JP2007005896A - Mail server, method and program for controlling download of e-mail - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent junk mails more efficiently by detecting junk mails of anonymous destination with higher precision. <P>SOLUTION: The mail server 2 comprises a means 23 for storing the downloading log information of E-mail, a means 21 for extracting destination information of each anonymous or rejected E-mail from downloading log information stored in the storage means 23 and making a rejected mail list 25, and a means 22 for acquiring destination information of E-mail and judging whether the destination information exists on the rejected mail list 25 or not, and rejecting reception of E-mail if the destination information exists on the rejected mail list 25 otherwise receiving and downloading the E-mail. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an electronic mail technique, and more particularly to a technique for preventing junk mail.

  In recent years, unsolicited e-mails sent without permission from the user on the Internet have become a problem. As a method for preventing such spam mail, for example, in Patent Document 1, the received data capacity of an email is calculated for each sender and destination based on the received information of the email, and exceeds a predetermined received data capacity. For the sender and destination, a mail server that refuses to receive the e-mail is described.

Japanese Patent Laid-Open No. 2004-228688 counts the number of e-mails with unknown destinations for each sender address, and e-mails that discard e-mails from sender addresses that have transmitted e-mails with unknown destinations over a predetermined number of times. The system is described.
JP 2002-374307 A JP 2003-163696 A

  As one of the spam mails, there is a harvesting attack for collecting mail addresses. In a harvesting attack, a merchant who wants to distribute advertising mail for advertising purposes generates a large number of random email addresses and sends an email. Then, e-mail addresses that do not return an error with an unknown destination are collected as real e-mail addresses.

  Traders who send spam mails such as harvesting attacks can change the sender information (sender IP address, sender mail address) as well as the destination mail address at a predetermined timing (impersonate) spam mail. May be sent. In such a case, it is difficult for the mail server side to identify the spam mail, and therefore it is also difficult to prevent the harvesting attack. Note that Patent Document 1 and Patent Document 2 do not take into account the change (impersonation) of the transmission source information.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to detect spam mail with unknown destinations with higher accuracy, and to prevent spam mail more efficiently.

  In order to solve the above-mentioned problem, for example, the present invention is a mail server that distributes electronic mail, and stores the distribution log storage means in which electronic mail distribution log information is stored and the distribution log storage means. In addition, from each delivery log information, the destination information of each e-mail whose destination is unknown or rejected is extracted, and a generation means for generating a reception rejection list, and the destination information of the e-mail is acquired and the destination information is acquired. If the destination information exists in the reception rejection list, the reception of the e-mail is rejected, and the destination information does not exist in the reception rejection list. Distribution means for receiving and distributing the electronic mail.

  The present invention is also a mail delivery control method performed by a mail server, wherein the mail server includes a delivery log storage unit storing electronic mail delivery log information, and a processing unit. Then, the processing unit generates the reception refusal list by extracting the destination information of each e-mail whose destination is unknown or rejected from the distribution log information stored in the distribution log storage unit. A determination step of acquiring e-mail destination information and determining whether the destination information is present in the reception rejection list; and in the determination step, determining that the destination information is present in the reception rejection list. If it is, the electronic mail is rejected, and if it is determined that the destination information does not exist in the reception rejection list, the electronic mail is received and distributed.

  In addition, the present invention is a mail delivery control program executed by a mail server, and the mail server includes a delivery log storage unit in which delivery log information of electronic mail is stored, and a processing unit. Then, the processing unit generates the reception rejection list by extracting the destination information of each e-mail whose destination is unknown or rejected from the distribution log information stored in the distribution log storage unit. A determination step of acquiring e-mail destination information and determining whether the destination information is present in the reception rejection list; and in the determination step, determining that the destination information is present in the reception rejection list. If it is, the electronic mail is rejected from being received, and if it is determined that the destination information does not exist in the reception rejection list, the electronic mail is received and distributed.

  According to the present invention, it is possible to detect spam mails with unknown destinations with higher accuracy and prevent spam mails more efficiently.

  Embodiments of the present invention will be described below.

  FIG. 1 is an overall configuration diagram of an electronic mail system to which an embodiment of the present invention is applied. The illustrated e-mail system has at least one client 1 and a mail server 2. Each client 1 and the mail server 2 are connected by a network 3 such as the Internet or a LAN (Local Area Network). The network 3 may be configured by a plurality of networks via a gateway.

  Each client 1 has a mail transmission / reception unit 11 that creates and transmits / receives e-mails, and transmits e-mails to other clients via the mail server 2 and receives e-mails from other clients. The mail transmission / reception unit 11 has the same function as a so-called mailer.

  The mail server 2 receives an electronic mail from the client 1 via the network 3 and distributes the electronic mail to a predetermined client 1. The illustrated mail server 2 includes a reception rejection list generation unit 21, a mail distribution unit 22, a distribution log table 23, an account table 24, and a reception rejection list 25.

  The reception rejection list generator 21 generates a reception rejection list 25 based on the distribution log table 23. The reception refusal list 25 is a list in which a destination mail address (destination information) of an e-mail to be rejected is set.

  The mail distribution unit 22 receives an electronic mail addressed to the client 1 under the mail server 2 and distributes the received electronic mail in response to a request from the destination client 1. The client 1 under the mail server 2 is a client 1 that uses the mail address of the domain name (host name) of the mail server 2.

  Further, the mail delivery unit 22 outputs the delivery log information of the email to the delivery log table 23. The distribution log table 23 stores the distribution result of the e-mail for each e-mail sent to the client under the mail server 2. The distribution log table 23 will be described later.

  The account table 24 is a table in which valid mail addresses (address information) existing under the mail server 2 are registered. It is assumed that the mail server 2 or the administrator of the mail server 2 always maintains the account table 24 in the latest state according to the change of the subordinate client (user).

  Each of the client 1 and the mail server 2 described above includes, for example, a CPU 901, a memory 902, an external storage device 903 such as an HDD, an input device 904 such as a keyboard and a mouse, a display, A general-purpose computer system including an output device 905 such as a printer and a communication control device 906 for connecting to a network can be used. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, the functions of the client 1 and the mail server 2 are executed by the CPU 901 of the client 1 in the case of the program for the client 1 and the CPU 901 of the mail server 2 in the case of the program for the mail server 2, respectively. Realized. Note that the memory 902 or the external storage device 903 of the mail server 2 is used for the distribution log table 23, the account table 24, and the reception rejection list 25 of the mail server 2. Note that the input device 904 and the output device 905 are provided as necessary for each device.

  Next, the delivery log table 23 of the mail server 2 will be described. The delivery log table 23 stores delivery log information of e-mails destined for clients under the mail server.

  FIG. 3 is a diagram illustrating an example of the distribution log table 23. In the delivery log table 23 shown in the figure, for each e-mail addressed to a client under the mail server, a reception time 31, a source IP address 32 and a source mail address 33 as destination information, and destination information are shown. Distribution log information (record) including a certain destination mail address 34 and status 35 is stored. The status 35 is set with an electronic mail delivery result such as “normal”, “destination unknown”, “reception refusal”.

  For example, if the destination email address 34 is a valid email address registered in the account table 24, the email is normally delivered to the client 1 that uses the destination email address, so the status is “normal”. Is set. If the destination email address 34 is a fictitious email address that is not registered in the account table 24, since the destination client 1 does not exist, “destination unknown” is set as the status.

  When the destination mail address 34 is a mail address registered in the reception rejection list 25, the reception is rejected (blocked), and “rejection rejection” is set in the status.

  Next, reception rejection list generation processing of the mail server 2 will be described.

  FIG. 4 is a flowchart of the reception rejection list generation process. In addition, the reception refusal list production | generation part 21 of the mail server 2 shall repeat the process shown in figure at a predetermined timing, and shall produce | generate the reception refusal list 25. FIG. It is assumed that the reception rejection list 25 is newly regenerated every time the illustrated process is performed, and the reception rejection list 25 is in an initialized state at the start of this processing.

  First, the reception refusal list generation unit 21 specifies distribution log information (records) within a predetermined time from the distribution log table 23 to the past from the present time (S11). The reception refusal list generator 21 refers to the reception time 31 of the distribution log table 23 and identifies each distribution log information within a predetermined time.

  And the reception refusal list production | generation part 21 reads either delivery log information from the specified delivery log information (S12). For example, it is conceivable that the reception rejection list generation unit 21 reads the reception times 31 in order of early (or late). Then, the reception rejection list generation unit 21 determines whether the status 35 of the read distribution log information is “destination unknown” or “reception rejection” (S13).

  In the case of the status 35 of “Destination unknown” or “Reception refusal” (S13: YES), the reception refusal list generation unit 21 determines that it corresponds to junk mail, and specifies the destination mail address 34 of the read distribution log information ( S14). On the other hand, if the status is other than “destination unknown” and “reception refusal”, that is, if the status is “normal” (S13: NO), the process proceeds to S17.

  And the reception refusal list production | generation part 21 discriminate | determines whether the destination mail address specified by S14 exists in the account table 24 (S15). By determining whether or not the account table 24 exists, it is possible to prevent a risk that an existing valid mail address is erroneously registered in the reception rejection list 25. In other words, even a destination mail address that has been “destination unknown” or “reception refusal” in the past may be transferred to an existing valid mail address. In such a case, it is possible to register an email address that currently exists in the reception rejection list, and to avoid erroneously rejecting an email addressed to the actual email address.

  If it does not exist in the account table 24 (S15: NO), the reception refusal list generator 21 stores (adds) the specified destination mail address 34 in the reception refusal list 25 (S16). That is, the reception refusal list generation unit 21 regards the e-mail with the specified destination mail address as spam mail such as a harvesting attack, and stores the destination mail address in the reception refusal list 25. On the other hand, if it exists in the account table 24 (S15: YES), since it has shifted to a valid email address that currently exists, the reception rejection list generation unit 21 adds the specified destination email address to the reception rejection list. Without proceeding to S17.

  And the reception refusal list production | generation part 21 discriminate | determines whether the following delivery log information (unprocessed delivery log information) exists (S17). If the next distribution log information exists (S17: YES), the reception rejection list generation unit 21 proceeds to S12 and repeats the subsequent processing. On the other hand, when the next distribution log information does not exist (S17: NO), the reception rejection list generation unit 21 ends the reception rejection list generation processing.

  Based on the distribution log information within the most recent predetermined time by the reception refusal list generation process described above, an unknown address and an refusal e-mail corresponding to junk e-mail are detected, and the destination e-mail address of each detected e-mail Can be generated.

  Next, the mail delivery process of the mail server 2 will be described.

  FIG. 5 is a diagram schematically showing the reception rejection list 25 used by the mail distribution unit 22 in the mail distribution processing described later. In the illustrated example, the reception rejection list generator 21 generates a reception rejection list 25 every T time.

  That is, the reception refusal list generating unit 21 generates the reception refusal list 25a by performing the process shown in FIG. 4 based on the distribution log information 23a within the T1 time that is back for T time at the S1 time. And the mail delivery part 22 performs the mail delivery process mentioned later using the reception refusal list 25a produced | generated based on the delivery log information 23a in T1 time within T2 time from S1 time to S2 time. And That is, the mail delivery unit 22 rejects (blocks) the reception of the e-mail with the destination mail address registered in the reception rejection list 25a.

  Similarly, the reception refusal list generator 21 generates a reception refusal list 25b based on the distribution log information 23b within T2 time at the time S2. And the mail delivery part 22 shall perform the mail delivery process mentioned later using the reception refusal list 25b within T3 time from S2 time to S3 time.

  FIG. 6 is a flowchart of the mail delivery process.

  First, the mail delivery part 22 acquires the transmission source IP address and transmission source mail address (transmission source information) of an electronic mail, and a destination mail address (destination information) (S21). It is assumed that the transmission source information and the destination information are notified to the mail server 2 prior to the reception of the electronic mail by a mail transmission protocol such as SMTP (Simple Mail Transfer Protocol). SMTP is defined in RFC821.

  Then, the mail delivery unit 22 determines whether or not the acquired destination mail address exists in the reception rejection list 25 (S22). In addition, the mail delivery part 22 shall discriminate | determine using the reception refusal list 25 produced | generated most recently as demonstrated in FIG.

  If the destination mail address does not exist in the reception rejection list 25 (S22: NO), the mail delivery unit 22 further determines whether or not the destination mail address exists in the account table 24 (S23). That is, the mail delivery unit 22 determines whether the destination mail address is a real mail address or a fictitious unknown mail address.

  If the destination mail address exists in the account table 24, that is, if it is an actual mail address (S23: YES), the mail delivery unit 22 receives the electronic mail and stores it in the external storage device (or memory). Then, the mail delivery unit 22 delivers the received electronic mail in response to a request from the destination client 1 (S24).

  On the other hand, if the destination email address exists in the reception rejection list 25 (S22: YES), or if the destination email address is unknown in the account table (S23: NO), the email delivery unit 22 acquires in S21. A reception rejection error message is transmitted to the transmission source client with the transmission source mail address as the destination (S25). In this case, the mail delivery unit 22 blocks the e-mail without receiving it. Thereby, the system load of the mail server 2 due to the reception of spam mail can be reduced.

  In addition, even when the destination email address is unknown (S23: NO), the mail delivery unit 22 transmits a reception rejection error message instead of an unknown destination error message (such as Unknown User). This makes it difficult for an attacker who sends spam mail to determine whether or not the mail address is an actual mail address, thereby avoiding a harvesting attack.

  Then, the mail delivery unit 22 outputs delivery log information to the delivery log table 23 (S26). That is, when an e-mail is received (S24), the mail delivery unit 22 receives the e-mail reception time 31, the transmission source information 32 and 33 and the destination mail address 34 acquired in S21, and the status 35 is “normal”. The distribution log information including “is output to the distribution log table 23.

  In the case of a destination mail address existing in the reception rejection list (S22: YES), the mail delivery unit 22 acquires the time when the sender information is acquired in S21, the sender information 32, 33 acquired in S21, and the destination mail. Distribution log information including the address 34 and “reception refusal” as the status 35 is output to the distribution log table 23. Further, in the case of a destination e-mail address whose destination is unknown (S23: NO), the e-mail delivery unit 22 obtains the time when the source information is acquired in S21, the source information 32, 33 and the destination e-mail address 34 acquired in S21. , Distribution log information including status 35 “destination unknown” is output to the distribution log table 23.

  In the present embodiment described above, the mail server 2 extracts the destination mail address of the e-mail whose destination is unknown and whose reception is rejected based on the distribution log information in the distribution log table 23, and generates the reception rejection list 25. . As a result, even if an attacker who sends junk e-mail changes junk e-mail or sends junk e-mail with camouflaged sender information, junk e-mail can be prevented more reliably. .

  In the present embodiment, in the reception rejection list generation process, not only the destination mail address whose destination is unknown, but also the destination mail address for which reception is rejected is set in the reception rejection list 25. As a result, it is possible to continuously refuse reception even for a destination mail address that has been repeatedly attacked from the past.

  In the present embodiment, in the reception refusal list generation process, it is determined whether or not the destination mail address exists in the account table 24, and is set in the reception refusal list 25 only when it does not exist. As a result, it is possible to prevent the risk of erroneously registering an actual valid mail address in the reception rejection list 25. That is, even if the destination e-mail address has been “address unknown” or “rejection refusal” in the past, if the e-mail address is subsequently changed to an existing e-mail address, the existing e-mail address is registered in the reception rejection list 25 at the present time, It is possible to avoid erroneously refusing to receive an e-mail addressed to the e-mail address.

  In the present embodiment, the reception rejection list 25 is regenerated at a predetermined timing. As a result, even if an e-mail address previously set in the reception rejection list 25 as an e-mail address with an unknown destination is received, if an e-mail addressed to the e-mail address is not transmitted thereafter, a reception rejection generated at the next timing It is not set in the list 25. Thereby, it is possible to flexibly cope with the spam mail attack pattern. In addition, it is possible to prevent an adverse effect (for example, when a mail address that has been considered unknown) is rejected for a long time (for example, when the mail address is changed to an existing mail address).

  In the present embodiment, even when the destination email address is unknown, an error message indicating that the destination is unknown is simply transmitted instead of an error message indicating that the destination is unknown. This makes it difficult for an attacker who sends spam mail to determine whether or not the mail address is an actual mail address, thereby avoiding a harvesting attack.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, in the above embodiment, in the reception refusal list generation process, the destination mail address of an e-mail whose destination is unknown or has been rejected even once is set in the reception refusal list 25. However, the present invention is not limited to this. For example, the destination mail address of an e-mail whose destination is unknown or rejected after a predetermined number of times within a predetermined time may be set in the reception rejection list 25. .

  In the above embodiment, the mail server 2 obtains an e-mail destination e-mail address in advance, and receives the e-mail when the destination e-mail address does not exist in the reception rejection list 25 and exists in the account table 24. (See FIG. 6). However, the present invention is not limited to this, and the mail server 2 may receive an e-mail together with the destination e-mail address in S21 of FIG. In this case, it is assumed that the mail server 2 discards the received electronic mail when transmitting a reception refusal error message (S25).

1 is a diagram illustrating an overall configuration of an electronic mail system to which an embodiment of the present invention is applied. It is a figure which shows the hardware structural example of each apparatus. It is a figure which shows an example of a delivery log table. It is a flowchart of a reception refusal list generation process. It is the figure which showed typically the reception refusal list used by mail delivery processing. It is a flowchart of a mail delivery process.

Explanation of symbols

1: client, 11: mail transmission / reception unit, 2: mail server, 21: reception rejection list generation unit, 22: mail distribution unit, 23: distribution log table, 24: account table, 25: reception rejection list, 3: network

Claims (6)

A mail server that delivers e-mail,
Delivery log storage means for storing email delivery log information;
From each distribution log information stored in the distribution log storage means, extracting the destination information of each e-mail whose destination is unknown or reception refusal, generating means for generating a reception refusal list;
Obtain destination information of the email and determine whether the destination information exists in the reception rejection list. If the destination information exists in the reception rejection list, reject the reception of the email, A mail server, comprising: a delivery unit that receives and delivers the electronic mail when the destination information does not exist in the reception rejection list. The mail server according to claim 1,
Account storage means for storing address information under the mail server is further provided,
The generating unit determines, for each of the extracted destination information, whether the destination information exists in the account storage unit, excludes the destination information existing in the account storage unit, and stores the reception rejection list. A mail server characterized by generating. The mail server according to claim 1 or claim 2,
Account storage means for storing address information under the mail server is further provided,
The distribution unit determines whether or not the destination information of the acquired email exists in the account storage unit, and rejects reception of the email when the destination information does not exist in the account storage unit. A mail server characterized by The mail server according to any one of claims 1, 2, and 3,
The generation unit specifies distribution log information within a predetermined time stored in the distribution log storage unit, regenerates the reception rejection list based on the specified distribution log information at a predetermined timing,
The mail server characterized in that the distribution means determines whether or not the destination information of the acquired e-mail exists in the most recently generated reception rejection list. A mail delivery control method performed by a mail server,
The mail server includes a delivery log storage unit in which email delivery log information is stored, and a processing unit.
The processor is
From each distribution log information stored in the distribution log storage unit, extracting destination information of each e-mail whose destination is unknown or reception refusal, and generating a reception refusal list;
A determination step of acquiring destination information of an email and determining whether the destination information is present in the reception rejection list;
In the determination step, if it is determined that the destination information exists in the reception rejection list, the reception of the electronic mail is rejected, and if it is determined that the destination information does not exist in the reception rejection list, the electronic mail is And a delivery step of receiving and delivering the email delivery control method. A mail delivery control program executed by a mail server,
The mail server includes a delivery log storage unit in which email delivery log information is stored, and a processing unit.
In the processing unit,
From each distribution log information stored in the distribution log storage unit, extracting destination information of each e-mail whose destination is unknown or reception refusal, and generating a reception refusal list;
A determination step of acquiring destination information of an email and determining whether the destination information is present in the reception rejection list;
In the determination step, if it is determined that the destination information exists in the reception rejection list, the reception of the electronic mail is rejected, and if it is determined that the destination information does not exist in the reception rejection list, the electronic mail is A mail delivery control program that executes a delivery step of receiving and delivering.

Images