target mail extraction module 1 that automatically determines and saves a copy of the monitoring target mail M1 in the monitoring target mail folder 21 and a copy of the other general mail M2 in the general mail folder 22. The administrator browses the electronic mail group sorted and stored in the monitored mail folder 22 as the monitored mail M1 and performs processing such as selecting the electronic mail that needs to issue a warning, that is, the warning mail M3. The mail monitoring module 2 and the administrator's processing in this mail monitoring module 2 , Weighted word list 1, which is used in the monitored e-mail extraction module 1
It is composed of three modules, namely, a monitored mail learning module 3 for automatically reorganizing 1.

The mail monitoring module 2 checks the monitoring target mail folder 21 and the general mail folder 22 as well as the monitoring target mail group stored in the monitoring target mail folder 21 one by one, and sends the monitoring mail to the sender. Monitoring mail viewing module 23 for determining whether or not a warning mail needs to be sent so that the warning mail is not sent or received, and a warning mail needs to be sent from the monitored mail group. Warning mail M3
The warning-requiring mail folder 24 for storing the warning-requiring mail and the warning-requiring mail M3 stored in the warning-requiring mail folder 24 by the operation manager are received mails RM. Also send mail S
If it is M, it is provided with a warning mail transmission module 25 that creates and sends a warning mail to the user of the transmission source.

Next, an electronic mail monitoring method by the electronic mail monitoring system having the above configuration will be described with reference to FIGS.

As shown in the flowchart of FIG. 2, the monitored mail extraction unit 1 receives the received mail RM sent through the Internet 100, and the Internet 10.
For each outgoing mail SM sent through 0, the words are analyzed one by one by the following method (step S1), the score for each mail is calculated by referring to the weighted word list 11 (step S2), and the preset judgment threshold is set. The value and the score are compared to determine whether the mail is a monitored mail / general mail (step S3). Then, the copy of the e-mail determined to be the monitored mail M1 is the monitored mail folder 2
Saved in 1 (step S4), other general mail M
A copy of the e-mail determined to be 2 is stored in the general mail folder 22 (step S5). In the case of the present embodiment, the original email itself is the received email RM.
If it is, the mail is forwarded to the mail post of the destination user, and if it is the outgoing mail SM, it is sent to the address of the destination through the Internet 100.

The operation manager, for example, once a day, once a week, or once a month in a predetermined cycle, the monitoring target mail M1 stored in the monitoring target mail folder 21.
The contents of the e-mail group determined to be checked are checked one by one.
Then, when the operation manager looks at the contents of the email and the content is not suitable for the operating base of the system, for example, if something that should be used for public use is used for private use, the content is against public order and morals. In this case, if the content is not suitable for education, the e-mail is determined to be the warning mail M3, is saved in the warning mail folder 24, and is sent to the corresponding user as "... The warning mail sending module 25 sends a warning mail such as "Let's stop.", "Be careful not to receive e-mails that are not suitable for ...".

Next, the method of calculating the score for each mail used to determine whether the sent / received mail corresponds to the monitored mail will be described in detail. The weighted word list 11 is a list as shown in FIG. 3 in which a weight suitable for discriminating a monitored mail from a general mail is set in advance for each of a large number of words by a method described later. Although words and weights prepared in advance as initial setting values are registered in the list 11 at the beginning of system operation, reorganization is repeated by automatic learning to be described later, and the user's preference gradually increases. It will be reflected.

The electronic mail is analyzed, and the word group contained therein is collated with the word group registered in the weighted word list 11 to obtain the score fi for each corresponding word i. At the same time, the weight wi for each word i is also obtained. Next, using the obtained score fi and the weight value wi for each word i, the sum of the weight values for all the words i in the email, that is, the score S = Σfi ×
Calculate wi.

Subsequently, the score S of this electronic mail is compared with a predetermined threshold value. If the score S is smaller than the threshold value, it is judged as a general mail M2 and a copy is stored in the general mail folder 22. If the score S is larger than the threshold value, the operation manager determines that the mail is a monitoring target mail M1 that needs to be checked in detail and saves it in the monitoring target mail folder 21.

To give a concretely simplified example, the content of the e-mail is "show a friend a sample image of a knife".
If so, "friend" = -10.5, "knife" = 101.2, "sample" = 18.7, "image"
= 5.9, the score S1 is S1 = -10.5.
It is + 101.2 + 18.7 + 5.9 = 115.3.
If the threshold value is set to 0, in this case, the score S1
> It is a threshold value, and it is determined that it is the monitored mail M1.

On the other hand, if the content of the e-mail is "send image of accident to friend", "friend" =
-10.5, "accident" = -16.6, "image" = 5.9
Therefore, the score S2 is S2 = -10.5-16.
6 + 5.9 = -21.2. In this case, the score S2
<It is a threshold value, and it is determined that it is the general mail M2.

As a result, for example, in the case where the students are allowed to use the computer in school lessons, and a unique address is assigned to each student to be used for e-mail,
They can monitor the sending and receiving of emails that are inappropriate for the students.

Although a simple example has been described above, a more detailed score calculation method is as follows. The captured email is represented by a vector space model. That is, n words expressing all mail sentences are selected, and each mail sentence is expressed by an n-dimensional vector as in the following equation.

[0026]

[Equation 1] Each element of this vector represents the importance of each word in the mail sentence d. A method called TF * IDF expressed by the following equation is used to express the importance of words.

[0027]

[Equation 2] Here, tf _di is the frequency of occurrence of the word i in the mail sentence d, N
Is the number of all mail texts, and df _i is the number of mail texts in which the word i appears.

The score Score (d) of a mail text d is calculated by the following equation.

[0029]

[Equation 3] Here, wi is the weight for each word i, and f _di is the number 2
It is the value of the expression and the f _di value of each word in the mail text.

If the score Score (d) of the equation 3 is larger than the threshold value of 0, the mail is the monitored mail M1, and if it is smaller than 0, the general mail M.
It is determined to be 2. In addition, each word i described above
The weight wi for the score is
The score (d) is set to be larger than 0, and the score Score (d) is set to be smaller than 0 in the case of the other mail.

The monitoring target mail learning module 3 in FIG. 1 uses the mail group of the general mail folder 22 and the mail group of the warning mail folder 24, and the weighted word list 11 is regularly or according to the instruction of the administrator. Update from time to time. The method of reorganizing the weighted word list 11 is the PLA method (Perceptron Learning Algorithm).
Method). This is shown in the flowchart of FIG.

First, various parameters are set (step S11). As this parameter, a set of weights of each word W = (w1, w2, ..., Wn), N learning data E =
{D1, d2, ..., dN}, misclassified data vector sum S = (S
, ..., Sn), a constant η, a maximum learning number Max, and a learning number m for repeating the learning process shown in FIG.

Then, n words with high frequency are selected from the words expressing all the mail sentences (step S1).
2).

Next, the word weight set W is initialized (step S13). In this initialization, a random number is input as the weight of each word. Then, the sum of the word weights, that is, the score Score (d), is calculated for all learning data by the formula 3 (step S14).

In this calculation result, it is checked whether or not the scores Score (d) ≦ 0 for all general mails M2 and the scores Score (d)> 0 for all warning mails M3 (step S15). ), The processing is ended if YES, but if NO, the following step S1 is performed for all the incorrectly classified mail texts.
7, the degree S of change in weight is corrected as indicated by S18.

That is, in step S17, the mail d
Is a warning mail M3 that requires warning, and the score Score (d) ≦ 0
If it is, the weight change degree S is corrected so as to be increased, and in step S18, the mail d is changed to the general mail M.
If 2 and the score Score (d)> 0,
The weight change degree S is corrected so as to be reduced.

Then, using the thus-corrected weight change degree S, the word weight set W is corrected according to the equation shown in step S19. Then, the learning number m is incremented by +1 (step S20), and it is checked whether or not the learning number m is smaller than the maximum learning number Max (step S21). Here, the learning number m is the maximum learning number Ma
If it is smaller than x, the process returns to step S14, and step S14 is performed until the condition shown in step S15 is satisfied.
The subsequent processing is repeated. Finally, a word weight set W for n words is obtained, and this is updated and registered in the weighted word list 11.

As described above, according to the electronic mail monitoring system and the electronic mail monitoring method of the present embodiment, the weighted word list 11 is enriched by automatic learning, and the weighted word list 11 is transmitted and received for the mail. The score was calculated using the email, and emails showing a score exceeding the threshold were saved as monitored emails separately from general emails, and the contents could be checked again. It is not necessary to check all of the above, it is necessary to have the system automatically discriminate e-mails of contents that are not generally suitable, and to check only those e-mails to determine whether it is necessary to send a warning mail, You can reduce the effort of checking emails.

Moreover, in the case of this system, since the weighted word list 11 is automatically reorganized, the contents of the weighted word list 11 can be further enhanced along with the operation of this system, and the electronic content is not suitable for the contents. The mail can be properly selected on the system side, which reduces the degree of caution required for the operation manager to check the content of the monitored mail, and correspondingly reduces the labor required for the system operation.

In the above embodiment, TF * IDF
However, the vector space model is not limited to this. For example, a vector using only TF (occurrence frequency in a document), or a method of expressing the presence or absence of a word as a simple vector with 0/1 Etc. can also be adopted.

Further, the present invention covers not only the above system but also the electronic mail monitoring program itself installed in the computer for constructing the system, and the recording medium recording the electronic mail monitoring program.

[0042]

As described above, according to the present invention, the operation manager of the electronic mail system can efficiently monitor the sent mail or the received mail of the monitored user.

Further, the operation manager checks the contents of the electronic mail group stored in the monitored mail storage means as the monitored mail, and reflects the will of the operating mother of the system when the warning mail is specified. By checking, it is possible to customize that a weighted word list that reflects its will is organized by automatic learning, and even with the same system, e-mails with disproportionate content depending on the nature of the operating mother are monitored mails. There is flexibility that can be.

[Brief description of drawings]

FIG. 1 is a block diagram showing a functional configuration of an electronic mail monitoring system according to an embodiment of the present invention.

FIG. 2 is a flowchart of an electronic mail automatic check function according to the above embodiment.

FIG. 3 is an explanatory diagram illustrating an example of a weighted word list in the above embodiment.

FIG. 4 is a flowchart of the PLA method according to the above embodiment.

[Explanation of symbols]

1 Monitoring target mail extraction module 2 Email monitoring module 3 Monitoring email learning module 11 Weighted word list 21 Mail folders to be monitored 22 General mail folder 23 Monitoring target email browsing module 24 Warning mail folder required 25 Warning email sending module 100 Internet

Continued front page    (72) Inventor Naomi Inoue             2-15-1 Ohara, Kamifukuoka City, Saitama Stock             Company CAD Research Institute F term (reference) 5B075 KK07 ND03 NR12 QP01 UU24

Claims (8)

[Claims] 1. An object to be monitored by performing word analysis on each of a large number of sent mails or received mails, obtaining a weight for each word that appears by referring to a weighted word list, and comparing the sum with a threshold value. Judge mail / general mail,
Monitoring target mail extracting means for extracting monitoring target mail, monitoring target mail saving means for saving the electronic mail group extracted by the monitoring target mail extracting means, and general mail group not extracted by the monitoring target mail extracting means A general e-mail storage unit for storing the e-mail, a warning e-mail storage unit for saving an e-mail message requiring warning selected from a group of e-mails to be monitored stored in the e-mail storage unit for monitoring, An object to be monitored which analyzes the words in the group of e-mails stored in the general mail storage means, obtains the weight to be used for the judgment of the target mail / general mail for each word, and reorganizes the weighted word list. An email monitoring system comprising email learning means. 2. The monitored mail learning means is a PLA.
The email monitoring system according to claim 1, wherein the weighted word list is reorganized by a method (Perceptron Learning Algorithm method). 3. A word analysis is performed on each of a large number of outgoing mails or incoming mails sent and received via the Internet, the weight of each appearing word is obtained by referring to the weighted word list, and the sum thereof is used as a threshold value. A step (1) of comparing and determining a monitoring target mail / general mail; a step (2) of saving the electronic mail determined to be the monitoring target mail in the step (1) in a monitoring target mail storage means; A step (3) of saving the electronic mail determined to be a general mail in the step (1) in the general mail storage means, and a warning required selected from the monitoring target mail group stored in the monitoring target mail storage means. A step (4) of saving the mail in the warning mail saving means, and an electronic mail saved in the warning mail saving means and the general mail saving means. Perform word analysis of the group, the monitored mail / General Mail weights used to perform determination obtained for each word, e-mail monitoring method and a step (5) to reorganize the weighted word list. 4. In the step (5), the PLA method (Pe
4. The email monitoring method according to claim 3, wherein the weighted word list is reorganized by the rceptron Learning Algorithm method. 5. A word analysis is performed on each of a large number of outgoing mails or incoming mails sent and received via the Internet, a weight for each word that appears is referred to by referring to a weighted word list, and the sum is used as a threshold value. A process (1) of comparing and determining a monitoring target mail / general mail; a process (2) of storing an electronic mail determined to be a monitoring target mail in the processing (1) in a monitoring target mail storage unit; A process (3) of saving the e-mail determined to be a general mail in the process (1) in the general mail storage unit, and a warning required selected from the monitoring target mail group stored in the monitoring target mail storage unit. A process (4) of saving the mail in the warning mail saving means, and a word analysis of the electronic mail group saved in the warning mail saving means and the general mail saving means are performed and monitored. Target email / General Mail seek weights used to make a determination for each word, e-mail monitoring program for causing and a process (5) to reorganize the weighted word list in the computer. 6. The PLA method (Percep) is used in the processing (5).
The e-mail monitoring program according to claim 5, wherein the weighted word list is reorganized by the tron learning algorithm method. 7. A word analysis is performed on each of a large number of outgoing mails or incoming mails sent and received via the Internet, a weight for each word that appears is obtained by referring to a weighted word list, and the total sum is used as a threshold value. A process (1) of comparing and determining a monitoring target mail / general mail; a process (2) of storing an electronic mail determined to be a monitoring target mail in the processing (1) in a monitoring target mail storage unit; A process (3) of saving the e-mail determined to be a general mail in the process (1) in the general mail storage unit, and a warning required selected from the monitoring target mail group stored in the monitoring target mail storage unit. A process (4) of saving the mail in the warning mail saving means, and a word analysis of the electronic mail group saved in the warning mail saving means and the general mail saving means are performed and monitored. A computer-readable recording medium in which an electronic mail monitoring program is recorded, which executes a process (5) of obtaining a weight used for determining a target mail / general mail for each word and reorganizing the weighted word list. . 8. The PLA method (Percep) is used in the processing (5).
The computer-readable recording medium recording the electronic mail monitoring program according to claim 7, wherein the weighted word list is reorganized by a tron learning algorithm method.