JP2011227850A - E-mail classification device, e-mail management server, e-mail classification method and e-mail classification program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an e-mail classification device, an e-mail management server, an e-mail classification method and an e-mail classification program which can reduce processing load for removing spam mail and reduce operation load of a user.SOLUTION: An e-mail classification device comprises: a mail receiving part 11 which receives e-mail; a feature vector acquisition part 12 which acquires a feature vector which shows feature of the e-mail based on data which shows ratio of junk mail in the e-mails received in the past and classified based on items of header information of the received e-mail; a rule creation part 14 which creates a classification rule for classifying e-mail with classification information whether an e-mail is a normal mail or not and a corresponding feature vector as learning data; and a classification part 13 which refers to the feature vector acquired from the e-mail and classifies whether the e-mail is a normal mail or a junk mail based on the classification rule when receiving a new e-mail.

Description

  The present invention relates to an e-mail classification device, an e-mail classification method, and an e-mail classification program for determining whether a received electronic mail is a junk mail or a normal mail.

  In recent years, with the development of networks, it has become possible to easily send and receive e-mail (hereinafter simply referred to as mail), and the number of junk mail (spam mail) that the recipient does not need has also increased. ing. Here, “spam mail” means mail that is sent indiscriminately and in large quantities without ignoring the recipient's intention and without prior request or consent.

  Such spam emails include virus infections due to attachments, etc., decreased productivity and efficiency of recipients due to an increase in unnecessary emails, increased load on servers and networks due to increased traffic, and fraudulent sites In terms of leakage of personal information and confidential information due to guidance, etc., it can be a threat regardless of individuals or organizations.

  Therefore, various measures are taken to eliminate such spam mail. For example, there is a filter for mail that reaches a mail account of a PC (Personal Computer). This filter performs sorting based on sender information (email address, host information, etc.) and syntax analysis of the mail text (see, for example, Non-Patent Document 1 and Non-Patent Document 2).

  By the way, when such a filter is applied to a portable terminal such as a portable telephone that is less powerful than a PC, the processing load is large, and thus it is not suitable for practical use. In the case of a mobile terminal, spam mail is often transmitted using an email address leaked from a specific site, and the sender of spam mail for one individual is limited. Therefore, a method for setting filter rules is employed in a server that manages transmission and reception of mail (for example, a server of a company (carrier) that provides a mobile phone communication service) (for example, Non-Patent Document 3). reference). Furthermore, a carrier of a communication service may receive a junk mail report from a user and update a filter rule (see, for example, Non-Patent Document 4).

  However, in setting the filter rule, it is necessary to register the domain of the mail address that the user wants to refuse to receive, so the operation becomes complicated. In addition, when the sender's e-mail address is forged or sent using a large number of servers, the effect is small. Furthermore, when a condition such as “reject mail from other than a mobile phone” or “reject mail including a URL” is set, normal mail corresponding to this reject rule cannot be received.

  Moreover, when reporting a junk mail report to a carrier, it is limited to a report mail from the mobile phone of the carrier concerned, and further, there is a problem in convenience because an operation by the user is required.

  Therefore, the present inventors have proposed an e-mail classification method for reducing the processing load for eliminating spam mail and reducing the operation load on the user (Japanese Patent Application No. 2009-242287). .

SpamAssassin, [October 7, 2009], Internet <http: // www. svn. apache. org / repos / asf / spamassin / branches / 3.2 / README> TransWare, [October 7, 2009], Internet <http: // www. transware. co. jp / product / ah / filter. html> “Reception / rejection setting”, [October 7, 2009], Internet <http: // www. nttdocomo. co. jp / info / spam_mail / measure / domain /> “If you have received junk mail”, [October 7, 2009], Internet <http: // www. nttdocomo. co. jp / info / spam_mail / if / index01. html>

  However, in order to efficiently eliminate spam mails, it is desirable to further reduce the processing load and the user's operation load.

  The present invention provides an e-mail classification device, an e-mail management server, an e-mail classification method, and an e-mail classification program that can reduce a processing load for eliminating spam mail and reduce a user's operation load. Objective.

  The present invention provides the following solutions.

  (1) A receiving unit that receives an e-mail, an acquisition unit that acquires a feature vector indicating characteristics of the e-mail based on header information of the e-mail received by the receiving unit, and the e-mail is normal In order to classify whether an e-mail is a normal mail or a junk mail using the classification information and the corresponding feature vector as learning data when classification information indicating whether the mail is spam or spam is received A creation unit that creates a classification rule, and the classification rule created by the creation unit with reference to a feature vector acquired by the acquisition unit from the email when a new email is received by the receiving unit A classifying unit that classifies whether the electronic mail is a normal mail or a junk mail based on the header information. Data indicating the ratio of junk e-mail out of previously received e-mails with the same classification based on any of the items of sender name, sender e-mail address, reply e-mail address or subject included in An e-mail classification device that acquires the feature vector based on at least one of data indicating whether or not any of the items has received the same e-mail in the past.

  According to such a configuration, the e-mail classification device defines a feature quantity based on statistical information based on an item of mail header information, acquires a feature vector having this feature quantity as an element, and obtains the classification information and the feature vector. Create classification rules as learning data. As a result, the electronic mail classification device can classify whether the mail is a normal mail or a spam mail according to each feature vector acquired from the mail.

  Therefore, the e-mail classification device represents the rule of header information peculiar to spam mail as a feature vector, and determines spam mail without analyzing the mail body. Can be reduced. Furthermore, since the e-mail classification device automatically classifies mail, the operation load on the user can be reduced.

  (2) The acquisition unit, as the feature vector, (a) data indicating a ratio of junk mail among previously received e-mails having the same top-level domain of the sender's mail address, (b) (C) data indicating the ratio of junk e-mail among previously received e-mails having the same top-level domain of the reply e-mail address, and (c) at least part of the account part of the sender's e-mail address is the same Data indicating the ratio of junk e-mail among e-mails received in the past, (d) Of e-mails received in the past where at least a part of the account part of the reply-to e-mail address is the same, (E) data received in the past in which the character string length of the account part in the sender's email address is of the same classification Data indicating the ratio of junk mail in mail, (f) Data indicating the ratio of junk mail among e-mails received in the past in which the character string length of the host part in the sender's mail address is of the same classification (G) data indicating the ratio of spam among previously received e-mails whose domain hierarchy depth in the host part in the sender's e-mail address is of the same classification, (h) the reply e-mail address (1) Data indicating the ratio of junk mail among previously received e-mails in which the character string length of the account part is of the same classification, (i) the character string length of the host part in the reply mail address is of the same classification Data indicating the ratio of junk e-mail among e-mails received in the past, (j) the same domain layer depth in the host part in the reply mail address (K) data indicating the ratio of junk e-mail among the previously received e-mails, and (k) the ratio of junk e-mails among e-mails received in the past whose character string length of the sender's name is of the same classification. (L) data indicating the ratio of junk e-mail out of e-mails received in the past whose character string length of the subject is the same classification, (m) e-mails having the same sender name in the past (N) data indicating whether or not an e-mail having the same sender's mail address has been received in the past, and (o) an electronic having the same return mail address. The feature vector including at least one of data indicating whether a mail has been received in the past and (p) data indicating whether an email having the same subject has been received in the past is taken. The electronic mail classification device according to (1) to be obtained.

  According to such a configuration, the electronic mail classification device acquires a feature vector including 16 types of data that is statistical information based on the sender's name, the sender's mail address, the reply destination mail address, and the subject. In other words, the e-mail classification device can extract the characteristics of spam mail in the mobile terminal by generating classification rules by learning statistical information of mail received in the past without analyzing the mail text. Thereby, the electronic mail classification device can automatically determine spam mail with high accuracy while reducing the processing load.

  (3) The creation unit determines a variable value indicating the possibility that the e-mail from which the feature vector is acquired is a spam mail corresponding to each of the feature vectors, and the variable is used as the classification rule. The electronic mail classification apparatus according to (1) or (2), wherein a threshold value for classifying values into those corresponding to normal mail and those corresponding to spam mail is set.

  According to such a configuration, the electronic mail classification device determines a variable value indicating the possibility of being spam mail for each feature vector, and sets a threshold value for classifying the variable value. Therefore, the electronic mail classification device can easily classify normal mail and spam mail by obtaining a variable value by acquiring a feature vector of the received mail and comparing it with a threshold value.

(4) The creation unit sets a first threshold value for classifying the variable value into one corresponding to normal mail, and a second threshold value for classifying the variable value into one corresponding to spam mail,
The said classification | category part is an electronic mail classification apparatus as described in (3) which classifies the newly received electronic mail into a normal mail, a junk mail, and another hold mail.

  According to such a configuration, the electronic mail classification device individually sets the first threshold for determining normal mail and the second threshold for determining spam mail. Therefore, the electronic mail classification device can determine each of the mails that are likely to be normal mails or spam mails, and can classify the others as reserved mails to suppress erroneous classification.

  (5) For the email classified by the classification unit, the creation unit adjusts the variable value or the threshold corresponding to the email when receiving an input to change the classification result ( The electronic mail classification device according to 3) or (4).

  According to such a configuration, when the automatic classification result is changed by the user, the e-mail classification device can adjust the variable value or threshold value for each feature vector and adjust the learning result of the classification rule. . Therefore, the e-mail classification device can re-learn by change input and improve the classification accuracy.

  (6) The e-mail classification apparatus according to any one of (3) to (5), wherein the creation unit accepts the classification information to which weighting according to the variable value is added as the learning data.

  According to such a configuration, the e-mail classification device can weight the learning data according to the variable value indicating the possibility of being spam mail. Improvement can be expected.

  (7) The e-mail classification device according to any one of (1) to (6), wherein the creation unit re-creates the classification rule at a predetermined opportunity.

  According to such a configuration, the e-mail classification device re-creates the classification rule at a predetermined timing, for example, at a certain period or when the processing load is reduced. Therefore, the electronic mail classification device can update the classification rule using new mail as learning data.

  (8) The creation unit creates the classification rule based on an email received by the receiving unit during a predetermined period until now, and does not refer to an email received before the predetermined period (1) To the electronic mail classification device according to any one of (7).

  According to such a configuration, the e-mail classification device learns based on the mails received during a predetermined period until now, so that old mails received before this time are excluded, and classification rules are determined based on new information. Can be created. Therefore, the electronic mail classification device can create a highly accurate classification rule reflecting the characteristics of recent spam mail.

  (9) The electronic device according to any one of (1) to (8), further including a notification unit that notifies information on an electronic mail classified as spam by the classification unit to a server that manages reception of the electronic mail. Mail classification device.

  According to such a configuration, the e-mail classification device notifies the mail information classified as spam mail to a server that manages the reception of the mail (for example, a server of a carrier that provides a mobile phone communication service). To do. Therefore, the e-mail classification device can automatically report the spam mail information to the server and update the filter rule in the server.

  (10) An e-mail management server that is connected to a terminal and manages e-mail addressed to the terminal, the receiving unit receiving the e-mail, and header information of the e-mail received by the receiving unit Transfer to the terminal, and in response to a request from the terminal, based on header information of the email received by the transfer unit that forwards the body of the email to the terminal and the reception unit, When receiving an acquisition unit that acquires a feature vector indicating a feature of an email and classification information indicating whether the email is a normal email or a junk email, the classification information and the corresponding feature vector are learned data A creating unit for creating a classification rule for classifying whether an email is normal mail or spam mail, and a pre-created by the creating unit A transmission unit that transmits a classification rule to the terminal at a predetermined timing, and the acquisition unit includes a sender name, a sender email address, a reply destination email address, or a subject included in the header information. Data indicating the ratio of junk mail among previously received e-mails having the same classification based on any item, and data indicating whether any of the items has received the same e-mail in the past An e-mail management server that acquires the feature vector based on at least one of them.

  According to such a configuration, the e-mail management server defines a feature quantity based on statistical information based on an item of mail header information, acquires a feature vector having this feature quantity as an element, and obtains classification information and a feature vector. Create classification rules as learning data. As a result, the terminal that is the destination of the e-mail can classify whether it is a normal mail or a spam mail according to each feature vector acquired from the mail.

  Therefore, the e-mail management server represents the rule of header information peculiar to spam mail as a feature vector, and the terminal determines spam mail without analyzing the mail text. Processing load can be reduced. Furthermore, since the terminal automatically classifies the mail, the operation load on the user can be reduced.

  (11) The creation unit accepts the classification information that the e-mail is a normal mail when the text of the e-mail is transferred to the terminal in a predetermined period after the e-mail is received. The electronic mail management server according to (10), wherein when the body of the electronic mail is not transferred to the terminal, the classification information indicating that the electronic mail is junk mail is received.

  According to such a configuration, the e-mail management server can learn the classification rule using the classification information indicating whether the terminal has downloaded the mail text. Thereby, the accuracy of the classification rule can be improved by using the judgment by the user of the terminal as teacher data.

  (12) A receiving step of receiving an e-mail, an acquisition step of acquiring a feature vector indicating the feature of the e-mail based on header information of the e-mail received in the receiving step, and the e-mail is normal In order to classify whether an e-mail is a normal mail or a junk mail using the classification information and the corresponding feature vector as learning data when classification information indicating whether the mail is spam or spam is received A creation step for creating a classification rule, and a reference to a feature vector acquired in the acquisition step from the email when a new email is received in the reception step, and the classification rule created in the creation step To determine whether the email is normal or spam A similar classification step is executed by the computer, and in the acquisition step, the classification based on any item of the sender name, the sender email address, the reply destination email address, or the subject included in the header information is the same The feature based on at least one of the data indicating the ratio of junk mail among the e-mails received in the past and the data indicating whether or not any of the items has received the same e-mail in the past Email classification method to get vector.

  According to such a configuration, the same effect as in (1) can be expected when the computer executes the e-mail classification method.

  (13) A reception step of receiving an email, an acquisition step of acquiring a feature vector indicating the feature of the email based on header information of the email received in the reception step, and the email is normal In order to classify whether an e-mail is a normal mail or a junk mail using the classification information and the corresponding feature vector as learning data when classification information indicating whether the mail is spam or spam is received A creation step for creating a classification rule, and a reference to a feature vector acquired in the acquisition step from the email when a new email is received in the reception step, and the classification rule created in the creation step To determine whether the email is normal or spam And the same classification step based on any of the items of sender name, sender email address, reply email address, or subject included in the header information in the acquisition step. The feature based on at least one of the data indicating the ratio of junk mail among the e-mails received in the past and the data indicating whether or not any of the items has received the same e-mail in the past E-mail classification program to get vectors.

  According to such a configuration, the same effect as in (1) can be expected by causing the computer to execute the e-mail classification program.

  According to the present invention, it is possible to reduce a processing load for eliminating spam mail and reduce a user's operation load.

It is a figure which shows the function structure of the portable terminal which concerns on 1st Embodiment. It is a figure which shows the 1st example of the classification rule which concerns on 1st Embodiment. It is a figure which shows the 2nd example of the classification rule which concerns on 1st Embodiment. It is a flowchart which shows the flow of the process accompanying the mail reception which concerns on 1st Embodiment. It is a flowchart which shows the flow of the process which produces the classification rule which concerns on 1st Embodiment. It is a figure which shows the function structure of the management server which concerns on 2nd Embodiment.

<First Embodiment>
Hereinafter, a first embodiment, which is an example of an embodiment of the present invention, will be described. In the mobile terminal 1 (e-mail classification device) according to the present embodiment, in a series of processes for sending and receiving mail, in a state in which header information is received, that is, in a state before receiving a text, mail is spam (hereinafter, referred to as spam mail). It is a device that determines whether it is spam mail. The mobile terminal 1 is a terminal compatible with a predetermined carrier wireless communication service, such as a mobile phone or a PHS.

FIG. 1 is a diagram illustrating a functional configuration of the mobile terminal 1 according to the present embodiment.
The mobile terminal 1 includes a control unit 10, a storage unit 20, a communication unit 30, an input unit 40, and a display unit 50.

  The control unit 10 is a part that controls the entire mobile terminal 1, and appropriately reads and executes various programs stored in the storage unit 20, thereby cooperating with the above-described hardware and various functions in the present embodiment. Is realized. The control unit 10 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 10 is provided is mentioned later.

  The storage unit 20 stores various programs for causing the hardware group to function as the mobile terminal 1, programs for causing the control unit 10 to execute various functions of the present embodiment, various databases, and the like. Various databases included in the storage unit 20 will be described later.

  The communication unit 30 communicates with an external device (for example, a server that manages transmission / reception of mail via a base station) in a predetermined frequency band (for example, 2 GHz band, 800 MHz band, etc.). The communication unit 30 demodulates the signal received from the antenna, supplies the processed signal to the control unit 10, modulates the signal supplied from the control unit 10, and transmits the signal from the antenna to the external device. To do.

  The input unit 40 is an interface device that receives an instruction input from the user to the mobile terminal 1. The input unit 40 is configured by, for example, a key operation unit or a touch panel.

  The display unit 50 displays a screen for accepting data input to the user, or displays a screen of a processing result by the mobile terminal 1. The user confirms the received mail on the screen displayed on the display unit 50. The display unit 50 may be a liquid crystal display or an organic EL display.

  The control unit 10 includes a mail reception unit 11 (reception unit), a feature vector acquisition unit 12 (acquisition unit), a classification unit 13, a rule creation unit 14 (creation unit), a data registration unit 15, a notification Unit 16. The storage unit 20 includes a rule DB (database) 21 and a mail DB 22.

  The mail receiving unit 11 receives mail addressed to the mail address of the user of the mobile terminal 1 via the communication unit 30.

  The feature vector acquisition unit 12 acquires a feature vector indicating the feature of the mail based on the mail header information received by the mail reception unit 11. The header information includes the sender's name, the sender's email address, the reply destination email address, and the subject. The feature vector acquisition unit 12 stores the data indicating the ratio of spam mails among the mails received in the past that have the same classification based on any item included in the header information, and the mails that have the same item in the past. A feature vector is acquired based on at least one of the data indicating whether or not it has been received. Specifically, the feature vector is a vector having at least one of the following 16 types of data (a) to (p) as an element.

  (A) Data indicating the ratio of spam mails among mails received in the past in which the sender's mail address has the same top-level domain.

  For example, when the top-level domain of the sender's email address matches the email received in the past, this element indicates “0 indicating the proportion of emails with the same top-level domain that have been determined as spam email in the past. ”To“ 1 ”.

  Note that if the number of emails matching the top level domain is less than a predetermined ratio (p1%), the element value is defined as a fixed value (for example, “0”). Thereby, it can suppress that a classification rule changes greatly with the classification | category result with respect to the sender's mail with low appearance frequency, and classification accuracy falls.

  (B) Data indicating the ratio of spam mails among mails received in the past in which the top level domain of the reply mail address is the same.

  This element is, for example, “0” indicating the proportion of mail that has been received in the past and the top-level domain of the reply mail address that has been determined to be spam mail in the past among the mail that matches the top-level domain. This is real value data of “1”.

  Note that if the number of emails matching the top-level domain is less than a predetermined ratio (p2%), the element value is defined as a fixed value (for example, “0”). As a result, it is possible to prevent the classification accuracy from being greatly changed due to the classification result for the reply destination mail having a low appearance frequency and the classification accuracy is lowered.

  (C) Data indicating the ratio of spam mails among previously received mails having at least a part of the account part of the sender's mail address.

  For example, when at least a part of the account portion of the email address of the sender and the email received in the past matches, this element indicates “0” indicating the proportion of the matched email that has been determined as spam email in the past. ”To“ 1 ”.

  Here, the account part means a character string ahead of the “@” mark in the mail address. The feature vector acquisition unit 12 determines whether the account part matches or does not match with the mail received in the past based on the first character string when the account part is separated by a predetermined delimiter (for example, hyphen, dot, pipe, underbar, etc.). It's okay. Accordingly, for example, mail addresses that are likely to be the same sender, such as “mail-75@example.com” and “mail-05@example.com”, can be statistically processed.

  If the number of matching emails is less than the predetermined ratio (p3%), the element value is defined as a fixed value (for example, “0”). Thereby, it can suppress that a classification rule changes greatly with the classification | category result with respect to the sender's mail with low appearance frequency, and classification accuracy falls.

  (D) Data indicating the ratio of spam mails among mails received in the past in which at least a part of the account part of the reply mail address is the same.

  For example, when at least a part of the account part of the reply mail address and the mail received in the past matches, this element is “0” indicating the ratio of the matched mail that has been determined to be spam mail in the past. This is real value data of “1”.

  Similar to the element (c), the feature vector acquisition unit 12 received in the past by the first character string when the account part is separated by a predetermined delimiter (for example, hyphen, dot, pipe, underbar, etc.). A match or mismatch with the email may be determined.

  If the number of matching emails is less than the predetermined ratio (p4%), the element value is defined as a fixed value (for example, “0”). As a result, it is possible to prevent the classification accuracy from being greatly changed due to the classification result for the reply destination mail having a low appearance frequency and the classification accuracy is lowered.

  (E) Data indicating the ratio of spam emails among emails received in the past in which the character string length of the account part in the sender email address is of the same classification.

  For example, when the character string length is larger than a predetermined threshold value (i1), this element indicates the ratio that has been determined to be spam mail in the past among the mails received in the past that similarly exceed the threshold value (i1). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than a predetermined threshold (i1), “0” indicating the ratio of the past determined as spam mail among the previously received mails whose character string length is equal to or less than the threshold (i1). This is real value data of “1”.

  (F) Data indicating the ratio of spam mail among mails received in the past in which the character string length of the host part in the mail address of the sender is the same classification.

Here, the host part refers to a character string behind the “@” mark in the mail address.
For example, when the character string length is larger than a predetermined threshold (i2), this element indicates the ratio of the past determined as spam mail among the mails received in the past in which the character string length exceeds the threshold (i2). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than the predetermined threshold (i2), similarly, “0” indicating the ratio of the past determined as spam mail among the mails received in the past whose character string length is equal to or less than the threshold (i2). This is real value data of “1”.

  (G) Data indicating the ratio of spam mails among mails received in the past in which the domain hierarchy in the host part within the sender's mail address has the same classification.

Here, the depth of the domain hierarchy refers to the number of host parts divided by dots “.”. For example, in the case of “test@example.com”, it is “2”.
For example, if the depth of the domain hierarchy is larger than a predetermined threshold (i3), this element is determined as spam mail in the past among the mails received in the past in which the domain hierarchy depth exceeds the threshold (i3). This is real value data of “0” to “1” indicating the ratio of the received data. In addition, when the domain hierarchy depth is equal to or less than a predetermined threshold (i3), the ratio of the past determined as spam mail among the previously received emails whose domain hierarchy depth is equal to or less than the threshold (i3) This is real value data of “0” to “1”.

  (H) Data indicating the ratio of spam mails among mails received in the past in which the character string length of the account part in the reply mail address is the same classification.

  For example, when the character string length is larger than a predetermined threshold (i4), this element indicates the ratio of the past determined as spam mail among the mails received in the past in which the character string length exceeds the threshold (i4). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than the predetermined threshold (i4), “0” indicating the ratio of the past determined as spam mail among the previously received mails whose character string length is equal to or less than the threshold (i4). This is real value data of “1”.

  (I) Data indicating the ratio of spam mails among mails received in the past in which the character string length of the host part in the reply mail address is the same classification.

  For example, when the character string length is larger than a predetermined threshold value (i5), this element indicates the ratio that has been determined as spam mail in the past among the mails received in the past that similarly exceed the threshold value (i5). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than the predetermined threshold (i5), “0” indicating the ratio of the past determined as spam mail among the previously received mails whose character string length is equal to or less than the threshold (i5). This is real value data of “1”.

  (J) Data indicating the ratio of spam mails among mails received in the past in which the depth of the domain hierarchy in the host part in the reply mail address is the same classification.

  For example, when the domain layer depth is larger than a predetermined threshold (i6), this element is determined to be spam mail in the past among the emails received in the past in which the domain layer depth similarly exceeds the threshold (i6). This is real value data of “0” to “1” indicating the ratio of the received data. In addition, when the domain hierarchy depth is equal to or less than a predetermined threshold (i6), the ratio of the past determined as spam mail among the previously received emails whose domain hierarchy depth is equal to or less than the threshold (i6) This is real value data of “0” to “1”.

  (K) Data indicating a ratio of spam mails among mails received in the past in which the character string length of the sender's name is the same classification.

  For example, when the character string length is larger than a predetermined threshold (i7), this element indicates the ratio of the past determined as spam mail among the mails received in the past in which the character string length exceeds the threshold (i7). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than the predetermined threshold (i7), “0” indicating the ratio of the past determined as spam mail among the previously received mails whose character string length is equal to or less than the threshold (i7). This is real value data of “1”.

  (L) Data indicating the ratio of spam mails among mails received in the past whose subject string length is the same.

  For example, when the character string length is larger than a predetermined threshold value (i8), this element indicates the ratio of the past determined as spam mail among the mails received in the past in which the character string length exceeds the threshold value (i8). This is real value data of “0” to “1”. Further, when the character string length is equal to or less than a predetermined threshold (i8), similarly, “0” indicating the proportion of the mail received in the past whose character string length is equal to or less than the threshold (i8) in the past. This is real value data of “1”.

  In the elements (e) to (l), there may be a plurality of threshold values (i1 to i8), and an element value is set for each category divided by these threshold values. As a result, the feature vector acquisition unit 12 can differentiate the element value for each category having a different tendency when the tendency regarding the ratio of spam mails greatly varies depending on the character string length or the depth of the domain hierarchy. It can be suppressed to improve the mail classification accuracy.

(M) Data indicating whether or not a mail having the same sender name has been received in the past.
(N) Data indicating whether or not a mail having the same sender's mail address has been received in the past.
(O) Data indicating whether or not a mail having the same reply mail address has been received in the past.
(P) Data indicating whether or not an email having the same subject has been received in the past.
The elements (m) to (p) are binary data “YES” or “NO”.

  The feature vector acquisition unit 12 can express the feature of the spam mail with a specific feature vector by combining these elements (a) to (p). Also, spam mail can be classified with high accuracy because it has a different feature vector from a mailing list that is easily determined as spam mail by a simple filter rule, or a mail magazine subscribed to regularly.

  Note that the feature vector acquisition unit 12 may target mail received by the mail receiving unit 11 during a predetermined period (for example, one year until now) when comparing with reference to mail received in the past. Thereby, the portable terminal 1 can reduce the influence by the characteristic of spam mail changing, and can detect a new spam mail accurately.

  The classification unit 13 refers to the feature vector acquired by the feature vector acquisition unit 12 and classifies whether the email is a normal email or a spam email based on a later-described classification rule (rule DB 21).

  In an initial state where no classification rule is created, the classification unit 13 classifies a plurality of emails received in the past according to a provisional rule. Specifically, for example, the sender registered in the address book is a normal mail, and the other is a spam mail. Alternatively, when classification is performed based on user operation input, this classification may be followed.

  When the rule creation unit 14 receives classification information indicating whether the received mail is a normal mail or a spam mail, the rule creation unit 14 uses the classification information and the corresponding feature vector as learning data to determine whether the mail is a normal mail or spam. Create a classification rule to classify mail. The classification information is a result of classification by the classification unit 13, and among these results, it is preferable that the data is highly reliable, that is, data that is highly likely to be normal mail or spam mail. The classification rule is preferably created by a method with a light processing load. For example, a learning algorithm such as a k-NN method, a decision binary tree, or SVM (Support Vector Machine) can be used.

  Here, the rule creation unit 14 re-creates the classification rule at a predetermined timing, for example, at a certain period or when the processing load of the mobile terminal 1 is reduced. Further, the rule creating unit 14 is based on the mail received by the mail receiving unit 11 during a predetermined period (for example, one year) so as to maintain the classification accuracy even when the characteristics of the spam mail are changed. Create a classification rule. By not referring to the mail received before the predetermined period, the rule creating unit 14 can accurately determine a new spam mail without being affected by the characteristics of the old spam mail. Moreover, since the amount of target data decreases, the processing load of the portable terminal 1 is reduced.

Here, an example of the created classification rule will be described.
FIG. 2 is a diagram illustrating a first example of the classification rule according to the present embodiment.

  The rule creation unit 14 determines a variable value Ps (0 ≦ Ps ≦ 1) indicating the possibility of being spam mail for each feature vector by a predetermined learning algorithm. If Ps is close to 1, there is a high possibility of being a spam mail, and if it is close to 0, there is a high possibility of being a normal mail. The above classification information may be this Ps. A value weighted as Ps is closer to 0 or 1 may be used as the classification information.

  In the example of FIG. 2, Ps is concentrated in the vicinity of 0 or 1 corresponding to the feature vector acquired from the received mail according to an ideal classification rule. The vertical axis shows the cumulative distribution of the number of actual normal mails and spam mails. Normal mail (solid line) reaches 100% when Ps is near 0, but spam mail (dashed line) has Ps of 1 It is 0% to the vicinity.

  Here, the rule creating unit 14 sets a threshold value Psth for classifying Ps into one corresponding to normal mail and one corresponding to spam mail. In the case of FIG. 2, the rule creation unit 14 sets Psth to “0.5”, mails with Ps less than Psth are normal mails (folder 1), and mails with Ps greater than Psth are spam mails (folder 2).

In an ideal state, mails can be reliably classified in this way. However, since Ps takes various values in reality, it is difficult to reliably classify by one threshold value Psth.
FIG. 3 is a diagram illustrating a second example of the classification rule according to the present embodiment.

  In the example of FIG. 3, the normal mail (solid line) is dispersed in a value where Ps is away from 0, and the spam mail is dispersed in a value where Ps is away from 1. Therefore, the rule creation unit 14 sets a first threshold value (Psth1 = 0.3) and a second threshold value (Psth2 = 0.7). In this case, the classification unit 13 classifies the received mail as a normal mail (folder 1) if Ps is less than Psth1, and as a spam mail (folder 3) if Ps is greater than or equal to Psth2. Then, if Ps is greater than or equal to Psth1 and less than Psth2, the classification unit 13 classifies the received mail as a pending mail (folder 2).

  Returning to FIG. 1, the data registration unit 15 stores the mail classified by the classification unit 13 in the mail DB 22 by dividing it into folders (normal mail, suspended mail, spam mail). At this time, the data registration unit 15 stores the feature vector and the classification information (Ps or a value obtained by weighting Ps) in association with the mail.

  In addition, the data registration unit 15 changes the classification result and updates the mail DB 22 according to a predetermined operation input from the input unit 40. Specifically, for example, by accepting operations such as, for example, receiving operations such as moving mail classified as normal mail to a spam mail folder, or moving mail classified as pending mail to a normal mail or spam mail folder The mail DB 22 is updated.

  Further, the data registration unit 15 provides this change information to the rule creation unit 14 when receiving the change input of the classification result. The rule creation unit 14 updates the classification rule of the rule DB 21 based on this change information.

  Specifically, the rule creation unit 14 adjusts the aforementioned variable value Ps or threshold value Psth (Psth1, Psth2) corresponding to the mail whose classification has been changed, or both. That is, for example, Ps is adjusted to be small when spam mail or hold mail is changed to normal mail, and Ps is adjusted to be large when normal mail or hold mail is changed to spam mail. Further, Psth1 is adjusted to be large when the hold mail is changed to normal mail, and Psth2 is adjusted to be small when the hold mail is changed to spam mail.

  The notification unit 16 notifies the server managing the reception of the mail (the server of the carrier providing the communication service of the mobile terminal 1) of the mail classified as spam mail by the classification unit 13. This notification may be a mail notification to a predetermined address. The server that receives the notification can update the filter rule of the received mail and suppress the transmission of the spam mail to the mobile terminal 1.

  In addition, although the notification part 16 may notify automatically at the timing when the mail was classified, it is not restricted to this. The notification unit 16 may notify when a user's confirmation input is accepted in order to prevent automatic notification based on an incorrect classification. Moreover, the notification part 16 is good also as notifying according to the request | requirement from a user, without performing automatic notification.

  FIG. 4 is a flowchart showing a flow of processing of the control unit 10 accompanying mail reception in the mobile terminal 1 according to the present embodiment.

  In step S <b> 1 (reception step), the control unit 10 (mail receiving unit 11) receives mail addressed to the user of the mobile terminal 1.

  In step S2 (acquisition step), the control unit 10 (feature vector acquisition unit 12) obtains the header information of the mail received in step S1, the header information of the mail received in the past, and the classification information (whether normal mail or spam mail). The feature vector is acquired based on the classification information.

  In step S3 (classification step), the control unit 10 (classification unit 13) collates the feature vector acquired in step S2 with the classification rule stored in the rule DB 21, and converts the received mail into normal mail and spam mail. Or classify it as a pending email.

  In step S4, the control unit 10 (data registration unit 15) divides the mail classified in step S3 into folders and stores it in the mail DB 22 together with the classification information.

  FIG. 5 is a flowchart showing a flow of processing (creation step) in which the control unit 10 (rule creation unit 14) of the mobile terminal 1 according to the present embodiment creates a classification rule.

  In step S <b> 11, the rule creation unit 14 determines whether it is time to create a classification rule. Specifically, the arrival of a predetermined period or the processing load of the portable terminal 1 is detected to be lower than a predetermined level, and it is determined as the creation timing. When the determination is YES, the rule creating unit 14 moves the process to step S12, and when the determination is NO, the rule creating unit 14 moves the process to step S17.

  In step S <b> 12, the rule creation unit 14 acquires the classification information related to the classified mail and the feature vector of each mail as learning data from the mail DB 22.

  In step S13, the rule creating unit 14 learns the classification rule by a predetermined algorithm based on the learning data acquired in step S12. Specifically, first, a variable value Ps is assigned to each feature vector.

  In step S14, the rule creating unit 14 determines a threshold value Psth for classifying Ps given in step S13 into normal mail or spam mail. As described above, two types of threshold values Psth (Psth1, Psth2) may be determined.

  In step S15, the rule creation unit 14 stores the classification rules created in step S13 and step S14 in the rule DB 21.

  In step S <b> 16, the rule creation unit 14 determines whether or not to finish creating the classification rule. Specifically, the rule creation unit 14 determines the end of the creation of the classification rule by receiving a predetermined operation input when it is no longer necessary to classify the mail or update the classification rule. When this determination is YES, the rule creation unit 14 ends the process. When the determination is NO, the rule creation unit 14 returns the process to step S11 and continues creating the classification rule at a predetermined timing.

  In step S <b> 17, the rule creation unit 14 determines whether or not the classification result has been changed by an operation input from the user. When this determination is YES, the rule creation unit 14 proceeds to step S18, and when the determination is NO, the rule creation unit 14 proceeds to step S16.

  In step S18, the rule creation unit 14 adjusts the variable value Ps or the threshold value Psth of the mail whose classification has been changed because the classification result based on the classification rule stored in the rule DB 21 is not appropriate. And the rule preparation part 14 moves a process to step S15, and updates a classification rule.

  As described above, according to this embodiment, the mobile terminal 1 easily obtains a feature vector based on several types of data that can be easily extracted from the header information, and uses the variable value Ps assigned to each feature vector. Automatic classification is easily performed based on the threshold value Psth (Psth1, Psth2). Therefore, the mobile terminal 1 can reduce the processing load for creating and classifying classification rules and reducing the operation load on the user. Furthermore, since the mobile terminal 1 does not analyze the mail body and generates a classification rule that represents the rule of header information unique to spam mail in the mobile terminal 1 as a feature vector, the processing accuracy is reduced while reducing the processing load. Can automatically determine spam emails.

Here, in the existing method, feature vectors having the following 17 types of data as elements are used.
(A ′) Data indicating whether or not the sender's mail address is registered in the address book.
(B ′) Data indicating whether or not mails having the same sender name and different sender mail addresses have been received in the past.
(C ′) Data indicating whether or not a mail having a common sender mail address and a different sender name has been received in the past.
(D ′) Data indicating whether or not a mail having a common sender name and a different reply destination mail address has been received in the past.
(E ′) Data indicating whether or not a mail having a common reply destination mail address and a different sender name has been received in the past.
(F ′) Data indicating whether or not a mail having a common sender mail address and a different reply destination mail address has been received in the past.
(G ′) Data indicating whether or not a mail having a common reply destination mail address and a different mail address of the sender has been received in the past.
(H ′) Data indicating whether or not a mail having a common sender name and a different subject has been received in the past.
(I ′) Data indicating whether or not a mail having a common subject name and a different sender name has been received in the past.
(J ′) Data indicating whether or not a mail having a common mail address and a different subject has been received in the past.
(K ′) Data indicating whether or not a mail having a common subject and a different mail address of the sender has been received in the past.
(L ′) Data indicating whether or not a mail having a common subject line and a different reply destination mail address has been received in the past.
(M ′) Data indicating whether or not a mail having a common reply destination mail address and a different subject has been received in the past.
(N ′) Data indicating when the sender's mail address appeared last time.
(O ′) Data indicating when the sender's name appeared last time.
(P ′) Data indicating when the reply mail address appeared last time.
(Q ′) Data indicating when the subject appears last time.
In the case of this existing method, when the number of registrations in the address book is n and the number of past mails is N, the maximum number of comparison processes is “n” times for (a ′), (b ′) to ( Since m ′) is “2N” times and (n ′) to (q ′) is “N” times, a total of “n + 12 × 2N + 4 × N” comparison processes are required.

  On the other hand, in the case of this embodiment, a feature vector can be created by a maximum of “N” times and a total of “16 × N” times of comparison processing for each element of (a) to (p). Therefore, the portable terminal 1 can further reduce the processing load.

  As the feature vector, the elements (a ′) to (q ′) may be further added to the elements (a) to (p) in the present embodiment. In this case, since the feature vector is further subdivided, an improvement in classification accuracy can be expected.

  In addition, when the automatic classification result is changed by the user, the mobile terminal 1 can adjust the variable value Ps or the threshold value Psth for each feature vector and adjust the learning result of the classification rule. Re-learning by change input can improve classification accuracy. Furthermore, since the mobile terminal 1 can weight the learning data according to the variable value Ps, it is expected that classification accuracy with high certainty is prioritized to improve classification accuracy.

  Moreover, since the portable terminal 1 re-creates a classification rule with a predetermined trigger, for example, at a fixed period or when the processing load is reduced, the classification rule can be updated using new mail as learning data. Furthermore, since the mobile terminal 1 learns based on mails received during a predetermined period until now, old mails received before this time can be excluded, and classification rules can be created with new information. Accordingly, the mobile terminal 1 can create a highly accurate classification rule reflecting the characteristics of recent spam mails.

  In addition, since the mobile terminal 1 notifies the server that manages the reception of the mail information of the mail classified as spam mail automatically or upon request, the filter rule is updated in this server, and the spam mail Reception can be suppressed.

Second Embodiment
Hereinafter, a second embodiment which is an example of an embodiment of the present invention will be described. The management server 2 (electronic mail management server) according to the present embodiment is a server that is connected to the mobile terminal 1a and manages mail addressed to the mobile terminal 1a. For example, a predetermined wireless communication such as a mobile phone or PHS It is a server of a carrier that provides a service. The management server 2 generates a classification rule for determining whether or not the received mail is spam mail in the mobile terminal 1a, and provides the classification rule to the mobile terminal 1a.
Hereinafter, while comparing with the configuration of the mobile terminal 1 according to the first embodiment, the same configuration is denoted by the same symbol or the symbol added with “a”, and the description is omitted or simplified.

FIG. 6 is a diagram illustrating a functional configuration of the management server 2 according to the present embodiment.
The management server 2 includes a control unit 10a, a storage unit 20a, a communication unit 30a, an input unit 40a, and a display unit 50a.

  The control unit 10a corresponds to the control unit 10 of the first embodiment, and is a part that controls the entire management server 2. The above-described hardware can be obtained by appropriately reading and executing various programs stored in the storage unit 20a. Various functions in the present embodiment are realized in cooperation with the hardware.

  The storage unit 20a corresponds to the storage unit 20 of the first embodiment, and various programs for causing a hardware group to function as the management server 2, programs for causing the control unit 10a to execute various functions of the present embodiment, and various databases Memorize etc.

  The communication unit 30a corresponds to the communication unit 30 of the first embodiment, and communicates with a plurality of portable terminals 1a via the predetermined network 3 and the base station 4.

  The input unit 40a corresponds to the input unit 40 of the first embodiment, and is an interface device that receives an instruction input from the user (administrator) to the management server 2.

  The display unit 50a corresponds to the display unit 50 of the first embodiment, and displays a screen for accepting data input to the user (administrator) or displays a screen of a processing result by the management server 2. .

Here, the control unit 10a includes a mail reception unit 11a (reception unit), a feature vector acquisition unit 12a (acquisition unit), a rule creation unit 14a (creation unit), a data registration unit 15a, and a mail transfer unit 17 ( A transfer unit) and a rule transmission unit 18 (transmission unit).
The storage unit 20a includes a rule DB 21a and a mail DB 22a.

  The mail receiving unit 11a corresponds to the mail receiving unit 11 of the first embodiment. The mail receiving unit 11a receives a mail addressed to the user's mail address of one of the mobile terminals 1a via the communication unit 30a, and stores it in the mail DB 22a.

  The feature vector acquisition unit 12a corresponds to the feature vector acquisition unit 12 of the first embodiment, and shows the feature of the mail, as in the first embodiment, based on the header information of the mail received by the mail reception unit 11a. Get a feature vector.

  The rule creation unit 14a corresponds to the rule creation unit 14 of the first embodiment, and when receiving the classification information indicating whether the received mail is a normal mail or a spam mail, this classification information and the corresponding feature vector As a learning data, a classification rule for classifying whether a mail is a normal mail or a spam mail is created and stored in the rule DB 21a as in the first embodiment.

  Here, the rule creating unit 14a sends the classification information indicating that this mail is a normal mail when the body of the mail is transferred to the destination mobile terminal 1a within a predetermined period after the mail is received. Accept from DB22a. Further, the rule creating unit 14a accepts, from the mail DB 22a, classification information indicating that this mail is spam mail when the text of this mail is not transferred to the mobile terminal 1a.

  The data registration unit 15a stores the feature vector acquired by the feature vector acquisition unit 12a and the classification information corresponding to the processing status of the mail transfer unit 17 (Ps or a value weighted to Ps) in association with the mail.

  The mail transfer unit 17 transfers the header information of the mail received by the mail receiving unit 11a and stored in the mail DB 22 to the mobile terminal 1a, and in response to a request from the mobile terminal 1a, the text of the mail is transferred. Transfer to the portable terminal 1a. Further, the transfer result is notified to the data registration unit 15, and classification information corresponding to the presence or absence of transfer is stored in the mail DB 22.

  The rule transmission unit 18 transmits the classification rule created by the rule creation unit 14a to the mobile terminal 1a at a predetermined timing. The predetermined timing may be a timing at which a request from the mobile terminal 1a is received, and the mobile terminal 1a periodically downloads and updates the classification rule from the management server 2.

  Note that the mobile terminal 1a may include the feature vector acquisition unit 12 of the first embodiment that acquires the feature vector of the email in order to classify the received email according to the downloaded classification rule. Alternatively, the mail transfer unit 17 may transfer the feature vector acquired by the feature vector acquisition unit 12a to the mobile terminal 1a together with the header information of the mail.

  Further, the management server 2 may include the classification unit 13 of the first embodiment. In this case, when the result classified by the classification unit 13 and the classification information according to the transfer result of the mail transfer unit 17 are different, the data registration unit 15a provides this change information to the rule creation unit 14a. Based on this change information, the rule creation unit 14a updates the classification rules in the rule DB 21a, as in the first embodiment.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  The variable value Ps described above indicates the possibility of being spam mail and can also be used as an index representing the importance of received mail. That is, the mobile terminal 1 (or 1a) determines that the received mail is more important or urgent as Ps is smaller (closer to 0), classifies the storage folder, or gives a flag to the user. May be.

  In the above-described embodiment, the case where the present invention is applied to mail received by the mobile terminal 1 (or 1a) has been described. However, the electronic mail classification apparatus or the electronic mail management server is not limited to this, and the present invention is not limited thereto. Can also be applied to other communication terminals such as PCs for sending and receiving mail on the Internet and servers for managing the sending and receiving of this mail.

  In the above-described embodiment, the feature vector acquisition unit 12 (or 12a) uses, as an element, data indicating the ratio of spam mails among previously received emails having the same classification based on the items included in the header information. The feature vector was acquired. The statistical values serving as these elements may be calculated in advance for each classification and stored together with the classification rules. According to this, when classifying newly received mail in the mobile terminal 1 (or 1a), the load of the feature vector acquisition process is reduced.

1 Mobile terminal (E-mail classification device)
1a mobile terminal 2 management server (e-mail management server)
10, 10a Control unit 11, 11a Mail receiving unit (receiving unit)
12, 12a Feature vector acquisition unit (acquisition unit)
13 Classification unit 14, 14a Rule creation unit (creation unit)
15, 15a Data registration unit 16 Notification unit 17 Mail transfer unit (transfer unit)
18 Rule transmitter (transmitter)
20, 20a Storage unit 21, 21a Rule DB
22, 22a Mail DB
30, 30a Communication unit 40, 40a Input unit 50, 50a Display unit

Claims (13)

A receiver for receiving e-mail;
Based on the header information of the email received by the receiving unit, an acquisition unit that acquires a feature vector indicating the feature of the email;
Whether the e-mail is a normal e-mail or a junk e-mail when the classification information indicating whether the e-mail is a normal e-mail or a junk e-mail is received, using the classification information and the corresponding feature vector as learning data A creation unit for creating a classification rule for classifying
When a new e-mail is received by the receiving unit, referring to the feature vector acquired by the acquiring unit from the e-mail, the e-mail is normal based on the classification rule generated by the generating unit A classification unit that classifies whether the message is email or spam,
The acquisition unit is a nuisance among previously received e-mails that have the same classification based on any of the items of the sender name, sender e-mail address, reply-to e-mail address, or subject included in the header information. An e-mail classification device that acquires the feature vector based on at least one of data indicating a mail ratio and data indicating whether or not the same item has received the same e-mail in the past. The acquisition unit, as the feature vector,
(A) data indicating the ratio of junk mail out of previously received e-mails having the same top-level domain of the sender's e-mail address;
(B) data indicating the ratio of junk e-mail among e-mails received in the past in which the top-level domain of the reply e-mail address is the same;
(C) data indicating the ratio of junk e-mail among previously received e-mails in which at least a part of the account part of the sender's e-mail address is the same;
(D) data indicating the ratio of spam mails among previously received e-mails in which at least a part of the account part of the reply mail address is the same;
(E) data indicating the ratio of junk e-mail among e-mails received in the past in which the character string length of the account part in the sender's e-mail address is of the same classification;
(F) Data indicating the ratio of spam mail among previously received e-mails in which the character string length of the host part in the sender's mail address is of the same classification,
(G) data indicating the ratio of junk e-mail among e-mails received in the past in which the domain hierarchy depth in the host portion in the sender's e-mail address is the same classification;
(H) data indicating the ratio of junk mail among e-mails received in the past in which the character string length of the account part in the reply mail address is the same classification;
(I) data indicating the ratio of junk e-mail among e-mails received in the past in which the character string length of the host part in the reply e-mail address is the same classification;
(J) Data indicating the ratio of spam among previously received e-mails in which the depth of the domain hierarchy in the host part in the reply-to e-mail address is the same classification;
(K) data indicating the ratio of junk mail among e-mails received in the past in which the character string length of the sender's name is the same classification;
(L) Data indicating the ratio of junk e-mail among e-mails received in the past in which the character string length of the subject is the same classification;
(M) data indicating whether an email having the same sender name has been received in the past;
(N) data indicating whether or not an email having the same sender's email address has been received in the past;
(O) data indicating whether an e-mail having the same reply-to e-mail address has been received in the past;
(P) data indicating whether an email having the same subject has been received in the past;
The electronic mail classification apparatus according to claim 1, wherein the feature vector having at least one of them as an element is acquired.   The creation unit determines a variable value indicating the possibility that the e-mail from which the feature vector is acquired is a spam mail corresponding to each of the feature vectors, and sets the variable value as normal as the classification rule. The electronic mail classification device according to claim 1 or 2, wherein a threshold value for classifying the mail into one corresponding to mail and one corresponding to spam mail is set. The creating unit sets a first threshold value for classifying the variable value into one corresponding to normal mail, and a second threshold value for classifying the variable value into one corresponding to spam mail,
The electronic mail classification apparatus according to claim 3, wherein the classification unit classifies newly received electronic mail into normal mail, spam mail, and other reserved mail.   The said creation part adjusts the said variable value corresponding to the said email, or the said threshold value, when the input which changes the result of the said classification | category is received about the email classified by the said classification | category part. The electronic mail classification device according to claim 4.   The electronic mail classification apparatus according to claim 3, wherein the creation unit receives the classification information to which weighting according to the variable value is added as the learning data.   The electronic mail classification apparatus according to claim 1, wherein the creation unit re-creates the classification rule at a predetermined opportunity.   The said preparation part produces the said classification rule based on the email received by the said receiving part in the predetermined period until now, and does not refer to the email received before the said predetermined period. The electronic mail classification device according to any one of 7.   The e-mail classification device according to claim 1, further comprising a notification unit that notifies information on an e-mail classified as spam by the classification unit to a server that manages reception of the e-mail. . An email management server that is connected to a terminal and manages emails addressed to the terminal,
A receiving unit for receiving the email;
Transferring the header information of the e-mail received by the receiving unit to the terminal, and in response to a request from the terminal, transferring a body of the e-mail to the terminal;
Based on the header information of the email received by the receiving unit, an acquisition unit that acquires a feature vector indicating the feature of the email;
Whether the e-mail is a normal e-mail or a junk e-mail when the classification information indicating whether the e-mail is a normal e-mail or a junk e-mail is received, using the classification information and the corresponding feature vector as learning data A creation unit for creating a classification rule for classifying
A transmission unit that transmits the classification rule created by the creation unit to the terminal at a predetermined timing;
The acquisition unit is a nuisance among previously received e-mails having the same classification based on any of the sender name, sender e-mail address, reply-to e-mail address, or subject included in the header information. An e-mail management server that acquires the feature vector based on at least one of data indicating a mail ratio and data indicating whether or not the same item has received the same e-mail in the past.   The creation unit receives the classification information indicating that the e-mail is a normal mail when the body of the e-mail is transferred to the terminal in a predetermined period after the e-mail is received; The e-mail management server according to claim 10, wherein the classification information that the e-mail is a junk e-mail is received when the text of the e-mail is not transferred to the terminal. A receiving step for receiving e-mail;
Based on the header information of the email received in the receiving step, an acquisition step of acquiring a feature vector indicating the feature of the email;
Whether the e-mail is a normal e-mail or a junk e-mail when the classification information indicating whether the e-mail is a normal e-mail or a junk e-mail is received, using the classification information and the corresponding feature vector as learning data A creation step to create a classification rule to classify
When a new email is received in the receiving step, the feature vector acquired in the acquisition step is referred to from the email, and the email is normal based on the classification rule created in the creation step. A computer that performs a classification step to classify whether the message is email or spam,
In the acquisition step, annoying among previously received e-mails that have the same classification based on any of the items of sender name, sender e-mail address, reply e-mail address or subject included in the header information An e-mail classification method for acquiring the feature vector based on at least one of data indicating a mail ratio and data indicating whether or not any of the items has received the same e-mail in the past. A receiving step for receiving e-mail;
Based on the header information of the email received in the receiving step, an acquisition step of acquiring a feature vector indicating the feature of the email;
Whether the e-mail is a normal e-mail or a junk e-mail when the classification information indicating whether the e-mail is a normal e-mail or a junk e-mail is received, using the classification information and the corresponding feature vector as learning data A creation step to create a classification rule to classify
When a new email is received in the receiving step, the feature vector acquired in the acquisition step is referred to from the email, and the email is normal based on the classification rule created in the creation step. A computer for performing a classification step of classifying whether the message is email or spam,
In the acquisition step, annoying among previously received e-mails that have the same classification based on any of the items of sender name, sender e-mail address, reply e-mail address or subject included in the header information An e-mail classification program for acquiring the feature vector based on at least one of data indicating a mail ratio and data indicating whether or not one of the items has received the same e-mail in the past.

Images