JP2008250597A - Computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer system capable of certainly filtering a troublesome mail. <P>SOLUTION: A harmful site decision part 13 analyzes a character string of a URI (Uniform Resource Identifier) recorded inside a reception mail, and decides whether a Web site identified by the URI is a harmful site or not. A harmful site decision part 21 analyzes a character string of a URI required with access by a user, and decides whether the Web site identified by the URI is the harmful site or not. A blacklist storage part 3 stores the URI decided that it is the harmful site by the harmful site decision parts 13, 21. A spam mail decision part 12 decides whether the reception mail is the junk mail or not based on the URI stored by the blacklist storage part 3. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a computer system that determines whether a received mail is a junk mail.

Spam mail called spam mail that is unilaterally transmitted to a computer terminal of an unspecified user is a problem. Patent Document 1 describes a technique for holding a URI (Uniform Resource Identifier) described in spam mail and performing filtering based on the held URI.
JP 2005-128922 A

  In the technique described in Patent Document 1, the URI is held by the system when the spam mail is received for the first time, and after the second reception, it is determined whether the mail is spam mail based on the URI. However, since the determination cannot be performed at the first reception, the spam mail cannot be reliably filtered. In this technique, URIs are collected only from received mail. However, since the URI described in the received mail is not necessarily the URI of the harmful site, there is a possibility that erroneous determination may occur. Further, in this technique, when determining whether or not the received mail is spam mail, since the determination is performed based only on the URI, an erroneous determination may occur.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a computer system capable of reliably filtering junk mail.

  The present invention has been made to solve the above-described problems, and analyzes a character string of a URI (Uniform Resource Identifier) described in a received mail, and a website identified by the URI is a harmful site. First harmful site determination means for determining whether or not there is present, storage means for storing the URI determined as a harmful site by the first harmful site determination means, and stored by the storage means A computer system comprising: a junk mail judging means for judging whether or not a received mail is a junk mail based on the URI.

  The computer system according to the present invention further includes second harmful site determination means for analyzing a character string of a URI for which a user requests access and determining whether or not a website identified by the URI is a harmful site. The storage means further stores the URI determined to be a harmful site by the second harmful site determination means.

  In the computer system of the present invention, the first harmful site determination means may further include at least one of an IP address of the website identified by the URI, information on the website domain, and information on the website page. Based on one of the above, it is determined whether or not the website is a harmful site, and the storage means further includes an IP address of the website determined to be a harmful site by the first harmful site determination means. , Storing at least one of the domain information of the website and the information of the page of the website, and the junk mail determination means further includes the IP address of the website stored in the storage means, the web Site domain information and the website page Based on at least one of di-information, received mail and judging whether or not spam.

  In the computer system of the present invention, the second harmful site determination means may further include an IP address of a website identified by the URI, information on the domain of the website, information on a page of the website, and The storage means further determines whether the website is a harmful site based on at least one of the information indicating the result of the user determining whether the website is a harmful site, and the storage means further includes The IP address of the website determined to be a harmful site by one harmful site determination means, information on the domain of the website, information on the page of the website, and whether or not the website is a harmful site At least one of the information indicating the result of the determination by the user, and The website determination unit further includes an IP address of the website stored in the storage unit, information on the domain of the website, information on a page of the website, and whether the website is a harmful site. It is characterized in that it is determined whether or not the received mail is a junk mail based on at least one of the information indicating the result of the determination by the user.

  According to the present invention, an unsolicited mail containing a URI to be determined for the first time is received by analyzing a character string of the URI described in the mail and determining whether or not it is a harmful site. Even in this case, junk mail can be reliably filtered. Further, by analyzing a URI character string requesting access by a user and determining whether or not the site is a harmful site, it is possible to improve the accuracy of determining a harmful site and to filter spam mails with certainty. Also, based on at least one of the website IP address, website domain information, website page information, and information indicating the result of the user determining whether the website is a harmful site, By determining whether or not the received mail is junk mail, it is possible to improve the accuracy of junk mail determination and reliably filter junk mail.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows the configuration of a computer system according to an embodiment of the present invention. The computer system according to the present embodiment includes a mail server 1 that delivers electronic mail, a proxy server 2 that receives an access request from a user and accesses an external network, and a blacklist storage unit 3 that stores URIs of harmful sites. have. The black list storage unit 3 may be installed in a database server or the like separate from the mail server 1 or the proxy server 2, or may be installed in the mail server 1 or the proxy server 2.

  In the mail server 1, the mail receiving unit 10 receives mail from an external network. The mail storage unit 11 stores the mail received by the mail receiving unit 10. The spam mail determination unit 12 determines whether or not the received mail is spam mail (spam mail). The harmful site determination unit 13 determines whether the website identified by the URI described in the received mail is a harmful site.

  In the proxy server 2, the web access monitoring unit 20 monitors user access to websites on an external network. The harmful site determination unit 21 determines whether or not the website for which the user requests access is a harmful site.

The harmful site determination units 13 and 21 check the following three types of information when determining whether the website is a harmful site.
(1) URI character string information (2) Domain information (3) Website page information For each of these three types of information, the harmful website is a harmful website. When the evaluation value indicating the possibility is calculated, the value obtained by summing the evaluation values obtained for each information is compared with a predetermined threshold, and the total value of the evaluation values exceeds the threshold, the website to be determined Is determined to be a harmful site.

  First, the contents of a check based on URI character string information will be described. The harmful site determination unit 13 of the mail server 1 reads the received mail stored in the mail storage unit 11, and analyzes the URI character string described in the received mail. The web access monitoring unit 20 of the proxy server 2 notifies the harmful site determination unit 21 of the URI of the website requested to be accessed when a user requests access to an external website. The harmful site determination unit 21 analyzes the character string of the notified URI.

  Information on fraud sites such as phishing scams can be read from the URI. When creating a fraud site, the URI is often devised so that the user or server administrator is not aware of the fraud site. For example, a character string similar to the name of a website that actually exists is stored in the URI, and a pattern that tricks the user can be considered. In this embodiment, character strings similar to names of famous websites and names themselves are listed in advance, and a high evaluation value is given to those matching the names. It also checks where in the URI a string with a name similar to a famous website is written. In the case of fraudulent sites, the character strings are often written in subdomains and directory names, so the evaluation value is increased when written in these places.

  In addition, the following patterns exist to trick server administrators. One is to create a blank directory and create a harmful site in it, and the other is to create a directory starting with "." And create a harmful site in it. It is also intended to hide the location of harmful sites from the administrator. In these cases, there is a space ("% 20" as the string) between the URI characters "/" and "/", or "." After "/". Or

  In addition to the above, URIs in which IP addresses are directly written, and examples in which the IP address is converted to decimal or hexadecimal are listed as URIs for harmful sites.

  Next, the contents of the check based on the domain information will be described. When an administrator of a harmful site creates and promotes a harmful site, it is possible to send a spam mail immediately after creating the harmful site. Therefore, the domain acquisition date can be used as a criterion. Further, in order to deal with cases such as being discovered early, a domain is often acquired with an expiration date as short as one year, and it is considered that the expiration date of the domain can also be used as a criterion. It is also possible to use an IP address as a criterion.

  The harmful site determination units 13 and 21 extract the domain name from the URI character string, and execute the whois command to acquire the domain information. Then, the harmful site determination units 13 and 21 confirm the acquisition date of the domain, and increase the evaluation value when the domain has been acquired recently. Moreover, the harmful site determination units 13 and 21 confirm the expiration date of the domain, and increase the evaluation value when the expiration date is short.

  Next, the contents of the check based on the information on the website page will be described. This is done by getting the information that is actually written on the pages of the website. Web pages often have words that are characteristic of the site. Therefore, a database of characteristic words is prepared in advance, the number of words included in the database is used, the appearance frequency of each word is calculated, and the evaluation value is weighted. The same is done not only on the web page written in the URI but also on the linked web page accessible from the page. When the link destination is included, an evaluation value is obtained for a plurality of pages, but the weight of the evaluation value is increased as the page is closer to the page indicated by the URI.

  Other than the above, the determination can also be made by comparing the unique words. Compare the proper noun written on the page indicated by the URI with the proper noun written on the page that can be said to be the top page of the domain site indicated by the URI that has been trimmed away from the URI string. If there is no common word between them, the relationship between the top page and the URI page is considered to be weak. It is considered that there are many in ordinary personal sites, but such cases are rare in the case of sites such as companies, and if there is no common proper name, it can be judged that it is a cracked site it can.

 Similarly, the titles between the pages described above are compared, and if the titles are different, it is possible to determine that there is a high possibility of being a harmful site. In the case of a phishing site, since there is a transmission form for transmitting a password or the like on the web page, the presence or absence of the transmission form can also be listed as an evaluation item.

 The harmful site determination units 13 and 21 access the website identified by the URI, download the information on the web page, and calculate the evaluation value based on the above-described criteria based on the information on the web page.

  Next, the operation of the mail server 1 will be described with reference to FIG. The mail receiving unit 10 receives the mail and stores the received mail in the mail storage unit 11 (step S100). The harmful site determination unit 13 reads the received mail from the mail storage unit 11 and extracts the URI from the text of the received mail (step S110).

  Subsequently, the harmful site determination unit 13 executes a whois command and acquires information on the domain to which the website indicated by the URI described in the received mail belongs. Further, the harmful site determination unit 13 accesses the web page indicated by the URI described in the received mail and acquires information on the page (step S120).

  Subsequently, the harmful site determination unit 13 analyzes the URI character string extracted from the received mail, analyzes the domain information and the web page information acquired in step S120, and evaluates each information and the sum thereof. A value is calculated (step S130). The harmful site determination unit 13 compares the total value of the evaluation values with a predetermined threshold, and determines whether the website identified by the URI described in the received mail is a harmful site based on the comparison result. (Step S140).

  If it is determined that the website is a harmful site (YES in step S140), the harmful site determination unit 13 associates the URI and the information acquired in step S120 and stores them in the blacklist storage unit 3 (step S150). If it is determined that the website is not a harmful site (NO in step S140), the process ends.

  Next, the operation of the proxy server 2 will be described with reference to FIG. When the user makes a request for accessing the website to the proxy server 2, the web access monitoring unit 20 notifies the harmful site determination unit 21 of the URI requested to be accessed (step S200). The harmful site determination unit 21 performs a time-consuming check (checking the character string in the URI and checking the information on the top page of the website), and calculates an evaluation value and a total value thereof for each piece of information (step S210). ).

  Subsequently, the harmful site determination unit 21 compares the total value of the evaluation values with a predetermined threshold, and based on the comparison result, whether or not the website identified by the URI that the user requested access to is a harmful site. Is determined (step S220). If it is determined that the website is a harmful site (YES in step S220), the harmful site determination unit 13 transfers the user's access to the warning page (step S230).

  At this time, a warning page shown in FIG. 4 is displayed on the terminal operated by the user. On the warning page, in addition to the warning message, a message 400 for confirming whether or not the user really wants to access the website is displayed, and buttons 410 and 420 for the user to input the determination result are displayed.

  The harmful site determination unit 13 recognizes the determination result of the website by the user according to the operation result of the buttons 410 and 420, and based on the determination result, the website identified by the URI that the user requested access to is determined. It is determined whether or not the site is a harmful site (step S240). If the user selects button 410 (YES in step S240), the user recognizes that the website has been determined to be a harmful site, and harmful site determination unit 13 uses the URI, the information acquired in step S210, Then, the determination result of the user is associated and stored in the black list storage unit 3 (step S250).

  When the user selects the button 420 (NO in step S240), the user recognizes that the website is not a harmful site, and the harmful site determination unit 13 determines that the user has visited the website. Access is permitted (step S260). Then, the harmful site determination unit 13 does not store the URI to be determined in the blacklist storage unit 3, and if the same URI has already been stored in the blacklist storage unit 3, the URI and the associated URI are associated therewith. Is deleted (step S270).

  On the other hand, if it is determined in step S220 that the website is not a harmful site, the harmful site determination unit 13 permits the user to access the website (step S280). Then, the harmful site determination unit 13 performs time-consuming checks (domain information check and other page check other than the top page of the website), and calculates an evaluation value and a total value of each information. (Step S290).

  Subsequently, the harmful site determination unit 21 compares the total value of the evaluation values with a predetermined threshold, and based on the comparison result, whether or not the website identified by the URI that the user requested access to is a harmful site. Is determined (step S300). When it is determined that the website is a harmful site (in the case of YES in step S300), the harmful site determination unit 13 receives a request for access to another page linked from the top page of the web. Then, the user access is transferred to the warning page (step S310). Subsequent steps S320 to S350 are the same as steps S240 to S270, and a description thereof will be omitted.

  If it is determined in step S300 that the website is not a harmful site, the harmful site determination unit 13 permits the user to access the website (step S360). Thereafter, the user can freely access the website.

  Based on the information stored in the blacklist storage unit 3 by the processing shown in FIGS. 2 and 3, the spam mail determination unit 12 of the mail server 1 determines whether or not the received mail is a spam mail. This determination is made based on whether or not a URI that matches the URI stored in the blacklist storage unit 3 is described in the received mail. When a URI that matches the URI stored in the blacklist storage unit 3 is described in the received mail, the spam mail determination unit 12 determines that the received mail is a spam mail.

  In addition, the IP address of the website stored in the blacklist storage unit 3 along with the URI, domain information, website page information (information on the web page title and frequent words), and the website are harmful sites. It is also possible to perform spam determination by a known method using information indicating the result of the user determining whether or not there is.

  As described above, according to the present embodiment, the mail server 1 analyzes the URI character string described in the mail and determines whether or not it is a harmful site. Even if a junk e-mail with “” is received, junk e-mail can be reliably filtered. Further, the proxy server 2 analyzes the character string of the URI for which the user requests access, and determines whether or not the site is a harmful site, thereby improving the accuracy of determining the harmful site and reliably filtering junk mail. be able to.

  Also, based on at least one of the website IP address, website domain information, website page information, and information indicating the result of the user determining whether the website is a harmful site, By determining whether or not the received mail is spam mail, it is possible to improve the spam mail determination accuracy and reliably filter junk mail. In particular, it is possible to correct an erroneous determination by automatic determination by determining whether or not the received mail is spam mail based on information indicating a result of the user determining whether or not the website is a harmful site. it can.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. .

It is a block diagram which shows the structure of the computer system by one Embodiment of this invention. It is a flowchart which shows the procedure of operation | movement of the mail server with which the computer system by one Embodiment of this invention is provided. It is a flowchart which shows the procedure of the operation | movement of the proxy server with which the computer system by one Embodiment of this invention is provided. It is a reference figure showing the warning page displayed in one embodiment of the present invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Mail server, 2 ... Proxy server, 3 ... Black list memory | storage part (memory | storage means), 10 ... Mail receiving part, 11 ... Mail memory | storage part, 12 ... Spam mail determination Part (spam e-mail judging means), 13 ... harmful site judging part (first harmful site judging means), 20 ... web access monitoring part, 21 ... harmful site judging part (second harmful site judging part) means)

Claims (4)

Analyzing a URI (Uniform Resource Identifier) character string described in the received mail and determining whether or not the website identified by the URI is a harmful site;
Storage means for storing the URI determined to be a harmful site by the first harmful site determination means;
A junk e-mail determination unit that determines whether the received mail is a junk mail based on the URI stored by the storage unit;
A computer system comprising: A second harmful site determination means for analyzing a character string of a URI for which a user requests access and determining whether or not the website identified by the URI is a harmful site;
The computer system according to claim 1, wherein the storage unit further stores the URI determined to be a harmful site by the second harmful site determination unit. The first harmful site determination means is further configured based on at least one of an IP address of a website identified by the URI, information on a domain of the website, and information on a page of the website. To determine if is a harmful site,
The storage means further includes at least one of an IP address of the website determined as a harmful site by the first harmful site determination means, information on the domain of the website, and information on a page of the website Remember
The junk mail determination means may further receive the received mail based on at least one of the IP address of the website, the domain information of the website, and the information of the website page stored by the storage means. The computer system according to claim 1, wherein it is determined whether or not it is a spam mail. The second harmful site determination means further includes an IP address of a website identified by the URI, information on the website domain, information on the website page, and whether the website is a harmful site. Determining whether the website is a harmful site based on at least one of the information indicating the result of the user's determination,
The storage means further includes an IP address of the website determined as a harmful site by the first harmful site determination means, information on the website domain, information on the website page, and the website Memorize at least one of the information indicating the result of the user's determination whether or not is a harmful site,
The junk mail determination means further includes the IP address of the website stored in the storage means, the domain information of the website, the information of the page of the website, and whether the website is a harmful site. The computer system according to claim 2, wherein it is determined whether or not the received mail is a junk mail based on at least one of the information indicating the result of the user determining whether or not.

Images