JP2008278507A - Messaging virus countermeasure program or the like - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a messaging virus countermeasure program or the like effective for a new type virus, transmission source assumed type virus and unspecific file attached type virus. <P>SOLUTION: A computer is caused to execute the steps of: judging whether to perform processing under a warning mode based on information, input to the computer, about whether to be cautious about a new type virus of which features are not predetermined; judging the risk of infection with the virus due to received electronic information based on predetermined conditions in the case that it is judged that processing is to be performed under the warning mode, not distributing but storing the received electronic information in the case that it is judged that there is the risk of infection with the virus, and distributing the received electronic information in the case that it is judged that there is no risk of infection with the virus; and processing the received electronic information based on features of the known messaging virus of which the features are predetermined, in the case that it is judged that processing is not to be performed under the warning mode. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a messaging virus countermeasure program or the like for taking measures against a messaging virus transmitted along with movement of electronic information, mainly e-mail, and in particular, a new virus, a virus that spoofs a sender, and The present invention relates to a messaging virus countermeasure program and the like effective for a virus that attaches and transmits an arbitrary file.

In recent years, infections due to viruses (hereinafter referred to as messaging viruses) transmitted along with movement of electronic information such as electronic mails are increasing. In order to suppress the damage caused by the messaging virus, a system for inspecting e-mail for viruses has been proposed. In this conventional system, in general, the contents of a file attached to an e-mail are inspected before the e-mail reaches the destination, and if it matches a pre-defined virus characteristic, the virus is deleted. The treatment is executed (for example, see Patent Document 1 below). Normally, when a virus is detected, a message indicating that the virus has been detected is sent to the sender of the electronic mail. Patent Document 2 below proposes a countermeasure against a virus that transmits a virus of the same type to a mail address registered in the mail address book of an infected client.
JP 2002-368820 A JP 2002-223256 A

  However, in the above conventional measures, in order to detect and remove the virus, it is necessary to grasp the characteristics of the virus in advance and to define it in the system. I can't. Therefore, in order to prevent damage from the new virus, there was no effective measure other than stopping mail delivery. This measure has a large impact on business, especially in companies, and is not preferable.

  In addition, if the virus is a sender spoofing virus that spoofs the sender email address, when the virus is detected as described above, if the virus detection message is notified to the sender, the email is actually sent. The message is sent to the sender who has not transmitted the message, that is, the sender who is not infected with the virus, and the message transmission is useless and annoying the other party.

  In addition, when a virus is an unspecified file attachment type virus that sends an e-mail with one or more arbitrary files in the computer attached together with the virus, the e-mail containing the virus usually Viruses are detected with a normal file attached, not a virus. In such a case, in the conventional system described above, usually, only the detected virus part is deleted and a subsequent e-mail is transmitted. However, in this case, the normal file attached by the virus is transmitted. Information will be leaked. This is a problem because, for example, unintended information is transmitted to the outside from within the company.

  Further, the notification message indicating that a virus has been detected, which is transmitted from the above-described conventional system, generally has a uniform content, and is desired to have a content suitable for the transmission partner.

  An object of the present invention is a messaging virus countermeasure program for taking action against a messaging virus, and provides a messaging virus countermeasure program and the like effective for a new virus, a sender spoofing virus, and an unspecified file attachment virus. It is to be.

  In order to achieve the above object, according to one aspect of the present invention, a messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted in association with distribution of electronic information on a network is input to the computer. A step of determining whether or not to perform processing in the alert mode based on information on whether or not to alert a new type of messaging virus whose characteristics are not predetermined, and when it is determined to perform the processing in the alert mode In addition, based on a predetermined condition, it is determined whether or not there is a risk of virus infection by the received electronic information. If it is determined that there is a risk of virus infection, the received electronic information is stored without being distributed. If it is determined that there is no risk of virus infection, the step of distributing the received electronic information and the warning A process of processing the received electronic information based on the characteristics of a known messaging virus whose characteristics are predetermined when it is determined that the processing is not performed in the mode. . Therefore, according to the present invention, when a new type of messaging virus appears, it is not necessary to cancel all mail distribution, and the influence of the mail cancellation can be reduced.

  Furthermore, in the above invention, a preferable aspect thereof is that the electronic information is distributed by electronic mail, and the predetermined condition for determining whether there is a risk of virus infection is attached to the received electronic mail. It is characterized by including at least one of a condition whether or not there is a file or a condition that whether or not the text of the received e-mail contains information that causes the computer to execute a predetermined operation. Thereby, highly accurate virus infection determination can be performed.

  Furthermore, in the above invention, a preferred aspect is that the information for causing the computer to execute a predetermined operation includes at least one of HTML code, script code, or binary data of a text program. Features.

  In order to achieve the above object, another aspect of the present invention provides a messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted along with the distribution of electronic information on a network. When the electronic information is received, the messaging virus associated with the received electronic information is a source spoofing virus that spoofs the transmission source of the electronic information associated with the messaging virus based on characteristics of a predetermined messaging virus. Determining whether or not the received messaging virus is a source spoofed virus, a virus detection notification message for notifying that a virus has been detected is transmitted to the received electronic information. Message sent and received If the ring virus is determined to be the source spoofing viruses is to execute a process that does not transmit the virus detection notification message to the computer. Therefore, according to the present invention, it is possible to prevent sending a message to a place that is not actually infected with a virus and causing trouble to the other party.

  In order to achieve the above object, another aspect of the present invention provides a messaging virus that causes a computer to take action against a messaging virus transmitted with electronic information distributed between a predetermined network and another network. When the countermeasure program receives the electronic information accompanied by the messaging virus, the messaging virus associated with the received electronic information determines the transmission source of the electronic information associated with the messaging virus based on the characteristics of the messaging virus determined in advance. A step of determining whether or not a spoofing source spoofing virus is detected, and a virus detection notification message for notifying that a virus has been detected when it is determined that the received messaging virus is not a transmission source spoofing virus Sending the received electronic information And when determining that the received messaging virus is a transmission source spoofing virus, determining whether the received electronic information is transmitted from the predetermined network; When it is determined that the received electronic information is transmitted from the predetermined network, the virus detection notification message is transmitted, and the received electronic information is not transmitted from the predetermined network. If it is determined, the computer is caused to execute a step of not transmitting the virus detection notification message.

  In order to achieve the above object, another aspect of the present invention provides a messaging virus handling program for causing a computer to execute a countermeasure against a messaging virus transmitted along with distribution of electronic information on a network. An unspecified file in which a messaging virus associated with the received electronic information attaches and transmits an arbitrary file in the computer based on a predetermined characteristic of the messaging virus when receiving electronic information accompanied by A step of determining whether or not the virus is an attachment-type virus, and if it is determined that the received messaging virus is not an unspecified file attachment-type virus, the received electronic information is transmitted to a destination, and the received messaging Virus is an unspecified file attachment type If it is determined that the scan is to be executed and a step of not transmitting the received electronic information to the computer. Therefore, according to the present invention, it is possible to prevent information leakage due to an unspecified file attachment type virus.

  Furthermore, in order to achieve the above object, another aspect of the present invention is to cause a computer to take action against a messaging virus transmitted along with electronic information distributed between a predetermined network and another network. When the messaging virus countermeasure program receives the electronic information accompanied by the messaging virus, the messaging virus associated with the received electronic information attaches any file in the computer based on the characteristics of the predetermined messaging virus. Determining whether the virus is an unspecified file attachment type virus that is transmitted, and if it is determined that the received messaging virus is not an unspecified file attachment type virus, the received electronic information is transmitted. Send to the received messaging window If it is determined that the virus is an unspecified file attachment virus, the step of determining whether or not the received electronic information is transmitted from the predetermined network; and When it is determined that the electronic information is not transmitted from a predetermined network, the received electronic information is transmitted, and when it is determined that the received electronic information is transmitted from the predetermined network And causing the computer to execute a step of not transmitting the received electronic information. Thereby, information leakage from a predetermined network can be prevented.

  In order to achieve the above object, still another aspect of the present invention provides a messaging that causes a computer to take action against a messaging virus transmitted along with electronic information distributed between a predetermined network and another network. When the virus countermeasure program receives electronic information accompanied by the messaging virus, the step of determining whether or not the received electronic information is transmitted from the predetermined network; and the received electronic information When it is determined that the message is transmitted from the predetermined network, a message prepared for the predetermined network is transmitted, and the received electronic information is not transmitted from the predetermined network. If it is determined, a message previously prepared for the other network is used. It is to perform the step of transmitting a di to the computer. As a result, it is possible to notify the contents suitable for the destination of the message, and it is effective in removing the messaging virus and preventing infection.

  Furthermore, in the above invention, a preferred aspect thereof is characterized in that the predetermined network is a network provided in a predetermined company.

  In order to achieve the above object, another aspect of the present invention is characterized in that a messaging virus countermeasure system for executing a measure against a messaging virus transmitted along with distribution of electronic information on a network is characterized in advance. A warning mode based on information on whether or not to warn a new messaging virus whose characteristics are not determined in advance, which is input to the messaging virus handling system; In the case where it is determined whether or not to perform processing in the alert mode, it is determined whether there is a risk of virus infection by the received electronic information based on a predetermined condition, and the virus infection If it is determined that the received electronic information is stored, the received electronic information is stored without being distributed, and Based on the characteristics of the known messaging virus stored in the storage means when it is determined that the received electronic information is distributed and processing is not performed in the alert mode. And virus countermeasure means for processing the received electronic information.

  In order to achieve the above object, according to still another aspect of the present invention, there is provided a messaging virus countermeasure method in a computer system for dealing with a messaging virus transmitted along with distribution of electronic information on a network. Determining whether to perform processing in the alert mode based on information regarding whether or not to alert a new type of messaging virus whose characteristics are not predetermined, which is input to the computer, and the computer system includes: When it is determined that processing is performed in the alert mode, based on a predetermined condition, it is determined whether there is a risk of virus infection by the received electronic information, and when it is determined that there is a risk of virus infection, Store the received electronic information without distributing it and determine that there is no risk of the virus infection. In the case where the received electronic information is distributed, and when the computer system determines not to perform the processing in the alert mode, the characteristics are determined based on the characteristics of the known messaging virus. And a process for processing the received electronic information.

  Further objects and features of the present invention will become apparent from the best mode for carrying out the invention described below.

  FIG. 1 is a configuration diagram according to an embodiment of a messaging virus countermeasure system to which the present invention is applied. A messaging virus countermeasure system 1 shown in FIG. 1 is a system using the messaging virus countermeasure program according to the present invention, and is distributed between the corporate network 2 and an external network (Internet 3) as shown in FIG. This is a system for treating various viruses transmitted together with the e-mail 6 or the like. Such a messaging virus handling system 1 has a warning mode against new viruses, and has a special countermeasure against a sender spoofed virus and an unspecified file attachment type virus, and is more effective and safer than conventional systems. It is intended to do.

  The corporate network 2 in FIG. 1 is a network such as a LAN (Local Area Network) arranged in the enterprise, and is connected to client terminals (4a, 4b,...) Used by each employee. The client terminals (4a, 4b,...) Are configured by a personal computer or the like, have a transmission / reception function for the email 6, and serve as a transmission source and transmission destination of the email 6 to be processed by the messaging virus countermeasure system 1. The corporate network 2 and client terminals (4a, 4b,...) Are the main protection targets of the messaging virus countermeasure system 1. In this embodiment, the corporate network and client terminals are used. A network in an organization other than a company and a client terminal connected thereto may be used. Further, the messaging exchange method used may be a means other than mail, such as file transfer or data download from the Web.

  Next, the Internet 3 in FIG. 1 is connected to the corporate network 2 and also to a plurality of client terminals (5a, 5b,...). The client terminals (5a, 5b,...) Are also configured by a personal computer or the like, and have a function for transmitting / receiving e-mail 6. The client terminals (4a, 4b,. I do. In the present embodiment, the Internet 3 is used. However, the Internet 3 may not be used as long as it is an external network of the company that transmits and receives electronic mail 6 to and from the corporate network 2.

  Next, the messaging virus countermeasure system 1 is a computer system provided between the corporate network 2 and the Internet 3, and the client terminals (4a, 4b,...) And the client terminals (5a, 5b,...) The e-mail 6 is sent and received via the system. As shown in FIG. 1, the messaging virus handling system 1 includes virus handling means 10 and storage means 20.

  The virus handling means 10 is a part that receives an electronic mail 6 distributed between the corporate network 2 and the Internet 3 and executes predetermined processing for various viruses associated therewith. Although specific processing contents will be described later, the virus countermeasure 10 is a main part of the present invention. The virus countermeasure unit 10 includes a computer program that instructs processing contents, a memory that reads the computer program, a control device that executes processing according to the computer program, and the like.

  As shown in FIG. 1, the storage unit 20 is a part that stores a pattern definition file 21 and a setting file 22, and is configured by a hard disk or the like provided in a computer system that constitutes the messaging virus handling system 1. The pattern definition file 21 is a file that defines the characteristics (patterns) of each known virus, and is used for processing when the virus countermeasure 10 described above detects a virus. The setting file 22 is a file that sets what kind of treatment is to be performed for each virus, and is read into the memory of the virus handling unit 10 when the virus handling unit 10 receives the e-mail 6. The virus handling unit 10 executes processing based on the contents described in the setting file 22. Note that by changing the description of the setting file 22, it is possible to change the processing for each virus in the virus handling unit 10 without changing the program of the virus handling unit 10. Therefore, it can be said that the messaging virus handling system 1 is a so-called easily customized system.

  FIG. 2 is a flowchart illustrating the processing performed by the virus countermeasure 10 of the messaging virus countermeasure system 1 according to this embodiment. Hereinafter, the contents of the processing performed in the messaging virus handling system 1 will be described with reference to FIG. First, the virus countermeasure 10 receives an email 6 transmitted from the corporate network 2 to the Internet 3 or from the Internet 3 to the corporate network 2 before the email 6 reaches the destination (FIG. 2). Step S1). The transmission source and the transmission destination of the e-mail 6 are connected to the client terminals (4a, 4b,...) In the company, the client terminals (5a, 5b,...) Outside the company, or the corporate network 2 and the Internet 3. A server system (not shown).

  Next, the virus countermeasure unit 10 reads the setting file 22 described above from the storage unit 20 into the memory (step S2 in FIG. 2). Thereafter, the virus handling unit 10 acquires information about the received electronic mail 6 and temporarily stores the information in a memory (step S3 in FIG. 2). The information acquired and held is information included in the header of the e-mail 6, information about the mail text, and information about the attached file. Specifically, processing procedures such as the sender of the e-mail 6, presence / absence of an attached file, HTML (Hypertext Markup Language), Java Script (Java is a registered trademark of Sun Microsystems, USA) Information about the presence / absence of binary data, such as written script code and executable file of a program encoded in text.

  Next, the virus countermeasure unit 10 determines whether or not it is a new virus alert mode (step S4 in FIG. 2). The new virus alert mode is a mode in which when a new virus not defined in the pattern definition file 21 appears, the virus is warned. It is determined by the administrator of the system 1 and the result is input to the messaging virus handling system 1. Based on this input information, the virus countermeasure 10 determines whether or not the new virus alert mode is in effect.

When information indicating that the new virus warning mode is set is input and the virus countermeasure 10 determines that the new virus warning mode is selected (Yes in step S4 in FIG. 2), the received e-mail 6 It is determined whether there is a risk of being infected with a virus at the transmission destination (step S5 in FIG. 2). Specifically, according to the description of the read setting file 22, the determination is made based on the following conditions.
(1) The received e-mail 6 has an attached file.
(2) There is an HTML code in the body (in the text data) of the received email 6.
(3) There is a script code in the body (in the text data) of the received e-mail 6.
(4) There is binary data of the program converted into text in the body (in the text data) of the received electronic mail 6.

  More specifically, as an example, if any one of the above conditions (1) to (4) is satisfied, it is determined that there is a risk of the virus infection. This is employed when the level of vigilance is the highest and there is not much information about new viruses. Normally, viruses are distributed using attached files, HTML codes in the mail text, etc., so the above conditions are set.

  Moreover, you may make it use only one or more conditions, without using all the conditions of said (1)-(4). For example, using only the condition (1), if there is an attached file, it may be determined that there is a risk of the virus infection, and if there is no attached file, it may be determined that there is no risk of the virus infection. . This is adopted when it is known that a new type of virus is distributed as an attached file. As described above, when new information is obtained to some extent, it is preferable to set conditions according to the information. The condition setting for this determination can be performed by the setting file 22.

  The conditions (2) to (4) include what is called a program in the mail body (in the text data), in other words, information that causes a computer to execute a predetermined operation. However, these are merely examples, and other conditions may be set to determine whether or not such a program is included.

  Further, in the determination of virus infection described above, the information acquired and held in step S3 of FIG. 2 described above is used. The determination of whether or not there is HTML code, script code, and binary data of the textized program in the body (text data) of the received e-mail 6 is, for example, an HTML tag. It is performed from the viewpoint of whether or not there is anything that is not included, what is in the programming language is not included, or characters that do not form a body as sentences are included.

  When it is determined that there is no risk of virus infection as a result of the above-described determination of the risk of virus infection (No in step S5 in FIG. 2), the virus countermeasure 10 transmits the e-mail 6 to the destination. (Step S6 in FIG. 2). On the other hand, if it is determined that there is a risk of virus infection (Yes in step S5 in FIG. 2), the electronic mail 6 is not transmitted and temporarily stored in the messaging virus countermeasure system 1 (in FIG. 2). Step S7). For example, it is stored in the storage means 20. Then, after the characteristics of the new virus being wary are grasped and the contents are defined (set) in the pattern definition file 21, the stored e-mail 6 is taken out and shown in FIG. The process from step S8 is executed. That is, processing such as virus removal is executed.

  As described above, the messaging virus handling system 1 has a warning mode when a new type of virus whose characteristics are not yet known appears, and passes only the e-mail 6 that is clearly free of the risk of virus infection. This is one major feature of the messaging virus countermeasure system 1. When a new virus appears, it is possible to minimize the influence of mail distribution while ensuring safety. In addition, when a certain amount of information about the new virus is obtained, the number of e-mails 6 to be passed can be further increased, and the effect is increased.

  On the other hand, returning to FIG. 2, if the information to enter the new virus warning mode has not been input and the virus handling means 10 determines that it is not in the new virus warning mode (No in step S4 in FIG. 2). ) Virus detection processing is performed on the electronic mail 6 (step S8 in FIG. 2). Specifically, in this processing, the attachment file and body characteristics of the e-mail 6 are compared with the characteristics (patterns) of each virus defined in the pattern definition file 21 described above. Determine whether or not.

  As a result of this determination, if the characteristics of the received e-mail 6 do not match or are not similar to the characteristics of all the viruses defined in the pattern definition file 21, the virus countermeasure 10 determines that no virus is detected. Then (No in step S9 in FIG. 2), the electronic mail 6 is transmitted to the destination (step S12 in FIG. 2). On the other hand, when the characteristics of the received e-mail 6 match or are similar to the characteristics of any virus defined in the pattern definition file 21, the virus countermeasure 10 determines that a virus has been detected ( In step S9 in FIG. 2, the virus deletion process is performed (step S10 in FIG. 2). In this processing, the virus handling unit 10 deletes the virus part of the electronic mail 6 and removes the virus. For example, if the virus is an attached file of the e-mail 6, the attached file is removed.

  Thereafter, the virus handling unit 10 performs an action on the electronic mail 6 in which the virus is detected based on the specifications of the electronic mail 6 (step S11 in FIG. 2). This step is one of the features of the messaging virus handling system 1, and based on the setting of the setting file 22 described above, each action appropriate for each received email 6 and virus is executed. Although specific processing contents in this step will be described later, more effective anti-virus measures suitable for each virus can be taken by the processing that does not exist in the conventional system, and the above-described problems can be solved.

  After the above process is completed, the virus handling unit 10 transmits the electronic mail 6 to the transmission destination and ends the process (step S12 in FIG. 2). However, depending on the processing content of step S11 of FIG. 2, the e-mail 6 may not be transmitted.

  Next, the specific content of the treatment (step S11 in FIG. 2) based on the specifications of the electronic mail 6 described above will be described. FIG. 3 is a flowchart showing one mode (first mode) of the process. In this example, the virus detected in the received e-mail 6 is a sender spoofing virus that spoofs a sender mail address.

  After the virus deleting process (step S10), the virus handling unit 10 determines whether or not the detected virus is a source spoofed virus (step S21 in FIG. 3). This determination is based on the recognized virus type since the virus type is grasped at the time when the virus is detected by collating with the pattern definition file 21 in the virus detection process (step S8 in FIG. 2). Done.

  As a result, if the detected virus is a transmission source spoofed virus (Yes in step S21 in FIG. 3), the processed electronic data is not transmitted without transmitting the virus detection notification message indicating that the virus has been detected. The mail 6 is transmitted to the transmission destination (step S12). On the other hand, if the detected virus is not a transmission source spoofed virus (No in step S21 in FIG. 3), the virus detection notification message is transmitted to the infected person (step S22 in FIG. 3). In this case, normally, the notification message is transmitted to the transmission source. Thereafter, the processed e-mail 6 is transmitted to the transmission destination (step S12).

  FIG. 4 is a description example of the setting file 22 for the treatment (step S11) based on the specifications of the electronic mail 6 in this aspect. “W32.KKK.H@mm” in the figure is an example of a sender spoofing virus, and the description on the second line in FIG. 4 indicates that “W32.KKK.H@mm” is detected. This means that no virus detection notification message is sent. The virus handling unit 10 refers to the portion of the setting file 22 read into the memory, and executes the processes of steps S21 and S22 in FIG.

  As described above, in this aspect, when the detected virus is a transmission source spoofing virus, the virus detection notification message is not transmitted. Therefore, it is possible to prevent the virus detection notification message from being transmitted to the transmission source that has not actually transmitted the virus and causing trouble to the other party. In addition, useless message transmission can be omitted. On the other hand, when it is not a sender spoof-type virus, a virus detection notification message is transmitted to the infected person, which is effective in removing the virus and preventing further infection.

  Next, FIG. 5 is a flowchart showing a second mode of the treatment based on the specifications of the electronic mail 6 (step S11 in FIG. 2). This example is also a case where the detected virus is a transmission source spoofing virus.

  After the virus deletion process (step S10), the virus handling unit 10 determines whether or not the detected virus is a source spoofed virus, as in the case of the first aspect described above (FIG. 5). Step S31). As a result, if the detected virus is not a transmission source spoofed virus (No in step S31 in FIG. 5), a virus detection notification message is transmitted to the infected person as in the first mode (FIG. 5). Step S32). Then, the processed electronic mail 6 is transmitted to the transmission destination (step S12).

  On the other hand, when the detected virus is a transmission source spoofing virus (Yes in step S31 in FIG. 5), it is determined whether or not the received e-mail 6 is from an in-company domain (FIG. 5). 5 step S33). That is, it is determined whether or not the email 6 is from the corporate network 2. This determination is performed by checking whether or not the domain of the source mail address of the received electronic mail 6 is an in-company domain of a company that is protected by the messaging virus countermeasure system 1.

  As a result of the determination, if the domain of the source mail address is an in-house domain (Yes in step S33 in FIG. 5), a virus detection notification message is transmitted (step S32 in FIG. 5). Such a message may be transmitted to the transmission source of the e-mail 6 or to a plurality of predetermined locations such as all client terminals (4a, 4b,...) Connected to the corporate network 2. You may do it. Similarly, after the message is transmitted, the processed electronic mail 6 is transmitted to the destination (step S12).

  On the other hand, as a result of the determination, if the domain of the transmission source mail address is not an in-company domain (No in step S33 in FIG. 5), the processed electronic mail 6 is not transmitted to the transmission destination without transmitting the virus detection notification message. The transmission is performed (step S12).

  FIG. 6 is a description example of the setting file 22 for the treatment (step S11) based on the specifications of the electronic mail 6 in the second mode. “W32.KKK.H@mm” in the figure shows an example of a source spoofing virus as in FIG. 4, and “abc.com” shows an in-company domain of the company name abc. “Msg.KKK.H.abc” is a file name in which a virus detection notification message for “W32.KKK.H@mm” transmitted to the company is stored.

  The description on the third line in FIG. 6 indicates that the virus detection notification message is not transmitted when “W32.KKK.H@mm” is detected and the domain of the source mail address is other than “abc.com”. I mean. Further, in the description on the fourth line in FIG. 6, when “W32.KKK.H@mm” is detected and the domain of the source mail address is “abc.com”, “msg.KKK.H. This means that the message stored in “abc” is transmitted. The virus handling unit 10 refers to the portion of the setting file 22 and executes the processes from steps S31 to S33 in FIG.

  As described above, in this aspect, when the detected virus is a transmission source spoofing virus, if the email 6 is from within the company, a virus detection notification message is transmitted, and the email 6 If is not from within the company, no virus detection notification message is sent. Accordingly, it is possible to prevent the other party from being inconvenienced by sending a virus detection notification message to a transmission source that has not actually transmitted the virus. In addition, since a virus detection notification message is sent to an employee who understands the processing in the messaging virus countermeasure system 1 for the company, there is little inconvenience to the destination of the message. , It can be notified that there is a source spoofing virus in the company. Furthermore, by setting the message to be transmitted to be related to the virus for the company, it is possible to quickly inform the defense and the removal method against the virus, and it is possible to ensure safety in the company network 2.

  Next, FIG. 7 is a flowchart showing a third mode of the treatment based on the specifications of the electronic mail 6 (step S11 in FIG. 2). In this example, the detected virus is an unspecified file attachment type virus in which one or more arbitrary files in the computer are attached together with the virus and an electronic mail is transmitted.

  After the virus deletion process (step S10), the virus handling unit 10 transmits a virus detection notification message informing the infected person that a virus has been detected (step S41 in FIG. 7). Thereafter, it is determined whether or not the detected virus is an unspecified file attachment type virus (step S42 in FIG. 7). Such a determination is made based on the type of virus ascertained by the above-described virus detection process (step S8 in FIG. 2).

  As a result of the determination, if the detected virus is an unspecified file attachment type virus (Yes in step S42 in FIG. 7), it is determined whether or not the received e-mail 6 is from a corporate domain. Determination is made (step S43 in FIG. 7). This determination is the same as in the case of the second aspect described above. As a result, if the received e-mail 6 is from the in-company domain (Yes in step S43 in FIG. 7), the received e-mail 6 is discarded (step S44 in FIG. 7), and the e-mail is sent. The process is terminated without transmitting 6.

  On the other hand, if the e-mail 6 is not from the corporate domain (No in step S43 in FIG. 7), the e-mail 6 is transmitted to the destination (step S12). When it is determined in step S42 in FIG. 7 that the detected virus is not an unspecified file attachment type virus (No in step S42 in FIG. 7), the electronic mail 6 is transmitted to the destination. (Step S12).

  FIG. 8 is a description example of the setting file 22 for the procedure (step S11) based on the specifications of the electronic mail 6 in the third mode. “W32.SSS.Worm@mm” in the figure is an example of an unspecified file attachment type virus, and “abc.com” indicates an in-company domain of the company name abc. The description on the third line in FIG. 8 means that if “W32.SSS.Worm@mm” is detected and the domain of the source mail address is “abc.com”, the mail is discarded. ing. The virus handling unit 10 refers to the portion of the setting file 22 read into the memory, and executes the processes of steps S42 to S44 in FIG.

  As described above, in this aspect, when the detected virus is an unspecified file attachment type virus, if the e-mail 6 is from within the company, the e-mail 6 is discarded and the e-mail 6 If is not from within the company, e-mail 6 is sent. Therefore, the client terminal (4a, 4b,...) In the company is infected with an unspecified file attachment type virus, and an arbitrary file in the client terminal that is not intended for the e-mail 6 transmitted from the client terminal. Even if the message is attached, the e-mail 6 including the attached file is discarded in the messaging virus countermeasure system 1, so that leakage of information from within the company can be prevented.

  In the above example based on FIG. 7, even if the detected virus is an unspecified file attachment type virus, if it is not the e-mail 6 from the company, the e-mail 6 is passed but detected. If the virus is an unspecified file attachment type virus, the electronic mail 6 may be discarded regardless of the transmission source of the electronic mail 6. That is, in the flowchart of FIG. 7, in the case of Yes in step S42, the process may proceed to step S44 without passing through step S43. In this case, information leakage from each network that distributes the electronic mail 6 via the messaging virus countermeasure system 1 can be prevented.

  Next, FIG. 9 is a flowchart showing a fourth mode of the treatment based on the specifications of the electronic mail 6 (step S11 in FIG. 2). In this example, the content of the virus detection notification message when a virus is detected is to be changed depending on the transmission destination.

  After the virus deleting process (step S10), the virus handling unit 10 determines whether or not the received electronic mail 6 is from an in-company domain (step S51 in FIG. 9). This determination is the same as in the case of the second aspect described above. As a result, if the received e-mail 6 is from the in-company domain (Yes in step S51 in FIG. 9), a virus detection notification message for the in-company infected person is transmitted to the infected person (FIG. 9). Step S52). On the other hand, if the received e-mail 6 is not from an in-company domain (No in step S51 in FIG. 9), a virus detection notification message for an out-of-company infected person is transmitted to the infected person (in FIG. 9). Step S53). In either case, the e-mail 6 is then transmitted (step S12).

  FIG. 10 is a description example of the setting file 22 for the action (step S11) based on the specifications of the electronic mail 6 in the fourth mode. “Abc.com” in the figure indicates an in-company domain of the company name abc. “Msg.abc” is a file that stores a virus detection notification message for an in-company infected person, and “msg.notabc” is a file that stores a virus detection notification message for an out-of-company infected person. The description on the second line in FIG. 10 means that if a virus is detected and the domain of the transmission source mail address is “abc.com”, the message stored in “msg.abc” is transmitted. is doing. Similarly, in the description on the third line in FIG. 10, when a virus is detected and the domain of the sender mail address is other than “abc.com”, the message stored in “msg.notabc” is transmitted. It means that. The virus handling unit 10 refers to the portion of the setting file 22 read into the memory, and executes the processes of steps S51 to S53 of FIG. 9 described above.

  As described above, in this aspect, when a virus is detected, if the email 6 is from within the company, a message for the company is transmitted, while the email 6 is sent from within the company. If it is not, send an external message. As a result, as compared with the case where a uniform message is transmitted as in the prior art, it becomes possible to provide appropriate information in accordance with the destination of the message, and the safety against the messaging virus can be further improved.

  As mentioned above, although the some example was demonstrated about the treatment (step S11) based on the item of the email 6, this messaging virus countermeasure system 1 is set so that only the process in one of these aspects may be performed. However, it is usually set so that a plurality of processes shown in these modes can be executed, and an appropriate one is selected from these processes based on the specifications of the received email 6 And run. Of these plural processes, for which both cannot be established, for example, it is necessary to set which process is adopted for the process in the first mode and the process in the second mode. There is.

  As described above, in the messaging virus countermeasure system 1 according to the present embodiment, it is possible to take more effective countermeasures than the conventional system against new viruses, sender spoofed viruses, unspecified file attached viruses, and the like. it can. In the present embodiment, the so-called mail virus associated with the delivery of the e-mail 6 has been described. However, the virus to be processed by the messaging virus handling system 1 is not limited to a mail virus, but a file via a network. This is a messaging virus in general transmitted along with the movement of electronic information, such as a virus transmitted along with the transfer of e-mail.

  The protection scope of the present invention is not limited to the above-described embodiments, but covers the invention described in the claims and equivalents thereof.

  The present invention can be used to take a measure against a messaging virus transmitted along with movement of electronic information, mainly electronic mail. In particular, it is not necessary to interrupt all mail distribution when a new type of messaging virus appears, and the influence of the mail interruption can be reduced. In addition, when a sender spoofed virus is received, useless and annoying notification messages can be omitted. Further, when an unspecified file attachment type virus is received, information leakage can be prevented.

1 is a configuration diagram according to an embodiment of a messaging virus countermeasure system to which the present invention is applied. FIG. It is the flowchart which illustrated the process which the virus countermeasure means 10 of the messaging virus countermeasure system 1 concerning this embodiment performs. It is the flowchart which showed the one aspect | mode of the process based on the item of an email. It is the figure which showed the example of description of the setting file 22 about the process (step S11 of FIG. 3) based on the item of the email 6 in this aspect. It is the flowchart which showed the 2nd aspect of the treatment (step S11 of FIG. 2) based on the item of the email 6. FIG. It is the figure which showed the example of a description of the setting file 22 about the process (step S11) based on the item of the email 6 in a 2nd aspect. It is the flowchart which showed the 3rd aspect of the process (step S11 of FIG. 2) based on the item of the email 6. FIG. It is the figure which showed the example of a description of the setting file 22 about the process (step S11) based on the item of the email 6 in a 3rd aspect. It is the flowchart which showed the 4th aspect of the treatment (step S11 of FIG. 2) based on the item of the email 6. FIG. It is the figure which showed the example of a description of the setting file 22 about the process (step S11) based on the item of the email 6 in a 4th aspect.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Messaging virus countermeasure system, 2 Corporate network, 3 Internet, 4a, 4b Client terminal, 5a, 5b Client terminal, 6 E-mail, 10 Virus countermeasure means, 20 Storage means, 21 Pattern definition file, 22 Setting file

Claims (17)

A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted along with the distribution of electronic information on a network,
Determining whether or not to perform processing in the alert mode based on information on whether or not to alert a new messaging virus whose characteristics are not predetermined, input to the computer;
When it is determined that processing is performed in the alert mode, based on a predetermined condition, it is determined whether there is a risk of virus infection by the received electronic information, and when it is determined that there is a risk of virus infection, If the received electronic information is stored without being distributed and it is determined that there is no risk of the virus infection, the step of distributing the received electronic information;
Causing the computer to execute a process for processing the received electronic information based on the characteristic of a known messaging virus whose characteristic is predetermined when it is determined that the process is not performed in the alert mode. Messaging virus handling program characterized by. In claim 1,
The electronic information distribution is an electronic mail distribution;
The predetermined condition for determining whether there is a risk of virus infection is whether the received e-mail has an attached file, or a predetermined operation is executed on the computer in the body of the received e-mail A messaging virus countermeasure program characterized by including at least one of the conditions of whether or not information to be included is included. In claim 2,
The messaging virus countermeasure program characterized in that the information for causing the computer to execute a predetermined operation includes at least one of HTML code, script code, or binary data of a text-formatted program. A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted along with the distribution of electronic information on a network,
When the electronic information accompanied by the messaging virus is received, the messaging virus accompanying the received electronic information spoofs the transmission source of the electronic information accompanied by the messaging virus based on the characteristics of the predetermined messaging virus. Determining whether it is a spoofed virus;
If it is determined that the received messaging virus is not a sender spoofed virus, a virus detection notification message notifying that a virus has been detected is transmitted to the sender of the received electronic information, and the received messaging A messaging virus countermeasure program that causes the computer to execute a step of not transmitting the virus detection notification message when it is determined that the virus is a sender spoofing virus. A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted with electronic information distributed between a predetermined network and another network,
When the electronic information accompanied by the messaging virus is received, the messaging virus accompanying the received electronic information spoofs the transmission source of the electronic information accompanied by the messaging virus based on the characteristics of the predetermined messaging virus. Determining whether it is a spoofed virus;
If it is determined that the received messaging virus is not a sender spoofed virus, a virus detection notification message notifying that a virus has been detected is transmitted to the sender of the received electronic information, and the received messaging If it is determined that the virus is a source spoofed virus, the step of determining whether or not the received electronic information is transmitted from the predetermined network;
When it is determined that the received electronic information is transmitted from the predetermined network, the virus detection notification message is transmitted, and the received electronic information is not transmitted from the predetermined network. A message anti-virus program for causing the computer to execute a step of not transmitting the virus detection notification message. A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted along with the distribution of electronic information on a network,
When the electronic information accompanied with the messaging virus is received, the messaging virus associated with the received electronic information attaches and transmits an arbitrary file in the computer based on a predetermined characteristic of the messaging virus. Determining whether it is an unspecified file attachment type virus;
When it is determined that the received messaging virus is not an unspecified file attachment type virus, the received electronic information is transmitted to a transmission destination, and the received messaging virus is determined to be an unspecified file attachment type virus. A messaging virus countermeasure program that causes the computer to execute a step of not transmitting the received electronic information. A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted with electronic information distributed between a predetermined network and another network,
When the electronic information accompanied with the messaging virus is received, the messaging virus associated with the received electronic information attaches and transmits an arbitrary file in the computer based on a predetermined characteristic of the messaging virus. Determining whether it is an unspecified file attachment type virus;
When it is determined that the received messaging virus is not an unspecified file attachment type virus, the received electronic information is transmitted to a transmission destination, and the received messaging virus is determined to be an unspecified file attachment type virus. Determining whether or not the received electronic information is transmitted from the predetermined network; and
When it is determined that the received electronic information is not transmitted from the predetermined network, the received electronic information is transmitted, and the received electronic information is transmitted from the predetermined network. If it is determined, the messaging virus countermeasure program causing the computer to execute a step of not transmitting the received electronic information. A messaging virus countermeasure program for causing a computer to take action against a messaging virus transmitted with electronic information distributed between a predetermined network and another network,
Determining whether or not the received electronic information is transmitted from the predetermined network when receiving the electronic information accompanied by the messaging virus;
When it is determined that the received electronic information is transmitted from the predetermined network, a message prepared in advance for the predetermined network is transmitted, and the received electronic information is transmitted from the predetermined network. A messaging virus countermeasure program characterized by causing the computer to execute a step of transmitting a message prepared in advance for the other network when it is determined that the message has not been transmitted. In any one of claims 5, 7 or 8,
The messaging virus countermeasure program, wherein the predetermined network is a network provided in a predetermined company. A messaging anti-virus system for performing a countermeasure against a messaging virus transmitted along with the distribution of electronic information on a network,
Storage means for storing information on the characteristics of known messaging viruses whose characteristics are predetermined;
Based on the information on whether or not to alert a new type of messaging virus whose characteristics are not defined in advance, which is input to the messaging virus handling system, determine whether or not to perform processing in the alert mode,
When it is determined that processing is performed in the alert mode, based on a predetermined condition, it is determined whether there is a risk of virus infection by the received electronic information, and when it is determined that there is a risk of virus infection, If the received electronic information is stored without distribution and it is determined that there is no risk of virus infection, the received electronic information is distributed,
A virus coping unit that performs processing on the received electronic information based on the characteristics of the known messaging virus stored in the storage unit when it is determined that the process is not performed in the alert mode. Messaging virus handling system. A messaging anti-virus system for performing a countermeasure against a messaging virus transmitted along with the distribution of electronic information on a network,
Storage means for storing information of the characteristics of the messaging virus whose characteristics are predetermined;
When the electronic information accompanying the messaging virus is received, the messaging virus accompanying the received electronic information spoofs the transmission source of the electronic information accompanying the messaging virus based on the characteristics of the messaging virus stored in the storage means. To determine if it is a source spoofing virus
If it is determined that the received messaging virus is not a sender spoofed virus, a virus detection notification message notifying that a virus has been detected is transmitted to the sender of the received electronic information, and the received messaging A messaging virus countermeasure system comprising: a virus countermeasure unit that does not transmit the virus detection notification message when it is determined that the virus is a transmission source spoofing virus. A messaging anti-virus system for performing a countermeasure against a messaging virus transmitted along with the distribution of electronic information on a network,
Storage means for storing information of the characteristics of the messaging virus whose characteristics are predetermined;
When electronic information accompanied by the messaging virus is received, the messaging virus associated with the received electronic information is transmitted with any file in the computer attached, based on the characteristics of the messaging virus stored in the storage means. To determine whether it is an unspecified file attachment virus
When it is determined that the received messaging virus is not an unspecified file attachment type virus, the received electronic information is transmitted to a transmission destination, and the received messaging virus is determined to be an unspecified file attachment type virus. And a virus countermeasure unit that does not transmit the received electronic information. A messaging anti-virus system for performing an action against a messaging virus transmitted along with electronic information distributed between a predetermined network and another network,
Determining whether the received electronic information is transmitted from the predetermined network when receiving the electronic information accompanied by the messaging virus;
When it is determined that the received electronic information is transmitted from the predetermined network, a message prepared in advance for the predetermined network is transmitted, and the received electronic information is transmitted from the predetermined network. If it is determined that the message has not been transmitted, a message prepared in advance for the other network is transmitted. A messaging virus countermeasure method in a computer system for dealing with a messaging virus transmitted along with distribution of electronic information on a network,
Determining whether or not to perform processing in the alert mode based on information on whether or not the computer system is alerted to a new messaging virus whose characteristics are not determined in advance, which is input to the computer;
When the computer system determines that the processing is performed in the alert mode, it determines whether there is a risk of virus infection by the received electronic information based on a predetermined condition, and determines that there is a risk of the virus infection If it is, store the received electronic information without delivery, and if it is determined that there is no risk of virus infection, delivering the received electronic information;
A step of processing the received electronic information based on the characteristic of a known messaging virus whose characteristic is predetermined when the computer system determines not to perform the process in the alert mode. A messaging virus countermeasure method characterized by the above. A messaging virus countermeasure method in a computer system for dealing with a messaging virus transmitted along with distribution of electronic information on a network,
When the computer system receives the electronic information accompanied by the messaging virus, the messaging virus associated with the received electronic information is based on a predetermined characteristic of the messaging virus. Determining whether or not the source is a spoofing source virus,
If the computer system determines that the received messaging virus is not a sender spoofing virus, it sends a virus detection notification message notifying that a virus has been detected to the sender of the received electronic information. And a step of not transmitting the virus detection notification message when it is determined that the received messaging virus is a transmission source spoofing virus. A messaging virus countermeasure method in a computer system for dealing with a messaging virus transmitted along with distribution of electronic information on a network,
When the computer system receives electronic information accompanied by the messaging virus, the messaging virus associated with the received electronic information attaches an arbitrary file in the computer based on a predetermined characteristic of the messaging virus. Determining whether the virus is an unspecified file attachment type virus that is transmitted
When the computer system determines that the received messaging virus is not an unspecified file attachment type virus, the computer system transmits the received electronic information to a destination, and the received messaging virus is an unspecified file attachment type virus. A messaging virus handling method, comprising: a step of not transmitting the received electronic information when it is determined that the received electronic information is present. A messaging virus countermeasure method in a computer system for taking action against a messaging virus transmitted along with electronic information distributed between a predetermined network and another network,
Determining whether or not the received electronic information is transmitted from the predetermined network when the computer system receives the electronic information accompanied by the messaging virus;
When the computer system determines that the received electronic information is transmitted from the predetermined network, the computer system transmits a message prepared in advance for the predetermined network, and the received electronic information is A message virus handling method, comprising: a step of transmitting a message prepared in advance for the other network when it is determined that the message is not transmitted from the predetermined network.

Images