JP2020013314A - E-mail confirmation device, information processing method, and program - Google Patents

Abstract

To concurrently achieve both of convenience of a user using e-mail and suppression of an access to malicious information included in e-mail.SOLUTION: A display operation detection unit 10 detects a display operation of an e-mail performed by a mailer managing the e-mail. A character string extraction unit 20 extracts, with the detection of the display operation by the display operation detection unit 10 as a trigger, a character string in a predetermined format from the character strings included in the e-mail that is a target of the display operation. A character string determination unit 30 acquires an output when the character string extracted by the character string extraction unit 20 is input to a learning model, which is machine-learned so as to be input the character string and to output information indicating that the information represented by the character string is malignant or benign. A notification unit 40 notifies an output result of the learning model acquired by the character string determination unit 30.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a mail confirmation device, an information processing method, and a program.

  Conventionally, in order to prevent access to a malicious site included in an e-mail received by a user terminal, an external device executes access using address information included in the e-mail, and a screen image obtained as a result is transmitted to the user terminal. A transmission technique has been proposed (for example, see Patent Document 1).

JP 2013-246474 A

  In the above, address information to be restricted is registered in advance, and when an access request from a user terminal that has received an email matches an address registered in advance, the address is accessed in a secure environment. Technology. Therefore, even if a malicious address is not registered in advance, the user terminal may directly access the address. On the other hand, if an address where access restrictions are emphasized and addresses that do not need to be restricted are registered in advance, the convenience of the user of the user terminal may be impaired.

  The present invention has been made in view of these points, and an object of the present invention is to provide a technique for achieving both the convenience of a user using an email and the suppression of access to malicious information included in the email. I do.

  A first aspect of the present invention is a program. The program includes a computer having a display operation detecting function for detecting a display operation of an e-mail performed by a mailer managing the e-mail and a display operation detecting function detecting the display operation by the display operation detecting function. A character string extraction function that extracts a character string in a predetermined format from character strings included in the target e-mail, and a function to input the character string and determine whether the information indicated by the character string is malicious or benign A character string determination function that obtains an output when the character string extracted by the character string extraction function is input to a learning model that has been machine-learned so as to output information indicating the learning model; And a notification function for notifying the output result of the model.

  The notification function associates a character string extracted by the character string extraction function with an output result of the learning model that receives the character string as an input in a window different from the mailer in a display unit displaying the mailer. In addition, the information may be displayed on the display unit.

  The notification function may display the character string extracted by the character string extraction function in a selectable manner, the program, the computer, when the character string displayed by the notification function is selected, A launcher function for starting an application determined according to the type of the selected character string may be further realized.

  The notification function may cause the display unit to display a new window that displays whether or not to start an application in a selectable manner when an output result of the learning model that receives the selected character string as an input is malicious. .

  When the program causes the computer to display a character string on the display unit in a manner in which the notification function can be selected in a window different from the mailer, an operation of prohibiting a selection operation in a window displaying the mailer The restriction function may be further realized.

  In order to provide the above-mentioned program or update a part of the program, a computer-readable recording medium storing the program may be provided, and the program may be transmitted via a communication line. .

  A second aspect of the present invention is an information processing method. In this method, the processor detects an e-mail display operation performed by a mailer that manages the e-mail, and, if the display operation is detected, a character string included in the e-mail to be displayed. From, a step of extracting a character string in a predetermined format, and a learning model machine-learned to input the character string and output information indicating whether the information represented by the character string is malignant or benign, A step of obtaining an output when the extracted character string is input and a step of notifying the obtained output result of the learning model are executed.

  A third aspect of the present invention is a mail confirmation device. This device is a display operation detecting unit that detects a display operation of an e-mail performed by a mailer that manages an e-mail, and is a target of the display operation when the display operation detecting unit detects a display operation. A character string extraction unit that extracts a character string in a predetermined format from character strings included in an e-mail, and receives the character string as input, and outputs information indicating whether the information represented by the character string is malicious or benign. A learning model that is machine-learned to be output, a character string determining unit that obtains an output when the character string extracted by the character string extracting unit is input, and an output of the learning model that the character string determining unit obtains. And a notifying unit for notifying the result.

  Note that any combination of the above-described components and any conversion of the expression of the present invention between a method, an apparatus, a system, a computer program, a data structure, a recording medium, and the like are also effective as embodiments of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, the convenience of the user using an email and the suppression of access to the malicious information contained in an email can be made compatible.

It is a figure for explaining composition of an e-mail confirmation system concerning an embodiment of the invention. It is a figure which shows typically the functional structure of the mail confirmation part which concerns on embodiment. FIG. 9 is a diagram illustrating a display example in which a notification unit causes the display unit to display a malicious character string when it is not included. FIG. 8 is a diagram illustrating a display example in which a notification unit displays a malicious character string on a display unit when the malicious character string is included. FIG. 9 is a diagram illustrating an example of another window that the notification unit displays on the display unit when a malicious character string is included. FIG. 7 is a diagram illustrating an example of a screen for allowing a notification unit to select whether to activate an application to be displayed on a display unit. It is a schematic diagram for explaining DMZ. 6 is a flowchart illustrating a flow of a mail confirmation process executed by the communication terminal according to the embodiment.

<Outline of Embodiment>
FIG. 1 is a diagram for explaining a configuration of a mail confirmation system S according to the embodiment of the present invention. The mail confirmation system S according to the embodiment is configured such that a communication terminal 1 is connected to a mail server 2 and a determination server 3 via a communication network N in a communicable manner. Hereinafter, an outline of the mail confirmation system S according to the embodiment will be described with reference to FIG.

  The communication terminal 1 is a smartphone, a tablet PC (Personal Computer), a desktop PC, a notebook PC, or the like, and is a computer including a computational resource such as a CPU (Central Processing Unit) and a memory (not shown). The communication terminal 1 includes a mail confirmation unit 100, a display unit 200, and a mailer 300.

  The display unit 200 is configured integrally with the communication terminal 1 when the communication terminal 1 is a smartphone, a tablet PC, a notebook PC, or the like. When the communication terminal 1 is a desktop PC, the display unit 200 can be a device independent of the communication terminal 1. FIG. 1 shows an example in which the display unit 200 is integrated with the communication terminal 1.

  The mailer 300 is a general electronic mail client, and is application software for transmitting and receiving electronic mail (hereinafter, simply referred to as “mail”) and managing the transmitted and received mail. The mailer 300 displays a list of information indicating the subject, sender, transmission date and time, etc. of the mail addressed to the user of the mailer 300 acquired by the mail server 2.

  The mail confirmation unit 100 monitors a mail display operation of the mailer 300 by the user. When detecting the mail display operation by the user, the mail checking unit 100 extracts a character string that conforms to a specific format included in the mail before the mailer 300 displays the mail on the display unit 200.

  Here, the “specific format” extracted from the mail by the mail checking unit 100 is, for example, a URI (Uniform Resource Identifier) starting with a character string such as “http” or “ftp”, a mail address including “@”, This format includes information such as a telephone number and an IP (Internet Protocol) address for accessing a device different from the communication terminal 1 or a person different from the user of the communication terminal 1. The mail confirmation unit 100 is implemented as, for example, a plug-in of the mailer 300.

  The mail confirmation unit 100 transmits the extracted character string to the determination server 3 and acquires the result. The determination server 3 is a server different from the mail server 2, and receives a character string that conforms to a specific format as input, and performs machine learning (for example, to output information indicating whether the information represented by the character string is malignant or benign). , Machine learning such as Deep Neural Network). The determination server 3 acquires the output of the learning model that receives the character string received from the mail confirmation unit 100 and transmits the learning model output to the mail confirmation unit 100.

  In general, a learning model created by using machine learning has a high generalization property, and has a high discriminating power not only for a character string used for teacher data for model creation but also for a character string similar to the teacher data. Therefore, unlike the benign / malignant determination using a general blacklist / whitelist, the determination server 3 can determine the benign / malignant even with an unknown character string. For example, the determination server 3 determines that the character string received from the mail confirmation unit 100 is benign if the numerical value calculated using the sigmoid function exceeds a predetermined threshold value and determines that the character string is malignant if the numerical value is lower than the predetermined threshold value.・ You may decide to be malignant.

  The mail confirmation unit 100 causes the display unit 200 to display the output result of the learning model acquired from the determination server 3. Thereby, the user of the communication terminal 1 can confirm whether or not the mail instructing the display to the mailer 300 contains a malicious character string before the mail is displayed on the display unit 200.

  If the mail does not include a malicious character string, the user can display the mail on the display unit 200 as usual. When a malicious character string is included in the mail, the user can also determine not to display the mail on the display unit 200. Thus, the mail confirmation system S according to the embodiment can achieve both the convenience of the user using the mail and the suppression of access to the malicious information included in the mail.

<Functional Configuration of Email Confirmation Unit 100>
FIG. 2 is a diagram schematically illustrating a functional configuration of the mail checking unit 100 according to the embodiment. In FIG. 2, arrows indicate main data flows, and there may be data flows not shown in FIG. In FIG. 2, each functional block shows a configuration of a function unit, not a configuration of a hardware (device) unit. The transfer of data between the functional blocks may be performed via any means such as a data bus, a network, a portable storage medium, or the like.

  The e-mail confirmation unit 100 is configured to execute a program stored in a storage unit of the communication terminal 1 (not shown) by a processor such as a CPU or a GPU (Graphics Processing Unit) of the communication terminal 1 so that the display operation detection unit 10 It functions as the extraction unit 20, the character string determination unit 30, the notification unit 40, the display control unit 50, the launcher unit 60, and the operation restriction unit 70.

  The display operation detection unit 10 detects a mail display operation performed by the mailer 300 that manages the mail. When the display operation detection unit 10 detects a display operation, the character string extraction unit 20 extracts a character string of a predetermined specific format from the character strings included in the mail to be displayed. Extract.

  The character string determination unit 30 receives the character string and inputs the character string extracted by the character string extraction unit 20 to a learning model machine-learned to output information indicating whether the information represented by the character string is malignant or benign. Enter a column and get its output. Specifically, the character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 including the learning model, and receives a result processed by the determination server 3 from the determination server 3.

  The notification unit 40 notifies the output result of the learning model acquired by the character string determination unit 30. Specifically, the notification unit 40 notifies the user by displaying the output result on the display unit 200 via the display control unit 50. At this time, the notification unit 40 may output different notification sounds to a speaker (not shown) of the communication terminal 1 depending on whether a malicious character string is included or not. Thereby, the user of the communication terminal 1 can grasp the output result by the notification sound without looking at the display unit 200.

  FIG. 3 is a diagram showing a display example in which the notifying unit 40 displays on the display unit 200 when a malicious character string is not included. As shown in FIG. 3, the notification unit 40 displays a message indicating the output result in a message display area M provided in a part of the window of the mailer 300. Further, since there is no malicious character string in the character string extracted by the character string extraction unit 20, the contents of the mail instructed by the user to perform the display operation are displayed on the window of the mailer 300.

  FIG. 4 is a diagram illustrating a display example in which the notifying unit 40 displays on the display unit 200 when a malicious character string is included. When a malicious character string is included, the notification unit 40 causes the message display area M to display a message indicating an output result, similarly to the case where a malicious character string is not included. As shown in FIG. 4, the notification unit 40 inputs the character string extracted by the character string extraction unit 20 and the character string to another window W different from the mailer 300 on the display unit 200 displaying the mailer 300. The display result is displayed on the display unit 200 in association with the output result of the learning model to be executed. Thereby, the user of the communication terminal 1 can check the output result without operating the window displaying the mailer 300.

  The notification unit 40 displays the character string extracted by the character string extraction unit 20 on another window W in a selectable manner. For example, when the character string extracted by the character string extraction unit 20 is a URI, the user of the communication terminal 1 can access the site indicated by the URI by selecting the character string.

  Specifically, when a character string displayed by notification unit 40 on another window W is selected, launcher unit 60 activates an application determined according to the type of the selected character string. Here, a specific example of the “application determined according to the type of the selected character string” is a web browser when the character string is a URI, and a call application when the character is a telephone number. When the character string is a mail address, the launcher unit 60 causes the display unit 200 to display a mail creation screen (not shown) of the mailer 300 via the display control unit 50. Accordingly, the user of the communication terminal 1 can start an application for directly accessing information indicated by each character string from another window W without searching for a character string from the window displaying the mailer 300. .

  FIG. 5 is a diagram illustrating an example of another window W displayed on the display unit 200 by the notification unit 40 when a malicious character string is included. FIG. 5 shows a state in which the notification unit 40 displays another window W on the display unit 200 by superimposing the window on the mailer 300. As shown in FIG. 5, another window W clearly indicates that the mail is suspected to be an unauthorized mail. The user of the communication terminal 1 can access the information indicated by the character string by selecting the character string displayed in another window W.

  Here, when the output result of the learning model that receives the selected character string as an input is malicious, the notification unit 40 displays a new window NW on the display unit 200 that displays whether the application can be started or not in a selectable manner. Display.

  FIG. 6 is a diagram illustrating an example of a screen for allowing the notification unit 40 to select whether to activate an application displayed on the display unit 200. As illustrated in FIG. 6, the notification unit 40 displays a new window NW on the display unit 200 by superimposing the window NW on the mailer 300. A message that warns that the character string selected by the communication terminal 1 is malicious is also displayed in the new window NW, and the notification unit 40 can urge the communication terminal 1 to warn of access. In the new window NW, the communication terminal 1 can cancel access to the information indicated by the selected character string.

  As described above, when the output result of the learning model having the selected character string as an input is malicious, when the user attempts to access the information indicated by the character string from the new window NW, the notification unit 40 warns the user. Arousing can be encouraged. At this time, if the user can directly access the information indicated by the character string from the character string displayed on the display unit of mailer 300, notification unit 40 may lose the opportunity to call the user's attention.

  Therefore, when the notification unit 40 displays the character string on the display unit 200 in a manner that can be selected in a window different from the mailer 300, the operation restriction unit 70 prohibits the user from performing a selection operation in the window displaying the mailer 300. I do. Accordingly, the operation restriction unit 70 can reduce a situation in which the user accesses the information indicated by the malicious character string in the output result of the learning model by erroneous operation.

  By the way, when the user accesses information indicated by a character string whose output result of the learning model is benign, the communication terminal 1 may start a normal application. On the other hand, when the user accesses information indicated by the malicious character string in the output result of the learning model, the communication terminal 1 preferably provides the user with a secure environment.

  Therefore, even if the type of the selected character string is the same, the launcher unit 60 may activate a different application when the output result of the learning model that receives the character string is different. More specifically, the launcher unit 60 uses a device installed in a DMZ (DeMilitarized Zone) segment in the network to which the communication terminal 1 connects when the output result of the learning model that receives the selected character string as an input is malicious. Start the application. The notification unit 40 causes the display unit 200 to display the output result of the application executed by the device installed in the DMZ segment.

  FIG. 7 is a schematic diagram for explaining the DMZ. Since the DMZ is a known technique, detailed description is omitted, but as shown in FIG. 7, an area sandwiched between two firewalls F existing between the communication terminal 1 and a public communication network N such as the Internet. Is a DMZ segment.

  In the DMZ segment, an application server 4 that executes an application for accessing information indicated by a malicious character string in the output result of the learning model is installed. Even if the application server 4 accesses the malicious website by executing the web browser application, the communication terminal 1 is not affected by the website. Since the notification unit 40 acquires the result executed by the application server 4 in the form of an image and displays the result on the display unit 200, the user of the communication terminal 1 securely confirms the result of accessing the information indicated by the malicious character string. be able to.

<Processing flow of information processing method executed by communication terminal 1>
FIG. 8 is a flowchart illustrating a flow of a mail confirmation process executed by communication terminal 1 according to the embodiment. The processing in this flowchart is started, for example, when the mailer 300 is activated.

  The display operation detection unit 10 waits for the user of the communication terminal 1 to perform a mail display operation on the mailer 300 (S2). While the display operation detection unit 10 has not detected the display operation (No in S4), the display operation detection unit 10 returns to step S2 and continues to wait for the user to perform the mail display operation.

  When the display operation detection unit 10 detects a display operation (Yes in S4), the character string extraction unit 20 extracts a character string of a predetermined specific format from the character strings included in the mail to be displayed. Is extracted (S6). The character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 (S8).

  The character string determination unit 30 obtains, from the determination server 3, an output result when the character string extracted by the character string extraction unit 20 is input to the machine learning model for determining whether the character string is benign or bad (S10). The notification unit 40 displays the output result acquired by the character string determination unit 30 from the determination server 3 on a window different from the mailer 300 in association with the character string extracted by the character string extraction unit 20 (S12).

  When the user selects the displayed character string (Yes in S14), and the output result of the learning model having the character string as an input is malignant (Yes in S16), the notification unit 40 determines the type of the selected character string. A new window is displayed on the display unit 200 for asking the user whether or not to start an application determined according to (S18).

  When the user selects to start the application (Yes in S20), or when the output result of the learning model that inputs the character string selected by the user is benign (No in S16), the launcher unit 60 The application corresponding to the selected character string is started (S22).

  When the user does not select the displayed character string (No in S14), when the user does not select to start the application (No in S20), or when the launcher unit 60 starts the application, the processing in this flowchart ends. I do.

<Effects of Communication Terminal 1 According to Embodiment>
As described above, according to the communication terminal 1 according to the embodiment, it is possible to achieve both the convenience of the user using the mail and the suppression of the access to the malicious information included in the mail.

  As described above, the present invention has been described using the embodiment, but the technical scope of the present invention is not limited to the scope described in the above embodiment, and various modifications and changes are possible within the scope of the gist. is there. For example, the specific embodiment of the dispersion / integration of the apparatus is not limited to the above-described embodiment, and all or a part of the apparatus may be functionally or physically dispersed / integrated in an arbitrary unit. Can be. Further, new embodiments that are generated by arbitrary combinations of the plurality of embodiments are also included in the embodiments of the present invention. The effect of the new embodiment caused by the combination has the effect of the original embodiment.

DESCRIPTION OF SYMBOLS 1 ... Communication terminal 2 ... Mail server 3 ... Judgment server 4 ... Application server 10 ... Display operation detection part 20 ... Character string extraction part 30 ... Character string judgment part 40 Notification unit 50 Display control unit 60 Launcher unit 70 Operation restriction unit 100 E-mail confirmation unit 200 Display unit 300 Mailer F Firewall N・ Communication network S ・ ・ ・ Email confirmation system

Claims (7)

On the computer,
A display operation detection function for detecting an e-mail display operation performed by a mailer that manages e-mail; and
When the display operation detection function detects a display operation, a character string extraction function for extracting a character string in a predetermined format from character strings included in the e-mail targeted for the display operation, ,
When a character string is input and the character string extracted by the character string extraction function is input to a learning model machine-learned to output information indicating whether the information represented by the character string is malignant or benign, A character string judgment function for acquiring
A notification function of notifying an output result of the learning model obtained by the character string determination function,
The program that realizes. The notification function corresponds to a character string extracted by the character string extraction function and an output result of the learning model that receives the character string as an input, in a window different from the mailer in a display unit displaying the mailer. And display it on the display,
The program according to claim 1. The notification function displays the character string extracted by the character string extraction function in a selectable manner,
The program, the computer,
When a character string displayed by the notification function is selected, a launcher function for starting an application determined according to the type of the selected character string is further realized.
The program according to claim 2. The notification function, when the output result of the learning model to input the selected character string is malicious, to display on the display unit a new window that displays in a selectable manner whether or not to start the application,
The program according to claim 3. On the computer,
If the notification function displays a character string on the display unit in a manner that can be selected in a window different from the mailer, further implements an operation restriction function of prohibiting a selection operation in a window displaying the mailer.
The program according to claim 3. The processor
Detecting an e-mail display operation performed by a mailer managing the e-mail;
When a display operation is detected, a step of extracting a character string in a predetermined format from character strings included in the e-mail targeted for the display operation,
Inputting a character string and obtaining an output when the extracted character string is input to a learning model machine-learned to output information indicating whether the information indicated by the character string is malignant or benign. ,
Notifying the obtained output result of the learning model,
Information processing method for executing. A display operation detecting unit that detects an electronic mail display operation performed by a mailer that manages the electronic mail;
When the display operation detecting unit detects a display operation, a character string extracting unit that extracts a character string in a predetermined format from character strings included in the electronic mail targeted for the display operation. ,
When a character string is input and the character string extracted by the character string extraction unit is input to a learning model machine-learned to output information indicating whether the information represented by the character string is malignant or benign, A character string determination unit for obtaining
A notification unit that notifies the output result of the learning model obtained by the character string determination unit,
Email confirmation device that realizes.

Images