JP2017167934A - COMMUNICATION DEVICE, Mail processing method, and mail processing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication device, a mail processing method, and mail processing program that can determine whether a website indicated by a URL included in the body of an email is a malicious website or not before accessing the website on the Internet from a terminal.SOLUTION: A mail data processing unit 12 of a communication device 10 extracts a URL written in the body of a received email. An additional information acquisition unit 13 accesses a website indicated by the URL and creates an image file representing a screen image of the website. Then, the mail data processing unit 12 attaches the image file created by the additional information acquisition unit 13 to the original email. Next, a control unit 11 transmits the email with the image file attached to a mail server (TO) 40 via a transmission/reception unit 14.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication device, a mail processing method, and a mail processing program, and more particularly to a communication device, a mail processing method, and a mail processing program that analyze and process the content of the text of a received mail.

  In recent years, many security incidents related to leakage of confidential information such as personal information have occurred. For example, an end user who is not familiar with information security easily clicks on a URL (abbreviation of “Uniform Resource Locator”) included in the text of a received mail. There are cases of phishing scams, such as accessing a malicious website and leading to information leakage.

  In order to prevent leakage of information to the outside due to such malicious mail, a countermeasure may be taken such as separating a network that can receive mail and a network that can access the Internet.

  As other countermeasures, when a user accesses a website on the Internet, a redirect screen for inquiring whether or not the user can access is displayed to alert the user (for example, Patent Document 1), or a secure proxy server acts as a proxy. A technique for accessing a Web site (for example, Patent Document 2) is disclosed.

  As a technique related to the reception of malicious mail, Patent Document 3 describes a technique that can easily sort out junk mail. That is, the computer extracts the domain of the URL included in the received electronic mail. Then, when the domain is registered in a database in which a spam mail domain is set in advance, it is determined that the mail is a spam mail. If it is determined that the mail is spam, the fact that it is spam is notified or the mail is deleted.

JP, 2014-225120, A JP 2013-246474 A JP 2010-079619 A

  However, in both of the techniques described in Patent Document 1 and Patent Document 2, processing (for example, display of a redirect screen or proxy access) is performed after a terminal accesses a Web site on the Internet.

  Therefore, when a network that can receive mail and a network that can access the Internet are separated, the user needs to perform an operation of switching between the networks. Thereafter, the user knows that the website is an unauthorized website only after accessing the website on the Internet. For this reason, there is a problem that the time and effort spent by the user for the network switching operation are wasted. This is because, in general, the operation of switching the network to be used is, for example, a method in which a user moves to another place and operates on a different terminal, or a method in which remote access is performed to a device capable of accessing the Internet. This is because complicated operations such as a method of “connecting to the Internet from the device” are required.

  Therefore, there is a demand for a technique that allows the user to determine whether or not the site indicated by the URL included in the mail text is a malicious website before performing the network switching operation as described above.

  Note that Patent Document 3 does not describe any technique for preventing leakage of information to the outside due to a mail recipient receiving a malicious electronic mail.

  An object of the present invention is to provide a communication device, a mail, and a mail that can determine whether or not the site indicated by the URL included in the body of the mail is a malicious website before accessing the website on the Internet from the terminal. To provide a processing method and a mail processing program.

The communication device of the present invention
Control means for analyzing the text of the received first electronic mail and determining whether or not a URL (Uniform Resource Locator) is included in the text;
When the control means determines that the text contains a URL, it acquires screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text, and from the acquired screen information Mail data processing means for creating at least one first image file and attaching the created first image file to the first e-mail;
If the control means determines that the text contains a URL, the first e-mail processed by the mail data processing means is forwarded to the destination, while the control means has a URL in the text. A transmission / reception means for transferring the first electronic mail to a destination when it is determined that the first electronic mail is not included.

In addition, the mail processing method of the present invention includes:
Analyzing the text of the received first e-mail and determining whether the text contains a URL (Uniform Resource Locator);
When the URL includes a URL, screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text is acquired, and at least one first image is acquired from the acquired screen information. Creating a file, attaching the created first image file to the first e-mail, transferring the first e-mail with the first image file attached to a destination;
On the other hand, if the URL is not included in the text, the first electronic mail is transferred to the destination.

The mail processing program of the present invention is
Analyzing the text of the received first e-mail, and determining whether the text contains a URL (Uniform Resource Locator);
When the URL includes a URL, screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text is acquired, and at least one first image is acquired from the acquired screen information. An image data adding process for creating a file, attaching the created first image file to the first email, and transferring the first email to which the first image file is attached;
If the URL does not include the body, the computer is caused to execute a mail relay process for transferring the first electronic mail to a destination.

  The present invention has an effect that the user can determine whether or not the site indicated by the URL included in the body of the mail is a malicious website before accessing the website on the Internet from the terminal. is there.

It is a block diagram which shows the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the communication apparatus 10 in 1st Embodiment. It is a block diagram which shows the 2nd Embodiment of this invention.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a first embodiment of the present invention.

  Referring to FIG. 1, the present embodiment includes a communication device 10, a mail server (FROM) 20, a website 30, a mail server (TO) 40, a terminal 50, and a LAN (abbreviation of “Local Area Network”). .) 60 and a network 70.

  The communication device 10 includes a control unit 11, a mail data processing unit 12, an additional information acquisition unit 13, and a transmission / reception unit 14. Further, the communication device 10 receives mail from the mail server (FROM) 20 via the network 70, processes the received mail, and transfers it to the mail server (TO) 40. Further, the communication device 10 is configured to be accessible to the Web site 30 via the network 70. The communication device 10 and the mail server (TO) 40 are connected via a communication network (not shown) such as a LAN. The communication device 10 may be in the mail server (TO) 40.

  The mail server (FROM) 20 transmits mail addressed to the user who uses the terminal 50 to the mail server (TO) 40 via the network 70 and the communication device 10.

  The mail server (TO) 40 receives mail from the outside (for example, the mail server (FROM) 20) via the communication device 10.

  The terminal 50 is a terminal through which a user receives mail addressed to himself / herself that has arrived at the mail server (TO) 40 from the outside, and is connected to the mail server (TO) 40 via the LAN 60. Note that the LAN 60 is not connected to an external network (for example, the network 70), and the terminal 50 cannot be connected to an external website (for example, the website 30) via the LAN 60. .

  The network 70 is a wide area network such as the Internet.

  The transmission / reception unit 14 included in the communication device 10 transmits / receives mail to / from the mail server (FROM) 20 and the mail server (TO) 40.

  The mail data processing unit 12 has a function of extracting a URL included in the body of the received mail and a function of acquiring an image file representing a screen image of a website created by the additional information acquisition unit and attaching it to the original mail. Have.

  The additional information acquisition unit 13 has a function of accessing the Web site 30 via the network 70 and a function of acquiring screen information of the Web site 30 indicated by the URL extracted by the mail data processing unit 12 and creating an image file. .

  The control unit 11 controls mail delivery between the transmission / reception unit 14 and the mail data processing unit 12.

  The communication device 10 includes a storage device (not shown) that stores a program and at least one processor (not shown) that reads the program into a memory and executes an instruction.

  Next, the operation of the communication device 10 will be described with reference to the flowchart of FIG.

  FIG. 2 is a flowchart showing the operation of the communication apparatus 10 in the present embodiment.

  Referring to FIG. 2, first, the transmission / reception unit 14 receives a mail from the mail server (FROM) 20 (step S101). The received mail is assumed to be mail addressed to a user who uses the terminal 50 connected to the mail server (TO) 40.

  Next, the control unit 11 analyzes the text of the mail received by the transmission / reception unit 14 and determines whether or not a URL is included (step S102).

  When the URL is not included in the body of the mail (in the case of “NO” in step S102), the control unit 11 transmits the received mail to the mail server (TO) 40 via the transmission / reception unit 14 (step S106). ).

  When the URL is included in the mail text (in the case of “YES” in step S102), the control unit 11 passes the received mail to the mail data processing unit 12.

  The mail data processing unit 12 extracts all URLs included in the text of the received mail (step S103), and passes each extracted URL to the additional information acquisition unit 13. Since the method of analyzing the mail text and extracting the URL is a general technique, a detailed description is omitted.

  Next, the additional information acquisition unit 13 accesses a Web site indicated by each URL received from the mail data processing unit 12 and acquires screen information indicating a screen image of the Web site. Then, the additional information acquisition unit 13 creates a screen shot from the acquired screen information, and passes the created screen shot as an image file (step S104) to the mail data processing unit 12. Since a method for accessing the website indicated by the URL and converting the screen information of the website into an image file is a general technique, a detailed description thereof will be omitted.

  In addition, there is a possibility that the website accessed by the additional information acquisition unit 13 is a malicious website that is infected by a virus just by accessing (browsing). However, since such a Web site is configured such that a virus is infected when a normal client terminal used by a user accesses, a device such as the communication device 10 that does not have a screen display function is used. Even if accessed, it will not be infected by the virus.

  Next, the mail data processing unit 12 attaches the image file received from the additional information acquisition unit 13 to the original mail (step S105) and passes it to the control unit 11.

  The control unit 11 transmits the mail with the image file attached to the mail server (TO) 40 via the transmission / reception unit 14 (step S106).

  In this way, the screen image of the Web site indicated by the URL described in the body of the email is attached to the email as an image file. Then, the user receives a mail attached with an image file from the mail server (TO) 40 using the terminal 50 and confirms the image file. As a result, the user connects the terminal 50 to an external network (for example, the network 70) if necessary from the confirmed screen image, and accesses the website (for example, the website 30).

  In step S104, the additional information acquisition unit 13 determines not only the image information of each Web site, but also so-called WHOIS information (that is, the domain name of the Web site, an IP (abbreviation of “Internet Protocol”) address, and the like. To the public, such as organization names that can be searched from. In this case, in step S105, the mail data processing unit 12 transmits the WHOIS information to the user by inserting the WHOIS information into the body of the mail or embedding the WHOIS information into the image file.

  In step S104, the additional information acquisition unit 13 accesses the Web site indicated by the URL extracted from the body of the mail every time and creates an image file. However, the additional information acquisition unit 13 creates a predetermined storage location (not shown) in the communication device 10. And the URL and the image file may be associated with each other and stored for a predetermined period. In this case, if the URL received from the mail data processing unit 12 is the same URL stored in the predetermined storage location, the additional information acquisition unit 13 associates the URL with the URL and stores the predetermined memory. The image file stored in the location is transferred to the mail data processing unit 12. Thereby, when the same URL is described in a plurality of mails, the second and subsequent image file creation processes of the additional information acquisition unit 13 become unnecessary. In particular, when the same URL is described in many e-mails, such as when the URL is sent by junk e-mail, many accesses to one Web site do not occur, and the communication device 10 Processing load can be reduced.

  In step S105, the mail data processing unit 12 creates a screen image as an image file when the target mail is an HTML (abbreviation of “HyperText Markup Language”) mail as an image file. May be attached. In this case, the mail data processing unit 12 converts the target mail into a text mail and passes it to the control unit 11.

  The communication device 10 may be installed in the middle of a mail delivery route from the mail server (FROM) 20 to the mail server (TO) 40. In this case, the communication device 10 and the mail server (TO) 40 are connected via a wide area network. Then, the communication device 10 applies the process of converting the screen information of the Web site indicated by the URL described in the mail into an image file, as shown in the flowchart of FIG. become.

  As described above, in this embodiment, before the terminal accesses the website on the Internet, the user determines whether or not the website indicated by the URL described in the body of the email is a malicious website. There is an effect that it can be judged. In addition, there is an effect that it is possible to prevent easy connection of a mail recipient to a malicious website that is infected with a virus simply by accessing (browsing) the website.

  The reason is that the mail data processing unit 12 of the communication device 10 extracts the URL described in the text of the received mail. Then, the additional information acquisition unit 13 accesses the website indicated by the URL and creates an image file representing the screen image of the website. Then, the mail data processing unit 12 attaches the image file created by the additional information acquisition unit 13 to the original mail. Next, the control unit 11 transmits the mail with the image file attached thereto to the mail server (TO) 40 via the transmission / reception unit 14. This is because the user can grasp the screen image of the website without accessing the website indicated by the URL described in the body of the email.

[Second Embodiment]
Next, a second embodiment including the basic configuration of the first embodiment of the present invention will be described.

  FIG. 3 is a block diagram showing this embodiment.

  Referring to FIG. 3, the communication device 90 according to the present embodiment includes a control unit 91, a mail data processing unit 92, and a transmission / reception unit 94.

  The communication device 90 receives mail from a transmission source mail server (not shown), processes the received mail, and forwards it to a transmission destination mail server (not shown). The communication device 90 is configured to be able to access a website (not shown) on the Internet.

  The control unit 91 analyzes the text of the received first electronic mail and determines whether or not a URL is included.

  When the control unit 91 determines that the URL is included in the text of the first electronic mail, the mail data processing unit 92 extracts at least one URL from the text of the first electronic mail. Then, the mail data processing unit 92 acquires screen information representing a screen image of a site on the Internet indicated by each extracted URL.

  Next, the mail data processing unit 92 creates at least one first image file from the acquired screen information. Then, the mail data processing unit 92 attaches the created first image file to the first e-mail.

  When the control unit 91 determines that the URL is included in the text of the first electronic mail, the transmission / reception unit 94 transfers the first electronic mail processed by the mail data processing unit 92 to the destination. On the other hand, when the control unit 91 determines that the URL is not included in the text of the first electronic mail, the transmission / reception unit 94 transfers the first electronic mail to the destination.

  As described above, in the present embodiment, the Web site indicated by the URL described in the body of the email is the malicious Web before accessing the Web site on the Internet from the terminal, as in the first embodiment. There is an effect that the user can determine whether or not the site. In addition, there is an effect that it is possible to prevent easy connection of a mail recipient to a malicious website that is infected with a virus simply by accessing (browsing) the website.

  The reason is that the mail data processing unit 92 extracts the URL described in the text of the received e-mail. Then, the mail data processing unit 92 accesses the website indicated by the URL and creates an image file representing the screen image of the website. Then, the mail data processing unit 92 attaches the created image file to the original e-mail. Next, the transmission / reception unit 94 transfers the mail with the image file attached to the destination. This is because the user can grasp the screen image of the website without accessing the website indicated by the URL described in the body of the e-mail.

DESCRIPTION OF SYMBOLS 10 Communication apparatus 11 Control part 12 Mail data processing part 13 Additional information acquisition part 14 Transmission / reception part 20 Mail server (FROM)
30 Website 40 Mail Server (TO)
50 terminals 60 LAN
70 Network 90 Communication Device 91 Control Unit 92 Mail Data Processing Unit 94 Transmission / Reception Unit

Claims (10)

Control means for analyzing the text of the received first electronic mail and determining whether or not a URL (Uniform Resource Locator) is included in the text;
When the control means determines that the text contains a URL, it acquires screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text, and from the acquired screen information Mail data processing means for creating at least one first image file and attaching the created first image file to the first e-mail;
If the control means determines that the text contains a URL, the first e-mail processed by the mail data processing means is forwarded to the destination, while the control means has a URL in the text. A communication device comprising: a transmission / reception means for transferring the first electronic mail to a destination when it is determined that the first electronic mail is not included. The mail data processing means includes
In addition to the first image file, registration information on the Internet related to the domain to which the site on the Internet indicated by the URL included in the text belongs is acquired, and the acquired registration information is embedded in the first image file. The communication device according to claim 1, wherein the communication device is inserted into a text of the first electronic mail. The mail data processing means includes
When the first e-mail is an HTML (HyperText Markup Language) e-mail, a screen image displayed as the HTML e-mail is created as a second image file, the first e-mail is converted into a text e-mail, The communication apparatus according to claim 1 or 2, wherein the first image file and the second image file are attached to the first electronic mail converted into mail. The mail data processing means includes
Storing at least one URL extracted from the text of the first electronic mail in a predetermined storage location in association with the first image file corresponding to the URL;
If the URL extracted from the text of the second e-mail is the same as the URL stored in the predetermined storage location, the URL is stored in the predetermined storage location in association with the same URL. The communication apparatus according to claim 1, wherein the first image file is attached to the second e-mail. Analyzing the text of the received first e-mail and determining whether the text contains a URL (Uniform Resource Locator);
When the URL includes a URL, screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text is acquired, and at least one first image is acquired from the acquired screen information. Creating a file, attaching the created first image file to the first e-mail, transferring the first e-mail with the first image file attached to a destination;
On the other hand, a mail processing method for transferring the first electronic mail to a destination if the URL is not included in the body. In addition to the first image file, registration information on the Internet related to the domain to which the site on the Internet indicated by the URL included in the text belongs is acquired, and the acquired registration information is embedded in the first image file. The mail processing method according to claim 5, wherein the mail processing method is inserted into a text of the first electronic mail. When the first e-mail is an HTML (HyperText Markup Language) e-mail, a screen image displayed as the HTML e-mail is created as a second image file, the first e-mail is converted into a text e-mail, The mail processing method according to claim 5 or 6, wherein the first image file and the second image file are attached to the first electronic mail converted into mail. Holding at least one URL extracted from the text of the first e-mail and the first image file corresponding to the URL in a predetermined storage location in association with each other;
If the URL extracted from the text of the second e-mail is the same as the URL stored in the predetermined storage location, the URL is stored in the predetermined storage location in association with the same URL. The mail processing method according to claim 5, wherein the first image file is attached to the second electronic mail. Analyzing the text of the received first e-mail, and determining whether the text contains a URL (Uniform Resource Locator);
When the URL includes a URL, screen information representing a screen image of a site on the Internet indicated by at least one URL extracted from the text is acquired, and at least one first image is acquired from the acquired screen information. An image data adding process for creating a file, attaching the created first image file to the first email, and transferring the first email to which the first image file is attached;
A mail processing program for causing a computer to execute a mail relay process for transferring the first electronic mail to a destination when the body does not include a URL. In addition to the first image file, registration information on the Internet related to the domain to which the site on the Internet indicated by the URL included in the text belongs is acquired, and the acquired registration information is embedded in the first image file. The mail processing program according to claim 9, further comprising: causing a computer to execute site information addition processing to be inserted into the text of the first electronic mail.

Images