JP5090305B2 - Junk mail processing method, system, apparatus and program - Google Patents

Description

  The present invention relates to a junk mail processing method, system, apparatus, and program for selecting junk mail.

In recent years, junk mail filters have been used to sort out junk mail. This spam mail filter refers to a so-called black list to determine whether or not the received electronic mail is a spam mail. That is, it is determined that an e-mail transmitted from a site or address previously posted on the black list is a spam mail.
[Online], September / December 2007 issue, five laws not to be mistaken for spam mail, [searched on August 19, 2008], Internet <URL: http: // allout. co. jp / career / corporateit / closeup / CU200770912A / index2. htm>

  However, the conventional junk mail filter cannot easily sort junk mail. This is because it is necessary to create a black list in advance, and it is necessary to frequently update the black list.

  The present invention is proposed in consideration of such circumstances, and it is possible to easily select spam mail by notifying that it is spam mail based on a predetermined rule or deleting the spam mail. An object of the present invention is to provide a spam mail processing method, apparatus, and program that can be used.

  In order to achieve the above object, the present inventor has found a mechanism for easily selecting junk mail according to a predetermined rule, and has come up with the present invention.

  The spam mail processing method according to the present invention is capable of easily selecting a spam mail by notifying that it is a spam mail based on a predetermined elapsed time or deleting the spam mail.

(1) computer, an electronic mail extracting those containing a URL from the e-mail received, extracts the UR L for each of the extracted e-mail, the URL is the information of the web page that the search robot collected when also the is the same as the URL that is registered in the configuration database has not passed the predetermined time based not registered before Symbol database, and spam determining step of determining as spam, the A spam mail processing method characterized by executing at least a spam mail processing step of notifying a spam mail or deleting the spam mail when it is determined to be a spam mail.

According to the invention of (1), the URL extracted for each e-mail is the same as the URL that has been registered in the database configured based on the web page information collected by the search robot and has not passed a predetermined time. Alternatively, when it is not registered in the database, it is determined that it is a spam mail, so that the spam mail can be easily selected. Here, for example, a database of a search engine corresponds to the database. Further, when the URL is the same as the URL registered in the database configured based on the information of the web page collected by the search robot and the predetermined time has not elapsed, or the URL is not registered in the database. Since it is determined to be an e-mail, there is no need to update the conventional blacklist. Here, in addition to this determination condition, when the search order of the URL in the search engine is lower than a predetermined threshold, it may be determined that the message is spam. According to this, even if an e-mail contains the URL of a site recently registered in a search engine, if the search order of this site is high, that is, if the popularity of this site is high, it is determined that the e-mail is not spam Can do.

(2) An e-mail extracting step in which the computer extracts a URL containing URL from the received e-mail, and a URL is extracted for each of the extracted e-mails, and the URL is information on web pages collected by the search robot. A junk e-mail judging step for judging that the e-mail is a junk e-mail when the URL is the same as the URL registered in the database configured based on the URL and the search order is lower than a predetermined threshold; A spam mail processing method characterized by executing at least a spam mail processing step of notifying that the mail is spam or deleting the spam mail when it is determined that the spam mail is the spam mail.

(3) An e-mail extracting unit that receives an e-mail and extracts a URL including the URL from the e-mail, extracts a URL for each extracted e-mail, and the URL is a web page collected by the search robot. A junk e-mail judging means for judging that the e-mail is a junk e-mail when it is the same as a URL registered in a database constructed based on information and has not been registered in the database, and the junk mail An unsolicited mail processing system comprising: an unsolicited mail processing means for notifying that it is an unsolicited mail or deleting the unsolicited mail when it is determined to be a mail.

(4) An e-mail extracting unit that receives an e-mail and extracts a URL including the URL from the e-mail, extracts a URL for each extracted e-mail, and the URL is a web page collected by the search robot. Junk e-mail determination that determines that the e-mail is a junk e-mail when the URL is the same as the URL registered in the database configured based on the information and has not passed the predetermined time and the search order is lower than the predetermined threshold And a spam mail processing means for notifying that it is a spam mail or deleting the spam mail when it is determined that the spam mail is the spam mail.

(5) An e-mail extracting unit that extracts an e-mail including a URL, and a URL is extracted for each extracted e-mail, and the URL is stored in a database configured based on information on a web page collected by a search robot. When the URL is the same as the registered URL that has not passed the predetermined time or when it is not registered in the database, the spam determination means for determining that it is a spam mail, and when determining that it is the spam mail, An unsolicited mail processing device comprising: an unsolicited mail processing means for notifying that it is an unsolicited mail or deleting the unsolicited mail.

(6) An e-mail extracting unit that extracts an e-mail including a URL, and a URL is extracted for each e-mail extracted, and the URL is stored in a database configured based on web page information collected by a search robot. When the URL is the same as a registered URL that has not passed a predetermined time and the search order is lower than a predetermined threshold, the spam mail determining means determines that the mail is spam, and the spam mail An unsolicited mail processing device, comprising: an unsolicited mail processing means for notifying that it is a spam mail or deleting the unsolicited mail when it is determined.

(7) A program that causes a computer to execute the method according to (1).

  According to the present invention, when the domain extracted for each e-mail is the same as the domain that has been registered in the database in advance and the predetermined time has not elapsed, or is not registered in the database in advance, it is spam mail Judgment mail can be easily selected because it is determined.

Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. This is merely an example, and the technical scope of the present invention is not limited to this.
[First Embodiment]

In the present embodiment, a database of a search engine (a so-called crawler database) is used as a database used when determining whether or not it is a spam mail.
[Overall configuration of spam mail processing device and related elements]

  FIG. 1 is a diagram illustrating an overall configuration of a spam mail processing device 1 and related elements according to the first embodiment.

  The spam mail processing device 1, the mail server 2, and the search server 3 according to the present embodiment are connected to a communication network N such as the Internet. It does not matter whether the connection with the communication network N is wired or wireless.

  The spam mail processing device 1 sorts spam mail from electronic mail received by the mail server 2 in accordance with a predetermined rule.

  The mail server 2 communicates with a mail client (not shown) or another mail server (not shown) by a protocol such as SMTP or POP3, and transmits / receives an e-mail. The mail server 2 includes an e-mail transmission unit 21 that transmits an e-mail, an e-mail reception unit 22 that receives an e-mail, and an e-mail storage unit 23 that stores the received e-mail. Here, the e-mail storage means 23 is accessible from the junk mail processing apparatus 1.

The search server 3 collects web pages by a search robot and stores the collected web page information. Here, the search server 3 includes a query receiving unit 31 that receives a query, a web page search unit 32 that searches for a web page that matches the received query, a search result transmission unit 33 that transmits a search result, and a search robot ( A web page collection unit 34 that collects web pages by a so-called crawler) and a web page information storage unit 35 that stores information on the collected web pages are provided. Here, the database 36 of the search engine stores information such as the date and time when the URL of the web page is registered, and constitutes a part of the web page information storage means 35. Details of the search engine database 36 will be described later. The search engine database 36 is accessible from the junk mail processing apparatus 1.
[Functional configuration of spam mail processing device]

  FIG. 2 is a diagram showing an outline of a functional configuration of the junk mail processing apparatus 1 according to the first embodiment. The spam mail processing apparatus 1 according to the present embodiment includes an electronic mail extraction unit 11, a spam mail determination unit 12, and a spam mail processing unit 13.

  The e-mail extracting unit 11 extracts the e-mail including the URL from the e-mail storage unit 23 of the mail server 2 and passes it to the junk mail determining unit 12.

  The junk mail determination unit 12 determines whether or not each e-mail received from the e-mail extraction unit 11 is a junk mail according to a predetermined rule, and passes the result to the junk mail processing unit 13.

The spam mail processing means 13 notifies that it is a spam mail or deletes the spam mail when the judgment result received from the spam mail judgment means 12 indicates “spam mail”.
Search engine database configuration

  FIG. 3 is a diagram showing an outline of the configuration of the database 36 of the search engine.

The search engine database 36 stores the site ID, the URL of the web page collected by the search robot, and the date and time when this URL was registered in the search engine database 36 in advance in association with each other.
[Hardware configuration of spam mail processing device]

  FIG. 4 is a diagram illustrating a hardware configuration of the junk mail processing apparatus 1 according to the first embodiment.

  The spam mail processing apparatus 1 includes a CPU (Central Processing Unit) 310 (a plurality of CPUs such as a CPU 320 may be added in a multiprocessor configuration), a bus line 200, a communication I / F (I / F). An interface) 330, a main memory 340, a BIOS (Basic Input Output System) 350, an I / O controller 360, a hard disk 370, an optical disk drive 380, and a semiconductor memory 390. The hard disk 370, the optical disk drive 380, and the semiconductor memory 390 are collectively referred to as a storage device 410.

  The control unit 300 is a part that controls the junk mail processing apparatus 1 in an integrated manner. By appropriately reading and executing various programs stored in the hard disk 370 (described later), the control unit 300 cooperates with the hardware described above. Various functions according to the invention are realized.

  The communication I / F 330 is a network adapter when the junk mail processing apparatus 1 transmits / receives information to / from the mail server 2 or the like (FIG. 1) via the communication network N (FIG. 1). The communication I / F 330 may include a modem, a cable modem, and an Ethernet (registered trademark) adapter.

  The BIOS 350 records a boot program executed by the CPU 310 when the spam mail processing device 1 is started, a program that the spam mail processing device 1 depends on hardware, and the like.

  A storage device 410 such as a hard disk 370, an optical disk drive 380, and a semiconductor memory 390 can be connected to the I / O controller 360.

  The hard disk 370 stores various programs for causing the hardware to function as the junk mail processing apparatus 1 and programs for executing the functions of the present invention. The spam mail processing apparatus 1 can also use a hard disk (not shown) separately provided as an external storage device.

  As the optical disk drive 380, for example, a DVD-ROM drive, a CD-ROM drive, a DVD-RAM drive, or a CD-RAM drive can be used. In this case, the optical disk 400 corresponding to each drive is used. A program or data can be read from the optical disk 400 by the optical disk drive 380 and provided to the main memory 340 or the hard disk 370 via the I / O controller 360.

  The computer in the present invention refers to an information processing device including a storage device, a control unit, etc., and the junk mail processing device 1 is configured by an information processing device including a storage device 410, a control unit 300, and the like. This information processing apparatus is included in the concept of the computer of the present invention.

In this spam mail processing apparatus 1, the control unit 300 mainly corresponds to the spam mail determination means 12, and the communication I / F 330 mainly corresponds to the electronic mail extraction means 11 and the spam mail processing means 13.
[Hardware configuration of mail server]

The mail server 2 also has a hardware configuration similar to that of the spam mail processing apparatus 1 described above.
[Hardware configuration of search server]

The search server 3 also has a hardware configuration similar to that of the spam mail processing device 1 described above.
[Flowchart According to First Embodiment of the Present Invention]

  FIG. 5 shows a flowchart of spam mail processing (1) according to the first embodiment of the present invention.

  S1: The e-mail extraction unit 11 extracts an e-mail including a URL from the e-mail storage unit 23 (storage device) of the mail server 2 and passes it to the junk mail determination unit 12. As a method of extracting an e-mail including a URL, for example, a determination is made based on whether or not a character string starting with a scheme name such as “http:” is included. In the case of an electronic mail in the HTML format, the determination may be made based on whether or not a tag specifying a link such as “href” is included.

  S2: The spam mail determination unit 12 extracts a URL for each email received from the email extraction unit 11. As a method of extracting the URL, for example, a character string starting with a scheme name such as “http:” is extracted. Whether the character string is at the end of the character string is determined based on, for example, whether the subsequent character is a space, a double quotation mark, or the like.

  S3: The spam mail determination means 12 searches the search engine database 36 for a record including the same URL as the URL extracted from the electronic mail.

  S4: The spam mail judging means 12 calculates the elapsed time from the date and time when the URL is registered in the database 36 of the search engine as follows when a record satisfying the search condition is found. First, the spam mail determination unit 12 acquires the value of the “date and time” field of a record that satisfies the search condition. Next, the junk mail determination means 12 acquires the current time using a timer function or the like provided by the operating system. Then, the spam mail determination unit 12 calculates the difference between the acquired “current time” and the “date field value” as the elapsed time.

  S5: The spam mail determination means 12 determines whether or not it is a spam mail as follows, and passes the result to the spam mail processing means 13. First, the spam mail determination means 12 determines that the mail is spam if the elapsed time from the date when the URL is registered in the search engine database 36 is equal to or less than a predetermined threshold. Further, the spam mail determination means 12 determines that the mail is spam mail even when a record satisfying the search condition is not found in the search of S3. Conversely, the junk mail determination means 12 determines that the mail is not junk mail when the elapsed time from the date and time when the URL was registered in the search engine database 36 exceeds a predetermined threshold. Here, in addition to these determination conditions, when the search order of this URL in the search engine is lower than a predetermined threshold, it may be determined that the message is spam. According to this, even if an e-mail contains the URL of a site recently registered in a search engine, if the search order of this site is high, that is, if the popularity of this site is high, it is determined that the e-mail is not spam Can do.

  S6: The spam mail processing means 13 creates an email indicating that it is a spam mail when the judgment result received from the spam mail judgment means 12 indicates “spam mail”. Send to the same address as the destination. Here, the spam mail processing means 13 deletes the spam mail from the electronic mail storage means 23 of the mail server 2 when the judgment result received from the spam mail judgment means 12 indicates “spam mail”. You may do it.

As described above, when the URL extracted for each e-mail is the same as the URL that has been registered in the search engine database 36 in advance and the predetermined time has not elapsed, or it has not been registered in this database in advance, it is annoying. Since it is determined to be an e-mail, it is possible to easily identify a junk e-mail. That is, since it is determined that an e-mail including a URL of a site recently registered in a search engine is a junk e-mail, there is no need to update a conventional black list. In addition, a provider providing a search engine can provide a service for easily selecting junk mail by using an existing search engine database 36 (crawler database).
[Second Embodiment]

In the present embodiment, a DNS database is used as a database used when determining whether or not it is a spam mail.
[Overall configuration of spam mail processing device and related elements]

  FIG. 6 is a diagram illustrating the overall configuration of the spam mail processing device 1 and related elements according to the second embodiment.

  The spam mail processing device 1, the mail server 2, and the WHOIS server 4 according to the present embodiment are connected to a communication network N such as the Internet. It does not matter whether the connection with the communication network N is wired or wireless.

  The spam mail processing device 1 sorts spam mail from electronic mail received by the mail server 2 in accordance with a predetermined rule.

  The mail server 2 communicates with a mail client (not shown) by a protocol such as SMTP or POP3, and transmits / receives e-mail. The mail server 2 includes an e-mail transmission unit 21 that transmits an e-mail, an e-mail reception unit 22 that receives an e-mail, and an e-mail storage unit 23 that stores the received e-mail.

The WHOIS server 4 provides information on the domain inquired from the WHOIS client (spam mail processing device). The WHOIS server 4 includes a domain information request receiving unit 41 that receives a request for information about a domain, a domain information search unit 42 that searches for information about a domain for which an acquisition request has been made, and a domain that transmits domain information found by the search. Information transmission means 43. Here, the DNS database 44 stores information such as the date and time when the domain was registered, and constitutes a part of the domain information search means 42. Details of the DNS database 44 will be described later.
[Functional configuration of spam mail processing device]

The spam mail processing apparatus 1 according to the present embodiment has the same functional configuration as that of the spam mail processing apparatus 1 of the first embodiment.
[DNS database configuration]

  FIG. 7 is a diagram showing an outline of the configuration of the DNS database 44.

The DNS database 44 stores a domain ID, a domain, and the date and time when the domain was registered in the DNS database 44 in association with each other. Here, the DNS database 44 may be used as a DNS zone file by storing a domain and an IP address in advance in association with each other.
[Hardware configuration of spam mail processing device]

The spam mail processing apparatus 1 according to this embodiment has the same hardware configuration as that of the spam mail processing apparatus 1 of the first embodiment.
[Hardware configuration of mail server]

The mail server 2 has the same configuration as that of the spam mail processing apparatus 1 of the first embodiment.
[WHOIS server hardware configuration]

The WHOIS server 4 also has the same configuration as the spam mail processing apparatus 1 of the first embodiment.
[Flowchart According to Second Embodiment of the Present Invention]

  FIG. 8 shows a flowchart of the spam mail process (2) according to the second embodiment of the present invention.

  S11: The e-mail extracting unit 11 extracts the e-mail including the URL from the e-mail storing unit 23 (storage device) of the mail server 2 and passes it to the junk mail determining unit 12. As a method of extracting an e-mail including a URL, for example, a determination is made based on whether or not a character string starting with a scheme name such as “http:” is included. In the case of an electronic mail in the HTML format, the determination may be made based on whether or not a tag specifying a link such as “href” is included.

  S12: The junk mail determination unit 12 extracts a URL for each email received from the email extraction unit 11. As a method for extracting the URL, for example, a character string starting with a scheme name such as “http” is extracted. Whether the character string is at the end of the character string is determined based on, for example, whether the subsequent character is a space, a double quotation mark, or the like.

  S13: The spam mail determination unit 12 extracts a domain included in the extracted URL. As a method for extracting a domain, for example, a character string after “: //” following a scheme name is extracted from a URL character string. That is, when the URL is “http://meiwaku-domain.co.jp”, the character string “meiwaku-domain.co.jp” after “http: //” is extracted.

  S14: The spam mail determination means 12 searches the DNS database 44 for a record including the same domain as the domain extracted from the URL. Here, as the DNS database 44, for example, a WHOIS database of JPRS (Japan Registry Service Co., Ltd.) is used.

  S15: When the record satisfying the search condition is found, the spam mail judging means 12 calculates the elapsed time from the date and time when the domain is registered in the DNS database 44 as follows. First, the spam mail determination unit 12 acquires the value of the “date and time” field of a record that satisfies the search condition. Next, the junk mail determination means 12 acquires the current time using a timer function or the like provided by the operating system. Then, the spam mail determination unit 12 calculates the difference between the acquired “current time” and the “date field value” as the elapsed time.

  S16: The spam mail determination means 12 determines whether or not it is a spam mail as follows and passes the result to the spam mail processing means 13. First, the junk mail determination means 12 determines that the mail is junk mail when the elapsed time from the date and time when the domain is registered in the DNS database 44 is equal to or less than a predetermined threshold. Further, the spam mail determination means 12 determines that the mail is spam mail even when a record satisfying the search condition is not found in the search of S14. Conversely, the junk mail determination means 12 determines that the mail is not junk mail when the elapsed time from the date when the URL is registered in the DNS database 44 exceeds a predetermined threshold.

  S17: The junk mail processing means 13 creates an e-mail indicating that it is a junk mail when the judgment result received from the junk mail judgment means 12 indicates “spam mail”. Send to the same address as the destination. Here, the spam mail processing means 13 deletes the spam mail from the electronic mail storage means 23 of the mail server 2 when the judgment result received from the spam mail judgment means 12 indicates “spam mail”. You may do it.

  As described above, the domain included in the URL extracted for each e-mail is the same as the domain that has been registered in the DNS database 44 in advance and the predetermined time has not elapsed, or is not registered in this database in advance. In addition, since it is determined that it is a spam mail, it is possible to easily identify the spam mail. That is, since it is determined that an e-mail including a URL composed of a domain of a site recently registered in the DNS is a junk mail, there is no need to update the conventional black list. Further, a supplier who provides DNS information can provide a service for easily selecting junk mail using a DNS database.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above.

  For example, you may perform the process which combined the spam mail process of 1st Embodiment mentioned above, and the spam mail process of 2nd Embodiment.

  Furthermore, the effects described in the embodiments of the present invention are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

It is a figure which shows the whole structure of the junk mail processing apparatus which concerns on 1st Embodiment, and a related element. It is a figure which shows the outline | summary of the function structure of the junk mail processing apparatus which concerns on 1st Embodiment. It is a figure which shows the outline | summary of a structure of the database of a search engine. It is a figure which shows the hardware constitutions of the junk mail processing apparatus which concerns on 1st Embodiment. The flowchart of the spam mail process (1) which concerns on 1st Embodiment of this invention is shown. It is a figure which shows the whole structure of the junk mail processing apparatus which concerns on 2nd Embodiment, and a related element. It is a figure which shows the outline | summary of a structure of the database of DNS. The flowchart of the spam mail process (2) which concerns on 2nd Embodiment of this invention is shown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Spam mail processing apparatus 2 Mail server 3 Search server 4 WHOIS server 11 Email extraction means 12 Spam mail judgment means 13 Spam mail processing means 21 Email transmission means 22 Email reception means 23 Email storage means 31 Query reception means 32 Web Page search means 33 Search result transmission means 34 Web page collection means 35 Web page information storage means 36 Search engine database 41 Domain information request reception means 42 Domain information search means 43 Domain information transmission means 44 DNS database

Claims (4)

Computer
An e-mail extraction step for extracting a URL containing URL from the received e-mail;
A URL is extracted for each of the extracted e-mails, and the URL is the same as a URL that has been registered in a database configured based on web page information collected by the search robot and has not passed a predetermined time, and A spam e-mail determining step for determining that the e-mail is spam when the ranking of the search is lower than a predetermined threshold;
A spam mail processing step of notifying that it is a spam mail or deleting the spam mail when it is determined that the spam mail is;
A spam mail processing method characterized by executing at least. E-mail extracting means for receiving e-mail and extracting URLs including URLs from the e-mail;
A URL is extracted for each of the extracted e-mails, and the URL is the same as a URL that has been registered in a database configured based on web page information collected by the search robot and has not passed a predetermined time, and A spam mail judging means for judging that the mail is a spam mail when the ranking of the search is lower than a predetermined threshold;
A spam mail processing means for notifying that it is a spam mail or deleting the spam mail when it is determined that the spam mail;
A spam mail processing system comprising: An e-mail extracting means for extracting an e-mail including a URL;
A URL is extracted for each of the extracted e-mails, and the URL is the same as a URL that has been registered in a database configured based on web page information collected by the search robot and has not passed a predetermined time, and A spam mail judging means for judging that the mail is a spam mail when the ranking of the search is lower than a predetermined threshold;
A spam mail processing means for notifying that it is a spam mail or deleting the spam mail when it is determined that the spam mail;
A spam mail processing device comprising:   A program causing a computer to execute the method according to claim 1.

Images