JP2004228908A - Junk mail preventing device and junk mail preventing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problems that data setting and checking processing are required for each of many users and considerable loads and costs are required for the operation of a mail server since the transmission origin of electronic mail is registered for each user in a mail server and mail transmitted from the transmission origin is eliminated in order to prevent junk mail in an electronic mail system. <P>SOLUTION: Received mail messages are stored for fixed time separately for the mail messages of the same text, the integrated value of the number of addresses of the mail message having the same text is held, and if the integrated value exceeds a prescribed value, the mail message is determined as the junk mail and discarded. Thus, the junk mail composed of the mail message having a large amount of the addresses or a large amount of the mail messages having the same contents is efficiently eliminated without performing the data setting and checking processing for the respective users. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a spam mail preventing method for an electronic mail system, and more particularly to a spam mail preventing apparatus and a spam mail for preventing spam mails having a large number of destinations and spam mails consisting of a large number of mail messages having the same text. Regarding email prevention methods.
Due to the rapid spread of mobile phones and diversification of functions, information exchange by e-mail has recently become commonplace, but these conveniences are exploited to address a large number of unspecified large numbers of destinations. “Junk mail,” which sends e-mail unilaterally or sends a large amount of e-mail with the same text, has become a social problem, and means for preventing it are desired.
[0002]
[Prior art]
Conventionally, spam was prevented by the following means.
(1). The user changes the default e-mail address given by the telephone company that operates the mail server to an original e-mail address that is difficult to generate mechanically.
(2). The sender's mail address and domain of the e-mail permitted to be received are registered with the telephone company that operates the mail server, and only the mail that matches the applicable conditions is left on the mail server and received.
(3). Register the sender's email address and domain of the e-mail that refuses to receive with the telephone company that operates the mail server, and discard e-mail that meets the applicable conditions from the mail server.
(4). Only the sender and subject of the e-mail are notified to the recipient of the e-mail, and the recipient is determined whether to receive or discard the e-mail.
[0003]
FIG. 15 is an outline of the operation of the conventional junk mail prevention method.
The mail senders 20A, 20B, 20C, and 20D are connected to the mail server 10 via the network 40, and the e-mail users 30a, 30b, and 30c hold their own mailboxes in the mail server 10. ing.
The mail senders 20A and 20B are normal mail senders. The normal mail sender 20A transmits the mail message M1 (A, a) to the user 30a, and the normal mail sender 20B transmits the users 30a and 30b. , 30c is transmitted to the electronic mail message M2 (B, a, b, c). Here, the meaning of the symbols separated by commas in parentheses is that the first symbol is an abbreviation of the identification information of the sender of the mail message, and the second and subsequent symbols are the identification information of the destination of the mail message. It is an abbreviation. For example, M2 (B, a, b, c) means a mail message whose source is the normal mail sender 20B and whose destination is the users 30a, 30b, 30c.
[0004]
The mass mail sender 20C includes the users 30a, 30b, and 30c, which are not spam mails but include a large number of mail messages M3 (C, *) and a large number of mail messages M4 (C, *) having the same text. Sending to the destination. Here, the symbol “*” in parentheses means a destination including the destinations of the users 30a, 30b, and 30c. A large number of electronic mail messages M3 (C, *), which is a single symbol in the notation, means a plurality of large electronic mail messages.
[0005]
The junk e-mail sender 20D includes a large number of e-mail messages M5 (D, *) and a large number of destination e-mail messages M6 (D, *) having the same body of junk mail, and also includes the users 30a, 30b, and 30c. Sending to the destination.
The mail server 10 is provided with reception condition verification units 11a, 11b, and 11c that can set reception conditions of a mail message for each user. For example, information for identifying the unsolicited mail sender 20D (denoted as “D” in FIG. 15) ), A large number of email messages M5 (D, *) of the same body and a large number of email messages M6 (D, *) from the unsolicited email sender 20D are sent to the users 30a and 30b. It can be prevented from reaching.
[0006]
As described above, in the conventional technology, the identification information of the sender of the spam mail is individually set for each user, and a large amount of the same electronic mail message and a large number of the electronic mail messages from the sender are excluded. (For example, see Patent Document 1).
[0007]
[Patent Document 1]
JP-A-2000-163341 (pages 6 to 9, FIG. 2)
[0008]
[Problems to be solved by the invention]
As described above, the conventional technology cannot prevent unsolicited unsolicited e-mail from being sent unless the e-mail recipient takes some kind of defense. Also, the telephone company that operates the mail server must deal with the processing of spam sent in large quantities in accordance with the conditions of each user, causing a large capital investment and operating cost. is there.
[0009]
The present invention relates to a junk e-mail prevention method for an e-mail system, wherein a junk e-mail prevention device that efficiently eliminates junk e-mails having a large number of destinations or a large number of identical texts without setting reception conditions for each e-mail user. An object of the present invention is to provide a method for preventing unwanted e-mail.
[0010]
[Means for Solving the Problems]
According to a first aspect, in a spam mail preventing apparatus or a spam mail preventing method for eliminating a mail message having a large number of destinations and / or a large number of mail messages having the same text, received via a network, the received mail message is Stored and held for a predetermined period of time, verified the identity by comparing and comparing the contents of the body of the received e-mail message, and integrated the number of destination addresses included in the e-mail message whose body was determined to be the same. When the integrated value of the number of destinations exceeds a predetermined value within the predetermined time, the mail message is discarded.
[0011]
According to the first aspect, a mail message having a large number of destinations exceeding a preset value or a large number of mail messages having the same body can be efficiently processed without setting e-mail reception conditions for each user. Can be eliminated.
According to a second aspect, in the apparatus and method for preventing unsolicited email according to the first aspect, a name is given to each field, which is an area that divides the content of the received email message, and is set as a field name and an arbitrary character string. An exceptional condition table that can register a plurality of pairs of possible keywords and information, and when the integrated value of the number of destinations exceeds a predetermined value within the predetermined time, the mail message is registered in the exceptional condition table. If the field indicated by the field name includes a keyword paired with the field name, the mail message is not discarded.
[0012]
According to the second invention, even for a mail message having a large number of destinations or a large amount of the same text, a mail message including a character string serving as a specific keyword in a specific field in the mail message is a normal mail message. It can be sent as a message to the user. Therefore, for example, by registering a specific mail address as a keyword in the source address field, a mail message that is not a spam of a specific source is a mail message having a large number of destinations or a large amount of the same text. Can be delivered to users.
[0013]
In addition, by registering a specific keyword in the title field or the body field, even for a mail message including the keyword in the title field or the body field, even if the mail message has a large number of destinations or a large amount of the same body. , Can be delivered to the user.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 is an outline of the operation of the spam mail prevention method of the present invention.
A junk mail prevention device 50 is provided between the mail server 10 and the network 40, and the mail senders 20A, 20B, 20C, and 20D are connected to the junk mail prevention device 50 via the network 40 and use e-mail. The users 30a, 30b, and 30c have their own mailboxes in the mail server 10.
[0015]
M1 to M6 are e-mail messages. Symbols separated by commas in parentheses are abbreviations of the identification information of the sender of the e-mail message, and the second and subsequent symbols are the destination of the e-mail message. This is an abbreviation of identification information. For example, M2 (B, a, b, c) means a mail message addressed to the users 30a, 30b, and 30c whose source is the normal mail sender 20B. The “*” symbol in parentheses means a destination including the destinations of the users 30a, 30b, and 30c. In some cases, the email message is described with the parentheses omitted for convenience of notation.
[0016]
The normal mail sender 20A sends the mail message M1 (A, a) to the user 30a, and the normal mail sender 20B sends the mail message M2 (B, a, b, c) to the users 30a, 30b, 30c. Has been sent.
The mass mail sender 20C sends the mass mail message M3 (C, *) and the mass mail message M4 (C, *), which are not spam but have the same text, to the destination including the users 30a, 30b, 30c. Sending.
[0017]
The junk e-mail sender 20D sends a large amount of e-mail message M5 (D, *) having the same body text as junk e-mail and a large amount of e-mail message M6 (D, *) to the destination including the users 30a, 30b, 30c. Sending.
The unsolicited e-mail prevention device 50 includes a common destination number verification unit 50 a independent of the user of the mail server 10, and a reception condition set in the destination number verification unit 50 a from a mail message received from the network 40. Is extracted, and delivered to the mail server 10. At this time, with respect to a mail message that does not satisfy the reception condition, only a message that satisfies the exception condition set in advance in the exception condition setting verification unit 50b is delivered to the mail server 10 without discarding. .
[0018]
In the example of FIG. 1, among the mail messages M3 to M6 excluded by the number-of-addresses verification unit 50a, the identification information “C” of the transmission source permitted to accept, which is set in the exception condition setting verification unit 50b, is satisfied. The mail messages M3 and M4 from the transmission source 20C are delivered to the mail server 10 without being excluded.
With the function of the unsolicited mail preventing apparatus 50 described above, the mail server 10 can prevent the unsolicited mail from reaching the users 30a, 30b, and 30c only by performing the normal mail distribution function.
[0019]
That is, in the mail server 10, it is not necessary to set and verify individual conditions for each user, and it is possible to efficiently eliminate a large number of destinations and a large amount of unsolicited mail having the same text.
FIG. 2 shows a transfer sequence according to the spam mail prevention method of the present invention, which will be described in sequence number order.
[0020]
S01. The normal mail sender 20A transmits a normal mail message M1 (A, a) to the junk mail prevention device 50. Here, "A" in parentheses indicates 20A which is the transmission source of the email message, and "a" indicates the user 30a which is the destination of the email message.
S02. The unsolicited e-mail prevention device 50 that has received the normal e-mail message M1 (A, a) uses the destination number verification unit 50a to make the number of destinations of the e-mail message M1 (A, a) not exceed the preset maximum number of destinations. Therefore, it is determined that the message is a normal mail message, and is transferred to the mail server 10 as it is.
[0021]
S03. The mail server 10 that has received the normal mail message M1 (A, a) stores the mail message in the mailbox of the user 30a, and delivers it to the user 30a when the user 30a accesses the mail message.
S04. The normal mail sender 20B transmits a normal mail message M2 (B, a, b, c) to the unwanted mail prevention device 50. Here, "B" in parentheses indicates 20B which is the transmission source of the e-mail message, and "a, b, c" indicates users 30a, 30b, and 30c that are destinations of the e-mail message.
[0022]
S05. The junk e-mail prevention device 50, which has received the normal mail message M2 (B, a, b, c), checks the number of destinations of the mail message M2 (B, a, b, c) in advance in the destination number verification unit 50a. Since the number does not exceed the set maximum number of destinations, it is determined to be a normal mail message and is transferred to the mail server 10 as it is.
S06. The mail server 10 that has received the normal mail message M2 (B, a, b, c) stores the mail message in the mailboxes of the users 30a, 30b, and 30c, and is accessed by the users 30a, 30b, and 30c. At that point, hand over to each user.
[0023]
S07. Next, the mass mail sender 20C transmits a large number of mail messages M3 (C, *) that are not spam mails but have the same text to the destination including the users 30a, 30b, and 30c.
Here, “C” in parentheses indicates 20C which is the transmission source of the mail message, and “*” indicates a destination including the users 30a, 30b, and 30c.
S08. In the unsolicited e-mail prevention device 50, which has received a large amount of e-mail messages M3 (C, *) having the same text, the destination number verification unit 50a calculates the integrated value of the number of destinations of the e-mail messages M3 (C, *) within a certain period of time. If the number exceeds the preset maximum number of destinations, it is determined that the reception condition is not satisfied, and the reception condition is temporarily excluded. Next, it is determined whether the exception condition set in the exception condition verification unit 50b is satisfied. .
[0024]
In the exceptional condition verification unit 50b, the identification information “C” of the transmission source is set as an exceptional condition for passing the mail message, and the identification information “C” is a large number of mail messages M3 ( Since this corresponds to “20C” which is the transmission source of C, *), the mail message M3 (C, *) is passed through as it is and transferred to the mail server 10.
S09. The mail server 10 stores a large amount of the received electronic mail message M3 (C, *) having the same text in the mailboxes of the users 30a, 30b, and 30c, and when the users 30a, 30b, and 30c access the electronic mail M3 (C, *). Hand over to each user.
[0025]
S10. Next, the mass mail sender 20C transmits a mail message M4 (C, *) that is not a spam mail but has a large number of destinations to destinations including the users 30a, 30b, and 30c. Here, "C" in parentheses indicates 20C which is the transmission source of the e-mail message, and "*" indicates the destination of the e-mail message including the users 30a, 30b, and 30c.
S11. The unsolicited e-mail prevention device 50 verifies the received e-mail message M4 (C, *) having a large number of destinations by the destination number verification unit 50a. If the destination number exceeds the preset maximum number of destinations, the mail It is determined that the message M4 (C, *) does not satisfy the reception condition and is temporarily excluded, and then it is determined whether or not the condition set in the exception condition verification unit 50b is satisfied.
[0026]
In the exceptional condition verification unit 50b, the identification information “C” of the transmission source is set as an exceptional condition for passing the mail message, and the identification information “C” is the transmission source of the received message M4 (C, *). Therefore, the mail message M4 (C, *) having the large number of destinations is passed through as it is and transferred to the mail server 10.
S12. The mail server 10 stores the received mail message M4 (C, *) having a large number of destinations in the mailboxes of the users 30a, 30b, and 30c, and when the users 30a, 30b, and 30c access the mail messages M4 (C, *). Hand over to each user.
[0027]
S13. The unsolicited email sender 20D sends a large number of email messages M5 (D, *) having the same body text as unsolicited email to the destination including the users 30a, 30b, and 30c. Here, “D” in parentheses indicates 20D which is the transmission source of the e-mail message, and “*” indicates a destination including the users 30a, 30b, and 30c.
S14. In the unsolicited e-mail prevention device 50 that has received a large amount of e-mail messages M5 (D, *) having the same body name, the destination number verification unit 50a calculates the integrated value of the number of destinations of the e-mail messages M5 (D, *) for a certain period of time. If the value exceeds the predetermined value, it is determined that the reception condition is not satisfied, and the reception condition is temporarily excluded, and it is determined whether or not the condition set in the exception condition verification unit 50b is satisfied.
[0028]
In the exceptional condition verification unit 50b, the identification information “C” of the sender is set as an exceptional condition for passing the mail message, but the sender of the large amount of received mail message M5 (D, *). Since it does not correspond to "20D", the mail message M5 (D, *) is regarded as unsolicited mail and discarded.
S15. The spam mail sender 20D transmits a mail message M6 (D, *) having a large number of destinations to be spam to the destination including the users 30a, 30b, and 30c. Here, “D” in parentheses indicates 20D which is the transmission source of the email message, and “*” indicates the destination including the users 30a, 30b, and 30c.
[0029]
S16. The unsolicited e-mail prevention device 50 verifies the received e-mail message M6 (D, *) having a large number of destinations by the destination number verification unit 50a, and when the number of destinations exceeds a predetermined value, the e-mail message M6 (D, *). D, *) are determined not to satisfy the reception condition and are temporarily excluded, and it is determined whether the condition set in the exceptional condition verification unit 50b is satisfied.
In the exceptional condition verification unit 50b, the identification information “C” of the sender is set as an exceptional condition for passing the email message, and the sender of the email message M6 (D, *) having a large amount of received destinations is set. Since this does not correspond to “20D”, the mail message M6 (D, *) having the large number of destinations is regarded as unsolicited mail and discarded.
[0030]
In the above description of the transfer sequence in FIG. 2, the sequences S01, S04, S07, S10, S13, and S15 are described in the order corresponding to the outgoing mail messages M1 to M6, respectively. The transmission timing and order of the transmission can be arbitrarily combined. Further, the number of e-mail messages is arbitrary, and is not limited to the above-described e-mail messages M1 to M6.
[0031]
FIG. 3 shows a configuration of a spam mail prevention device according to the present invention.
The packet receiving unit 51 receives the packet data from the network 40, and transfers the packet data to the mail message assembling unit 52 if the packet data is a mail packet, and transfers the packet data to the packet transmitting unit 56 if the packet data is not a mail packet. Transfer to mail server 10.
[0032]
The mail message assembling unit 52 analyzes the mail packet delivered from the packet receiving unit 51, assembles it into one mail message, and delivers it to the destination number exception condition verification unit 53.
The destination number exception condition verification unit 53 realizes the functions of the destination number verification unit 50a and the exception condition verification unit 50b shown in the outline of the operation of the spam mail prevention method of the present invention in FIG. The number of destinations of the delivered e-mail message having the same content is integrated and stored as an integrated value of the number of destinations in the e-mail message management table. Is exceeded, it is determined whether or not the e-mail message corresponds to the exceptional conditions set in the exceptional condition table 62. If the junk mail flag in the table 64 is set and an exceptional condition is met, it is regarded as a normal mail message and transferred to the mail server 10.
[0033]
The e-mail message transfer / discard unit 54 is activated at a predetermined period, searches the received e-mail message stored in the e-mail message storage area 63, and, based on the time stamp given to the e-mail message, It is determined whether or not the storage state of the mail message has continued for a certain period of time. Then, if the e-mail message has continued for a certain period of time, it is determined whether or not the e-mail message is junk mail. If the e-mail message is junk mail, it is discarded. I do.
[0034]
The e-mail message decomposing unit 55 decomposes the e-mail message delivered from the destination number exception condition verification unit 53 into a mail packet format that can be transmitted to the mail server 10 connected to the unsolicited e-mail prevention device 50, Deliver to 56.
The packet transmitting unit 56 transmits the delivered mail packet to the mail server 10.
[0035]
The e-mail message storage area 63 is an area for temporarily storing the received e-mail message during the e-mail message storage time set in the destination number management table 61.
The e-mail message management table 64 is a table that holds an integrated value of the number of destinations of the e-mail message of the same text, a spam flag, and an address of an area in the e-mail message storage area 63 in which the e-mail message of the same text is stored.
[0036]
The destination number management table 61 is a table in which specified values for verifying whether or not a received mail message is unsolicited mail are set, and includes a maximum number of destinations and a mail message storage time for storing the mail message.
The exception condition table 62 is a table that defines an exception condition when judging as unsolicited e-mail. Each entry is a field name in the e-mail message in which the exception condition is set, and a character string serving as an exception condition included therein. Consists of pairs with keywords.
[0037]
FIG. 4 shows the configuration of the destination number management table of the junk mail prevention apparatus according to the present invention.
It consists of the maximum number of destinations A1 and the email message storage time A2, and the integrated value of the number of destinations of the received email message of the same text exceeds the value indicated by the maximum number of destinations A1 within the time specified by the email message storage time A2. In this case, the mail message is determined to be unsolicited mail.
[0038]
Here, in the integration process of the number of destinations, the count is also increased for the same destination. Therefore, if a large number of mail messages having the same text and the same destination are received within the time specified by the mail message storage time A2 and exceed the value indicated by the maximum number of destinations A1, it is also determined to be unsolicited mail. You.
FIG. 5 shows the configuration of the exception condition table of the junk mail prevention apparatus according to the present invention.
[0039]
The exception condition table 62 includes an exception condition number Ba and exception conditions B1 to Bn. Each exception condition includes a field name for specifying a field in the email message and a keyword indicating a specific character string. For example, the exceptional condition B2 includes a field name B2a and a keyword B2b.
If the integrated value of the number of destinations of the received e-mail message of the same text exceeds the maximum number of destinations within a predetermined time, the exception condition table 62 is referred to and set in the exception condition table 62 of the received e-mail message. It is checked whether or not the field indicated by the field name includes the character string specified by the corresponding keyword. If any of the keywords set in the exceptional condition table 62 is included, The mail message is regarded as not junk mail, and is transferred to the mail server 10 without being discarded.
[0040]
FIG. 6 is a configuration example of an exception condition table of the junk mail prevention apparatus according to the present invention. Examples of the field name include “Subject:” indicating the title field of the email message, “From:” indicating the transmission source field of the email message, and “body” indicating the body field of the email message. In the configuration example of FIG. 6, a character string serving as a keyword of "Advertisement", "news", or "Information" is set for the field name "Subject:" indicating the title field of the mail message, and the title field is set in the title field. A mail message including any one of the character strings “Advertisement”, “news”, and “Information” is not determined to be junk mail even if the integrated value of the number of destinations exceeds the maximum number of destinations.
[0041]
In addition, as character strings serving as keywords corresponding to “From:” indicating a transmission source field of a mail message, “adv@aaa.co.jp”, “news@bbb.co.jp”, and “info@ccc.co” .Jp "is set, and one of the character strings of" adv@aaa.co.jp "," news@bbb.co.jp ", and" info@ccc.co.jp "is set in the transmission source field. The mail message including the message is not determined to be junk mail even if the integrated value of the number of addresses exceeds the maximum number of addresses.
[0042]
Further, a character string of “NO82451” is set as a character string serving as a keyword corresponding to “body:” indicating a body field of the mail message, and the mail message including the character string of “NO82451” in the body field is: Even if the integrated value of the number of destinations exceeds the maximum number of destinations, it is not determined to be spam.
In this way, by arranging the contents of the exception condition table 62 between the provider of the e-mail system and the sender of the e-mail message and setting the contents appropriately, the user of the e-mail system does not need to set anything. Only junk mail can be eliminated.
[0043]
FIG. 7 shows a configuration of a mail message storage area of the junk mail prevention device according to the present invention.
The received e-mail message is stored in the e-mail message storage area 63 with a time stamp indicating the time of reception, the number of destinations, and the same e-mail link indicating the address of the area where the e-mail message of the same body is stored. You.
[0044]
As shown in FIG. 7, the mail message storage area 63 is a group of variable length areas for storing received mail messages. For example, the storage area C2 includes a time stamp C2a, a destination number C2b, and the same mail link C2c. Is set, the received mail message C2d is stored.
Various known methods can be used for managing the variable-length area constituting the mail message storage area 63. However, the method is not described here since it does not affect the essence of the present invention.
[0045]
FIG. 8 shows a configuration of a mail message management table of the junk mail prevention device according to the present invention.
The e-mail message management table 64 manages the e-mail messages of the same body in a grouped manner. The e-mail message management table 64 holds a destination number integrated value which is an integrated value of the number of destinations of the e-mail message of the same body received within a certain time. If the integrated value exceeds the preset maximum number of destinations, the junk mail flag is set to “ON”.
[0046]
In the configuration of FIG. 8, p identical mail groups D1 to Dp are managed. For example, the identical mail group D2 is a destination number integrated value D2a meaning the total number of destinations of all mail messages belonging to the same mail group D2. , A spam mail flag D2b indicating whether the integrated value of the number of destinations has exceeded the maximum number of destinations, and a storage area of the first mail message in a group of mail messages of the same body stored in the mail message storage area 63. The same mail group link D2c.
[0047]
FIG. 9 is an operation flowchart of the packet receiving unit of the apparatus for preventing unsolicited e-mail according to the present invention.
S5101. The packet is received from the network to which the junk mail prevention device is connected.
S5102. It is determined whether the received packet is a mail packet conforming to SMTP (Simple Mail Transfer Protocol) which is a protocol for transmitting and receiving e-mail on the Internet, based on whether the port number included in the header is "25". If the port number is "25" (YES), the process proceeds to the next step S5103 because the packet is a mail packet. If the port number is not "25" (NO), it is not a mail packet, and the flow shifts to step S5104.
[0048]
S5103. The received mail packet is delivered to the mail message assembling section 52, and the process is terminated.
S5104. The received packet is transferred to the packet transmitting unit 56 for transfer to the mail server 10, and the process is terminated.
FIG. 10 is an operation flowchart of the e-mail message assembling section of the junk e-mail prevention device according to the present invention.
[0049]
S5201. The mail packet delivered from the packet receiving unit 51 is decoded according to the SMTP protocol, and a mail message is assembled.
S5202. The assembled email message is delivered to the destination number exception condition verification unit 53.
FIG. 11 is an operation flowchart of the destination number exception verification unit of the spam mail prevention apparatus according to the present invention.
[0050]
S5301. The mail message delivered from the mail message assembling unit 52 is stored in the mail message storage area 63.
S5302. The reception time is set in the time stamp area of the mail message stored in the mail message storage area 63.
S5303. It is determined whether there is already a mail message having the same text in the mail message storage area 63 by comparing the text field of the mail message and if there is the same text mail (YES), proceed to the next step 5304. If the same text mail does not exist (NO), the process proceeds to step S5308.
[0051]
Here, as a means for comparing and collating the body field of the email message, if a predetermined ratio of the whole body matches, a method of regarding the same body as the same body is also possible. Junk mail that sends a large amount of text with almost the same content can also be handled.
S5304. The number of destinations of the received e-mail message is added to the integrated value of the number of destinations held in the corresponding entry in the e-mail message management table 64.
[0052]
S5305. It is determined whether the destination number integrated value integrated in step S5304 exceeds the maximum number of destinations set in the destination number management table 61, and if it exceeds (YES), the flow shifts to the next step S5306. If not exceeded (NO), the process ends.
S5306. It is determined whether or not the received e-mail message includes a keyword corresponding to the field set in the exception condition table 62. If the received e-mail message does not include a keyword corresponding to the field (NO), it is regarded as unsolicited e-mail and the next The process moves to step S5307, and if it is included (YES), the process ends.
[0053]
S5307. The junk mail flag of the corresponding entry in the mail message management table 64 is set to “ON”, and the process is terminated.
S5308. An entry for the received mail message is generated in the mail message management table 64.
S5309. As the initial value of the entry generated in step S5308, the number of destinations of the received e-mail message is set as the destination number integrated value, the unsolicited mail flag is set to "OFF", and the process ends.
[0054]
FIG. 12 is an operation flowchart of the e-mail message transfer discarding unit of the junk e-mail prevention device according to the present invention. The mail message transfer discard unit 54 is activated at a predetermined cycle and performs the following processing.
S5401. The mail messages stored in the mail message storage area 63 are sequentially searched. As a search method, for example, a method of sequentially following the same mail group link registered in the mail message management table 64 is efficient.
[0055]
S5402. As a result of the search in step S5401, if an unprocessed mail message is present in the mail message storage area 63 (YES), the process proceeds to step S5403, and if no unprocessed mail message remains in the mail message storage area 63 ( NO), end the processing.
S5403. If the difference between the current time and the value of the time stamp of the retrieved e-mail message has passed the e-mail message storage time set in the destination number management table 61 (YES), the process moves to the next step S5404, and the e-mail is sent. If the message storage time has not elapsed (NO), the flow returns to step S5401.
[0056]
S5404. The junk mail flag in the e-mail message management table 64 is checked. If the junk mail is a junk mail (YES), the process proceeds to the next step S5405, and if not, the process proceeds to a step S5407.
S5405. The mail message is taken out from the mail message storage area 63 and discarded. S5406. The number of destinations of the mail message is subtracted from the total number of destinations in the mail message management table 64, and the process is terminated.
[0057]
S5407. The e-mail message is taken out from the e-mail message storage area 63, passed to the e-mail message decomposing unit 55, and the flow advances to step S5406.
In the above description of the operation flowchart of the e-mail message transfer / discard unit 54 of the spam mail prevention device according to the present invention, the process of discarding the region from the e-mail message storage area 63 and the e-mail message management table 64 is performed by various known methods. However, the description is omitted because it does not affect the essence of the present invention.
[0058]
FIG. 13 is an operation flowchart of the mail message decomposing unit of the junk mail prevention device according to the present invention, and performs the following processing.
S5501. The mail message transferred from the mail message transfer / discard unit 54 is decomposed into mail packets according to SMTP.
S5502. The disassembled mail packet is delivered to the packet transmitting unit 56, and the process is terminated.
[0059]
FIG. 14 is an operation flowchart of the packet transmitting unit of the junk mail prevention apparatus according to the present invention, and performs the following processing.
S5601. The packet delivered from the packet receiving unit 51 or the mail message disassembling unit 55 is transmitted to the mail server 10.
In the above detailed description of the present invention, the configuration in which the unsolicited e-mail prevention device is connected to the outside of the conventional mail server has been described, but a function corresponding to the unsolicited e-mail prevention device can be implemented inside the mail server. .
[0060]
Also, as a method of eliminating a large amount of email messages having the same body, if the entire body is not exactly the same, for example, if the ratio specified in advance is the same, the body is regarded as almost the same body and is excluded as spam. This can be easily realized by the present invention. In the configuration of the apparatus for preventing junk e-mail according to the present invention shown in FIG. 3, various variations are conceivable for the configuration method of each processing block and the configuration of each table, but the present invention is similarly applicable.
[0061]
(Supplementary Note 1) In a spam mail prevention device that eliminates a mail message having a large number of destinations and / or a large number of mail messages with the same body text received via a network,
Means for storing and holding the received e-mail message for a predetermined period of time,
A comparing and collating means for verifying the identity of the contents of the body of the received e-mail message;
Means for holding a destination count integrated value obtained by integrating the number of destination addresses included in the mail message determined to have the same text,
If the destination number integrated value exceeds a predetermined value within the fixed time, the mail message is discarded.
A spam mail prevention device characterized by the following.
[0062]
(Supplementary Note 2) In a method for preventing unsolicited e-mails which excludes e-mail messages received via a network and having a large number of destinations and / or large amounts of e-mail messages having the same text,
Stores and holds received email messages for a predetermined period of time,
Compare the contents of the body of the received email message to verify their identity,
Holds a destination count integrated value obtained by integrating the number of destination addresses included in the email message determined to have the same body,
If the destination number integrated value exceeds a predetermined value within the fixed time, discard the mail message.
A method for preventing junk mail.
[0063]
(Supplementary note 3) In the method for preventing unsolicited email described in Supplementary note 2,
Name each field, which is an area that divides the contents of the received email message,
Exception condition table that can register multiple pairs of information of field names and keywords that can be set as arbitrary character strings,
If the integrated value of the number of destinations exceeds a predetermined value within the fixed time, the keyword corresponding to the field name is set in the field indicated by the field name registered in the exception condition table in the mail message. If it does, do not discard the email message.
A method for preventing junk mail.
[0064]
(Supplementary Note 4) In the method for preventing spam described in Supplementary note 3,
The field is a source address field in the mail message,
A method for preventing junk mail.
(Supplementary note 5) In the method for preventing unsolicited email described in Supplementary note 3,
The field is a title field of the email message.
A method for preventing junk mail.
[0065]
(Supplementary note 6) In the method for preventing unsolicited email described in Supplementary note 3,
The field is a body field of the email message.
A method for preventing junk mail.
[0066]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to the present invention, it is possible to eliminate unsolicited spam mail including a large number of destinations and a large amount of spam mail having the same body without special setting or operation by a mail user. Can be. In addition, it is no longer necessary to manage the e-mail processing conditions that have been managed for each user in the past, making it possible to implement effective measures to prevent unsolicited e-mail with a small capital investment, and improve reliability. A high e-mail system can be built and operated at low cost.
[Brief description of the drawings]
FIG. 1 shows an outline of the operation of the spam mail prevention method of the present invention.
FIG. 2 is a transfer sequence according to the spam mail prevention method of the present invention.
FIG. 3 shows a configuration of a spam mail prevention device according to the present invention.
FIG. 4 is a configuration of a destination number management table of the junk mail prevention apparatus according to the present invention.
FIG. 5 is a diagram showing the configuration of an exception condition table of the junk mail prevention apparatus according to the present invention.
FIG. 6 is a configuration example of an exception condition table of the junk mail prevention apparatus according to the present invention.
FIG. 7 shows a configuration of a mail message storage area of the junk mail prevention device according to the present invention.
FIG. 8 shows the configuration of a mail message management table of the junk mail prevention device according to the present invention.
FIG. 9 is an operation flowchart of the packet receiving unit of the junk mail prevention apparatus according to the present invention.
FIG. 10 is an operation flowchart of a mail message assembling unit of the junk mail prevention device according to the present invention.
FIG. 11 is an operation flowchart of a destination number exception condition verification unit of the spam mail prevention apparatus according to the present invention.
FIG. 12 is an operation flowchart of a mail message transfer discarding unit of the junk mail prevention device according to the present invention.
FIG. 13 is an operation flowchart of a mail message decomposing unit of the junk mail prevention device according to the present invention.
FIG. 14 is an operation flowchart of the packet transmitting unit of the junk mail prevention apparatus according to the present invention.
FIG. 15 is a schematic diagram showing the operation of the conventional junk mail prevention method.
[Explanation of symbols]
10 Mail server
11a, 11b, 11c Receiving condition verification unit
20A, 20B Normal mail sender
20C mass email sender
20D Spammers
30a, 30b, 30c Users
40 Network
50 Spam mail prevention device
50a Destination number verification unit
50b Exception condition verification unit
51 packet receiver
52 Email Message Assembly Department
53 Destination number exception condition verification unit
54 Email message transfer discarding section
55 Email Message Decomposition Unit
56 packet transmitter
61 Destination number management table
62 Exception condition table
63 Mail message storage area
64 Email message management table
A1 Maximum number of destinations
A2 Email monitoring time
Ba Number of exception conditions
B1 to Bn exception conditions
B2a field name
B2b Keywords
C1-Cm storage area
C2a time stamp
C2b Number of destinations
C2c Same mail link
C1d mail message
D1-Dp Same mail group
D2a Total number of destinations
D2b Spam mail flag
D2c Same mail group link
M1, M2 Normal mail message
M3 mass mail message
M4 mass e-mail message
M5 junk mass email message
M6 annoying mass destination mail message

Claims (3)

In a spam mail prevention device for excluding a mail message having a large number of destinations and / or a large number of mail messages with the same body text received via a network,
Means for storing and holding the received e-mail message for a predetermined period of time,
A comparing and collating means for verifying the identity of the contents of the body of the received e-mail message;
Means for holding a destination count integrated value obtained by integrating the number of destination addresses included in the mail message determined to have the same text,
If the destination number integrated value exceeds a predetermined value within the fixed time, the mail message is discarded.
A spam mail prevention device characterized by the following. In a spam mail prevention method for eliminating a mail message having a large number of destinations and / or a large number of mail messages of the same body received via a network,
Stores and holds received email messages for a predetermined period of time,
Compare the contents of the body of the received email message to verify their identity,
Holds a destination count integrated value obtained by integrating the number of destination addresses included in the email message determined to have the same body,
A junk e-mail prevention method, wherein the e-mail message is discarded when the destination number integrated value exceeds a predetermined value within the predetermined time. The method for preventing junk mail according to claim 2,
Name each field, which is an area that divides the contents of the received email message,
Exception condition table that can register multiple pairs of information of field names and keywords that can be set as arbitrary character strings,
If the integrated value of the number of destinations exceeds a predetermined value within the fixed time, the keyword corresponding to the field name is set in the field indicated by the field name registered in the exception condition table in the mail message. If it does, do not discard the email message.
A method for preventing junk mail.

Images