JP2022136097A - E-mail confirmation device, information processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To concurrently achieve both the convenience of a user using an e-mail and the prevention of an access to malicious information included in the e-mail.

SOLUTION: A program causes a computer to realize: a character string extraction function of extracting a character string in a predetermined format from character strings included in an e-mail to be subjected to an e-mail display operation performed by a mailer that manages the e-mail; a character string determination function of acquiring an output obtained when the character string extracted by the character string extraction function is input to a learning model that has been machine-learned so as to input a character string and output information indicating that information indicated by the character string is malicious or benign; and a display function of, when an output result of the learning model using the character string extracted by the character string extraction function as an input is malicious, displaying the character string in a selectable manner and, when the displayed character string is selected, displaying whether or not to activate an application, in a selectable manner.

SELECTED DRAWING: Figure 2

COPYRIGHT: (C)2022,JPO&INPIT

Description

The present invention relates to an email confirmation device, an information processing method, and a program.

Conventionally, in order to prevent access to a malicious site included in an email received by a user terminal, an external device executes access using the address information included in the email, and the screen image obtained as a result is sent to the user terminal. Techniques for transmission have been proposed (see Patent Document 1, for example).

JP 2013-246474 A

In the above, the address information to be restricted access is registered in advance, and if the access request from the user terminal that receives the mail matches the pre-registered address, the address is accessed in a secure environment. Technology. Therefore, even if the address is malicious, if the address is not registered in advance, the user terminal may directly access the address. On the other hand, placing too much importance on access restrictions and registering in advance addresses that do not require restrictions may impair convenience for the user of the user terminal.

The present invention has been made in view of these points, and it is an object of the present invention to provide a technique for achieving both convenience for users who use e-mail and suppression of access to malicious information contained in the e-mail. do.

A first aspect of the present invention is a program. This program provides a computer with a character string extractor for extracting character strings in a predetermined format from character strings contained in e-mails to be displayed by a mailer that manages e-mails. The character string extracted by the character string extraction function is input to a learning model that is machine-learned so that a function and a character string are input and information indicating whether the information indicated by the character string is malignant or benign is output. A character string determination function that acquires the output when the character string extraction function extracts the character string, and displays the character string in a selectable manner when the output result of the learning model is malignant. and a display function for displaying whether or not the application can be started in a selectable manner based on the selection of the selected character string.

The program further realizes a display operation detection function for detecting the display operation, and the character string extraction function extracts the character string when the display operation detection function detects the display operation. good too.

The display function may display, in a window different from the mailer, a character string in a selectable manner when the output result of the learning model to which the character string extracted by the character string extraction function is input is malignant. good.

When the display function of the computer causes the character string to be displayed in a selectable manner in a window different from that of the mailer, an operation restriction function that prohibits a selection operation in the window displaying the mailer may be further realized. good.

In order to provide the above program or update part of the program, a computer-readable recording medium recording this program may be provided, or this program may be transmitted via a communication line. . The display function may display the output result of the learning model acquired by the character string determination function.

A second aspect of the present invention is an information processing method. In this method, the step of extracting a character string in a predetermined format from character strings included in an e-mail to be displayed by a mailer managing e-mails; a step of obtaining an output when a character string is input and the extracted character string is input to a learning model machine-learned to output information indicating whether the information indicated by the character string is malignant or benign; Displaying the character string in a selectable manner when the output result of the learning model with the extracted character string as input is malignant, and whether or not the application can be started based on the selection of the displayed character string is displayed in a selectable manner.

A third aspect of the present invention is an email confirmation device. This device includes a character string extraction unit for extracting a character string in a predetermined format from character strings included in an e-mail to be displayed by a mailer that manages the e-mail; When a character string extracted by the character string extracting unit is input to a learning model machine-learned so that a character string is input and information indicating whether the information indicated by the character string is malignant or benign is output. A character string determination unit that acquires an output, and a character string that is displayed in a selectable manner when the output result of the learning model that receives the character string extracted by the character string extraction unit as input is malignant, and the displayed character and a display unit that displays whether or not to start an application in a selectable manner based on the selection of a column. A display operation detection unit that detects the display operation may be further implemented, and the character string extraction unit may extract the character string when the display operation detection unit detects the display operation.

The display unit may display the character string extracted by the character string extraction unit and the output result of the learning model having the character string as an input in a window different from the mailer. The display unit may display a new window displaying whether or not to start the application in a selectable manner when the output result of the learning model to which the selected character string is input is malignant. When the display unit displays the character string in a selectable manner in a window different from the mailer, an operation restriction unit may be further implemented that prohibits a selection operation in the window displaying the mailer. Any combination of the above-described components, and expressions of the present invention converted into methods, devices, systems, computer programs, data structures, recording media, etc. are also effective as aspects of the present invention.

ADVANTAGE OF THE INVENTION According to this invention, the convenience of the user using an email and the access control to the malicious information contained in an email can be made compatible.

It is a figure for demonstrating the structure of the mail confirmation system which concerns on embodiment of this invention. It is a figure which shows typically the functional structure of the mail confirmation part which concerns on embodiment. FIG. 10 is a diagram showing a display example displayed on the display unit by the notification unit when no malicious character string is included; FIG. 10 is a diagram showing a display example displayed on the display unit by the notification unit when a malicious character string is included; FIG. 10 is a diagram showing an example of another window that the notification unit causes the display unit to display when a malicious character string is included; FIG. 10 is a diagram showing an example of a screen for selecting whether or not to start an application displayed on the display unit by the notification unit; It is a schematic diagram for demonstrating DMZ. 9 is a flowchart for explaining the flow of mail confirmation processing executed by the communication terminal according to the embodiment;

<Overview of Embodiment>
FIG. 1 is a diagram for explaining the configuration of an e-mail confirmation system S according to an embodiment of the present invention. The mail confirmation system S according to the embodiment is configured such that a communication terminal 1 is connected to a mail server 2 and a judgment server 3 via a communication network N so as to be able to communicate with each other. Hereinafter, an outline of the mail confirmation system S according to the embodiment will be described with reference to FIG.

The communication terminal 1 is a smartphone, a tablet PC (Personal Computer), a desktop PC, a notebook PC, or the like, and is a computer provided with computational resources such as a CPU (Central Processing Unit) and memory (not shown). The communication terminal 1 includes a mail confirmation section 100 , a display section 200 and a mailer 300 .

The display unit 200 is integrated with the communication terminal 1 when the communication terminal 1 is a smart phone, a tablet PC, a notebook PC, or the like. When the communication terminal 1 is a desktop PC, the display section 200 can be a device independent of the communication terminal 1. FIG. FIG. 1 shows an example in which the display unit 200 is integrated with the communication terminal 1. As shown in FIG.

The mailer 300 is a general e-mail client, and is application software for sending and receiving e-mail (hereinafter simply referred to as "mail") and for managing the sent and received mail. The mailer 300 displays a list of information indicating the subject, sender, date and time of transmission of the mail addressed to the user of the mailer 300 acquired by the mail server 2 .

The mail confirmation unit 100 monitors the mail display operation of the mailer 300 by the user. When the mail confirmation unit 100 detects the mail display operation by the user, before the mailer 300 displays the mail on the display unit 200, the mail confirmation unit 100 extracts a character string that fits a specific format contained in the mail.

Here, the “specific format” extracted from the email by the email confirmation unit 100 includes, for example, a URI (Uniform Resource Identifier) starting with a character string such as “http” or “ftp”, an email address including “@”, It is a format provided with information for accessing a device different from the communication terminal 1 or a person different from the user of the communication terminal 1, such as a telephone number or an IP (Internet Protocol) address. Note that the mail confirmation unit 100 is implemented as a plug-in of the mailer 300, for example.

The mail confirmation unit 100 transmits the extracted character string to the determination server 3 and acquires the result. The determination server 3 is a server different from the mail server 2, and receives as input a character string that fits a specific format, and performs machine learning (for example, , Machine learning such as Deep Neural Network) is equipped with a learning model. The determination server 3 acquires the output of the learning model whose input is the character string received from the email confirmation unit 100 and transmits the output to the email confirmation unit 100 .

In general, learning models created using machine learning have increased generalizability, and have high discriminative power not only for character strings used as teacher data for model creation, but also for character strings similar to teacher data. Therefore, the determination server 3 can determine benign/malignant even for an unknown character string, unlike the benign/malignant determination using a general blacklist/whitelist. For example, the determination server 3 determines that the character string received from the mail confirmation unit 100 is benign when the numerical value calculated using the sigmoid function exceeds a predetermined threshold, and is malignant when it is less than the predetermined threshold.・Malignancy may be determined.

The mail confirmation unit 100 causes the display unit 200 to display the output result of the learning model acquired from the determination server 3 . As a result, the user of the communication terminal 1 can confirm whether or not a malicious character string is included in the mail for which the mailer 300 has been instructed to display the mail before the mail is displayed on the display unit 200.例文帳に追加

If the mail does not contain malicious character strings, the user can display the mail on the display unit 200 as usual. If the mail contains a malicious character string, the user can also decide not to display the mail on the display unit 200 . In this way, the email confirmation system S according to the embodiment can achieve both convenience for users who use emails and suppression of access to malicious information contained in the emails.

<Functional Configuration of Mail Confirmation Unit 100>
FIG. 2 is a diagram schematically showing the functional configuration of the mail checking section 100 according to the embodiment. In FIG. 2, arrows indicate main data flows, and there may be data flows not shown in FIG. In FIG. 2, each functional block does not show the configuration in units of hardware (apparatus), but the configuration in units of functions. Data exchange between functional blocks may be performed via any means such as a data bus, network, or portable storage medium.

The mail confirmation unit 100 executes a program stored in a storage unit of the communication terminal 1 (not shown) by a processor such as a CPU or a GPU (Graphics Processing Unit) of the communication terminal 1, so that the display operation detection unit 10, the character string It functions as an extraction unit 20 , a character string determination unit 30 , a notification unit 40 , a display control unit 50 , a launcher unit 60 and an operation restriction unit 70 .

The display operation detection unit 10 detects an email display operation performed by the mailer 300 that manages emails. When the display operation detection unit 10 detects a display operation, the character string extraction unit 20 extracts a character string in a predetermined specific format from the character strings included in the mail subject to the display operation. Extract.

The character string determination unit 30 receives a character string as an input, and the character extracted by the character string extraction unit 20 is added to the learning model machine-learned so as to output information indicating whether the information indicated by the character string is malignant or benign. Input a column and get its output. Specifically, the character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 having the learning model, and receives the result processed by the determination server 3 from the determination server 3 .

The notification unit 40 notifies the output result of the learning model acquired by the character string determination unit 30 . Specifically, the notification unit 40 notifies the user by displaying the output result on the display unit 200 via the display control unit 50 . At this time, the notification unit 40 may cause the speaker (not shown) of the communication terminal 1 to output different notification sounds depending on whether or not a malicious character string is included. Thereby, the user of the communication terminal 1 can understand the output result by the notification sound without looking at the display unit 200 .

FIG. 3 is a diagram showing a display example displayed on the display unit 200 by the notification unit 40 when no malicious character string is included. As shown in FIG. 3, the notification unit 40 displays a message indicating the output result in a message display area M provided in a part of the window of the mailer 300. FIG. In addition, since there is no malicious character string in the character string extracted by the character string extraction unit 20, the contents of the mail for which the user instructed the display operation are displayed in the window of the mailer 300. FIG.

FIG. 4 is a diagram showing a display example displayed on the display unit 200 by the notification unit 40 when a malicious character string is included. Even when a malicious character string is included, the notification unit 40 displays a message indicating the output result in the message display area M as in the case where the malicious character string is not included. As shown in FIG. 4, the notification unit 40 inputs the character string extracted by the character string extraction unit 20 and the character string to a separate window W different from the mailer 300 on the display unit 200 displaying the mailer 300. The display unit 200 is caused to display the output result of the learning model in association with the output result. Thereby, the user of the communication terminal 1 can confirm the output result without operating the window displaying the mailer 300 .

The notification unit 40 displays the character string extracted by the character string extraction unit 20 in a separate window W in a selectable manner. For example, if the character string extracted by the character string extraction unit 20 is a URI, the user of the communication terminal 1 can access the site indicated by the URI by selecting the character string.

Specifically, when the character string displayed on the separate window W by the notification unit 40 is selected, the launcher unit 60 activates an application determined according to the type of the selected character string. A specific example of "the application determined according to the type of the selected character string" is a web browser when the character string is a URI, and a call application when the character string is a phone number. When the character string is a mail address, the launcher section 60 causes the display section 200 to display a mail creation screen (not shown) of the mailer 300 via the display control section 50 . As a result, the user of the communication terminal 1 can start an application for accessing information indicated by each character string directly from another window W without searching for the character string from the window displaying the mailer 300. .

FIG. 5 is a diagram showing an example of another window W displayed on the display unit 200 by the notification unit 40 when a malicious character string is included. FIG. 5 shows that the notification unit 40 displays another window W on the display unit 200 superimposed on the window showing the mailer 300 . As shown in FIG. 5, another window W clearly indicates that the mail is suspected to be fraudulent. The user of the communication terminal 1 can access the information indicated by the character string by selecting the character string displayed in the separate window W. FIG.

Here, if the output result of the learning model to which the selected character string is input is malignant, the notification unit 40 displays a new window NW on the display unit 200 in a manner in which whether or not to start the application can be selected. display.

FIG. 6 is a diagram showing an example of a screen for selecting whether or not to start an application displayed on the display unit 200 by the notification unit 40. As shown in FIG. As shown in FIG. 6, the notification unit 40 causes the display unit 200 to display a new window NW superimposed on the window showing the mailer 300 . The new window NW also displays a message calling attention that the character string selected by the communication terminal 1 is malicious, and the notification unit 40 can call attention to the access to the communication terminal 1. - 特許庁In the new window NW, the communication terminal 1 can also cancel access to the information indicated by the selected character string.

In this way, when the output result of the learning model whose input is the selected character string is malignant, the notification unit 40 warns the user when the user tries to access the information indicated by the character string from the new window NW. Arousal can be encouraged. At this time, if the user can directly access the information indicated by the character string displayed on the display section of the mailer 300, the notification section 40 may miss the opportunity to alert the user.

Therefore, when the notification unit 40 causes the display unit 200 to display the character string in a selectable manner in a window different from the mailer 300, the operation restriction unit 70 prohibits the user's selection operation in the window displaying the mailer 300. do. As a result, the operation restriction unit 70 can reduce a situation in which the user erroneously accesses the information indicated by the malicious character string in the output result of the learning model.

By the way, when the user accesses the information indicated by the character string whose output result of the learning model is benign, the communication terminal 1 may start a normal application. On the other hand, when the user accesses the information indicated by the malicious character string output from the learning model, the communication terminal 1 preferably provides the user with a secure environment.

Therefore, the launcher unit 60 may launch different applications when the output results of the learning models input with the selected character strings are different even if the selected character strings are of the same type. More specifically, the launcher unit 60 is a device installed in a DMZ (DeMilitarized Zone) segment in the network to which the communication terminal 1 is connected when the output result of the learning model whose input is the selected character string is malignant. Launch the application. The notification unit 40 causes the display unit 200 to display the output result of the application executed by the device installed in the DMZ segment.

FIG. 7 is a schematic diagram for explaining the DMZ. Since the DMZ is a known technology, a detailed explanation is omitted, but as shown in FIG. is the DMZ segment.

The DMZ segment is provided with an application server 4 that executes an application for accessing information indicated by a malicious character string output from the learning model. Even if the application server 4 executes a web browser application and accesses a malicious website, the communication terminal 1 is not affected by the website. The notification unit 40 acquires the result of execution by the application server 4 in the form of an image and displays it on the display unit 200, so that the user of the communication terminal 1 can safely confirm the result of accessing the information indicated by the malicious character string. be able to.

<Processing Flow of Information Processing Method Executed by Communication Terminal 1>
FIG. 8 is a flowchart for explaining the flow of mail confirmation processing executed by the communication terminal 1 according to the embodiment. The processing in this flowchart starts, for example, when the mailer 300 is activated.

The display operation detection unit 10 waits for the user of the communication terminal 1 to perform a mail display operation on the mailer 300 (S2). While the display operation detection unit 10 does not detect the display operation (No in S4), the display operation detection unit 10 returns to step S2 and continues waiting for the user's mail display operation.

When the display operation detection unit 10 detects a display operation (Yes in S4), the character string extraction unit 20 extracts a character string in a predetermined specific format from the character strings included in the mail subject to the display operation. is extracted (S6). The character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 (S8).

The character string determination unit 30 acquires the output result from the determination server 3 when the character string extracted by the character string extraction unit 20 is input to the machine learning model for determining whether the character string is benign or malignant (S10). The notification unit 40 associates the output result obtained by the character string determination unit 30 from the determination server 3 with the character string extracted by the character string extraction unit 20 and displays it in a window different from the mailer 300 (S12).

If the user selects the displayed character string (Yes in S14) and the output result of the learning model with the character string as input is malignant (Yes in S16), the notification unit 40 determines the type of the selected character string. The display unit 200 is caused to display a new window for confirming with the user whether or not to start the application determined according to (S18).

If the user selects to launch the application (Yes in S20), or if the output result of the learning model whose input is the character string selected by the user is benign (No in S16), the launcher unit 60 prompts the user to An application corresponding to the selected character string is started (S22).

When the user does not select the displayed character string (No in S14), when the user does not select to start the application (No in S20), or when the launcher unit 60 starts the application, the processing in this flowchart ends. do.

<Effect of Communication Terminal 1 According to Embodiment>
As described above, according to the communication terminal 1 according to the embodiment, it is possible to achieve both convenience for users who use e-mail and suppression of access to malicious information included in the e-mail.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist thereof. be. For example, specific embodiments of device distribution/integration are not limited to the above-described embodiments. can be done. In addition, new embodiments resulting from arbitrary combinations of multiple embodiments are also included in the embodiments of the present invention. The effect of the new embodiment caused by the combination has the effect of the original embodiment.

1 Communication terminal 2 Mail server 3 Determination server 4 Application server 10 Display operation detection unit 20 Character string extraction unit 30 Character string determination unit 40 Notification unit 50 Display control unit 60 Launcher unit 70 Operation restriction unit 100 Mail confirmation unit 200 Display unit 300 Mailer F Firewall N・Communication network S・・・mail confirmation system

Claims (11)

to the computer,
a character string extracting function for extracting a character string in a predetermined format from character strings contained in an e-mail subject to an e-mail display operation performed by a mailer that manages the e-mail;
When the character string extracted by the character string extraction function is input to a learning model that has undergone machine learning so that a character string is input and information indicating whether the information indicated by the character string is malignant or benign is output. A character string judgment function that acquires the output,
When the character string extracted by the character string extraction function is input, and the output result of the learning model is malignant, the character string is displayed in a selectable manner, and based on the selection of the displayed character string, a display function for displaying whether or not an application can be started in a selectable manner;
program to realize Said program
Further realizing a display operation detection function for detecting the display operation,
The character string extraction function extracts the character string when the display operation detection function detects the display operation.
A program according to claim 1. The display function displays, in a window different from the mailer, a character string in a selectable manner when the output result of the learning model to which the character string extracted by the character string extraction function is input is malignant.
3. A program according to claim 1 or 2. to the computer;
When the display function displays a character string in a selectable manner in a window different from the mailer, further realizing an operation restriction function for prohibiting a selection operation in the window displaying the mailer,
4. A program according to claim 3. The display function displays the output result of the learning model obtained by the character string determination function.
A program according to any one of claims 1 to 4. the processor
a step of extracting a character string in a predetermined format from character strings included in an e-mail to be displayed by a mailer managing the e-mail;
a step of obtaining an output when a character string is input and the extracted character string is input to a learning model machine-learned to output information indicating whether the information indicated by the character string is malignant or benign; ,
When the output result of the learning model with the extracted character string as input is malignant, the character string is displayed in a selectable manner, and whether or not the application can be started is determined based on the selection of the displayed character string. displaying in a selectable manner;
Information processing method that performs a character string extracting unit for extracting character strings in a predetermined format from character strings included in an e-mail to be displayed by a mailer that manages the e-mail;
When a character string extracted by the character string extracting unit is input to a learning model machine-learned so that a character string is input and information indicating whether the information indicated by the character string is malignant or benign is output. a character string determination unit that acquires the output;
The character string extracted by the character string extraction unit is displayed in a selectable manner when the output result of the learning model is malignant, and based on the selection of the displayed character string, a display unit for displaying whether or not to start an application in a selectable manner;
A mail confirmation device that realizes Further realizing a display operation detection unit that detects the display operation,
The character string extraction unit extracts the character string when the display operation detection unit detects the display operation.
The mail confirmation device according to claim 7. The display unit displays, in a window different from the mailer, the character string extracted by the character string extraction unit and the output result of the learning model that receives the character string as input.
The mail confirmation device according to claim 7 or 8. When the output result of the learning model to which the selected character string is input is malignant, the display unit displays a new window that displays whether or not to start the application in a selectable manner.
The mail confirmation device according to claim 9. When the display unit displays a character string in a selectable manner in a window different from the mailer, further realizing an operation restriction unit that prohibits a selection operation in the window that displays the mailer.
The mail confirmation device according to claim 9 or 10.

Images