JP2006128917A - E-mail control device, e-mail control method, program, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a e-mail control device capable of preventing an e-mail server from stopping its function due to large quantities of mails. <P>SOLUTION: A transmitter, a transmission server, and a receiver of each of e-mails received within a prescribed time range are extracted from transmission/reception records of e-mails received by an e-mail delivery server 102, by a transmitter/transmission server/receiver detection part 104, and the numbers of e-mails transmitted from the same transmitters and the same transmission servers and the numbers of e-mails transmitted to the same receivers are calculated by a mass mail detection part 105, and a transmission server being a transmission source of large quantities of e-mails is detected on the basis of results of comparison between the calculated numbers of e-mails and a threshold α. A band control command for narrowing down a reception band of e-mails from the detected transmission server is generated by a control command generation part 106 and is sent to a band control device 101. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an electronic mail control apparatus, an electronic mail control method, a program, and a storage medium for controlling reception of a large amount of mail in an electronic mail server.

  Among e-mails are fraudulent e-mails called spam (SMPAM) mails or junk mails that do not want the recipient to promote or solicit. Such illegal e-mails are usually sent to a large number of unspecified destinations, and the number thereof is enormous. An electronic mail server that receives such an enormous number of mails has a risk of paralyzing its transmission / reception function when it receives more mails than its processing capacity.

  In addition, with recent improvements in the performance of information devices such as PCs (personal computers), it has become possible to send a large amount of e-mails in a short time. When transmitting to a large number of destinations, the sender may unintentionally paralyze the transmission / reception function of the electronic mail server in the same manner as the above-described unauthorized mail.

  As a method for avoiding the paralysis of the send / receive function by a large amount of e-mails, there is a method of strengthening the e-mail server's ability to enable processing even if a large amount of e-mails are received. However, in reality, this often leads to enhanced reception of spam mail rather than measures against legitimate e-mail, and the investment efficiency for the original legitimate e-mail is deteriorated.

  As a countermeasure against unauthorized e-mail to eliminate such spam e-mails, an e-mail server maintains a table describing a sender / sender of an unauthorized e-mail called a spam list, and is described in this table. There is a method of rejecting reception or transmission rejection of an e-mail from a sender / sender that matches the sent sender / sender. However, since an unauthorized e-mail sender always sends an e-mail while changing the sender name and transmission server, it is difficult to dynamically update the sender name / sender in the above table. In many cases, countermeasures against fraudulent email using the above method are followed.

Therefore, as one of the methods used for countermeasures against fraudulent e-mail, the destination and sender information and specific keywords are extracted from the information described in the e-mail passing through the e-mail server, and the same as the extracted information. A method has been proposed in which the number of e-mails in which the above information is described is measured and reception of e-mails that exceed the threshold is rejected (see, for example, Patent Documents 1 and 2).
JP 2000-163341 A JP 2000-353133 A

  However, when illegal mail countermeasures are implemented by the above-described method, it is impossible to detect whether or not the email itself is legitimate. Actually, since the control is performed based on the number of transmissions, Regardless of whether the mail is a legitimate mail or an illegal mail, reception of an electronic mail transmitted exceeding the threshold is rejected.

  For example, when notifications are sent to employees within a company by e-mail, a large number of e-mails are sent normally. In such a case, there is a possibility that e-mails do not reach each employee. There is sex. In addition, when an e-mail is transmitted from a plurality of senders of an organization to the same destination outside the organization, that is, when a large amount of illegal mail is transmitted to the same destination, The message is transmitted to the destination without being identified as an illegal mail.

  An object of the present invention is to provide an electronic mail control apparatus, an electronic mail control method, a program, and a storage medium that can prevent an electronic mail server from being stopped due to a large amount of mail.

  In order to achieve the above object, the present invention receives an electronic mail transmitted from a transmission server and delivers the received electronic mail to a corresponding destination, and between the transmission server and the electronic mail server An e-mail control device connected to a bandwidth control device for controlling the bandwidth of a communication line used for e-mail communication, the same specific parameters based on an e-mail reception record of the e-mail server An e-mail number detecting means for detecting the number of received e-mails, and a sender of the e-mail according to the number of e-mails having the same specific parameter detected by the e-mail number detecting means A bandwidth control command for generating a bandwidth control command for controlling the reception bandwidth of the email from the transmission server, which is transmitted to the bandwidth control device. To provide an electronic mail control unit, characterized in that it comprises a command generating unit.

  In order to achieve the above object, the present invention receives an electronic mail transmitted from a transmission server and delivers the received electronic mail to a corresponding destination, and between the transmission server and the electronic mail server An e-mail control method using an e-mail control device connected to a bandwidth control device for controlling a bandwidth of a communication line used for e-mail communication, based on an e-mail reception record of the e-mail server E-mail number detecting step for detecting the number of e-mails having the same specific parameter, and the number of e-mails having the same specific parameter detected in the e-mail number detecting step is a predetermined value. And generating a band control command for controlling the reception band of the email from the transmission server that is the transmission source of the email, To provide an electronic mail control method characterized by comprising a band control command generation step of transmitting to the control unit.

  In order to achieve the above object, the present invention receives an electronic mail transmitted from a transmission server and delivers the received electronic mail to a corresponding destination, and between the transmission server and the electronic mail server A program executed on an e-mail control device connected to a bandwidth control device for controlling a bandwidth of a communication line used for e-mail communication, based on an e-mail reception record of the e-mail server , According to the number of e-mails having the same specific parameters detected by the e-mail number detection module detecting the number of e-mails having the same specific parameters, Generating a bandwidth control command for controlling the reception bandwidth of the email from the transmission server that is the sender of the email; Provides a program characterized by comprising a band control command generation module to be transmitted to the serial bandwidth control apparatus.

  In order to achieve the above object, the present invention provides a storage medium in which the above program is stored so as to be readable by a computer.

  According to the present invention, it is possible to prevent the electronic mail server from being stopped due to a large amount of mail.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an electronic mail control apparatus according to an embodiment of the present invention.

  As shown in FIG. 1, the e-mail control apparatus 103 extracts a sender, a transmission server, and a receiver for each e-mail received within a predetermined time range from the e-mail transmission / reception record received by the e-mail delivery server 102. A sender / sender server / recipient detector 104 is provided. The sender, transmission server, and recipient for each electronic mail extracted by the sender / transmission server / recipient detection unit 104 are input to the mass mail detection unit 105.

  The mass mail detection unit 105 determines the number of emails transmitted from the same sender based on the sender, the transmission server, and the receiver for each input email, and the number of emails transmitted from the same transmission server. , And the number of e-mails sent to the same recipient, respectively, and based on a comparison result between each calculated number of e-mails and a preset threshold value α, the sender of mass mails Detect the sending server. Here, mass mails are e-mails sent from the same number of senders exceeding the above threshold within a predetermined time range, and sent from the same number of transmission servers exceeding the above threshold within a predetermined time range. Or an email sent to the same number of recipients exceeding the threshold within a predetermined time range. Further, as will be described later, the threshold value α is the number of e-mails equal to the number of e-mails received within a range (T−ΔT <t <T) from the current time (T) to a certain time (ΔT). When the reception is assumed to continue thereafter, this is the maximum number of receptions with a low possibility of stopping the function of the electronic mail delivery server 102. Then, information indicating the detected mass mail transmission server is input to the control command generation unit 106.

  The control command generation unit 106 generates a bandwidth control command for narrowing the reception bandwidth of the email from the transmission server that is the transmission source of the mass mail indicated by the input information, and sends the bandwidth control command to the bandwidth control device 101. The bandwidth control command is used to control the reception bandwidth of the email from the transmission source server that is the email according to the number of emails received by the same sender, transmission server, and receiver.

  The bandwidth control device 101 controls the bandwidth of a communication line used for transmission / reception of electronic mail, and based on the bandwidth control command from the control command generation unit 106, from the transmission server that is the transmission source of mass mail. Control to narrow down the e-mail reception bandwidth.

  Next, transmission / reception records of emails created by the email delivery server 102 will be described with reference to FIG. FIG. 2 is a diagram showing an example of an e-mail transmission / reception record created by the e-mail delivery server 102.

  The email transmission / reception record created by the email delivery server 102 is called “syslog”. As shown in FIG. 2, this transmission / reception record is a set of a line relating to the sender and a line relating to the receiver, and each line is composed of a plurality of items separated by a space. The first to third items in each row are all items corresponding to time. Also, information relating to the sender to the mail server is written in the seventh item beginning with “from =” in the line relating to the sender. In addition, the server of the transmission source is recorded in the 14th item starting with “relay =” in the line relating to the sender. Information relating to the recipient is written in the seventh item starting with “to =” in the row relating to the recipient. Then, an identifier is written in the sixth item (“msgid”) of each row, and it is identified by this identifier whether or not they are the same mail.

  From the information written in each of the 1st to 3rd items in each row, the 7th and 14th items in the row related to the sender, and the 7th item in the row related to the recipient, when and which sender is which server. You can read who used it and sent it to.

  Next, processing of the sender / transmission server / recipient detection unit 104 will be described with reference to FIGS. 3 is a flowchart showing a processing procedure by the sender / transmission server / recipient detection unit 104 in FIG. 1, and FIG. 4 is written in the file by the processing by the sender / transmission server / recipient detection unit 104 in FIG. FIG. 5 is a view showing an example of information indicating the reception time (t) of an e-mail, a sender, a transmission server, and a receiver. FIG. It is a figure which shows an example of a program.

  As shown in FIG. 3, the sender / transmission server / recipient detection unit 104 reads a row related to the sender recorded in the above-mentioned e-mail transmission / reception record (syslog) (step S101). Here, it is assumed that the latest sender is read from the line. Then, the sender / transmission server / recipient detection unit 104 receives the e-mail reception time (t) corresponding to the row based on the time information written in the first to third items of the row related to the read sender. ) Is within a predetermined time range (T−ΔT <t <T) (step S102).

  If it is determined in step S102 that the reception time (t) of the e-mail corresponding to the read line relating to the sender is within a predetermined time range (T−ΔT <t <T), the sender / transmission server / Recipient detection unit 104 sends the sender from the 7th item in the line related to the sender of the e-mail, the transmission server from the 14th item in the same line, and 7 in the line related to the receiver paired with the line related to the sender. Recipients are extracted from the second item, and the reception time (t) of the e-mail, the extracted sender (from), the transmission server (relay), and the recipient (to) are written in the file (step S103). Then, the sender / transmission server / recipient detection unit 104 returns to step S101, reads the line related to the next sender recorded in the transmission / reception record (syslog) of the e-mail, and similarly receives the reception time (t ) Within a predetermined time range (T−ΔT <t <T), e-mail senders, sending servers, and recipients are extracted and written to a file.

  If it is determined in step S102 that the e-mail reception time (t) corresponding to the read line relating to the sender is not within the predetermined time range (T−ΔT <t <T), the sender / transmission server / Recipient detection unit 104 ends this process. This is because reading from the line related to the latest sender in the transmission / reception record is performed, so that the line following the line related to the sender whose reception time (t) is not within the predetermined time range (T−ΔT <t <T). This is because, of course, this is a line relating to a sender whose reception time (t) is not within the predetermined time range (T−ΔT <t <T).

  In this way, all e-mail senders (s1,...), Transmission servers (m1,...), And recipients (reception time (t) within a predetermined time range (T−ΔT <t <T)) A file in which r1, ...) is written is generated. For example, a file in which information indicating the reception time (t) of the electronic mail, the sender, the transmission server, and the recipient is written in the format shown in FIG. The created file is input to the mass mail detection unit 105.

  The processing by the sender / transmission server / recipient detection unit 104 is executed by a program as shown in FIG. 5, for example.

  Next, processing by the mass mail detection unit 105 will be described with reference to FIGS. 6 and 7. FIG. 6 is a flowchart showing a procedure of processing by the mass mail detection unit 105 in FIG. 1, and FIG. 7 is a diagram showing an example of a program for executing processing by the mass mail detection unit 105 in FIG.

  As shown in FIG. 6, the mass mail detection unit 105 includes a sender (s1,...), A transmission server (m1,...), A receiver in a file input from the sender / transmission server / recipient detection unit 104. Based on (r1,...), The number of the same sender, the same transmission server, and the same recipient is calculated (step S201). Here, calculating the number of the same sender, the same sending server, and the same recipient respectively means the number of e-mails sent from the same sender and the number of e-mails sent from the same sending server. The number of e-mails sent to the same recipient.

  Next, the mass mail detection unit 105 determines whether or not the above threshold value is exceeded for each of the calculated number of identical senders, number of identical transmission servers, and number of identical recipients ( Step S202). That is, e-mails transmitted from the same number of senders exceeding the threshold within a predetermined time range, e-mails transmitted from the same number of transmission servers exceeding the threshold within a predetermined time range, or predetermined A determination is made as to whether there are emails sent to the same number of recipients that exceed the threshold in the time range.

  If it is determined in step S202 that the calculated number exceeds the threshold, the mass mail detection unit 105 determines that there are a large number of transmission servers that are transmission sources of the number of emails exceeding the threshold. It is detected as a transmission server (PM1, PM2, PM3,...) That is a mail transmission source (step S203). Here, for example, if the number exceeding the above threshold is the number of the same senders, based on “relay =” of the line that matches “from =” of the line related to the sender of the corresponding email, A transmission server that is a transmission source of the electronic mail transmitted from the sender is detected. Similarly, when the number of identical transmission servers exceeds the threshold value, the transmission server is detected based on “relay =” in the line related to the transmission server of the corresponding electronic mail. Also, if the number of identical recipients exceeds the above threshold, based on “relay =” in the row relating to the sender in the row relating to the sender that is paired with the row relating to the recipient of the corresponding email A transmission server that is a transmission source of the electronic mail transmitted to the recipient is detected. Information indicating a list of detected transmission servers is input to the control command generation unit 106. Then, the mass mail detection unit 105 ends this process.

  If each of the calculated numbers does not exceed the threshold value in step S202, the mass mail detection unit 105 ends this process.

  The processing by the mass mail detection unit 105 is executed by a program as shown in FIG. 7, for example.

  Next, the processing of the control command generation unit 106 will be described with reference to FIG. FIG. 8 is a diagram illustrating an example of a control command generated by the control command generation unit 106.

  The control command generation unit 106 controls the bandwidth of the input information so as to narrow the reception bandwidth in the communication bandwidth between the transmission server (PM1,...) And the email delivery server 102 to the minimum reception bandwidth (β) that can be communicated. Generate a command. For example, as shown in FIG. 8, this bandwidth control command is a command including a transmission server name to be communicated and a designated bandwidth. In addition, the control command generation unit 106 acquires the current setting status and communication amount from the bandwidth control device 101, and determines that the bandwidth limit is set in the current bandwidth control device 101 based on these information. In the case of the control command, the control command for the current bandwidth limitation is added to the generated control command. The bandwidth control command is used to control the reception bandwidth of the email from the transmission source server that is the email according to the number of emails received by the same sender, transmission server, and receiver.

  The control command generated by the control command generation unit 106 is input to the bandwidth control device 101. The bandwidth control device 101 initializes the communication bandwidth setting based on the control command and is instructed by the input control command. The reception band in the communication band between the transmission server (PM1,...) And the e-mail delivery server 102 is narrowed down to the minimum communication band (β) that can be communicated.

  As described above, according to the present embodiment, since the communication band between the transmission server that is the transmission source of mass mail and the electronic mail delivery server 102 is limited, the spam list for rejecting spam mail as in the past is used. There is no need to update, and even when a large amount of spam mail other than the setting is transmitted, the e-mail delivery server 102 does not stop functioning, and the e-mail delivery server 102 is in a state where it stops functioning. Can be prevented. In addition, normal emails are not rejected because there is no reception rejection of normal emails sent in large quantities unlike the technology that eliminates illegal emails by rejecting emails sent exceeding the threshold. Can be delivered reliably. In addition, even when e-mails are transmitted from different senders or transmission servers to the same recipient and the number is large, reception of a large amount of e-mails to the same recipient is restricted.

  Note that an object of the present invention is to supply a storage medium (or recording medium) on which a program code of software that implements the functions of the above-described embodiments is recorded to a system or apparatus, and a computer (or CPU) of the system or apparatus. Needless to say, this can also be achieved by reading and executing the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the storage medium storing the program code constitutes the present invention.

  Examples of the storage medium for supplying the program code include a floppy (registered trademark) disk, a hard disk, a magneto-optical disk, a CD-ROM, a CD-R, a CD-RW, a DVD-ROM, a DVD-RAM, and a DVD. -RW, DVD + RW, magnetic tape, nonvolatile memory card, ROM, etc. can be used. Alternatively, the program code may be downloaded via a network.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an operating system (OS) running on the computer based on the instruction of the program code. A case where part or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing is also included.

  Furthermore, after the program code read from the storage medium is written into a memory provided in a function expansion card inserted into the computer or a function expansion unit connected to the computer, the function is determined based on the instruction of the program code. The case where the CPU of the expansion card or the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing is also included.

It is a block diagram which shows the structure of the electronic mail control apparatus which concerns on one embodiment of this invention. It is a figure which shows an example of the transmission reception record of the email produced by the email delivery server. 3 is a flowchart illustrating a processing procedure performed by a sender / transmission server / recipient detection unit 104 in FIG. 1. It is a figure which shows an example of the information which shows the reception time (t) of the email written in the file by the process of the sender / transmission server / recipient detection part 104 of FIG. 3, a sender, a transmission server, and a receiver. It is a figure which shows an example of the program for performing the process by the sender / transmission server / recipient detection part 104 of FIG. It is a flowchart which shows the procedure of the process by the mass mail detection part 105 of FIG. It is a figure which shows an example of the program for performing the process by the mass mail detection part 105 of FIG. It is a figure which shows an example of the control command produced | generated by the control command production | generation part.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Band control apparatus 102 E-mail delivery server 103 E-mail control apparatus 104 Sender / transmission server / recipient detection part 105 Mass mail detection part 106 Control command generation part

Claims (10)

An e-mail server that receives an e-mail transmitted from a transmission server and delivers the received e-mail to a corresponding destination, and a bandwidth of a communication line used for e-mail communication between the transmission server and the e-mail server An e-mail control device connected to a bandwidth control device for controlling the width,
E-mail number detecting means for detecting the number of e-mails having the same specific parameters based on the e-mail reception record of the e-mail server;
Band for controlling the reception band of the email from the transmission server that is the transmission source of the email according to the number of emails having the same specific parameter detected by the email number detection means An electronic mail control apparatus comprising: a band control command generation unit that generates a control command and transmits the control command to the band control apparatus.   2. The electronic mail control apparatus according to claim 1, wherein the specific parameter is one of an electronic mail sender, a transmission server, and a receiver. A transmission server detection unit for detecting a transmission server that is a transmission source of the email when the number of emails having the same specific parameter detected by the email number detection unit exceeds a predetermined value; Have
The band control command generation unit generates a band control command for narrowing a reception band of an email from the transmission server detected by the transmission server detection unit, and transmits the band control command to the band control device. Item 2. The electronic mail control apparatus according to Item 1. The number of e-mails detecting means detects the number of e-mails having the same specific parameters received per predetermined unit time based on the e-mail reception record of the e-mail server,
The bandwidth control command reproduction means is a transmission server that is a sender of the e-mail according to the number of e-mails having the same specific parameter detected per predetermined unit time detected by the e-mail number detection means 2. The electronic mail control device according to claim 1, wherein a bandwidth control command for controlling a reception bandwidth of an electronic mail from the network is generated and transmitted to the bandwidth control device. An e-mail server that receives an e-mail transmitted from a transmission server and delivers the received e-mail to a corresponding destination, and a bandwidth of a communication line used for e-mail communication between the transmission server and the e-mail server An e-mail control method using an e-mail control device connected to a bandwidth control device for controlling the width,
An e-mail number detection step of detecting the number of e-mails having the same specific parameters based on the e-mail reception record of the e-mail server;
A band for controlling a reception band of an email from a transmission server that is a transmission source of the email according to the number of emails having the same specific parameter detected in the email number detection step A band control command generation step of generating a control command and transmitting the control command to the band control device.   6. The electronic mail control method according to claim 5, wherein the specific parameter is one of an electronic mail sender, a transmission server, and a receiver. A transmission server detection step of detecting a transmission server that is a transmission source of the e-mail when the number of e-mails having the same specific parameter detected in the e-mail number detection step exceeds a predetermined value; Have
The bandwidth control command generation step generates a bandwidth control command for narrowing a reception bandwidth of an email from the transmission server detected in the transmission server detection step, and transmits the bandwidth control command to the bandwidth control device. Item 6. The electronic mail control method according to Item 5. The number of e-mails detecting step detects the number of e-mails received per unit time having the same specific parameters based on the e-mail reception record of the e-mail server,
The bandwidth control command reproduction step includes a transmission server that is a transmission source of the e-mail according to the number of e-mails having the same specific parameter detected in the e-mail number detection step per predetermined unit time. 2. The electronic mail control device according to claim 1, wherein a bandwidth control command for controlling a reception bandwidth of an electronic mail from the network is generated and transmitted to the bandwidth control device. An e-mail server that receives an e-mail transmitted from a transmission server and delivers the received e-mail to a corresponding destination, and a bandwidth of a communication line used for e-mail communication between the transmission server and the e-mail server A program executed on an e-mail control device connected to a bandwidth control device for controlling the width,
An e-mail number detection module for detecting the number of e-mails having the same specific parameters based on the e-mail reception record of the e-mail server;
Band for controlling the reception band of the email from the transmission server that is the transmission source of the email according to the number of emails having the same specific parameter detected by the email count detection module A program comprising: a bandwidth control command generation module that generates a control command and transmits the control command to the bandwidth control device.   A storage medium storing the program according to claim 9 in a computer-readable manner.

Images