JP2009302823A - E-mail system, e-mail transfer method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce a load of users for spam mail removal. <P>SOLUTION: An e-mail system has: a mail receiving means 11 for receiving e-mail; a determination condition storage means 13 for prestoring spam mail determination conditions with first and second thresholds specified for the determination conditions; a mail determination means 14 for providing a determination value to e-mail corresponding to the determination conditions, and determining it as spam mail if the determination value is equal or more than the first threshold, as non-spam mail if less than the second threshold, or as pending mail if equal or more than the second threshold and less than the first threshold; and a mail transfer means 18 for transferring e-mail to either of a spam mail box 15, personal mail boxes 17A to 17C, or a pending mail box 16 according to the determination result. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an electronic mail system, an electronic mail transfer method, and a program.

  In recent years, with the widespread use of electronic mail, spam mail such as spam mail that is unilaterally transmitted without permission to an unspecified number of users has become a problem.

  For this reason, recently, an e-mail system provided with a mail determination means for determining whether or not an e-mail addressed to a user is a junk mail has become widespread (see, for example, Patent Document 1).

  Here, a conventional electronic mail system will be described with reference to FIG.

  As shown in FIG. 4, in the conventional e-mail system, when an e-mail addressed to the user is received from the network (step S401), it is first determined whether or not the received e-mail is a junk e-mail. (Step S402).

  The e-mail determined to be junk mail by the e-mail determining means is transferred to the junk mail box, and the e-mail determined to be other mail (hereinafter referred to as non-spam mail) is transferred to the user's personal mailbox. (Step S403).

Thereafter, the user connects to the user's personal mailbox using an information processing device such as a mobile phone or a personal computer, and receives an e-mail addressed to the user (step S404).
JP 2003-046578 A

  By the way, in the conventional e-mail system, if the junk mail judgment conditions are tightened, even e-mails that are originally non-spam mails are transferred to the junk mail box, so the junk mail judgment conditions are somewhat relaxed. It was.

  As a result, an email that is originally spam may be mistakenly determined to be non-spam and forwarded to a personal mailbox. In this case, the user has a great deal of effort to deal with spam. There was a problem that it would take.

  SUMMARY OF THE INVENTION An object of the present invention is to provide an electronic mail system, an electronic mail transfer method, and a program that can reduce a burden on a user for spam mail.

The e-mail system of the present invention includes:
Mail receiving means for receiving e-mail;
A determination condition storage means for preliminarily storing a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first An e-mail determination unit that determines that the e-mail is a pending e-mail if it is less than the threshold and greater than or equal to the second threshold;
Mail transfer means for transferring the electronic mail to any one of spam mail storage means, non-spam mail storage means, and pending mail storage means according to the determination result.

The e-mail transfer method of the present invention includes:
An email transfer method by an email system,
A receiving step for receiving e-mail;
A determination condition storage step for preliminarily storing in the determination condition storage means a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first A determination step of determining that the mail is a pending mail if it is less than the threshold and greater than or equal to the second threshold;
A transfer step of transferring the electronic mail to any one of spam mail storage means, non-spam mail storage means, and pending mail storage means according to the determination result.

The program of the present invention
On the computer,
A determination condition storage procedure for preliminarily storing in the determination condition storage means a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the received e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first A determination procedure for determining a pending mail if it is less than a threshold of 1 and greater than or equal to the second threshold;
A transfer procedure for transferring the electronic mail to any one of the spam mail storage means, the non-spam mail storage means, and the pending mail storage means according to the determination result.

  According to the present invention, the determination of electronic mail uses the junk mail determination condition and the first and second threshold values set for the determination condition. Junk mail can be determined in multiple stages.

  Therefore, the possibility of junk mail is very high, and e-mails that are determined to be junk mail or e-mails that are determined to be junk mail or that are determined to be pending mail are not transferred to the storage means for non-spam mail. Therefore, the probability that the user erroneously receives the junk mail is greatly reduced, and the load corresponding to the junk mail can be reduced.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

  In the embodiment described below, the e-mail system is described as being used by three users A to C for the sake of simplicity, but the number of users is not limited.

  As shown in FIG. 1, the electronic mail system 10 of the present embodiment includes a mail receiving unit 11, a black list DB (Data Base) 12, a determination condition DB 13, a mail determination unit 14, a junk mail box 15, The holding mail box 16, personal mail boxes 17 </ b> A to 17 </ b> C, and mail transfer means 18 are provided.

  The mail receiving means 11 receives e-mails addressed to users A to C from a network 40 such as the Internet.

  The blacklist DB 12 stores in advance a blacklist of IP addresses, email addresses and domains of senders that may send spam, and keywords that may be described in the subject and body of spam emails. Black list storage means.

  The determination condition DB 13 is a determination condition storage unit that stores in advance a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold.

  The operation for storing the black list or the like in the black list DB 12 and the operation for storing the determination condition or the like in the determination condition DB 13 are performed by a control unit (not shown).

  The mail determination unit 14 assigns a determination value corresponding to the determination condition of the junk mail stored in the determination condition DB 13 to the electronic mail received by the mail reception unit 11, and the provided determination value is equal to or greater than the first threshold value. If it is less than the second threshold, it is determined to be non-spam mail, and if it is less than the first threshold and greater than or equal to the second threshold, it is determined to be a pending mail.

  The spam mail box 15 is a spam mail storage unit that stores an electronic mail that has been determined to be spam by the mail determination unit 14.

  The hold mail box 16 is a hold mail storage unit that stores an e-mail that is determined to be a hold mail by the mail determination unit 14.

  The junk mail box 14 and the hold mail box 16 are stored in the POP (Post Office Protocol) or SMTP (SMTP), which is a protocol for sending and receiving e-mails, via the network 40 by the information processing device 30 such as an administrator's mobile phone or personal computer. Connection is possible using Simple Mail Transfer Protocol.

  The personal mail boxes 17A to 17C are provided corresponding to the information processing devices 20A to 20C of the users A to C, respectively, and are e-mails addressed to the users A to C determined as non-spam mail by the mail determination means 14 Is a storage means for non-spam mails.

  The personal mailboxes 17A to 17C can be connected to the information processing apparatuses 20A to 20C such as the mobile phones and personal computers of the users A to C through the network 40 using POP and SMTP.

  The mail transfer means 18 sends the e-mail received by the mail receiving means 11 to one of the junk mail box 15, the hold mail box 16, or the personal mail boxes 17A to 17C according to the determination result by the mail determination means 14. Forward to.

  Further, the mail transfer means 18 transfers the e-mail addressed to the users A to C stored in the hold mail box 16 to the corresponding personal mail boxes 17A to 17C according to an instruction from the information processing apparatus 30 by the administrator. Or forwarded to the junk mail box 15.

  Hereinafter, the operation of the electronic mail system of this embodiment will be described.

[Overall operation]
First, the overall operation of the electronic mail system will be described with reference to FIGS.

  As shown in FIGS. 2 and 3, when the mail receiving means 11 receives an e-mail from the network 40 (step S201), the mail determining means 14 first stores the received e-mail in the determination condition DB 13. A determination value according to the determination condition of the spam mail is determined, and if the determination value provided is equal to or greater than the first threshold, it is determined as spam, and if it is less than the second threshold, it is determined as non-spam mail. If it is less than the threshold value of 1 and greater than or equal to the second threshold value, it is determined as a pending mail (step S202).

  Next, the mail transfer unit 18 converts the e-mail received by the mail receiving unit 11 into the junk mail box 15, the hold mailbox 16, or the personal mail according to the determination result determined by the mail determination unit 14. Transfer to one of the boxes 17A to 17C (step S203).

  As a result, there is an effect that the probability that the e-mails transferred to the personal mail boxes 17A to 17C, that is, the e-mails received by the users A to C are included in the spam mails is remarkably reduced.

  The administrator periodically connects to the hold mailbox 16 through the network 40 using the information processing device 30 and checks the hold mail stored in the hold mailbox 16 (step S204). Then, the administrator instructs the mail transfer means 18 to transfer the hold mail from the hold mail box 16 to the personal mail boxes 17A to 17C when there is an e-mail that is not spam in the hold mail. (Step S205). When the administrator determines spam mail as described above, for example, information acquired in advance from users A to C (for example, an email scheduled to be transmitted from a certain sender is not spam mail, etc. Information).

  In response to this, the mail transfer means 18 transfers the hold mail instructed from the information processing apparatus 30 of the manager from the hold mail box 16 to the corresponding personal mail boxes 17A to 17C (step S206).

In this way, since the administrator only needs to check the e-mail after the e-mail having a very high possibility of junk e-mail is excluded, the effect that the number of e-mail checks is significantly reduced can be obtained. .
[Judgment operation]
Next, the determination operation of the mail determination unit 14 will be described with a specific example.

Here, in the determination condition DB 13, the following conditions (1) to (6) are stored in advance as spam mail determination conditions, and the mail determination unit 14 satisfies the conditions (1) to (6). It is assumed that e-mail is determined using a predetermined condition.
(1) The source IP address described in the received e-mail header matches the IP address of the black list DB 12 (2) The source e-mail address described in the received e-mail header is black Match the mail address of the list DB 12 (3) The number of keywords matching the keyword of the black list DB 12 described in the subject and body of the received e-mail (4) Described in the body of the received e-mail Number of URL links (5) A keyword matching the keyword of the blacklist DB 12 is described in the subject and body of the received email (6) Source domain described in the header of the received email Matches the domain of the blacklist DB 12 <Determining operation example 1>
This operation example is an example when one of the above conditions (3) and (4) is used.

  For example, in the case of (3), the determination condition DB 13 stores “5” as the first threshold and “2” as the second threshold.

  First, the mail determination unit 14 reads the subject and text from the e-mail received by the mail receiving unit 11, compares it with the keyword group stored in the blacklist DB 12, and if there is a matching keyword, it is received. The count value provided for each e-mail is incremented by 1 using a counter (not shown).

  After that, when all the comparisons between the subject and body of the received electronic mail and the keyword group are completed, the mail determination unit 14 refers to the count value at that time as the determination value. For example, when the count value is “7”, that is, the first threshold value “5” or more, the received electronic mail is determined to be spam mail, and the count value is “3”, that is, the first threshold value “5”. If it is less than “2” and greater than or equal to the second threshold “2”, it is determined that the received email is a pending email, and if the count value is “1”, that is, less than the second threshold “2”, The received electronic mail is determined as non-spam mail. Note that if the count value exceeds the first threshold before the comparison of the subject and text is completed, the processing may be terminated there.

  As a modified example of this operation example, the first threshold value and the second threshold value may be values representing the number of keywords as a percentage, such as 30% and 5% of all words in the subject and text, respectively. .

  As another modified example of this operation example, the determination condition DB 13 stores “30” as the first threshold and “5” as the second threshold, and the black list DB 12 stores the keyword group. For each keyword, the number of levels (for example, 1 to 5) set for the keyword is added and stored. Then, the mail determination means 14 may add the number of keyword levels that match the keyword group stored in the blacklist DB 12 for the received electronic mail as the count value.

Further, for example, in the case of (4), the mail determination unit 14 does not use the black list DB 12 but simply counts the number of URL links extracted from the text of the received email, and uses the count value as the determination value. And
<Determination operation example 2>
This operation example is an example in which the above two conditions (5) and (6) are used.

  For example, in this case, the determination condition DB 13 stores “2” as the first threshold and “1” as the second threshold.

  The mail determination means 14 reads the subject and text from the email received by the mail receiving means 11, compares them with the keyword group stored in the blacklist DB 12, and if there is a matching keyword, the received electronic The count value provided for each mail is incremented by 1 using a counter (not shown).

  Further, the mail determination unit 14 reads the transmission source domain from the header of the email received by the mail reception unit 11, compares it with the domain group stored in the blacklist DB 12, and if there is a matching domain. The count value provided for each received e-mail is incremented by 1 using a counter (not shown).

Thereafter, the mail determination unit 14 refers to the count value as a determination value. For example, when the count value is “2”, that is, the first threshold value “2” or more, the received electronic mail is regarded as spam mail. If the count value is “1”, that is, less than the first threshold “2” and greater than or equal to the second threshold “1”, the received e-mail is determined to be a pending mail, and the count value is “ If it is 0 ”, that is, less than the second threshold value“ 1 ”, the received electronic mail is determined as non-spam mail.
<Judgment operation example 3>
This operation example is an example in which one or more of the above conditions (1), (2), (5), and (6) are used.

  For example, in this case, the determination condition DB 13 stores “5” as the first threshold value and “3” as the second threshold value. Further, for each condition, the number of levels of the condition (for example, “1” "To" 5 ") are added and stored. Regarding the conditions (1) and (2), if the condition is satisfied, it can be determined as a spam mail. Therefore, the number of levels is preferably set to “5”. Then, the mail determination unit 14 adds the number of levels satisfying the condition of the received electronic mail as the count value, and sets the value as the determination value.

  As described above, in the present embodiment, the junk mail determination condition and the first and second threshold values set for the determination condition are used for the determination of the e-mail. It can be determined in multiple stages as mail or non-spam mail.

  Therefore, the possibility of junk mail is very high, and the e-mail determined to be junk mail or the e-mail determined to be the junk mail due to the junk mail is not transferred to the personal mailboxes 17A to 17C. .

  Therefore, the user A to C has an effect that the probability of receiving the spam mail by mistake is remarkably reduced, and the load corresponding to the spam mail can be reduced.

  In addition, since the email to be checked by the administrator is only the pending email stored in the pending mailbox 16, the administrator can only send the email after the email that is highly likely to be spam is excluded. Check it out.

  This eliminates the need for the administrator to check e-mails that have a very high probability of spam, and the number of e-mail checks is greatly reduced, and the e-mail can be managed efficiently. It is done.

  Note that the electronic mail system 10 may be realized by a single device, or each component in the electronic mail system 10 is an independent device, and is realized by the plurality of devices. It may be a thing.

  The determination operation performed by the mail determination unit 14 and the storage operation in the black list DB 12 and the determination condition DB 13 may be applied to a program for causing a computer to execute. In addition, the program can be stored in a storage medium and can be provided to the outside via a network.

It is a block diagram which shows the structure of the electronic mail system of one Embodiment of this invention. It is a flowchart explaining the whole operation | movement of the electronic mail system shown in FIG. It is a figure explaining the whole operation | movement of the electronic mail system shown in FIG. It is a figure explaining the whole operation | movement of the conventional electronic mail system.

Explanation of symbols

11 Mail Receiving Means 12 Black List DB
13 Judgment condition DB
14 Mail determination means 15 Junk mail box 16 Hold mailbox 17A-17C Personal mailbox 18 Mail transfer means 20A-20C Information processing apparatus (users A-C)
30 Information processing device (administrator)

Claims (20)

Mail receiving means for receiving e-mail;
A determination condition storage means for preliminarily storing a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first An e-mail determination unit that determines that the e-mail is a pending e-mail if it is less than the threshold and greater than or equal to the second threshold;
An e-mail system comprising: a mail transfer unit that transfers the e-mail to any one of a junk mail storage unit, a non-spam mail storage unit, and a reserved mail storage unit according to the determination result. The mail transfer means is
2. The electronic mail system according to claim 1, wherein the electronic mail stored in the storage means for holding mail is transferred to the storage means for non-spam mail from an external instruction. A black list storing means for storing in advance a black list of keywords described in the subject and body of the e-mail;
The determination condition storage means includes
As the determination condition, a condition is described that is based on the number of keywords that match the keyword of the blacklist storage means described in the subject and body of the email,
The mail determination means
3. The electronic mail system according to claim 1, wherein a value corresponding to the number of keywords matching the keyword of the black list storage unit described in the subject and body of the electronic mail is used as the determination value. A black list storage means for storing in advance a black list of keywords described in the subject and body of the e-mail and the number of levels set for each of the keywords;
The determination condition storage means includes
As the determination condition, a condition is described that is based on the number of keywords that match the keyword of the blacklist storage means described in the subject and body of the email,
The mail determination means is
The electronic mail system according to claim 1 or 2, wherein a value obtained by adding the number of keyword levels that match the keyword of the blacklist storage means described in the subject and body of the electronic mail is used as the determination value. The determination condition storage means includes
As the determination condition, a condition that the number of URL links described in the body of the email is used as a reference is stored,
The mail determination means
The electronic mail system according to claim 1 or 2, wherein a value corresponding to a quantity of URL links described in a body of the electronic mail is used as the determination value. A black list storage means for storing in advance a keyword described in the subject and body of the email, and a black list of a domain from which the email is sent;
The determination condition storage means includes
As the determination condition,
A first condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the e-mail;
Storing a second condition that a source domain of the email matches a domain of the blacklist storage means;
The e-mail system according to claim 1, wherein the e-mail determination unit uses the number of conditions satisfied by the e-mail among the first and second conditions as the determination value. A black list storage means for previously storing a keyword described in the subject and body of the e-mail, an IP address of the e-mail sender, a mail address, and a black list of domains;
The determination condition storage means includes
As the determination condition,
A first condition that a source IP address of the e-mail matches an IP address of the blacklist storage unit;
A second condition that a source mail address of the e-mail matches a mail address of the blacklist storage means;
A third condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the email;
Storing a fourth condition that a source domain of the email matches a domain of the blacklist storage means;
Storing the number of levels set for each of the first to fourth conditions;
The mail determination means
The value obtained by adding the number of levels of the condition satisfied by the e-mail among the one or more predetermined conditions among the first to fourth conditions is set as the determination value. The e-mail system described. An email transfer method by an email system,
A receiving step for receiving e-mail;
A determination condition storage step for preliminarily storing in the determination condition storage means a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first A determination step of determining that the mail is a pending mail if it is less than the threshold and greater than or equal to the second threshold;
A transfer step of transferring the electronic mail to any one of a spam mail storage means, a non-spam mail storage means, and a reserved mail storage means according to the determination result.   9. The e-mail transfer method according to claim 8, further comprising a re-forwarding step of transferring the e-mail stored in the hold mail storage means to the non-spam mail storage means from an external instruction. A blacklist storage step of storing in advance in the blacklist storage means a blacklist of keywords described in the subject and body of the email;
In the determination condition storing step,
As the determination condition, the determination condition storage means stores a condition described in the subject and body of the e-mail and based on the number of keywords that match the keyword of the blacklist storage means,
In the determination step,
10. The e-mail transfer method according to claim 8 or 9, wherein a value corresponding to the number of keywords matching the keyword of the black list storage means described in the subject and body of the e-mail is used as the determination value. A blacklist storing step of storing in advance in a blacklist storage means a blacklist of keywords described in the subject and body of the e-mail and the number of levels set for each keyword;
In the determination condition storing step,
As the determination condition, the determination condition storage means stores a condition described in the subject and body of the e-mail and based on the number of keywords that match the keyword of the blacklist storage means,
In the determination step,
10. The e-mail transfer method according to claim 8 or 9, wherein a value obtained by adding the number of keyword levels that match the keyword of the blacklist storage means described in the subject and body of the e-mail is used as the determination value. . In the determination condition storing step,
As the determination condition, a condition that the number of URL links described in the body of the email is used as a reference is stored in the determination condition storage unit;
In the determination step,
The e-mail transfer method according to claim 8 or 9, wherein a value corresponding to a quantity of URL links described in a body of the e-mail is used as the determination value. A blacklist storage step of storing in advance in the blacklist storage means a keyword described in the subject and body of the email and a blacklist of a domain from which the email is sent;
In the determination condition storing step,
As the determination condition,
A first condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the e-mail;
Storing the second condition that the source domain of the e-mail matches the domain of the blacklist storage means in the determination condition storage means;
In the determination step,
10. The e-mail transfer method according to claim 8, wherein a number of conditions satisfied by the e-mail among the first and second conditions is set as the determination value. 11. A blacklist storing step of storing in advance in the blacklist storage means a keyword described in the subject and body of the email, an IP address of the sender of the email, a mail address, and a blacklist of domains;
In the determination condition storing step,
As the determination condition,
A first condition that a source IP address of the e-mail matches an IP address of the blacklist storage unit;
A second condition that a source mail address of the e-mail matches a mail address of the blacklist storage means;
A third condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the email;
Storing the fourth condition that the source domain of the e-mail matches the domain of the blacklist storage means in the determination condition storage means;
Storing the number of levels set for each of the first to fourth conditions in the determination condition storage means;
In the determination step,
The value obtained by adding the number of levels of the condition satisfied by the e-mail among one or more predetermined conditions among the first to fourth conditions is set as the determination value. The email transfer method described. On the computer,
A determination condition storage procedure for preliminarily storing in the determination condition storage means a determination condition for spam mail, together with a first threshold set for the determination condition and a second threshold smaller than the first threshold;
A determination value corresponding to the determination condition is assigned to the received e-mail, and if the determination value is equal to or greater than the first threshold, it is spam, if it is less than the second threshold, non-spam mail, the first A determination procedure for determining a pending mail if it is less than a threshold of 1 and greater than or equal to the second threshold;
A program for executing a transfer procedure for transferring the electronic mail to any one of a spam mail storage unit, a non-spam mail storage unit, and a hold mail storage unit according to the determination result. In the computer,
Further executing a blacklist storage procedure for storing in advance a blacklist of keywords described in the subject and body of the email in a blacklist storage means;
In the determination condition storing procedure,
As the determination condition, the determination condition storage means stores a condition described in the subject and body of the e-mail and based on the number of keywords that match the keyword of the blacklist storage means,
In the determination procedure,
The program according to claim 15, wherein a value corresponding to the number of keywords matching the keyword of the blacklist storage means described in the subject and body of the electronic mail is used as the determination value. In the computer,
Further executing a blacklist storage procedure for storing in advance in the blacklist storage means the blacklist of keywords described in the subject and body of the e-mail, and the number of levels set for each of the keywords,
In the determination condition storing procedure,
As the determination condition, the determination condition storage means stores a condition described in the subject and body of the e-mail and based on the number of keywords that match the keyword of the blacklist storage means,
In the determination procedure,
The program according to claim 15, wherein a value obtained by adding the number of keyword levels that match the keyword of the blacklist storage unit described in the subject and body of the electronic mail is used as the determination value. In the determination condition storing procedure,
As the determination condition, a condition that the number of URL links described in the body of the email is used as a reference is stored in the determination condition storage unit;
In the determination procedure,
The program according to claim 15, wherein a value corresponding to a quantity of URL links described in a body of the electronic mail is set as the determination value. In the computer,
Further executing a blacklist storing procedure for storing in advance in the blacklist storage means the keywords described in the subject and body of the email, and the blacklist of the domain from which the email was sent,
In the determination condition storing procedure,
As the determination condition,
A first condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the e-mail;
Storing the second condition that the source domain of the e-mail matches the domain of the blacklist storage means in the determination condition storage means;
In the determination procedure,
The program according to claim 15, wherein the determination value is the number of conditions that the electronic mail satisfies among the first and second conditions. In the computer,
Further executing a blacklist storage procedure for storing in advance in the blacklist storage means a blacklist of the keywords described in the subject and body of the email, the IP address of the sender of the email, the email address, and the domain;
In the determination condition storing procedure,
As the determination condition,
A first condition that a source IP address of the e-mail matches an IP address of the blacklist storage unit;
A second condition that a source mail address of the e-mail matches a mail address of the blacklist storage means;
A third condition that a keyword that matches the keyword of the blacklist storage means is described in the subject and body of the email;
Storing the fourth condition that the source domain of the e-mail matches the domain of the blacklist storage means in the determination condition storage means;
Storing the number of levels set for each of the first to fourth conditions in the determination condition storage means;
In the determination procedure,
The value obtained by adding the number of levels of the condition satisfied by the e-mail among one or more predetermined conditions among the first to fourth conditions is set as the determination value. program.

Images