JP2013236308A - Mail check method, mail check device, and mail check program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mail check method, a mail check device, and a mail check program which efficiently detect a targeted threat mail candidate.SOLUTION: The mail check method which detects an alarming mail candidate from target mails to be received newly comprises a feature information data base (a DB, hereafter) generation process and a detection process. The feature information DB generation process extracts, from plural authorized received mails, plural pieces of feature information contained in the mail headers of the received mails to generate a feature information DB. If similarity between first pieces of feature information contained in the mail header of the reception target mail and second pieces of feature information of the plural received mails having the same address as that of the reception target mail, which are referred from the feature information DB, is smaller than a reference similarity, the detection process detects the reception target mail, as an alarming mail candidate.

Description

  The present invention relates to a mail check method, a mail check device, and a mail check program.

  In recent years, the number of targeted attack emails for the purpose of stealing information stored in computers of specific organizations and individuals has increased rapidly. Targeted attack mail is not an attack on an unspecified number of people, but has a feature that an attack is performed by specifying a specific target. For example, a targeted attack email is sent as a subject or body email that spoofs a real organization or individual sender and pretends to be a legitimate business or request. Then, the recipient is caused to induce virus infection by opening an attached file or to send a virus by induction to a specific site.

  In this way, the target-type attack email pretends to be an actual sender and is sent as if it were a legitimate email. However, there is a limit to the process in which each recipient checks the consistency of the mail header, attached file, body text, sender address, etc. for each mail to be received and discriminates the targeted attack mail. For this reason, it is desirable that the target-type attack mail be automatically detected by the mail checker before the mail is received by the mailer.

  In recent mail checkers, spam mails are detected by designating characteristic words or the like that appear frequently with manual or automatic learning (for example, Patent Document 1). Further, for example, there is a method in which a received mail server detects a non-regular mail by verifying a domain of a transmission source mail address and determining whether or not the domain is a regular server. As a result, unauthorized mail such as targeted attack mail and spam mail is detected.

Japanese Patent Application No. 2010-501864

  However, since the number of targeted attack emails is small, unlike spam emails, it is difficult for a mail checker to learn features based on information obtained from targeted attack emails. In addition, in order for the received mail server to verify the domain, it is necessary to mount a domain verification function for each mail server, which is not easy. As described above, it is difficult to efficiently detect the targeted attack mail.

  An object of the present invention is to provide a mail check method, a mail check apparatus, and a mail check program for efficiently detecting a targeted attack mail candidate.

  The first aspect is a mail check method for detecting a warning mail candidate from a newly received target mail, and for a plurality of legitimate received mails, a plurality of feature information included in the mail header of the received mail is extracted. And a feature information database generating step for generating a feature information database (hereinafter referred to as DB), a plurality of first feature information included in the mail header of the reception target mail, and the reception target mail referenced from the feature information DB If the similarity between the plurality of received mails having the same source address and the second plurality of feature information is less than the reference similarity, the reception target mail is detected as a warning mail candidate.

  According to the first aspect, targeted attack mail candidates are efficiently detected.

It is a figure which shows an example of a structure of the mail check apparatus in this Embodiment. It is a figure which shows an example of a mail header. It is a figure which shows the specific example of the transmission date and time (characteristic information) extracted from the received mail. It is an example figure which shows the pattern information contained in title information, and the notation fluctuation dictionary d3. It is a figure which shows the specific example of the destination information acquired based on the received mail. It is a figure which shows the specific example of the IP address of a transmission origin server, and a via | transit time zone. It is a figure which shows the specific example of combination characteristic information. It is a figure which shows the specific example of feature information DB. It is a flowchart figure explaining the flow of a similarity determination process. It is a flowchart explaining the calculation process of total coincidence value sim. It is a figure which shows an example of the weighting coefficient of the feature information for every transmission source address.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the technical scope of the present invention is not limited to these embodiments, but extends to the matters described in the claims and equivalents thereof.

[Configuration of Mail Check Device 200]
FIG. 1 is a diagram illustrating an example of the configuration of a mail check apparatus 200 according to the present embodiment. The mail check device 200 in the present embodiment includes, for example, a mail check unit 10, a mailer 21, and an alert user interface 22. The mail check device 200 is connected to another mail server 100 via the Internet. The mail check apparatus 200 in this embodiment may be on either the server side or the client side.

  When the mail check unit 10 in the present embodiment detects the mail to be received, the mail check unit 10 compares the feature information of the mail to be received and the legitimate received mail to determine the similarity. Then, the mail check unit 10 determines that there is a possibility that the reception target mail having a low similarity is a non-regular mail, that is, a target-type attack mail, via the alert user interface 22 or the like. Notify the warning information. The recipient (hereinafter referred to as a user) confirms the mail to be received when the warning information is notified about the mail to be received. And a user does not permit reception, when it judges with it being a target type attack mail about a receiving object mail.

  1 includes, for example, a mail server 11, a mail receiving device 12, a mail feature extraction unit 13, a target-type attack mail detection unit 14, an alert generation unit 15, a feature information DB d1, and weighting factor information for each sender. d2 and a notation fluctuation dictionary d3. The mail receiving device 12 detects a mail to be received and notifies the mail server 11 of the mail. The mail server 11 performs control related to mail transmission / reception and calls the target attack mail detection unit 14 when a mail to be received is detected.

  The target-type attack email detection unit 14 extracts feature information included in the email header of the email to be received, and refers to the feature information DBd1 and features of a legitimate received email having the same source address as the email to be received. Read information. Then, the target-type attack mail detection unit 14 obtains the similarity of the feature information between the reception target mail and the received mail. If the similarity is less than the reference similarity, the alert generation unit 15 warns the reception target mail. Notify as an email candidate. The alert generation unit 15 causes the alert user interface 22 to display the notified alert mail candidate information.

  The mail feature extraction unit 13 extracts the feature information included in the mail header of each mail for each legitimate received mail and generates the feature information DBd1. In addition, the mail feature extraction unit 13 has a notation fluctuation dictionary d3 that is a list of notation fluctuation phrases. The mail feature extraction unit 13 refers to the notation fluctuation dictionary d3 and detects the notation fluctuation phrase included in the title information included in the mail header as the feature information. Details will be described later.

  Further, the sender weight coefficient information d2 has a weight coefficient for each of a plurality of feature information for each source address. The target-type attack mail detection unit 14 refers to the weight coefficient information d2 corresponding to each feature information and reflects it when calculating the similarity.

  As described above, the mail check unit 10 according to the present embodiment extracts a plurality of feature information included in a mail header of a mail for a plurality of legitimate received mails, and generates a feature information DB d1. Then, the mail check unit 10 resembles the feature information included in the mail header of the target email to be received and the feature information of a plurality of received emails having the same source address as the reception target email referenced from the feature information DBd1. Determine the degree. Then, when the similarity is less than the reference similarity, the mail check unit 10 detects the reception target mail as a warning mail candidate.

  Here, the feature information will be described.

[Feature information]
The characteristic information indicates a part of information included in the mail header of the mail. In the present embodiment, the feature information is, for example, the IP address of the sender mail server, the domain information of the sender mail server, the time zone information, the software type of the mailer used by the sender, the sending day, the sending time, Indicates pattern information, destination information, etc. in title information. Any one of these pieces of feature information is compared between the reception target mail and the received mail. A specific example of the comparison process will be described later based on a flowchart.

  Next, a specific example of the mail header will be described here.

[Mail header]
FIG. 2 is a diagram illustrating an example of the mail header Mh. The mail header Mh in the figure is an example of the mail header Mh of the reception target mail transmitted from the address “bbbbbb@domain2.com” to the address “aaaaa@domain1.com”, for example.

  As shown in FIG. 2, the mail header Mh includes, for example, “From”, “Sender”, “To”, “Subject”, “Message-ID”, “Date”, “Received”, “Reply-To”, “Reply-To”, “ It includes items such as “X-Mailer”. However, since the information included in the mail header Mh and its format differ depending on the type of mailer software, it is not limited to the example of FIG.

  Specifically, From information indicates a transmission source address, and To information indicates a destination address. The Reply-To information indicates a mail reply destination, and the Subject information indicates mail title information. Message-ID information is a unique identification ID for identifying a mail, and indicates information generated based on information such as a transmission date, time, and a domain of a transmission source mail server. Date information indicates the mail transmission date and time, and X-Mailer information indicates the name of the mailer software used by the mail sender.

  The Received information indicates information on the IP address and domain name of the mail route server and the IP address and domain name of the transmission source server. Received information is recorded in order from the bottom for the number of routed servers. That is, the lowest Received information indicates the sender, and the highest Received information indicates its mail server. In this example, the Received information on the first line indicates a record of the receiving server, and the Received information on the second line indicates a record of the transmitting server. The format of the Received information is, for example, “Received: from server [IP address] by receiving server name [with transfer protocol] id unique ID for destination mail address: processing date and time”. The processing date / time includes transmission day information, transmission time information, and time zone information of the transit server.

  According to the example of the mail header Mh in FIG. 2, the source address is “bbbbbb@domain2.com” based on the From information H1, and the destination address is “aaaaaa@domain1.com” based on the To information H3. Recognize. Further, based on the Date information H8, it is found that the transmission date is 10:02:13 (China time) on November 22, 2010 (Monday). Similarly, based on the Subject information H2, it can be seen that the title of the mail is “Next-About Meeting”, and based on the X-Mailer information H8, the software used at the time of mail transmission is Foxmail. Further, based on the Message-ID information H7, the domain of the sender mail server is domain2. com.

  Further, based on the first Received information H11 in the mail header Mh of FIG. 2, the mail of the destination aaaaaa@domain1.com is sent at 10:02:13 (Japan time) on November 22, 2010 (Monday). It can be seen that the message was received from the receiving server receivehost.co.jp of the IP address x0.26.xxx.xxx. Then, based on the second Received information H12, at 10:02:13 (China time H4) on November 22, 2010 (Monday), the server receivehost.co.jp sends the IP address 210.xxx.xxx. It can be seen that the mail is received from the transmission source server sendhost.co.jp of H.226 (H5).

  Thus, a plurality of types of feature information are detected from the mail header Mh of the mail as shown in FIG. Subsequently, each feature information will be described based on a specific example.

[Feature information: Send date / time]
FIG. 3 is a diagram showing a specific example of the transmission date and time (feature information) extracted from the received mail. The list L1 in the figure shows a specific example of the transmission date and time included in the mail headers of the received mails of the three transmission source addresses suzuki, tanaka, and itpml2. In this example, the source address is represented as a local part (information before @) in the mail address, for example, Suzuki. As described above with reference to FIG. 2, the transmission date and time is acquired based on the Date information.

  For example, information L1-1 in the date / time list L1 in FIG. 3 indicates that the received mail with the transmission source address itpml2 was transmitted at 12:41 on March 1, 2012. Similarly, information L1-2 in the date / time list L1 indicates that the received mail of the transmission source address suzuki was transmitted at 10:14 on March 1, 2012. As described above, the transmission date and time, the transmission time included in the time, the transmission day of the week, and the like are extracted as feature information based on each received mail.

  Graph times tg1 to tg3 in FIG. 3 are graphs showing the number of received emails for each transmission time for each source address based on the list L1 in FIG. In the time graphs tg1 to tg3, the horizontal axis indicates the transmission time, and the vertical axis indicates the number of received mails. The day of week graphs wg1 to wg3 in the same figure are graphs showing the number of received emails for each day of the transmission for each source address based on the list L1. In the day of week graphs wg1 to wg3, the horizontal axis indicates the transmission day of the week, and the vertical axis indicates the number of received mails.

  First, the transmission date and time of the transmission source address tanaka will be described. According to the time graph tg1 of the transmission source address tanaka, all the received mails from the transmission source address tanaka are transmitted from 8:00 to nearly 10:00. On the other hand, according to the day-of-week graph wg1 of the transmission source address tanaka, the received mail from the transmission source address tanaka is transmitted evenly from Monday to Friday. That is, the received mail from the transmission source address tanaka tends to be transmitted from 8 o'clock to 10 o'clock on any day of the week from Monday to Friday.

  Next, the transmission date and time of the transmission source address suzuki will be described. According to the time graph tg2 of the transmission source address suzuki, the received mail from the transmission source address suzuki is transmitted evenly in time. Further, according to the day-of-week graph wg2 of the transmission source address suzuki, the received mail from the transmission source address suzuki is transmitted evenly from Monday to Saturday. For this reason, the degree of variation of the transmission time and the transmission day of the received mail with the transmission source address Suzuki is large.

  Next, the transmission date and time of the transmission source address itpml2 will be described. According to the time graph tg3 of the transmission source address itpml2, all received mails from the transmission source address itpml2 are transmitted at 12:00. Further, according to the day-of-week graph wg3 of the transmission source address itpml2, the received mail from the transmission source address itpml2 is always transmitted on Wednesday or Friday. For this reason, the degree of variation between the transmission time and the transmission day of the received mail with the transmission source address itpml2 is small. The received mail at the transmission source address itpml2 is a periodic transmission mail such as a mail magazine.

  As described above, the transmission time and the transmission day of the week included in the transmission date and time are acquired as feature information from each received mail based on the mail header Mh. The characteristic tendency of the transmission time, the transmission day of the week, and the degree of variation in information differ depending on the sender, that is, the source address. The transmission date and time is information that is difficult to impersonate by a third party. For this reason, the transmission date and time information included in the title information is used as a comparison target as feature information, thereby enabling more detailed similarity determination.

  In the example of FIG. 3, the example in which the transmission time is extracted as time unit information has been described, but the transmission time may be extracted as information in time zone units. In this case, the transmission time is acquired as time zone information, for example, within working hours, outside working hours, and late night hours.

[Feature information: Pattern information in title information]
FIG. 4 is a diagram illustrating a specific example of pattern information included in title information acquired based on a received mail and an example of a notation fluctuation dictionary d3. Lists L2-1 to L2-3 in the figure show specific examples of title information included in the mail headers of the received mails of three transmission source addresses suzuki, tanaka, and itpml2. As described above with reference to FIG. 2, the title information is acquired based on the subject information. The pattern information indicates, for example, a notation fluctuation phrase, a prefix, and a suffix phrase.

  The notation fluctuation dictionary d3 in FIG. 4 is a dictionary in which words and phrases that are likely to cause notation fluctuation are registered in advance. The notation fluctuation means that different character notation exists for one phrase having the same sound and the same meaning. The notation shaking phrase is, for example, a bracket type, a symbol type, a full-width or half-width swing of a symbol, and the like. Specifically, the notation swing phrases are "server" and "server", "meeting" and "meeting", "-(full-width)" and "-(half-width)", "" "and" [] ", etc. is there.

  Title information in legitimate received mail with the same source address has a tendency characteristic of selection of the sender's word. For this reason, the title information in the legitimate received mail having the same source address often has the same written phrase, prefix, and suffix. Also, common prefixes and suffixes exist in title information such as a mail magazine with the same source address.

  First, the received mail title information list L2-1 from the transmission source address tanaka will be described. The title information T1 in the title information list L2-1 has the notation fluctuation phrase “-(half-width hyphen)” included in the notation fluctuation dictionary d3. Therefore, a hyphen of a single-byte character is extracted as feature information from the title information T1. Further, the title information T1 includes a prefix phrase “☆ business” common to other received mails. Therefore, the prefix phrase “☆ business” is also extracted as feature information based on the title information T1. In the same manner, feature information is extracted based on the title information of other received mails with the same source address.

  Next, description will be made based on the title information list L2-2 of the received mail from the transmission source address suzuki. The title information T2 in the title information list L2-2 includes the notation fluctuation phrases “meeting”, “: (half-width colon)”, and “-(half-width hyphen)”. Therefore, “meeting”, “: (half-width colon)”, and “− (half-width hyphen)” are extracted as feature information from the title information T2. For other received mails, feature information is extracted based on the title information in the same manner.

  The description will be made based on the title information list L2-3 of the received mail from the source address itpml2. The title information T3 in the title information list L2-3 includes a notation swing phrase ("") and a suffix "X communication News-No." Therefore, ““ ”” and “X Communication News-No.” Are extracted as feature information from the title information T3. Similarly, pattern information included in each title information is extracted as feature information for other received mails.

  In this manner, pattern information such as notation fluctuation, prefix, and suffix included in the title information is acquired as feature information based on each received mail. The pattern information in the title information is information that is difficult to impersonate by a third party, although the tendency varies depending on the sender. For this reason, pattern information in the title information is used as a comparison target as feature information, so that a more detailed and flexible similarity determination can be performed.

[Feature information: Destination information]
FIG. 5 is a diagram illustrating a specific example of the destination information acquired based on the received mail. Destination information lists L3-1 to L3-3 in the figure show specific examples of the destination information included in the mail headers of the received mails of the three transmission source addresses suzuki, tanaka, and itpml2. The destination information is acquired based on the To information and Cc information in the mail header. In the example shown in the figure, the address indicating the destination is represented by an easily identifiable name such as Sato, Yamada B, or Mgm-ml.

  Specifically, according to the first destination information in the destination information list L3-1 of the received mail from the source address tanaka, Sato is specified for To and Yamada B and Mgm-ml are specified for Cc. Similarly, according to the first destination information in the destination information list L3-2 of the received mail from the source address suzuki, Sato is specified for To and Yamamoto B and Suzuki (sender himself) are specified for Cc.

  The destination information lists L4-1 to L4-3 in FIG. 5 show patterns of destination information included in the destination information lists L3-1 to L3-3. For example, the destination information list L3-1 of the source address tanaka has a lot of destination information in which Sato is designated as To and Yamada B and Mgm-ml are designated as Cc. Further, the destination information list L3-2 of the transmission source address suzuki has a lot of destination information in which Sato is designated as To and Yamamoto B and Suzuki are designated as Cc. Similarly, the destination information list L3-3 of the source address itpml2 has a lot of destination information in which Sato, Tanaka, Suzuki, and Kato are specified for To.

  As described above, To information and Cc information included in the destination information are acquired as feature information based on each received mail. The destination information may include a destination information pattern that is frequently specified for each source address.

  In the destination information list L3-2, Suzuki designated as Cc indicates the mail address of the sender. This indicates a case where mail is transmitted to the sender. Generally, in a targeted attack mail, it is difficult to specify the sender's mail address in Cc. This is because the target-type attack mail in which the sender is misrepresented increases the possibility of being detected early by designating the sender mail address or other address in Cc. For this reason, in this embodiment, the accuracy of detection of the target-type attack mail is improved by making Cc information in addition to To information subject to comparison and determination as feature information.

[Feature information: Source IP address]
FIG. 6 is a diagram illustrating a specific example L5 of the IP address of the transmission source server acquired based on the received mail and a specific example L6 of the transit time zone. A list L5 in the figure shows a specific example of the IP address of the transmission source server included in the mail headers of the received mails of the three transmission source addresses Suzuki, tanaka, and itpml2. As described above with reference to FIG. 2, the Received information on the second line indicates a record of the transmission server and includes the IP address information of the transmission server.

  For example, in the information L5-1 of the IP address list L5 in FIG. 6, the received mail of the source address itpml2 is transmitted from the server of the IP address “x0.26.0. *** (higher three levels)”. It shows that. In this example, * in the IP address indicates a value that is not compared. Similarly, the information L5-2 in the IP address list L5 indicates that the received mail having the transmission source address Suzuki is transmitted from the server having the IP address “x4.65.5. ***”.

  In the example of FIG. 6, the upper three-level information is acquired as the feature information for the IP address of the transmission server. Thus, in this embodiment, the upper predetermined level in the IP address of the transmission server is acquired as the feature information. For example, upper two-level information such as “x4.65. ***. ***. ***” may be acquired as the feature information. This is because the lower level of the IP address of the transmission server is likely to fluctuate when the IP address is dynamically assigned or when the transmission server is distributedly operated.

  Further, when mails are transmitted from the same transmission source address by a plurality of transmission servers such as a company and a home, the IP address of the transmission source server is different even if it is a legitimate received mail. However, in such a case, the IP address of the transmission source server is limited to two patterns of IP addresses when transmitting from the company and home.

  As described above, based on each received mail, the IP address information (in this example, the upper three levels) of the transmission source server included in the Receive information is extracted as the feature information. Further, since the IP address information is information that is easily limited to a specific pattern for each source address, the accuracy of detection of the target-type attack mail is improved by being compared as feature information.

[Feature information: Via time zone]
A list L6 in FIG. 6 shows a specific example of the transit time zone included in the mail headers of the received mails of the three transmission source addresses suzuki, tanaka, and itpml2. The transit time zone is acquired based on the time zone information included in the Received information of one or a plurality of servers that are routed from the transmission server of the transmission source to the reception server.

  For example, the information L6-1 of the transit time zone list L6 in FIG. 6 indicates that the received mail with the transmission source address suzuki is transmitted via the server of the time zone of +0800 (China). Similarly, the information L6-2 of the transit time zone list L6 is transmitted via the server of time zone +0800 (China) and the server of time zone +0900 (Japan) by the received mail of the sender address suzuki. Indicates that

  Thus, based on each received mail, each time zone information included in the transit server information (Receive information) is extracted as feature information. A targeted attack email may be sent via an overseas server. For this reason, the accuracy of detection of the target-type attack mail is improved by using the time zone of the transit server of the mail to be received as a comparison target as the feature information.

[Feature information: Mailer used]
As described above with reference to FIG. 2, the used mailer information is acquired based on the X-Mailer information. In general, the mailer software used when sending an email hardly changes depending on the sender. For this reason, the information of the used mailer acquired based on the received mail of the same transmission source address is highly likely to be the same. For this reason, the accuracy of detection of the target-type attack mail is improved by using the used mailer information as feature information.

[Feature information: Combination information]
FIG. 7 is a diagram illustrating a specific example of the combination feature information acquired based on the received mail. The mail header Mh in the figure is the same as the mail header Mh in FIG. The domain information H7 of the transmission source server, the IP address H5 of the transmission source server, and the time zone H4 of the transmission source server in the figure indicate information (transmission source information) related to the mail transmission source environment. In the figure, feature information (combination feature information) obtained by combining a plurality of pieces of transmission source information among these pieces of transmission source information will be described.

  Targeted attack emails are sent with spoofed legitimate senders. For this reason, even if a part of the source information of the combination feature information matches between the targeted attack mail and the legitimate received mail, the combination of the plurality of source information is difficult to match. On the other hand, a combination of a plurality of pieces of source information matches between legitimate received emails having the same source address. Moreover, even if it is a legitimate received mail transmitted from the same transmission source address by a plurality of base servers, such as home and office, the combination of transmission source information is limited to a specific pattern. For this reason, as the feature information, the combination feature information is used as a comparison target and reflected in the similarity, thereby improving the accuracy of detection of the target-type attack mail.

  A table L7 in FIG. 7 shows an example of a combination of the domain, IP address, and time zone of the transmission source server as the combination feature information. For example, in L7-1 in Table L7, the time zone is Japan and the domain is aaa. xx. com and the IP address is “x21.23.01. *** (upper three levels)”. Thus, the domain, IP address, and time zone of the source server are limited to a specific pattern with respect to the source address. For this reason, for example, even when a part of the domain, IP address, and time zone of the transmission source server is misrepresented in the mail header Mh of the mail to be received, the combination feature information does not match and is reflected in the similarity Is done.

  As described with reference to FIGS. 3 to 7, a plurality of feature information is extracted based on the mail header Mh of the received mail. Based on a plurality of regular received mails, feature information is extracted for each received mail, and a feature information DBd1 is generated. Next, an example of the feature information DBd1 generated based on the mail header Mh of the received mail will be described.

[Specific Example of Feature Information DBd1]
FIG. 8 is a diagram illustrating a specific example of the feature information DBd1. The feature information DBd1 in FIG. 5 includes, for example, for each source mail address, the IP address of the source server, the time zone, the transmission time zone, the mailer used, the transit time zone, the domain information of the source server, To information, and Cc information. The pattern information in the title information is included as feature information. However, the example of the feature information included in the feature information DBd1 is not limited to this example.

  In the example of FIG. 8, e-mail addresses are represented as ID4 and ID20, for example. Further, the feature information DBd1 in FIG. 6 converts the time zone and mailer information into simple information such as numerical values and holds the information. For example, a value 1 relating to the time zone indicates 8 o'clock to 10 o'clock, and a value 2 indicates 10 o'clock to 12 o'clock. Further, for example, a value 1 relating to the mailer used indicates Foxmail, and a value 2 indicates Thunderbird.

  Further, the feature information DBd1 in FIG. 8 also stores the subject information after converting it into simple information such as numerical values. For example, the value 1 of the first argument in the subject information (1, 1) indicates “-(hyphen)”, and the value 1 of the second argument indicates double-byte characters. Similarly, for example, the first argument value 1 in the subject information (1, 2) is “(hyphen)”, and the second argument value 2 is a single-byte character. For example, the subject information (7, 7) indicates the prefix phrase “X communication”.

  In the feature information DBd1 of FIG. 8, the feature information with ID = 1 indicates an example of feature information extracted based on the mail header of one received mail. Specifically, for the feature information extracted from the received mail with ID = 1, the source address is ID4, the upper three levels in the IP address of the source server are “x8.103.124. ***”, the time zone Indicates 2 (10 o'clock to 12 o'clock), and the mailer used is 1 (Foxmail). Furthermore, the transit time zone is only +0900 (Japan), the domain of the transmission source server is “aaaa.bbbb.com”, the address ID 31 is specified in addition to the receiver in To, and the address ID 4 (sender itself) in Cc Indicates that is specified. Further, it indicates that the title information includes the prefix phrase “X communication” in addition to “-(double-byte hyphen)”.

  In this way, feature information is extracted based on each received mail. The same applies to feature information extracted based on other received mails in the feature information DBd1 of FIG.

  Note that the feature information DBd1 in FIG. 8 is generated based on, for example, received mails of either or both of the mails received within the latest fixed period and the last fixed amount of received mails. However, since the transmission frequency varies depending on the mail source address, the number of received mails to be extracted may not be sufficient based on mails received within the most recent fixed period. For this reason, a certain amount of received mails may be extracted.

  In addition, feature information extracted based on received mail may change due to changes in the environment of the mail sender. For example, when a mail sender is transferred or a department is changed, there is a possibility that characteristic information such as the IP address of the transmission source server, domain information, and destination information will change. Therefore, it is desirable that the feature information DBd1 is periodically updated so that changes in the feature information are appropriately reflected. As a result, the similarity between the reception target mail and the received mail is determined in a timely manner based on the appropriately updated feature information DBd1.

  Next, the flow of the mail check process in the present embodiment will be described based on the flowchart diagram.

[Flowchart: Flow of similarity determination processing]
FIG. 9 is a flowchart for explaining the flow of similarity determination processing in the mail check apparatus 200 according to this embodiment. In the process of FIG. 6, it is assumed that the feature information DBd1 is generated by the mail feature extraction unit 13 based on, for example, the regular received mails of the most recent month.

  When the mail receiving unit of the mail check unit 10 detects the mail to be received (S11), the target-type attack mail detection unit 14 of the mail check unit 10 has the same sender address as that of the target mail, that is, the same sender. It is determined whether there is a reception history (S12). The reception history indicates a list of received mails that the feature information DBd1 has extracted feature information. When there is a reception history of the same sender (YES in S12), the target-type attack email detection unit 14 receives the email to be received and N (i = 1 to N) received emails (hi) of the same sender. To hN).

  In the flowchart of FIG. 9, the received mail is compared with each of the N received mails, and the received mail (similar received mail) whose total matching amount value sim with the receiving target mail exceeds the reference matching amount value th. The number SN is determined as the similarity. When the number SN of similar received mails exceeds the reference similarity mm, the reception target mail is determined to be a regular mail. The reference matching amount value th and the reference number mm are determined in advance (S13). Initially, the number mm of similar reception target mails is initialized to 0 (S14).

  The target-type attack mail detection unit 14 compares the reception target mail with a plurality of received mails having the same source address, and calculates a total match value sim (S15). Subsequently, the target-type attack mail detection unit 14 determines whether or not the calculated total matching amount value sim exceeds the reference matching amount value th (S16). When the reference match amount value th is exceeded (YES in S16), the target-type attack mail detection unit 14 counts up the similar received mail count SN exceeding the reference match amount value th (S17). Next, the target-type attack mail detection unit 14 determines whether or not the similar received mail number SN exceeds the reference similarity mm (S18).

  When the number of similar received mails SN does not exceed the reference similarity (NO in S18), or when the total matching amount value sim does not exceed the reference matching amount value th (NO in S16), the target-type attack mail detecting unit 14 Increments the variable i and sets the next received mail having the same source address as the object of determination (S19). If the determined number of received emails (i) has not reached N (NO in S20), the targeted attack email detection unit 14 similarly calculates the similarity between the received email and the email to be received. (S15), the similarity is determined.

  On the other hand, when the number of similar received mails SN exceeds the reference similarity mm (YES in S18), it is determined that the mail is a legitimate mail because the similarity of the feature information with the legitimate received mail is high. Therefore, the target-type attack mail detection unit 14 adds the information of the reception target mail to the reception history information, and sets it as the extraction target of the feature information DBd1 (S24). Then, the mail server receives the reception target mail (S25).

  Returning to the determination in step S12, if there is no reception history of the same sender (NO in S12), it indicates that there is no feature information of the received mail of the same sender in the feature information DBd1. That is, it indicates that the reception target mail is a mail from a new sender. Therefore, the alert generation unit 15 displays warning information that the mail is from a new sender and needs to be confirmed by the user (S21). As described above, in the case of the mail from the new sender in this embodiment, the warning information is displayed because there is no feature information of the received mail in the feature information DB, but the warning information for the mail from the new sender is displayed. The method of suppressing the display of will be examined separately.

  In step S20, when the determined number of received emails reaches N (YES in S20), while the number of similar received emails SN does not exceed the reference similarity mm (NO in S18), that is, This indicates that all received mails having the same source address have been determined while it is not determined to be a regular mail. Therefore, the alert generating unit 15 displays warning information indicating that there is no received mail similar to the reception target mail (S22).

  When warning information (S21) that the received mail is a mail from a new sender or warning information (S22) that the received mail does not satisfy the similarity is displayed on the display screen or the like, the user Determines whether or not the reception of the reception target mail is permitted (S23). When reception of the reception target mail is permitted (YES in S23), the targeted attack mail detection unit 14 adds the information of the reception target mail to the reception history information (S24), and the mail server receives the reception target mail. (S25). On the other hand, when reception of the reception target mail is not permitted (NO in S23), the target-type attack mail detection unit 14 discards the reception target mail (S26). However, the target-type attack mail detection unit 14 may receive the reception target mail after the safety process after performing the safety process on the reception target mail. The security process is, for example, deleting an attached file, adding a warning text to the text, deleting a link in the text.

  Next, the calculation process of the total matching amount value sim in step S15 in the flowchart of FIG. 9 will be described based on the following flowchart.

[Flowchart: Flow of processing for calculating total matching amount value sim]
FIG. 10 is a flowchart for explaining the calculation processing of the total matching amount value sim of the feature information of the reception target mail and the received mail. First, the targeted attack mail detection unit 14 acquires transmission date information based on Date information included in the mail header of the reception target mail (S32). Subsequently, the target-type attack mail detection unit 14 determines whether or not the transmission day of the acquired transmission date and time information matches the transmission day of the week extracted from the compared received mail (S33).

  The target-type attack mail detection unit 14 adds a value 5 to the variable Score (S34) if they match (S34), and does not add to the variable Score if they do not match (NO in S33). Subsequently, the target-type attack mail detection unit 14 determines whether or not the transmission time zone in the acquired transmission date and time information matches the transmission time zone in the compared received mail (S35). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S36) if they match (S36), and does not add to the variable Score if they do not match (S35: NO).

  Next, the target-type attack mail detection unit 14 acquires pattern information in the title information based on the Subject information included in the mail header of the reception target mail (S38). Subsequently, the target-type attack mail detection unit 14 determines whether or not the acquired pattern information matches the pattern information extracted from the compared received mail (S38). If they match (YES in S38), the targeted attack mail detection unit 14 adds the value 5 to the variable Score (S39), and if they do not match (NO in S38), does not add to the variable Score.

  Next, the target-type attack mail detection unit 14 acquires destination information based on the To and Cc information included in the mail header of the reception target mail (S40). Subsequently, the target-type attack mail detection unit 14 determines whether or not the acquired destination information matches the destination information extracted from the compared received mail (S41). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S42) if they match (S41: NO), and does not add to the variable Score if they do not match (S41: NO).

  Next, the target-type attack mail detection unit 14 acquires use mailer information based on the X-mailer information included in the mail header of the reception target mail (S43). Subsequently, the target-type attack mail detection unit 14 determines whether or not the acquired use mailer information matches the use mailer information extracted from the received mail to be compared (S44). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S45) if they match (S45), and does not add to the variable Score if they do not match (NO in S44).

  Next, the targeted attack mail detection unit 14 acquires the received information of the transmission source server included in the mail header of the reception target mail (S46), and extracts the IP address information of the transmission source server based on the received information. (S47). Subsequently, the target-type attack mail detection unit 14 determines whether or not the acquired IP address information matches the IP address information extracted from the compared received mail (S48). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S49) if they match (S49), and does not add to the variable Score if they do not match (NO in S48).

  Next, the target-type attack email detection unit 14 determines that the transit time zone information based on the received information of the transit transmission server included in the email header of the email to be received is the transit time zone information extracted from the received email to be compared. It is determined whether or not they match (S50). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S51) if they match (S51), and does not add to the variable Score if they do not match (NO in S50).

  Then, the targeted attack mail detection unit 14 receives the combination information (combination feature information) of the domain, IP address, and time zone of the transmission source server indicating the transmission source information included in the mail header of the reception target mail. It is determined whether or not it matches the combination feature information extracted from the completed mail (S52). The target-type attack mail detection unit 14 adds the value 5 to the variable Score (S53) if they match (S53), and does not add to the variable Score if they do not match (NO in S52).

  Thus, the variable Score, which is a cumulative value, is calculated as the total matching amount value sim between the reception target mail and one received mail. Then, the total match amount value sim is compared with the reference match amount value th (S16 in FIG. 9), and it is determined whether or not it is a similar received mail.

  As described above, the mail check unit 10 according to the present embodiment extracts a plurality of feature information included in a mail header of a received mail for a plurality of legitimate received mails, and generates a feature information DB d1. Then, the mail check unit 10 includes the feature information included in the mail header of the target email to be received, and the plurality of feature information of a plurality of received emails having the same source address as the reception target email referenced from the feature information DBd1. Determine similarity. Then, the mail check unit 10 determines that there is a possibility that the mail to be received whose similarity is less than the reference similarity, that is, the similarity is low, is an unauthorized mail, and notifies the user as a warning mail. In addition, since each of the mails to be received is compared for a plurality of pieces of feature information, the accuracy of warning mail detection is improved. In addition, the item example of the feature information compared with the flowchart figure of FIG. 10 is an example. Any of the plurality of feature information included in the mail header may be compared to calculate the similarity.

  In the flowcharts of FIGS. 9 and 10, received mail (similar received) whose reception target mail and source address are the same and whose total match amount value sim with the reception target mail exceeds the reference match amount value th. Email) SN is calculated and determined as the similarity. As a result, when the number of similar received mails is equal to the reference number (reference similarity), it is determined that the mail is a regular mail. However, it is not limited to this example. For example, the mail check unit 10 calculates the total accumulated value of the total matching amount values sim with the same predetermined source number of mails that have the same source address, and compares it with the reference similarity. Also good.

[Concrete example]
A specific example in the flowchart of FIG. 9 will be described based on the feature information DBd1 of FIG. In this example, it is assumed that the reference coincidence value th is 20 and the reference similarity is 10.

  The sender address of the mail to be received is ID4, the upper three levels in the IP address of the sender server are “x8.103.124. ***”, the time zone is 3, the identification value of the mailer used is Foxmail, A case where the transit time zone is only +0900 (Japan), the domain of the transmission source server is “aaaa.bbbb.com”, ID31 is specified in addition to the receiver in To, and ID4 is specified in Cc. The title information includes a half-width hyphen. In addition, the transmission day of the reception target mail is assumed to be Tuesday, for example.

  For example, a case where a received mail having the same source address ID4 as the reception target mail in the feature information DBd1 of FIG. In the feature information DBd1 of FIG. 8, the feature information of the received mail whose transmission source address is ID4 indicates the feature information of ID = 1 and 3. Although not shown, it is assumed that the feature information DBd1 in FIG. 8 has extracted feature information of 90 received mails whose source address is ID4.

  First, the targeted attack mail detection unit 14 acquires transmission date / time information included in the mail header of the reception target mail (S32), and the transmission day of the week in the acquired transmission date / time information is extracted from the received mail with ID = 1. It is determined whether or not it coincides with the transmitted day of the week (S33). In the example of the feature information DBd1 in FIG. 8, the transmission day of the week is not extracted. For example, it is assumed that the transmission day of the received mail with ID = 1 is Friday. In this case, since the transmission day of the week does not match (NO in S33), the variable Score remains 0.

  Subsequently, the target-type attack mail detection unit 14 compares the transmission time zones (S35). In this example, the transmission time zone of the reception target mail is 3, and the transmission time zone of the received mail with ID = 1 is 2, so the transmission time zones do not match (NO in S35). For this reason, the variable Score remains at 0. Next, the target-type attack mail detection unit 14 acquires pattern information in the title information (S37) and compares it (S38). In this example, since the title information of the received mail and the received mail with ID = 1 does not match (NO in S38), the variable Score remains at 0.

  Subsequently, the target-type attack mail detection unit 14 acquires destination information included in the mail header of the reception target mail (S40) and compares it (S41). In this example, since the destination information of the received mail and the received mail with ID = 1 match (YES in S38), the value 5 is added to Score. Subsequently, the target-type attack mail detection unit 14 acquires the used mailer information included in the mail header of the reception target mail (S43) and compares it (S44). In this example, since the used mailer information of the received mail and the received mail with ID = 1 match (YES in S44), the value of Score increases to 10.

  Subsequently, the target-type attack mail detection unit 14 extracts the IP information of the transmission server included in the mail header of the reception target mail (S46, S47) and compares it (S48). In this example, since the IP address (the upper three levels) of the transmission source server of the received mail and the ID = 1 received mail match (YES in S48), the value of the variable Score increases to 15. To do. Subsequently, the target-type attack mail detection unit 14 compares the transit time zone information included in the mail header of the reception target mail (S50), but if it matches (YES in S50), the value of the variable Score is set to 20. To increase.

  Then, the target-type attack mail detection unit 14 compares the combination of the domain of the transmission source server, the IP address of the transmission source server, and the time zone of the transmission source server included in the mail header of the reception target mail (S52). In this example, the domain of the transmission source server of the mail to be received is aaaa.bbbb.com, the IP address is “x8.103.124. *** (upper 3 levels)”, and the time zone is +0900 (Japan). . For this reason, the combination feature information of the mail to be received matches the combination feature information of ID = 1 in FIG. For this reason, the value of the variable Score increases to 25.

  Then, the value of the calculated variable Score, that is, the total matching amount value sim is compared with the reference matching amount value th (20 in this example). In this example, since the total matching amount value sim (variable Score = 25) exceeds the reference matching amount value th (YES in S16), the similar received mail count SN is incremented. Subsequently, the reception target mail is compared with the received mail of ID = 3 in the feature information DBd1, and the total matching amount value sim is calculated in the same manner and compared with the reference matching amount value th. This determination is also performed for the other received mail stored in the feature information DBd1 and whose source address is ID4. When the similar received mail count SN exceeds the reference similarity mm (10 in this example) (YES in S18), it is determined that the mail is a regular mail and reception is permitted (S24, S25).

  Further, for example, in the specific example, when the used mailer information included in the mail header of the mail to be received does not match (NO in S44), the value of the variable Score is 20. At this time, since the value of the variable Score (total match value sim) does not exceed the reference match value th (20 in this example) (NO in S16), the similar received mail count SN is not incremented. As described above, the similarity of the reception target mail is determined based on the matching result of the plurality of pieces of feature information. The reference coincidence threshold value th is appropriately set based on the number of feature information to be compared, the degree of variation, and the like.

  In the flowchart of FIG. 10, the calculation method of the total matching amount value sim when the value “5” is always added to the variable Score is described regardless of the content of any feature information. However, the added value added when the feature information matches may be changed by the feature information. Next, a weighting factor that is set for each feature information and changes the added value when the feature information matches will be described.

[Weighting factor]
The degree of variation in the feature information of a plurality of received mails with the same source address varies depending on the type of feature information. That is, depending on the type of feature information, the degree of variation is small for feature information whose contents are easily fixed or patterned, and the degree of variation is large for feature information whose contents are difficult to be patterned.

  For example, feature information such as used mailer, source server domain, time zone, transit time zone, etc. is information that depends on the transmission environment, so variation in feature information between received emails of the same source address The degree is small. That is, since the content of these feature information is limited to one or a specific pattern, it is easy to match between legitimate received mails having the same source address. Also, the degree of variation of the IP address of the transmission source server varies depending on the sender. For example, the degree of variation in the IP address of a sender server of a sender that transmits from a plurality of bases such as a home, a company, a business trip destination, etc. is large, and the IP address of the sender server of the sender that transmits from a specific base such as a company The degree of variation is small.

  On the other hand, since the pattern information, fixed phrases, transmission time zone, transmission day of the week, destination information, etc. in the title information are information artificially specified by the sender, the degree of variation in the feature information among the received mails large. In other words, these pieces of feature information are unlikely to match between legitimate received mails having the same source address.

  Therefore, a weighting coefficient is given depending on the type of feature information. For example, the weight coefficient is multiplied by Score in the flowchart of FIG. That is, when the weight coefficient is 3, the matching amount value corresponding to the feature information is 15 (= 5 * 3). However, the present invention is not limited to this example. For example, a weighting factor may be added to Score as in the matching amount value 8 (= 5 + 3). Any method may be used as long as the weighting factor is reflected on the similarity.

  Therefore, for example, among the feature information, the weight information is set to be small for the feature information having a small variation degree and the content is easily specified as the predetermined pattern, and the weight coefficient is set to be small for the feature information having a large variation degree and the content is difficult to specify. . As a result, in the total match value between the mail to be received and each received mail, the specific gravity of the match value corresponding to the feature information having a large weighting coefficient is large, and the match value corresponding to the feature information having a small weighting coefficient is Specific gravity becomes small. As a result, the degree of content variation in the received mail is small, and the comparison result of the highly reliable feature information is more remarkably reflected in the similarity, and the target-type attack mail candidate is detected more accurately.

  Further, as in the example of the IP address of the transmission source server described above, the tendency of the variation degree of the characteristic information in the received mail varies depending on the sender. For this reason, the weighting factor may be adjusted in units of source addresses based on the degree of variation in the characteristic information of received mails with the same source address. That is, the difference in the degree of variation for each sender is absorbed and dealt with by the weight coefficient of each feature information set for each sender. The weighting factor is updated as appropriate based on the most recent predetermined amount of received mail. Thereby, the weighting coefficient of the feature information for each sender is set to an optimum value based on the degree of variation in the feature information of the received mail of each sender.

  Thereby, the comparison result of the feature information with a small degree of content variation in the received mail of the same source address is more remarkably reflected in the similarity, so that the targeted attack mail candidate is detected with higher accuracy. For example, with respect to the transmission source address of a mail transmitted at a specific transmission date and time such as a mail magazine, the weighting factor of feature information related to the transmission date and time (transmission day of the week and transmission time) is set to a large value.

  Also, for example, among the feature information, the weighting factor of the first feature information group depending on the transmission environment indicating the IP address of the sender mail server, the domain information of the sender mail server, the time zone information, and the sender mailer type is large, The weighting factor of the artificial second feature information group due to the sender indicating the transmission day of the week, transmission time, title information, and destination information is set small. In a legitimate received mail, the content of the feature information in the first feature information group is easily limited to a specific pattern and the degree of variation is small, and the content of the feature information in the second feature information group is less likely to be limited in tendency to vary. This is because it has a characteristic of being large.

  Therefore, for the total match value of the received mail and each received mail, the weighting factor of the feature information of the first feature information group is increased to increase the specific gravity of the corresponding match value, and the second feature information group The weight coefficient of the feature information is reduced to reduce the specific gravity of the corresponding match value. As a result, the comparison result of the feature information depending on the transmission environment in the received mail is more remarkably reflected in the similarity, so that the targeted attack mail candidate can be detected with higher accuracy.

  In addition, the weighting factor of the feature information (combined feature information) obtained by combining a plurality of pieces of source information in the source information group including the IP address, domain information, and time zone information of the source mail server is shown for each source information. It may be set to a value larger than the weight coefficient of the feature information. For example, the weighting factor of the combination feature information is set to a value larger than the weighting factor of the individual feature information indicating the IP address of the transmission source mail server, domain information, and the like.

  Since targeted attack emails are sent with spoofed legitimate senders, even if some of the source information of the combination feature information matches between the targeted attack email and the legitimate received email, multiple Combinations of source information are difficult to match. Therefore, the weighting coefficient of the combination feature information indicating highly reliable feature information is set to a larger value, and the comparison result is more prominently reflected in the similarity, so that the target-type attack mail candidate is detected with higher accuracy. Is done.

  FIG. 11 is a diagram illustrating an example of the weighting factor information d2 of the feature information for each transmission source address. In this example, a weighting coefficient is assigned to each feature information for each source address. However, a weighting coefficient may be given to each feature information as a common value for all transmission source addresses.

  In the example of the weighting factor of FIG. 11, specifically, the weighting factor 10 is given to the IP address, time zone, domain, mailer used, and transit time zone of the source server whose source address is ID4. That is, a large weight coefficient (10 in this example) is assigned to the feature information that depends on the transmission environment. On the other hand, a weighting factor 7 is assigned to the transmission time zone, a weighting factor 5 is assigned to the destinations To and Cc, and a weighting factor 3 is assigned to the pattern information of the title information. That is, for feature information whose contents are likely to fluctuate by being artificially specified, a smaller weighting factor (in this example, 3, 5, 7) has a smaller degree of content variation and high reliability. Is assigned a larger weighting factor (10 in this example).

  In addition, a large value other than the pattern information is assigned to the weighting coefficient of each feature information whose source address is ID20. This indicates, for example, a weighting factor of a source address such as a mail magazine. For example, in a mail magazine or the like, since the content of feature information such as a transmission time zone and destination information is fixed, a large weighting coefficient is given. Although not shown in FIG. 11, weighting factors are similarly assigned to the combination feature information.

  As a result, even if the pattern information in the title information and the destination information do not match with respect to the legitimate mail to be received, the feature information such as the IP address of the transmission source server having a large weighting coefficient matches, The total matching amount value exceeds the reference matching amount value th. As a result, the mail to be received is determined as a regular mail.

  Further, it is desirable that the weighting coefficient is appropriately updated based on the latest regular received mail in the same manner as the feature information DBd1. As a result, even when the degree of variation in the feature information changes, the similarity of the mail to be received is timely adjusted by adjusting the specific gravity of the match value corresponding to each feature information in the total match value. Determined.

  As described above, the mail check apparatus 200 according to the present embodiment extracts a plurality of feature information included in a mail header of a received mail for a plurality of regular received mails, and generates a feature information DB d1. Then, the mail check device 200 includes the first plurality of feature information included in the mail header of the reception target email, and the plurality of received emails having the same source address as the reception target email referenced from the feature information DBd1. When the similarity with the plurality of feature information items 2 is less than the reference similarity, the reception target mail is detected as a warning mail candidate.

  Targeted attack e-mails are sent with spoofed legitimate senders, so it is often difficult for humans to judge, but the e-mail check device 200 has received a legitimate received e-mail with the same sender as the e-mail to be received. By determining the degree of similarity with the mail and notifying the reception target mail having a low similarity, a candidate for the target-type attack mail can be automatically detected. As a result, the mail check device 200 can detect a target attack mail candidate before being received by the mailer, and can avoid damage.

  In addition, since the mail check device 200 according to the present embodiment enables operation in a client environment such as a PC or a mobile terminal, it is not necessary to manage each user's reception history information and feature information in a server environment. Moreover, since the characteristic information is a part of information included in the mail header of the received mail, it is difficult to identify a specific individual. This is also effective from the viewpoint of holding personal information.

  In the mail check device 200 according to the present embodiment, the plurality of pieces of feature information includes first feature information including an IP address of a sender mail server, domain information of the sender mail server, time zone information, and a sender mailer type. Have any one or more of the group. As a result, the mail check device 200 can determine the similarity between the reception target mail and the received mail with higher accuracy based on the feature information having a small variation degree depending on the mail transmission environment.

  In the mail check device 200 according to the present embodiment, the plurality of feature information further includes one or more of a second feature information group including a transmission day, a transmission time, title information, and destination information. . As a result, the mail check device 200 further determines the similarity between the reception target mail and the received mail based on the characteristic information having the artificial tendency characteristic by the sender in addition to the characteristic information depending on the mail transmission environment. The degree can be determined more closely. As a result, the mail check device 200 detects featured attack mail candidates even when the characteristic information related to the transmission environment in the mail header is misrepresented by comparing characteristic information that is difficult to impersonate as a comparison target. be able to.

  In the mail check device 200 according to the present embodiment, the feature information DB d1 has a weighting factor for each feature information, and the weighting factor has a first degree of variation in feature information for a plurality of received emails. The first weighting factor (for example, 10) is set in the case of (the degree of variation is small), and the first weighting factor is set in the case where the degree of variation in the feature information is a second degree (the degree of variation is large) greater than the first degree. A second weighting factor (for example, 5) smaller than the weighting factor is set. Then, in the detection step, the mail check device 200 determines whether or not the plurality of feature information of the reception target email matches the plurality of feature information in the plurality of received emails having the same source address, The degree of similarity is obtained according to the cumulative added value of each matching amount value reflecting the weighting factor corresponding to the matched feature information.

  As described above, the weighting coefficient is set to be large for feature information whose content of variation is small and the content is easily specified in a predetermined pattern, and the weighting factor is set to be small for feature information whose content is difficult to specify. As a result, in the total match value between the mail to be received and each received mail, the specific gravity of the match value corresponding to the feature information having a large weighting coefficient is large, and the match value corresponding to the feature information having a small weighting coefficient is Specific gravity becomes small. As a result, the comparison result of the feature information with a small degree of content variation in the received mail is more remarkably reflected in the similarity, and the targeted attack mail candidate can be detected with higher accuracy.

  Alternatively, in the mail check apparatus 200 according to the present embodiment, the IP address of the transmission source mail server, the domain information of the transmission source mail server, the time zone information, and the weight coefficient of the characteristic information of the first characteristic information group indicating the transmission mailer type Is set to a first weighting factor (eg, 10). Then, the weighting factor of the feature information of the second feature information group indicating the transmission day of the week, the transmission time, the title information, and the destination information is set to a second weighting factor (for example, 5) smaller than the first weighting factor. Then, in the detection step, the mail check device 200 determines whether or not the plurality of feature information of the reception target email matches the plurality of feature information in the plurality of received emails having the same source address, The degree of similarity is obtained according to the cumulative added value of each matching amount value reflecting the weighting factor corresponding to the matched feature information.

  As described above, the feature information whose content is likely to be limited to a specific pattern due to the transmission environment has a large weighting factor, and the feature information whose content is difficult to be specified due to the dependency on the sender is set to a small weighting factor. The As a result, in the total match value of the mail to be received and each received mail, the weight of the match value corresponding to the feature information whose contents are easily specified in a predetermined pattern becomes large, and it corresponds to the feature information whose contents are difficult to specify. The specific gravity of the coincidence amount value becomes small. Thereby, when the reception target mail is a regular mail, the total matching amount value of the feature information with each received mail becomes large, and the target attack mail is detected with higher accuracy.

  Furthermore, in the mail check device 200 according to the present embodiment, the feature information is a combination feature obtained by combining a plurality of pieces of source information from a group of source information including the IP address of the source mail server, domain information, and time zone information. Information, and the weighting factor of the combination feature information is set to a third weighting factor (for example, a value greater than 10) that is larger than the weighting factor of each feature information indicated by the transmission source information. Then, in the detection step, the mail check device 200 determines whether or not a combination of a plurality of pieces of transmission source information that is combination feature information matches.

  Since the targeted attack mail is transmitted by spoofing a legitimate sender, the combination of feature information depending on the transmission environment is unlikely to match between the targeted attack mail and the legitimate received mail. Therefore, the mail check device 200 makes it possible to detect the target-type attack mail with higher accuracy by comparing the combination feature information, which is a combination of information indicating the transmission source information, and reflecting it in the similarity. For this reason, the mail check device 200 increases the weighting coefficient of the combination feature information that is highly reliable feature information, and more significantly reflects the comparison result in the similarity, thereby detecting the target attack mail candidate. Make it more accurate.

  A weighting factor for each feature information may be provided for each source address. At this time, the weighting coefficient for each transmission source address is determined based on the degree of variation in feature information among a plurality of received mails having the same transmission source address. As a result, when the tendency of the variation degree of the feature information varies depending on the transmission source address, it is possible to determine with higher accuracy whether the reception target mail has the same characteristics as the received mail of the same transmission source address. Become. In other words, the target attack mail candidate is detected with higher accuracy by accurately reflecting the characteristic of the variation degree of the characteristic information in the received mail of the same source address in the similarity.

  In addition, the mail check apparatus 200 according to the present embodiment regularly receives a plurality of regular received mails in either or both of the received mails in the latest fixed period and the last fixed amount of received mails. For the mail, a plurality of feature information included in the mail header of the received mail is extracted to generate and update the feature information DB d1. Thereby, the mail check apparatus 200 can determine the similarity of the reception target mail in a timely manner according to the latest characteristic information by appropriately updating the characteristic information DBd1 based on the legitimate received mail. For this reason, even when the transmission environment of a regular sender changes, the target type attack mail candidate is always properly detected by appropriately updating the feature information DBd1 based on the latest regular received mail. .

  In the mail check device 200 according to the present embodiment, the similarity indicates the number of received emails in which the cumulative addition value of the matching amount values exceeds the reference matching amount value. In other words, the mail check device 200 determines that the received mail that has a high degree of coincidence between the mail to be received and the characteristic information is a regular mail when the number of the received mails is equal to the reference number. Thereby, since it determines based on the similarity with several received mail, the mail check apparatus 200 can detect a target-type attack mail with higher precision.

  The mail check process in the present embodiment may be stored as a program in a computer-readable recording medium, and may be performed by the computer reading and executing the program.

  The above embodiment is summarized as follows.

(Appendix 1)
An email check method for detecting a warning email candidate from a newly received target email,
A feature information DB generating step for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of regular received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detection step of detecting the reception target mail as a warning mail candidate when the similarity with the information is less than the reference similarity.

(Appendix 2)
In Appendix 1,
The first and second plurality of feature information is one of an IP address of a sender mail server, domain information of the sender mail server, time zone information, and a first feature information group having a sender mailer type. Or an email check method with multiple.

(Appendix 3)
In Appendix 2,
The first and second plurality of feature information further includes one or more of a second feature information group having a transmission day of the week, a transmission time, pattern information in title information, and destination information.

(Appendix 4)
In any one of supplementary notes 1 to 3,
The feature information DB has a weighting factor for each feature information,
The weighting factor is set to a first weighting factor when the variation degree of the feature information is the first degree for the plurality of received mails, and the variation degree of the feature information is larger than the first degree. Set to a second weighting factor that is smaller than the first weighting factor in the case of a second degree;
The detection step determines whether or not the first plurality of feature information and the second plurality of feature information match each other, and each match in which the weighting factor corresponding to the matched feature information is reflected A mail check method for obtaining the similarity according to a cumulative addition value of quantity values.

(Appendix 5)
In Appendix 3,
The feature information DB has a weighting factor for each feature information,
The weighting factor of the feature information of the first feature information group is set to a first weighting factor, and the weighting factor of the feature information of the second feature information group is set to a second weighting factor smaller than the first weighting factor. And
The detection step determines whether or not the first plurality of feature information and the second plurality of feature information match each other, and each match in which the weighting factor corresponding to the matched feature information is reflected A mail check method for obtaining the similarity according to a cumulative addition value of quantity values.

(Appendix 6)
In any one of supplementary notes 1 to 3,
The feature information DB has a weighting factor for each feature information,
The feature information further includes combination feature information obtained by combining a plurality of pieces of sender information from a sender information group including a sender mail server IP address, domain information, and time zone information,
The weighting factor of the combination feature information is set to a third weighting factor that is larger than the weighting factor of each feature information indicated by the transmission source information,
The detection step determines whether or not each of the plurality of received mails matches the combination of the plurality of transmission source information as the combination feature information for the reception target mail, and corresponds to the matched feature information A mail check method for obtaining the similarity according to a cumulative addition value of each matching amount value in which the weighting factor is reflected.

(Appendix 7)
In Appendix 4,
The weighting factor is provided for each source address,
The mail check method, wherein the variation degree of the feature information is a variation degree of the feature information in the plurality of received mails having the same transmission source address.

(Appendix 8)
In any one of appendices 1 to 7,
The plurality of received emails may indicate either or both of emails received within a recent period of time, or a certain amount of emails that have been received most recently.
The feature information DB generation means is a mail check method for periodically updating the feature information DB.

(Appendix 9)
In any of Supplementary Notes 4 to 6,
The similarity check is an email check method that indicates the number of received emails in which a cumulative addition value of the match value exceeds a reference match value.

(Appendix 10)
In Appendix 2,
The mail check method, wherein the IP address of the sender mail server is a reference upper level IP address among IP addresses.

(Appendix 11)
A mail check device that detects a warning mail candidate from a newly received target mail,
A feature information DB generating means for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of legitimate received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detecting unit that detects the reception target mail as a warning mail candidate when the similarity to the information is less than the reference similarity.

(Appendix 12)
A computer-readable mail check program for causing a computer to execute a mail check process for detecting a warning mail candidate from a newly received target mail,
The email check process
A feature information DB generating step for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of regular received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detection step of detecting the reception target email as a warning email candidate when the similarity to the information is less than a reference similarity.

200: mail check device, 10: mail check unit, 21: mailer,
22: Alert user interface, 11: Mail server, 12: Mail receiving device,
13: Mail feature extraction unit, 14: Targeted attack mail detection unit, 15: Alert generation unit 15,
d1: Feature information DB, d2: Weight coefficient information, d3: Notation fluctuation dictionary

Claims (12)

An email check method for detecting a warning email candidate from a newly received target email,
A feature information DB generating step for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of regular received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detection step of detecting the reception target mail as a warning mail candidate when the similarity with the information is less than the reference similarity. In claim 1,
The first and second plurality of feature information is one of an IP address of a sender mail server, domain information of the sender mail server, time zone information, and a first feature information group having a sender mailer type. Or an email check method with multiple. In claim 2,
The first and second plurality of feature information further includes one or more of a second feature information group having a transmission day of the week, a transmission time, pattern information in title information, and destination information. In any one of Claims 1 thru | or 3,
The feature information DB has a weighting factor for each feature information,
The weighting factor is set to a first weighting factor when the variation degree of the feature information is the first degree for the plurality of received mails, and the variation degree of the feature information is larger than the first degree. Set to a second weighting factor that is smaller than the first weighting factor in the case of a second degree;
The detection step determines whether or not the first plurality of feature information and the second plurality of feature information match each other, and each match in which the weighting factor corresponding to the matched feature information is reflected A mail check method for obtaining the similarity according to a cumulative addition value of quantity values. In claim 3,
The feature information DB has a weighting factor for each feature information,
The weighting factor of the feature information of the first feature information group is set to a first weighting factor, and the weighting factor of the feature information of the second feature information group is set to a second weighting factor smaller than the first weighting factor. And
The detection step determines whether or not the first plurality of feature information and the second plurality of feature information match each other, and each match in which the weighting factor corresponding to the matched feature information is reflected A mail check method for obtaining the similarity according to a cumulative addition value of quantity values. In any one of Claims 1 thru | or 3,
The feature information DB has a weighting factor for each feature information,
The feature information further includes combination feature information obtained by combining a plurality of pieces of sender information from a sender information group including a sender mail server IP address, domain information, and time zone information,
The weighting factor of the combination feature information is set to a third weighting factor that is larger than the weighting factor of each feature information indicated by the transmission source information,
The detection step determines whether or not each of the plurality of received mails matches the combination of the plurality of transmission source information as the combination feature information for the reception target mail, and corresponds to the matched feature information A mail check method for obtaining the similarity according to a cumulative addition value of each matching amount value in which the weighting factor is reflected. In claim 4,
The weighting factor is provided for each source address,
The mail check method, wherein the variation degree of the feature information is a variation degree of the feature information in the plurality of received mails having the same transmission source address. In any one of Claims 1 thru | or 7,
The plurality of received emails may indicate either or both of emails received within a recent period of time, or a certain amount of emails that have been received most recently.
The feature information DB generation means is a mail check method for periodically updating the feature information DB. In any one of Claims 4 thru | or 6.
The similarity check is an email check method that indicates the number of received emails in which a cumulative addition value of the match value exceeds a reference match value. In claim 2,
The mail check method, wherein the IP address of the sender mail server is a reference upper level IP address among IP addresses. A mail check device that detects a warning mail candidate from a newly received target mail,
A feature information DB generating means for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of legitimate received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detecting unit that detects the reception target mail as a warning mail candidate when the similarity to the information is less than the reference similarity. A computer-readable mail check program for causing a computer to execute a mail check process for detecting a warning mail candidate from a newly received target mail,
The email check process
A feature information DB generating step for extracting a plurality of feature information included in a mail header of the received email and generating a feature information database (hereinafter referred to as DB) for a plurality of regular received emails;
The first plurality of characteristic information included in the mail header of the reception target mail, and the second plurality of characteristics of the plurality of received mails having the same source address as the reception target mail referenced from the characteristic information DB. And a detection step of detecting the reception target email as a warning email candidate when the similarity to the information is less than a reference similarity.

Images