JP5278929B2 - Information processing apparatus, information processing method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program, and in particular, e-mails to be audited are classified and grouped by automatic classification, and whether or not transmission is possible for the classified and grouped e-mails is performed. The present invention relates to an e-mail audit apparatus, an e-mail audit method, and an e-mail audit program that can be set.

  In recent years, the influence of leakage of personal information and confidential information on the trust of companies has increased. With the enforcement of various laws such as the Personal Information Protection Law, it is urgent for companies to take measures against information leakage. There are various causes of information leakage, such as unauthorized access from the outside, many of which are due to carelessness and other reasons.

  One such information leakage countermeasure is a mail filtering system. The e-mail filtering system sets e-mail characteristics as filtering conditions, such as the presence or absence of keywords that are likely to lead to information leakage, and selects e-mails that are subject to auditing or transmission control. The administrator can efficiently prevent information leakage by visually determining the selected electronic mail.

  As such prior art, in Patent Document 1, based on preset conditions, an email to be audited is selected, and a list of selected emails is sent to an administrator corresponding to the sender of the email. A mechanism for displaying audits and prompting audits is disclosed. In the technique of Patent Document 1, an email to be audited is extracted according to a fixed condition such that a keyword is described in the body of the email or a destination is a specific destination. Then, a summary of the extracted e-mail is created and notified to the auditor (administrator), and a mechanism that can be audited based on the summary is provided.

JP 2006-085642 A

  However, as the demand for information leakage prevention increases and diversifies, the number of e-mails subject to audit or transmission control increases, and the contents become diversified, and the e-mails that the administrator must visually check. The complexity of numbers and judgments is increasing.

If the number of e-mails that need to be visually confirmed is limited to a certain extent, it is possible to find e-mails that have a high possibility of information leakage by checking the title of each e-mail.
However, as the number of e-mails to be confirmed increases, it becomes difficult to even find e-mails that need to be examined from the list of e-mails, increasing the burden on the administrator.
In addition, an urgent mail is buried in many e-mails waiting for confirmation, and there is a problem that transmission is delayed.

An object of the present invention is that it allows to perform the audit instructions collectively to provide a mechanism for efficient work email audit or transmission control for increasing size.

The present invention is an information processing apparatus for performing electronic mail audit, and audit mail storage means for storing the e-mail audited, by analyzing the contents of the stored e-mail before Symbol audit mail storage means Field determination means for determining a field composition indicating the predetermined field determined to belong to the email and the degree to which the email belongs to the email; and the email stored in the audit mail storage means Grouping means for grouping for each e-mail having a similar field composition, and information relating to an audit screen capable of receiving audit results for the e-mail in units of groups divided by the grouping means. The audit information generating means to be generated and the information related to the audit screen of the email generated by the audit information generating means are output. Characterized in that it comprises a power means.

Further, the information processing apparatus of the present invention further compares the field composition of the group calculated by the average field composition calculation means with the field composition of each email grouped in the group, A variation calculation unit that calculates a variation degree of the field composition of each email, and the audit information generation unit, for each group when the variation degree calculated by the variation calculation unit is smaller than a predetermined value And generating information related to an audit screen capable of accepting an audit result.

The information processing apparatus of the present invention further includes:
A holding time storage means for storing a holding time for holding the transmission of an e-mail for each predetermined field;
A hold time calculating means for calculating a hold time for an e-mail using the hold time stored in the hold time storage means and the field composition determined by the field determining means;
A transmission hold means for holding the transmission of the e-mail during the hold time calculated by the hold time calculation means;
It is characterized by providing.

The information processing apparatus according to the present invention further includes an audit result receiving unit that receives an audit result for the suspended email, and an email that has received the audit result according to the audit result received by the audit result receiving unit. Determining means for determining whether or not to transmit.
The information processing apparatus according to the present invention further includes an audit result totaling unit that totals the audit results received by the audit result receiving unit for each group, and the determination unit includes the totalization results by the audit result totaling unit. And determining means for determining whether or not to transmit an electronic mail belonging to the group.
The audit mail storage means of the information processing apparatus according to the present invention is characterized in that an electronic mail suspended according to a transmission control condition indicating a condition for deferring transmission of the electronic mail is stored as an audit target.

According to the present invention, it is possible to improve the efficiency of the work of the e-mail audit or transmission control for increasing size.

It is a figure which shows the structure of the electronic mail auditing apparatus of embodiment of this invention. It is a figure which shows the hardware constitutions of the various terminals of embodiment of this invention. It is a figure which shows the basic processing flow of the electronic mail auditing apparatus of embodiment of this invention. It is a flowchart which shows the reception process of embodiment of this invention. It is a figure which shows an example of the control condition table of embodiment of this invention. It is a formula which calculates an evaluation value from field composition of an embodiment of the present invention. It is a figure which shows an example of the audit | inspection mail of embodiment of this invention. It is a figure which shows an example of the audit mail preservation | save table of embodiment of this invention. It is a figure which shows an example of the audit mail preservation | save table containing the clustering result of embodiment of this invention. It is a flowchart which shows the audit process of embodiment of this invention. It is a figure which shows an example of the user information table of embodiment of this invention. It is a figure which shows an example of the priority weight setting table of embodiment of this invention. It is a figure which shows an example of the field composition with respect to the email of embodiment of this invention. It is a 2nd figure which shows an example of the field composition with respect to the email of embodiment of this invention. It is a flowchart which shows the evaluation value calculation process of embodiment of this invention. It is a figure which shows an example of the audit | inspection screen with respect to the individual email of embodiment of this invention. It is a flowchart which shows the audit process with respect to the clustered email of embodiment of this invention. It is a flowchart which shows the evaluation value calculation process with respect to the cluster of an email of embodiment of this invention. It is a figure which shows an example of the audit | inspection screen with respect to the clustered electronic mail of embodiment of this invention. It is a figure which shows an example of the control condition table containing the holding time of embodiment of this invention. It is a figure which shows an example of the priority weight setting table containing the holding time of embodiment of this invention. It is a flowchart which shows a reception process in case holding time is included in the control conditions of embodiment of this invention. It is a flowchart which shows the automatic execution time calculation process of embodiment of this invention. It is a figure which shows an example of the audit mail preservation | save table containing the automatic execution time of embodiment of this invention. It is a flowchart which shows the automatic execution process of embodiment of this invention. It is a flowchart which shows the audit information generation process in consideration of the variation degree of embodiment of this invention. It is a figure which shows an example of the audit result preservation | save table of embodiment of this invention. It is a flowchart which shows the audit information generation process in consideration of the past audit result of embodiment of this invention. It is a figure which shows an example of the field composition total result with respect to the cluster of embodiment of this invention. It is a figure which shows the middle course in evaluation value calculation with respect to the cluster of embodiment of this invention. It is a formula for calculating the holding time from the field composition of the embodiment of the present invention. It is a 3rd figure which shows an example of the field composition with respect to the email of embodiment of this invention. It is a formula which calculates the distance of the field composition of an electronic mail of the embodiment of the present invention, and the average field composition of a cluster. It is a figure which shows an example of the result of having calculated the distance with respect to the cluster of embodiment of this invention.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a diagram showing the configuration of an electronic mail auditing apparatus (corresponding to the information processing apparatus of the present invention) according to an embodiment of the present invention. The configuration of various terminals connected to the network in FIG. 1 is an example, and it goes without saying that there are various configuration examples depending on the application and purpose.

  Reference numeral 100 denotes an electronic mail auditing device that provides an electronic mail auditing function. The electronic mail auditing apparatus 100 can transmit and receive data to and from the sender terminal 120, the manager terminal 130, and the mail server 140 via the network. The mail server 140 can send and receive data to and from the external network 150. The e-mail auditing apparatus 100 determines whether or not e-mails meeting the conditions can be transmitted according to a predetermined transmission control condition defined in advance for the e-mail received from the sender terminal 120. In addition, the administrator terminal 130 receives a determination as to whether or not the administrator can send the electronic mail whose transmission has been suspended from the administrator terminal 130, and performs control according to the determination on the electronic mail. The e-mail permitted to be transmitted is transmitted to the mail server 140 and is transmitted from the mail server 140 to the external network 150.

  A receiving unit 101 receives an electronic mail transmitted from the sender terminal. Reference numeral 102 denotes a transmission control unit that acquires a transmission control condition that matches the email received by the receiving unit 101 from the transmission control condition storage area 110 and controls the email according to the matched transmission control condition. Reference numeral 103 denotes an e-mail that is determined to be audited by the administrator in the transmission control unit 102, and analyzes the contents of the e-mail so that the field to which the e-mail belongs and the degree to which the e-mail belongs (the weight of the field) This is a field determination unit that determines and stores the value in association with the electronic mail in the audit mail storage area 111 (corresponding to the audit mail storage unit).

  104, for the administrator who conducts the audit, identifies members belonging to the group managed for each administrator from the information in the user information storage area 113, and sends an e-mail from which the member is the sender from the audit mail storage area 111. This is an audit information generation unit that acquires the evaluation value of the e-mail by the evaluation value calculation unit 105 and generates information necessary for the audit by the administrator.

  In the electronic mail auditing apparatus according to the present embodiment, the audit information generation unit 104 is stored in the electronic mail or the audit mail storage area 111 that is intended to be transmitted from the sender terminal 120 by the member managed by the administrator. Audit all emails First, the audit information generation unit 104 groups these e-mails into a plurality of clusters by the cluster generation unit 106, calculates the evaluation value of the cluster by the evaluation value calculation unit 105, and provides information necessary for the audit by the administrator. This is an audit information generation unit to be generated.

  105, in the audit of the e-mail or the cluster based on the priority weight for the field stored in the setting storage area 112 (corresponding to the priority storage unit) with respect to the cluster generated by the e-mail and cluster generation unit 106. It is an evaluation value calculation part which evaluates a priority and digitizes (evaluation value).

  106 divides an email that is about to be transmitted by a member managed by the administrator or all emails stored in the audit mail storage area 111 into a plurality of clusters based on the field determined by the field determination unit 103. A cluster generation unit for performing A priority weight setting unit 107 stores the evaluation priority set by the administrator in the setting storage area 112 for a predetermined field.

  108, for the audit information generated by the audit information generation unit 107, based on the audit result designated by the administrator from the audit unit 132, the electronic mail whose transmission has been suspended is subjected to a processing process including a deletion process or a transmission process. This is the audit processing department to be performed. Reference numeral 109 denotes an automatic execution processing unit that automatically processes an email satisfying a specified condition among emails pending transmission stored in the audit email storage area 111.

  Reference numeral 120 denotes a sender terminal (corresponding to an email creating apparatus) used by a sender who sends an email. The sender terminal 120 can send and receive e-mails to and from the e-mail auditing apparatus 100 via the network. Reference numeral 121 denotes an e-mail transmission / reception program having a function of a general e-mail transmission / reception program.

  Reference numeral 110 denotes a transmission control condition storage area for storing transmission control conditions. The transmission control condition includes a conditional expression for collating with an e-mail, a determination when the condition is met, and a default operation when the condition is met. The default operation is set when the determination is pending transmission. A specific example will be described later with reference to FIG.

  Reference numeral 111 denotes an audit mail storage area for storing an electronic mail to be audited whose transmission is suspended. Reference numeral 112 denotes a setting storage area for storing setting information such as priorities for fields. Although details of the fields will be described later, the contents of the body of the e-mail are for showing a combination of a plurality of fields. Reference numeral 113 denotes a user information storage area for storing a relationship between an administrator who performs auditing and a sender who is audited by the administrator. Reference numeral 114 denotes an audit result storage area for storing the results of the audit performed by the administrator.

  Reference numeral 130 denotes an administrator terminal (corresponding to an audit result specifying device) used by an administrator who audits electronic mail. Reference numeral 131 denotes setting means for setting the operation of the electronic mail auditing apparatus 100 via the network. Reference numeral 132 denotes an auditing unit that audits an electronic mail that has been suspended by the electronic mail auditing apparatus 100 via a network.

  Reference numeral 140 denotes a mail server that transmits e-mails received from the transmission control unit 102, the audit processing unit 108, and the automatic execution processing unit 109 to the external network 150. Reference numeral 150 denotes an external network.

  Next, the hardware configuration of the electronic mail audit apparatus 100 (information processing apparatus), mail sender terminal 120, administrator terminal 130, and mail server 140 of FIG. 1 will be described with reference to FIG. FIG. 2 is a diagram illustrating a hardware configuration of the host computer 200.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 202 or the external memory 211 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS) that is a control program of the CPU 201 and a function executed by each server or each PC. Various programs to be described later are stored. The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program necessary for execution of processing into the RAM 203 and executing the program.

  An input controller (input C) 205 controls input from a pointing device such as a keyboard 209 or a mouse (not shown). A video controller (VC) 206 controls display on a display device such as a CRT display (CRT) 210. The display device may be a liquid crystal display as well as a CRT. These are used by the administrator as needed. The present invention is not directly related. The memory controller (MC) 207 is stored in a hard disk (HD), a floppy (registered trademark) disk or a PCMCIA card slot for storing a boot program, browser software, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a compact flash (registered trademark) connected via an adapter. A communication I / F controller (communication I / FC) 208 is connected to and communicates with an external device via a network, and executes communication control processing in the network. For example, Internet communication using TCP / IP is possible. Note that the CPU 201 enables display on the CRT 210 by executing outline font rasterization processing on a display information area in the RAM 203, for example. In addition, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the CRT 210.

An e-mail audit program 212 for realizing the present invention is recorded in the external memory 211 and is executed by the CPU 201 by being loaded into the RAM 202 as necessary. Furthermore, the definition file 213 and various information tables 214 used by the program 212 according to the present invention are stored in the external memory 211, and detailed description thereof will be described later.
(Basic flow)

  Next, a basic processing flow of the electronic mail auditing apparatus will be described with reference to FIG. FIG. 3 is a diagram showing a basic processing flow of the electronic mail auditing apparatus according to the embodiment of the present invention.

  In step S301, the e-mail auditing apparatus 100 receives the e-mail transmitted from the sender terminal 120, and determines whether or not the administrator needs to audit the received e-mail. Details of this reception processing will be described later with reference to FIG. In step S <b> 302, the electronic mail auditing apparatus 100 stores the electronic mail 302 to be audited that is determined to be audited by the administrator in the audit mail storage area 111.

In step S303, the electronic mail auditing apparatus 100 presents the audit target mail 302 in response to a request from the administrator, and performs processing such as transmitting or stopping the transmission of the audit target mail 302 in accordance with an instruction from the administrator. Details of this audit process will be described later with reference to FIG.
(Reception processing)

Next, the detailed flow of the process of step S301 is demonstrated using FIG. FIG. 4 is a diagram showing a processing flow when an email is received by the email auditing apparatus according to the embodiment of the present invention.
In step S <b> 401, the receiving unit 101 receives an e-mail transmitted from the e-mail transmission / reception program 121 operating on the sender terminal 120.

  In step S402, the transmission control unit 102 starts the iterative process up to step S405 for the transmission control condition stored in the transmission control condition storage area 110.

  FIG. 5 is an example of a control condition table showing transmission control conditions stored in the transmission control condition storage area 110. The control condition includes a conditional expression for collating with an electronic mail, a determination when the condition is met, and a default operation when the condition is met. The default operation is set when the determination is pending transmission.

  In step S403, the transmission control unit 102 determines whether or not the transmission control condition matches the email received in step S401. If the condition is met, the process proceeds to step S404. If not, the process moves to step S405.

  If the transmission control conditions of FIG. 5 are determined one by one and determined to match, the transmission control unit 102 refers to the determination items in the matched transmission control conditions (FIG. 5) in step S404. If the determination item is “transmission permitted”, the process proceeds to step S406. If the determination item is “transmission impossible”, the process proceeds to step S407. If the determination item is “transmission pending”, the process proceeds to step S408. In this way, transmission control conditions are determined one by one, and e-mails that meet the transmission control conditions and whose determination item is “transmission pending” are selected and extracted.

  If one transmission control condition in FIG. 5 is determined and it is determined that they do not match, the transmission control unit 102 determines whether or not the transmission control condition storage area 110 has the next transmission control condition in step S405. If it is determined that there is a next transmission control condition, the processing from step S402 is performed for the next transmission control condition. If there is no next transmission control condition, the process proceeds to step S406. In step S406, the transmission control unit 102 transmits an e-mail to the mail server 140 and ends the process. In this embodiment, when there is no match with the transmission control condition, the mail is sent. However, the present invention is not limited to this, and when there is no match, “send” The processing may be moved to step S408 as “hold”, or the processing may be moved to step S407 as “transmission impossible”.

In step S407, the transmission control unit 102 deletes the electronic mail without transmitting it, and ends the process. At this time, the transmission control unit 102 may notify the sender of the e-mail that the e-mail has been deleted without being transmitted using a known technique of the e-mail or the messenger function.
In step S408, the field determination unit 103 analyzes the content of the email and identifies the field to which the email belongs.

  In the field classification of the present invention, the field to which the electronic mail belongs is not determined as one, but the specified field and the degree of belonging to the field are expressed as a plurality of sets as shown in FIG. Hereinafter, a combination of a plurality of fields and degrees for a document (e-mail) is referred to as field composition.

  Email field classification can be implemented using existing methods such as naive Bayes classifiers. In the naive Bayes classifier, the probability that a document belongs to the document group can be obtained from the frequency of occurrence of the word constituting the document in the document group belonging to a certain field. Based on this probability, the degree belonging to the field is quantified and acquired as the field composition. The acquisition of the field composition may be performed by a method other than the naive Bayes classifier. Since a known technique can be used for this field composition acquisition method, a specific description thereof is omitted.

In step S409, the transmission control unit 102 stores the email in the audit mail storage area 111. At the same time, in step S408, the transmission control unit 102 stores the field determined by the field determination unit 103 and the frequency of the field in association with the email. Exit.
(Specific example of reception processing)
Next, processing for the electronic mail in FIG. 7 will be described in detail.

  In step S401, the receiving unit 101 receives the electronic mail in FIG. In step S402, the transmission control unit 102 starts the iterative process up to step S405 for the transmission control condition shown in FIG. 5 stored in the transmission control condition storage area 110.

In step S403, the transmission control unit 102 determines whether the control condition 501 matches the email received in step S401. The control condition 501 indicates that it is determined whether or not the character string “confidential” is included in the e-mail. Since the electronic mail in FIG. 7 does not meet the control condition 501, the process proceeds to step S405.
In step S405, if there is a next transmission condition, the transmission control unit 102 moves the process to step S402 because there is a next transmission control condition 502.

The control condition 502 (including the “confidential” character string) and the control condition 503 (including the “confidential” character string) do not match the e-mail in FIG. 7, and the processing from step S401 to step S405 is repeated.
In step S402, the transmission control unit 102 starts processing for the control condition 504, and moves the processing to step S403.

In step S403, the transmission control unit 102 determines whether the control condition 504 matches the email received in step S401. The control condition 504 indicates that it is determined whether or not the address of the sender of the e-mail matches backward with the character string “bbb.co.jp”. Since the electronic mail in FIG. 7 matches the control condition 504, the process proceeds to step S404.
In step S404, the transmission control unit 102 proceeds to processing step S408 because the determination item of the matched transmission control condition 504 is “transmission pending”.
In step S408, the field determination unit 103 analyzes the content of the email in FIG. 7 and obtains the field composition in FIG. 13 as the field to which the email belongs.

In step S409, the transmission control unit 102 stores the electronic mail in FIG. 7 and the field composition in FIG. 13 as a record 801 in the audit mail storage table shown in FIG. 8 arranged in the audit mail storage area 111. To finish the process.
(Audit processing)
Next, a detailed flow of the process in step S303 will be described with reference to FIG.
FIG. 10 is a diagram showing a processing flow at the time of auditing by the electronic mail auditing apparatus according to the embodiment of the present invention.

  The processes in steps S1001 to S1003 may be performed for the administrator who performs the audit when there is a request for performing the audit by the audit unit 132 from the administrator terminal, or for all the administrators. It may be performed periodically. In the present invention, a case will be described in which processing is performed when an audit execution request is made.

  In step S1001, the audit information generation unit 104 refers to the user information table as shown in FIG. 11 stored in the user information storage area 113, and checks the administrator from the email stored in the audit mail storage area 111. Acquires an e-mail (hereinafter referred to as an audit target e-mail) in which the user to be managed is the sender.

  In step S1002, the evaluation value calculation unit 105 refers to the priority weight setting table as shown in FIG. 12 stored in the setting storage area 112, and calculates an evaluation value for each email for the audit target mail. To do. The evaluation value calculation method will be described later.

  In step S1003, the audit information generation unit 104 generates, as audit information, information necessary for displaying the audit means from the audit target mail and the evaluation value. In this embodiment, no particular information is added, and rearrangement is performed based on evaluation values.

  In step S1004, the audit information generation unit 104 generates a screen to be displayed on the audit unit 132 as shown in FIG. 16 from the audit information. The audit unit 132 adds an administrator instruction for the audit target mail to the audit information.

  As described above, the audit information generation unit 104 generates the email audit screen shown in FIG. 16, and the audit screen is transmitted from the audit processing unit 108 to the audit unit 132 by access from the audit unit of the administrator terminal 130. Displayed on the administrator terminal. However, the present invention is not limited to this. For example, the audit information generation unit 104 determines an electronic mail to be audited preferentially from a plurality of electronic mails to be audited according to the evaluation value of each electronic mail. Generate information related to the email audit screen. The audit processing unit 108 may output the information related to the audit screen of the e-mail to the auditing means 132 so that the auditing screen of FIG. 16 is displayed according to the display control program on the auditing means 132 side. That is, the information relating to the email audit screen may be the email audit screen itself, or may be an information code that is the basis for displaying the email audit screen.

  FIG. 16 shows an example of an audit screen displayed by the audit means 132. The audit screen displays the evaluation value calculated in step S1002 in the evaluation value column 1603, and displays a list of emails to be audited in the order of the evaluation value.

The audit screen exclusively receives a transmission permission or transmission disabled instruction from the administrator through a transmission field 1601 (transmission permission) and a deletion field 1602 (transmission disabled) for each electronic mail.
When the collective operation button 1605 is pressed on the audit screen, an instruction to permit transmission or not to transmit is added to the audit information, and the process proceeds to step S1005.
When the cancel button 1606 is pressed on the audit screen, the process proceeds to step S1005 without doing anything.

  When the individual audit column 1604 is pressed, the audit screen displays an individual audit screen for displaying details of the e-mail. When an audit instruction is issued on the individual audit screen, the audit screen updates the value in the transmission field 1601 or the deletion field 1602 in accordance with the audit instruction.

  In order to assist the administrator's audit, the audit screen may summarize the contents of the e-mail and display it as a snippet, or may display it as a popup for a specific area.

In step S1005, the audit processing unit 108 executes the audit instruction for the suspended electronic mail based on the audit information to which the administrator's instruction for the audit target mail is added, and ends the process. The e-mail instructed to permit transmission is transmitted to the mail server 140 and transmitted to the external network 150. An e-mail instructed not to be sent is deleted without being sent.
At this time, the audit processing unit 108 may notify the sender of the e-mail that transmission or deletion has been performed.
(Specific example of audit processing)
Next, the case where the administrator “okada@aaa.co.jp” has requested audit processing will be described in detail.

  In step S1001, the audit information generation unit 104 refers to the user information table shown in FIG. 11 stored in the user information storage area 113, and the administrator “okada@aaa.co.jp” User “nakamura@aaa.co.jp”, “okubo@aaa.co.jp”, “nakazawa@aaa.co.jp”, “nagatomo@aaa.co.jp” are acquired, and the audit mail storage area 111 E-mails 801 to 804 transmitted by the acquired user are acquired from the audit mail storage table shown in FIG.

  In step S1002, the evaluation value calculation unit 105 evaluates the evaluation value 4.4 for the e-mail 801, the evaluation value 1.5 for the e-mail 802, and the e-mail 803 by an evaluation value calculation method described later. An evaluation value of 4.1 is obtained for the electronic mail 804.

  In step S <b> 1003, the audit information generation unit 104 generates audit information in which audit target mails are rearranged in the order of e-mail 801, e-mail 803, e-mail 804, e-mail 802 in descending order of evaluation value.

  In step S1004, the audit information generation unit 104 generates a screen from the audit information as shown in FIG. By performing the processing in the order of display, the administrator can perform processing in order from an e-mail with a high evaluation value (determined to be audited preferentially). Although the evaluation value may be displayed as it is in the evaluation value column 1603, in this embodiment, the evaluation value is expressed by six-step parameters “0 to 5”. For example, if the evaluation value is 4.4 for the e-mail 801, the decimal point is rounded off and displayed as the evaluation value 4 in the evaluation value field 1603. If the evaluation value is 1.5 for the e-mail 802, the decimal point is rounded off to the evaluation value. 2 is displayed in the evaluation value column 1603.

  Here, it is assumed that transmission permission is instructed to the e-mail 801, e-mail 803, and e-mail 804 by the administrator on the audit screen shown in FIG.

In step S1005, the audit processing unit 108 transmits the e-mail 801, e-mail 803, and e-mail 804 to the mail server 140, and deletes the e-mail 802 without transmitting it.
(Evaluation value calculation process)

  Next, a detailed flow of the process in step S1002 will be described with reference to FIG. FIG. 15 is a diagram showing a processing flow at the time of evaluation value calculation of the electronic mail auditing apparatus according to the embodiment of the present invention.

  In step S1501, the evaluation value calculation unit 105 starts the iterative process up to step S1508 for all the audit target emails acquired in step S1001.

  In step S1502, the evaluation value calculation unit 105 starts the iterative process up to step S1505 for the field composition associated with the audit target mail being processed.

  In step S1503, the evaluation value calculation unit 105 acquires the priority weight corresponding to the field being processed from the priority weight setting table as shown in FIG.

  In step S1504, the evaluation value calculation unit 105 stores the priority weight acquired in step S1503 in the temporary area in association with the field being processed and the frequency of the field.

  In step S1505, if there is a next field associated with the audit target mail being processed, the evaluation value calculation unit 105 returns the process to step S1502 and starts processing for the next field. If there is no next field, the process proceeds to step S1506.

In step S1506, the evaluation value calculation unit 105 calculates an evaluation value from the field, frequency, and priority weight stored in the temporary area. The evaluation value is a numerical value of the degree to be audited. In the present embodiment, an evaluation value is obtained from the formula shown in FIG. 6, and the larger the evaluation value, the more auditing is preferentially performed.
In step S1507, the evaluation value calculation unit 105 stores the evaluation value calculated in step S1506 in association with the audit target mail being processed.

In step S1508, if there is a next audit target mail, the evaluation value calculation unit 105 returns the process to step S1001, and starts processing for the next audit target mail. If there is no next audit target mail, the process ends.
(Specific example of evaluation value calculation)
Next, processing for an electronic mail having the field composition of FIGS. 13 and 14 will be described in detail.
In step S1501, the evaluation value calculation unit 105 starts processing for an e-mail having the field composition of FIG.
In step S1502, the evaluation value calculation unit 105 starts processing for the field composition of FIG.

In step S1503, the evaluation value calculation unit 105 acquires a priority weight for the field composition 1301. The field of the field composition 1301 is “economy / contract”, and the priority weight 5 is acquired from the setting “economic / contract” 1201 in the priority weight setting table of FIG.
In step S1504, the evaluation value calculation unit 105 stores (field, frequency, priority weight) = (“economy / contract”, 40, 5) in the temporary area.
In step S <b> 1505, the evaluation value calculation unit 105 returns the process to step S <b> 1502 because there is the next field composition (“economy / distribution”).

Similarly, for the field compositions 1302 to 1305, repeating steps S1502 to S1505 results in the following set of values: ("Economic / Contract", 40, 5), ("Economy / Distribution", 20, 5), (“Machine / Camera”, 20, 4), (“Chemical / Glass”, 10, 3), (“Optical / Lens”, 10, 3) are stored in the temporary storage area.
In step S1506, the evaluation value calculation unit 105 calculates the evaluation value 4.4 from the equation of FIG. 6 for the field, frequency, and priority weight stored in the temporary area.
(Evaluation value) = (40 × 5 + 20 × 5 + 20 × 4 + 10 × 3 + 10 × 3) / 100
= 4.4
In step S1507, the evaluation value calculation unit 105 stores the evaluation value calculated in step S1506 in association with the audit target mail being processed.
In step S1508, the evaluation value calculation unit 105 returns to step S1001 because there is an e-mail having the field composition shown in FIG.

When the processing from step S1502 to step S1505 is repeated in the same manner for the field compositions 1401 to 1403 shown in FIG. 14, the following value pairs are obtained: ("Economic / Contract", 20, 5), ("Economic / Stock" ”, 50, 1), (“ gambling / market ”, 30, 0) are stored in the temporary storage area.
In step S1506, the evaluation value calculation unit 105 calculates an evaluation value 1.5 from the formula of FIG. 6 for the field, frequency, and priority weight stored in the temporary area.
(Evaluation value) = (20 × 5 + 50 × 1 + 30 × 0) / 100
= 1.5

In this way, by calculating the evaluation value based on the priority weight set for the field by the administrator, the evaluation value of an email having a large degree of the field that the administrator wants to prioritize increases, and as a result, priority is given. Can be processed.
(Second embodiment)
(Audit by clustering)
Next, as a second embodiment, a case where auditing mail is clustered (grouped) and audited will be described with reference to FIG. The number of emails to be grouped is arbitrary, and those having similar classifications are grouped. FIG. 17 is a diagram illustrating a processing flow of audit processing.

  Clustering may be performed for all e-mails stored in the audit mail storage area 111 or only for audit target mails for a specific administrator. In the present embodiment, a case will be described in which clustering is performed on all electronic mails stored in the audit mail storage area 111.

  The processing of step S1701 or step S1702 to step S1704 may be performed on the administrator who performs the audit when there is a request for auditing by the auditing means 132 from the administrator terminal, or all managers May be performed periodically. In the present embodiment, a case will be described in which the processes of step S1701 and steps S1702 to S1704 are performed when an audit execution request is made.

In step S1701, the clustering unit 106 performs clustering processing on the email stored in the audit email storage area 111 based on the field composition associated with the email, and acquires the cluster. Clustering can be realized by using a method such as a self-organizing map or a K-average method.
The clustering result is stored by adding the number given to the cluster to the information of the e-mail as in the audit mail storage table shown in FIG.

  In step S1702, the audit information generation unit 104 refers to the user information table as shown in FIG. 11 stored in the user information storage area 113, and checks the administrator from the email stored in the audit mail storage area 111. Obtains an email (audit email) whose sender is the email user to be managed.

  In step S1703, the evaluation value calculation unit 105 refers to the priority weight setting table shown in FIG. 12 stored in the setting storage area 112 in step S1701, and selects one audit target mail from the acquired clusters. An evaluation value is calculated for the cluster including the above. The evaluation value calculation method will be described later.

  In step S1704, the audit information generation unit 104 generates information necessary for displaying the audit means as audit information from the cluster and the evaluation value. In the present embodiment, no information is added.

  In step S 1705, the audit information generation unit 104 generates an audit screen shown in FIG. 19 from the audit information and displays it on the audit unit 132. The auditing unit 132 adds an administrator instruction for the cluster or the audit target mail to the audit information.

  FIG. 19 is an example of an audit screen for the cluster generated in step S1705 and displayed on the auditing unit 132. The audit screen displays the evaluation values calculated in step S1703 in the evaluation value column 1905, and displays a list of clusters to be audited in order of the evaluation values.

  The audit screen exclusively receives an instruction to permit or prohibit transmission from the administrator through the transmission column 1901 (transmission permitted) and the deletion column 1902 (transmission disabled) for each cluster. The audit screen displays the main field composition in the cluster in the field field 1903 among the field compositions of the electronic mail constituting the cluster. When the collective operation button 1907 is pressed on the audit screen, an instruction to permit transmission or not to transmit is added to the audit information, and the process proceeds to step S1706. If a cancel button 1908 is pressed on the audit screen, the process moves to step S1706 without doing anything. When the individual audit column 1906 is pressed, the audit screen displays an individual cluster audit screen that displays an audit screen for the cluster. The individual cluster audit screen has the same function as the audit screen shown in FIG. When an audit instruction is given on the individual audit screen, the individual audit instruction is added to the audit information. The audit screen indicates that the value of the transmission column 1901 or the deletion column 1902 is invalid and the progress of the audit is updated by updating the value of 1904.

  In step S1706, the audit processing unit 108 performs processing of the suspended email based on the audit information to which the administrator's instruction for the cluster or audit target email is added, and ends the processing. The e-mail belonging to the cluster instructed to send is sent to the mail server 140 and sent to the external network 150. The e-mail belonging to the cluster instructed not to be sent is deleted without being sent. Individually designated cluster mails follow the individual instructions. At this time, the audit processing unit 108 may notify the sender of the e-mail that transmission or deletion has been performed.

In this way, auditing can be performed from a cluster composed of e-mails to be audited preferentially. In addition, since audit target emails with similar field composition are gathered in the cluster, it is possible to summarize the titles and outlines of audit target emails belonging to the fields that do not require detailed examination, and give audit instructions collectively.
(Specific example of auditing by clustering)

  Next, a specific description will be given of a case where the administrator “okada@aaa.co.jp” performs auditing by clustering on the email stored in the audit mail storage table shown in FIG.

  In step S1701, the clustering unit 106 performs clustering on the emails stored in the audit mail storage table shown in FIG.

  In the present embodiment, clustering is performed using a K-average method as an example of a clustering method. As a result of clustering, e-mail 901, e-mail 903, and e-mail 905 are classified into cluster 1, e-mail 902 and e-mail 906 are classified into cluster 2, and e-mail 904 is classified into cluster 3. Details of the clustering will be described later.

  In step S1702, the audit information generation unit 104 refers to the user information table shown in FIG. 11, and the sender is the management target of the administrator “okada@aaa.co.jp” from the audit mail table of FIG. Get an email. Since all senders of the e-mails 901 to 906 in FIG. 9 are managed by “okada@aaa.co.jp”, the e-mails 901 to 906 are acquired.

  In step S1703, the evaluation value calculation unit 105 obtains an evaluation value 4.2 for cluster 1, an evaluation value 1.75 for cluster 2, and an evaluation value 2.8 for cluster 3 by an evaluation value calculation method described later.

  In step S1704, the audit information generation unit 104 generates audit information rearranged in the order of cluster 1, cluster 3, and cluster 2 in descending order of cluster evaluation values.

  In step S 1705, the audit information generation unit 104 generates a screen as shown in FIG. 19 from the audit information and displays it on the audit unit 132. As a result, processing can be performed in order from the cluster with the highest evaluation value (which should be audited preferentially).

  Here, it is assumed that, on the audit screen shown in FIG. 19, the administrator has instructed transmission permission to cluster 1 and cluster 3 and instructed cluster 2 to be unable to transmit.

In step S1706, the audit processing unit 108 transmits the e-mail 901, e-mail 903, e-mail 905, and e-mail 904 belonging to the cluster 1 to the mail server 140, and the e-mail 902 belonging to the cluster 2, Delete the e-mail 906 without sending it.
(Clustering details)

The K-means method, which is a clustering method, will be described. The algorithm for clustering based on the field composition of email by the K-means method is as follows.
(Step 1) E-mails are randomly arranged in N clusters (step 2) The center (average of field composition) of each cluster is obtained (average field composition calculation processing)
(Step 3) Repeat for each e-mail (step 4) Calculate the distance for the center of each cluster (step 5) Change the cluster to which there is a cluster with a center closer to the current cluster (step 6) The electron whose cluster has been changed If there is mail, return to step 2. (step 7) End The calculation method of the distance at (step 4) is based on the equation of FIG.

Here, it is assumed that FIG. 34 is obtained as a result of randomly assigning e-mails 901 to 906 to three clusters and obtaining an average. At this time, for example, the distance from the center of each cluster with respect to the field composition of the e-mail 905 is as follows.
(Distance to cluster 1)
= √ (35-50) ² + (15-0) ² + (20-20) ² + (15-0) ² + (15-30) ²
= √900
= 30
(Distance to cluster 2)
= √ (10-50) ² + (0-20) ² + (75-0) ² + (5-0) ² + (0-30) ² + (10-0) ²
= √ 8650
= 93.0053 ...
(Distance to cluster 3)
= √ (25-50) ² + (15-0) ² + (10-20) ² + (35-30) ² + (15-0) ²
= √1200
= 34.6410 ...
As a result, the field composition 905 has the shortest distance from the center of the cluster 1, so the cluster to which the field composition 905 belongs is changed to the cluster 1.
Clustering is realized by repeating such processing until there is no more e-mail whose cluster is changed.
(Calculation of cluster evaluation value)
Next, the evaluation value calculation processing for the cluster in step S1703 will be described with reference to FIG.
In step S1801, the audit information generation unit 104 initializes cluster information secured in the temporary area.

In step S1802, the audit information generation unit 104 starts the iterative process up to step S1807 for all the audit target emails acquired in step S1001.
In step S1803, the audit information generation unit 104 acquires cluster information corresponding to the cluster to which the audit target mail being processed belongs from the temporary area.

  In step S1804, the audit information generation unit 104 starts the iterative process up to step S1806 for the field composition associated with the audit target mail being processed.

  In step S1805, the audit information generation unit 104 adds the field composition being processed and the frequency of the field acquired in step S1503 to the cluster information acquired in step S1803.

  In step S1806, if there is a next field composition associated with the audit target mail being processed, the audit information generation unit 104 returns the process to step S1804 and starts processing for the next field composition. If there is no next field composition, the process proceeds to step S1807.

  In step S1807, if there is a next audit target mail, the audit information generation unit 104 returns the process to step S1802, and starts processing for the next audit target mail. If there is no next audit target mail, the process proceeds to step S1808.

  In step S1808, the audit information generation unit 104 starts the iterative process up to step S1813 for all the cluster information acquired in steps S1801 to S1807.

  In step S1809, the audit information generation unit 104 obtains an average field composition included in the cluster information being processed. The average field composition is configured as an average value of all fields included in the cluster information and the frequency of the fields.

  In step S1810, the audit information generation unit 104 refers to the priority weight setting table as shown in FIG. 12 stored in the setting storage area 112 and corresponds to each field with respect to the average field composition acquired in step S1809. Get priority weight.

In step S1811, the audit information generation unit 104 calculates an evaluation value from the field, frequency, and priority weight of the average field composition by the same method as in step S1506.
In step S1812, the audit information generation unit 104 stores the evaluation value in the cluster information.

In step S1813, if there is next cluster information, the audit information generation unit 104 returns the process to step S1808 and starts the process for the next cluster information. If there is no next cluster information, the process ends.
(Specific example of cluster evaluation value calculation)
The evaluation value calculation process will be specifically described with reference to an email stored in the audit mail shown in FIG.
In step S1801, the audit information generation unit 104 initializes cluster information secured in the temporary area.
In step S1802, the audit information generation unit 104 starts processing for the email 901.
In step S1803, the audit information generation unit 104 acquires cluster information corresponding to the cluster 1 to which the electronic mail 901 belongs from the temporary area.
In step S1804, the audit information generation unit 104 starts processing for the field composition of the e-mail 901.

In step S 1805, the audit information generation unit 104 adds the first field composition and frequency (“economy / contract”, 40) of the electronic mail 901 to the cluster information of cluster 1.
In step S1806, the audit information generation unit 104 returns the process to step S1804 because there is the next field composition (“economy / distribution”).
In step S 1804, the audit information generation unit 104 starts processing for the next field composition (“economy / distribution”) of the e-mail 901.

In step S 1805, the audit information generation unit 104 adds the second field composition and frequency (“economy / distribution”, 30) of the email 901 to the cluster information of cluster 1.
In step S1806, since there is the next field composition (“machine / camera”), the audit information generation unit 104 returns the process to step S1804.
In step S 1804, the audit information generation unit 104 starts processing for the next field composition (“machine / camera”) of the e-mail 901.

In step S 1805, the audit information generation unit 104 adds the third field composition and frequency (“machine / camera”, 30) of the e-mail 901 to the cluster information of cluster 1.
In step S1806, since there is no next field composition, the audit information generation unit 104 returns the process to step S1807.
In step S1807, the audit information generating unit 104 returns the process to step S1802 because there is the next audit target mail (e-mail 902).
In step S1802, the audit information generation unit 104 starts processing for the email 902.
In step S1803, the audit information generation unit 104 acquires cluster information corresponding to the cluster 2 to which the electronic mail 902 belongs from the temporary area.
Similarly, Steps S1804 to S1806 are repeated to add the field composition of the e-mail 902 to the cluster information of the cluster 2.

Similarly, when the processes in steps S1802 to S1807 are repeated for the emails to be audited from email 903 to email 906, the cluster information shown in FIG. 29 is stored in the temporary storage area.
In step S 1808, the audit information generation unit 104 starts processing for the cluster information 2901 of cluster 1.
In step S1809, the audit information generation unit 104 calculates the average field composition of the cluster information 2901.

In step S1810, the audit information generation unit 104 refers to the priority weight setting table shown in FIG. 12 for the average field composition acquired in step S1809, and acquires the priority weight of each field composition.
FIG. 30 is a table showing the processing results of steps S1809 and S1810.
In step S1811, the audit information generation unit 104 calculates 4.2 an evaluation value for the average field composition in FIG. 30 using the formula in FIG.
(Evaluation value) = (40 × 5 + 10 × 5 + 10 × 3 + 20 × 4 + 20 × 3) / 100
= 4.2
In step S1812, the audit information generation unit 104 stores the evaluation value 4.2 in association with the cluster information 2901.
In step S1813, the audit information generation unit 104 returns the processing to step S1808 because there is next cluster information 2902.
Hereinafter, similarly, an evaluation value of 1.75 is acquired for the cluster information 2902 and an evaluation value of 2.8 is acquired for the cluster information 2903.

In this way, by calculating the evaluation value based on the priority weight set for the field by the administrator, the evaluation value of the cluster composed of e-mails including the contents of the field that the administrator wants to prioritize increases. , Will be able to process with priority. In addition, it is possible for the administrator to select a cluster with a small evaluation value (low necessity for scrutiny) according to his / her own circumstances, such as giving an audit instruction in a lump summarily.
(Third embodiment)
(Automatic auditing with hold time setting)

  Next, as a third embodiment, a case where an audit process is automatically performed according to a set hold time will be described with reference to FIG. FIG. 22 is a diagram illustrating a processing flow of an audit process by setting a holding time.

  In this embodiment, the transmission control condition table stored in the transmission control condition storage area 110 is added with a holding period and has a configuration as shown in FIG. The difference between the transmission control condition table of FIG. 20 and FIG. 5 is that an item of “holding period” is provided. The processing from step S401 to step S408 is the same processing as the flow shown in FIG. 4 in the first embodiment.

  In step S2201, when the suspension period is set in the transmission control condition, the transmission control unit 102 moves the process to step S2202. If the hold period is not set, the process proceeds to step S409. In step S2202, the transmission control unit 102 automatically determines the time and automatic operation to execute the process from the suspension period set in the control condition when the administrator does not perform the audit within the suspension period. Details of the process for determining the automatic execution time will be described later.

In step S409, the transmission control unit 102 stores the field determined by the field determination unit 103 in step S408 and the frequency of the field in the audit mail storage area 111 in association with the e-mail in the same manner as in the first embodiment. At the same time, the automatic execution time and automatic operation acquired in step S2202 are also stored in association with the e-mail, and the process ends.
FIG. 24 shows an example of an audit mail storage table in which execution times and automatic operations are stored in association with electronic mail.
(Specific example of reception processing when holding time is included)

  Next, the case of processing the e-mail in FIG. 7 will be specifically described with respect to the transmission control condition table in FIG. If the e-mail in FIG. 7 is processed with respect to the transmission control condition table in FIG. The control condition 2004 is met.

In step S404, the transmission control unit 102 shifts to processing step S408 because the determination of the matched transmission control condition 2004 is transmission pending. In step S408, the field determination unit 103 analyzes the content of the email in FIG. 7 and obtains the field composition in FIG. 13 as the field to which the email belongs, as in the specific example of the first embodiment.
In step S2201, the field determination unit 103 moves the process to step S2202, since the hold time is set in the transmission control condition 2004.

  In step S2202, the field determination unit 103 sets “February 16 15:12:00” as the automatic execution time from the holding period of the transmission control condition 2004 (the e-mail reception time in FIG. 7 February 16 12: 00). 3 hours after 12:00) is calculated.

In step S409, the transmission control unit 102 sets the e-mail in FIG. 7, the field composition in FIG. 13, the execution time “February 16, 15:12:00” calculated in step S2202, and the control condition 2004. The automatic operation “send” that has been performed is stored as the record 2401 in the audit mail storage table shown in FIG. 24 arranged in the audit mail storage area 111, and the process is terminated.
(Automatic execution time determination process)
Next, automatic execution time determination processing will be described with reference to FIG.
FIG. 23 is a diagram showing a processing flow of automatic execution time determination processing.

  In step S2301, the transmission control unit 102 determines whether a hold time is set for the transmission control condition matched in step S403 in FIG. If a value indicating “field dependent” is set, the process proceeds to step S2302. If the time has been set, the process proceeds to step S2307 to perform a hold time acquisition process.

  In step S2302, the transmission control unit 102 starts the iterative process up to step S2305 for the field composition acquired in step S408 of FIG.

In step S2303, the transmission control unit 102 acquires the hold time from the priority weight table as shown in FIG. 21 for the field being processed. As shown in the priority weight table of FIG. 21, a hold time may be provided for each field in the priority weight table, but each field and the hold time may be prepared in separate tables (hold time table). . In other words, in the present embodiment, the holding time table includes a priority weight table having an item of holding time.
In step S2304, the transmission control unit 102 stores the frequency for the field being processed in association with the hold time acquired in step S2303.

In step S2305, if there is a field to be processed next, the transmission control unit 102 returns the process to step S2302 and starts processing for the next field. If there is no field to process next, the process proceeds to step S2306.
In step S2306, the transmission control unit 102 calculates the hold time for the entire e-mail from the frequency of the stored field and the hold time using the formula of FIG.
The holding time may be calculated based on the priority weight of the field, the evaluation value, or the like other than the frequency of the field, or may be calculated based on a plurality of conditions.
In step S2307, the transmission control unit 102 acquires the hold time of the applicable transmission control condition (acquires hold time), and adds the acquired hold time to the reception time of the email being processed as the automatic execution time. calculate.

  Considering the operating hours of the organization (business hours and business hours of the company), only the operating hours may be added. Also, as the reference time, the current time (time when the time determination process is executed) or the like may be used in addition to the e-mail reception time.

In step S2308, the transmission control unit 102 stores the automatic execution time acquired in step S2307 and the automatic operation under the transmission control condition in association with the electronic mail being processed.
(Specific example of execution time calculation process)
Next, an execution time calculation process in the case where the transmission control condition 2006 in FIG. 20 matches the electronic mail whose field composition is FIG. 32 will be specifically described.

In step S2301, the transmission control unit 102 shifts the process to step S2302 because the value indicating the “field-dependent” suspension time of the transmission control condition 2006 is set.
In step S2302, the transmission control unit 102 starts processing for the field composition 3201.

In step S2303, the transmission control unit 102 acquires a hold time value “3 hours” corresponding to the field “economy / contract” of the field composition 3201 from the hold time table (priority weight table) of FIG.
In step S2304, the transmission control unit 102 stores (field, frequency, holding time) = (economy / contract, 30, 3 hours) in the temporary storage area.
In step S2305, since there is a field composition 3202 to be processed next, the transmission control unit 102 returns the process to step S2302.

The same processing is repeated, and values (Economic / Contract, 30, 3 hours), (Economic / Distribution, 20, 1 hour), (Economic / Stock, 50, 12 hours).
In step S2306, the transmission control unit 102 calculates 7.1 hours as a holding time for the entire electronic mail as follows using the equation of FIG.
(Holding time) = (30 × 3 + 20 × 1 + 50 × 12) / 100
= 7.1 (hours)

  Here, assuming that the reception time of the e-mail being processed is “February 16, 10:20”, in step S2307, the transmission control unit 102 sets “February 16, 10:20” to “7. One hour (7 hours and 6 minutes) is added to obtain “February 16, 17:26” as the automatic execution time.

In step S2308, the transmission control unit 102 associates the automatic execution time “February 16, 17:26” acquired in step S2307 and the automatic operation “transmission” in the transmission control condition 2006 with the electronic mail being processed. Remember.
(Automatic execution process)
Next, automatic processing after the holding period has elapsed will be described with reference to FIG.
FIG. 25 is a diagram showing a processing flow of automatic execution processing. The automatic execution process is started as a separate process and always operates until the service stop condition is set.

  In step S2501, if the service stop condition is set, the automatic execution processing unit 109 ends the process. If the service stop condition is not set, the process proceeds to step S2502.

  In step S2502, the automatic execution processing unit 109 refers to the audit mail storage table as shown in FIG. 24 stored in the pending mail storage area 111, and selects an email whose execution time is older than the current time from among the audit target mails. get.

  In step S2503, if the automatic execution processing unit 109 can acquire an e-mail in step S2502, the process proceeds to step S2504. If the e-mail cannot be acquired, the process proceeds to step S2509.

  In step S2504, the automatic execution processing unit 109 starts repetitive processing up to step S2508 for all the emails acquired in step S2502.

In step S2505, if the automatic operation associated with the electronic mail being processed is set to delete, the automatic execution processing unit 109 moves the process to step S2506. If the automatic operation is set to transmission, the process proceeds to step S2507.
In step S2506, the automatic execution processing unit 109 deletes the electronic mail being processed and moves the process to step S2508.
In step S2507, the automatic execution processing unit 109 transmits an e-mail being processed, and proceeds to step S2508.

In step S2508, if there is no next e-mail, the automatic execution processing unit 109 moves the process to step S2509. If there is a next e-mail, the process returns to step S2504 to start the process for the next e-mail.
In step S2509, the automatic execution processing unit 109 waits for a preset time, and then proceeds to step S2501.
(Specific example of automatic execution processing)
Next, the automatic execution process for the audit mail storage table shown in FIG. 24 will be specifically described. At this time, it is assumed that the service stop condition is not set.
In step S2501, since the service stop condition is not set, the automatic execution processing unit 109 moves the process to step S2502.
Here, if the current time is “February 16, 2009, 16:00”

In step S2502, the automatic execution processing unit 109 acquires an e-mail 2401 having an execution time older than the current time from the audit mail storage table of FIG.
In step S2503, since the automatic execution processing unit 109 has acquired the e-mail 2041 in step S2502, the process proceeds to step S2504.
In step S2504, the automatic execution processing unit 109 starts processing for the electronic mail 2401.

In step S2505, the automatic execution processing unit 109 shifts the processing to step S2507 because the automatic operation associated with the e-mail 2401 is set to “send”.
In step S2507, the automatic execution processing unit 109 transmits an e-mail 2401, and moves the process to step S2508.
In step S2508, the automatic execution processing unit 109 moves the process to step S2509 because there is no other e-mail.

  In step S2509, the automatic execution processing unit 109 waits for a preset time process, returns the process to step S2501, and repeats the same process until a service stop condition is set.

In this way, because the hold time is automatically adjusted according to the matched control conditions and the email classification field, the emails in the fields where the importance of scrutiny is low and it is desirable that no delay occurs Can suppress the occurrence of delays, and e-mails in fields that require scrutiny must be audited by the administrator.
(Fourth embodiment)
(Batch processing is prohibited due to variation)

  Next, as a fourth embodiment, in an email auditing apparatus that processes and processes audit target emails, batch audit instructions are not permitted for clusters in which the content of contained emails varies. The case will be described with reference to FIG. FIG. 26 is a diagram showing a processing flow for generating audit information for a cluster.

  In step S2601, the audit information generation unit 104 starts the iterative process up to step S2609 on the cluster information acquired in the evaluation value calculation process S1703. In step S2602, the audit information generation unit 104 determines whether the number of mails included in the cluster being processed satisfies a specified condition. For example, the regulation condition is that the number of e-mails is “2 or more” (may be “5 or more”). If the regulation condition is satisfied, the process proceeds to step S2603. If the regulation condition is not satisfied, the process proceeds to step S2608.

  In step S2603, the audit information generation unit 104 starts the iterative process up to step S2605 for all e-mails included in the cluster being processed. In step S2604, the audit information generation unit 104 obtains a distance (difference) between the average field composition acquired from the cluster information and the field composition of the electronic mail being processed, and stores the distance (difference) in association with the electronic mail being processed. The distance is obtained from the equation shown in FIG.

  In step S2605, if the next e-mail to be processed exists in the cluster, the audit information generation unit 104 returns the process to step S2603 and starts the process for the next e-mail. If there is no next e-mail, the process proceeds to step S2606. In step S2606, the audit information generation unit 104 calculates the degree of cluster variation from the stored average field composition and the distance between the emails. In the case of this embodiment, the degree of variation is the proportion of e-mails whose distance from the average field composition is equal to or less than a specified value among e-mails belonging to the cluster. For the degree of variation, an average distance or a standard deviation may be used. In the present embodiment, for example, the degree of variation is determined as the proportion of e-mails whose distance from the average field composition is greater than the specified value “20”.

  In step S2607, the audit information generation unit 104 determines whether the variation degree calculated in step S2606 satisfies a specified condition. If the condition is satisfied (the variation is large), the process proceeds to step S2608. If the condition is not satisfied (the variation is small), the process proceeds to step S2609.

  In step S2608, the audit information generation unit 104 sets batch processing prohibition information in the cluster information being processed. In step S2609, when there is next cluster information, the audit information generation unit 104 returns the processing to step S2601 and starts processing for the next cluster information. If there is no next cluster information, the process is terminated.

If there are variations in the contents of the emails included in the cluster, if audit instructions are given in a batch, many emails with contents that differ from the average field composition are included, resulting in unintended results there is a possibility. For clusters for which batch processing prohibition information has been set, the transmission column 1901 and the deletion column 1902 in the cluster audit screen of FIG. 19 are invalidated so that only individual audit processing can be performed, thereby suppressing unintended batch operations. Can do.
(Specific example of prohibition of batch processing due to the degree of cluster variation)

Next, the audit information generation process of the fourth embodiment for the email stored in the audit mail shown in FIG. 9 will be specifically described. Similar to the second embodiment, cluster information shown in FIG. 29 is obtained in the evaluation value calculation processing step S1703.
In step S2601, the audit information generation unit 104 starts processing for the cluster information 2901 corresponding to the cluster 1.

  In step S2602, the audit information generation unit 104 determines whether the number of mails included in the cluster 1 satisfies a specified condition. Here, if the specified condition is that the number of mails included in the cluster is 2 or more, the number of mails in cluster 1 is “3”, which satisfies the condition, and the process moves to step S2603. In step S2603, the audit information generation unit 104 starts processing for the email 901.

In step S2604, the audit information generation unit 104 obtains the distance between the average field composition of the cluster 1 and the field composition of the email 901 as follows using FIG.
(Distance) = √ (40−40) ² + (10−30) ² + (10−0) ² + (20−30) ² + (20−0) ²
= √1000
= 31.62 ...
In step S2605, the audit information generation unit 104 returns the processing to step S2603 because there is an e-mail 903 belonging to cluster 1.

  Similarly, when the electronic mail 903 and the electronic mail 905 belonging to the cluster 1 are processed, “37.41” is obtained as the distance from the electronic mail 903 and “20” is obtained as the distance from the electronic mail 905.

  Here, assuming that the degree of variation is “the proportion of emails whose distance from the average field composition of the cluster is greater than“ 20 ””, in step S2606, the audit information generation unit 104 determines that the distance between the email 901 and the email 903 is Since it is larger than “20” and the distance of the e-mail 905 is “20” or less, “0.66... (= 2/3)” is obtained as the value of the variation degree.

  Here, if the variation condition is “variation degree is 0.2 or more (corresponding to the first threshold)”, the audit information generation unit 104 determines that the variation degree of cluster 1 is “0. 66 ... ”is equal to or greater than“ 0.2 ”, the predetermined condition is satisfied, and the process proceeds to step S2608.

  In step S2608, the audit information generation unit 104 sets batch processing prohibition information in the cluster information 2901. In step S2609, the audit information generation unit 104 returns the process to step S2601 because there is cluster information 2902 corresponding to cluster 2 as the next cluster information.

  In step S2601, the audit information generation unit 104 starts processing for the cluster information 2902 corresponding to the cluster 2. In step S2602, since the number of mails included in cluster 2 is “2” and satisfies the condition, the audit information generation unit 104 moves the process to step S2603. In step S2603, the audit information generation unit 104 starts processing for the electronic mail 902.

In step S2604, the audit information generation unit 104 obtains the distance between the average field composition of the cluster 2 and the field composition of the e-mail 901 as follows using FIG.
(Distance) = √ (10−10) ² + (75−80) ² + (5−10) ² + (10−0) ²
= √150
= 12.24 ...
In step S2605, the audit information generation unit 104 returns the processing to step S2603 because there is an e-mail 904 belonging to cluster 2.
Similarly, when the electronic mail 904 belonging to the cluster 2901 is processed, “12.24...” Is obtained as the distance from the electronic mail 904.

  In step S2606, since the distance between the e-mail 902 and the e-mail 904 is greater than “20”, the audit information generation unit 104 obtains “0 (= 0/2)” as the variation degree value of the cluster 2.

  In step S2607, since the degree of variation of cluster 2 is “0” and less than “0.2”, the audit information generation unit 104 does not satisfy the predetermined condition and moves the process to step S2609.

In step S2609, the audit information generation unit 104 returns the processing to step S2601 because there is cluster information 2903 corresponding to cluster 3 as the next cluster information. In step S2601, the audit information generation unit 104 starts processing for the cluster information 2903 corresponding to the cluster 3. In step S2602, the audit information generation unit 104 moves the process to step S2608 because the number of mails included in the cluster 3 is 1 and does not satisfy the condition. In step S2608, the audit information generation unit 104 sets batch processing prohibition information in the cluster information 2903. In step S2609, the audit information generation unit 104 ends the process because there is no next cluster information.
As a result, it is possible to prevent a determination error due to batch processing when the field composition of electronic mail included in the cluster is large and determination is difficult at a glance.
(Fifth embodiment)
(Audit information generation processing using audit results)

  Next, as a fifth embodiment, a case in which past audit results are used in an auditing apparatus that audits clustered emails to be audited will be described with reference to FIG. FIG. 28 is a diagram showing a processing flow for generating audit information for a cluster. FIG. 27 is an example of an audit result storage table stored in the audit result storage area 114.

  In the present embodiment, the audit processing unit 108 stores the email transmitted or deleted based on the audit instruction in the audit process in step S1005 of FIG. 10 in the audit result storage table in association with the audit instruction. The audit instruction is stored in the audit result column 2701.

  In the present embodiment, in the clustering process in step S1701, the audited electronic mail stored in the audit result storage table stored in the audit result storage area 114 is also applied to the cluster.

  In step S2801, the audit information generation unit 104 starts the iterative process up to step S2806 for the cluster information acquired in the evaluation value calculation process S1703. In step S2802, the audit information generation unit 104 totals audit results for audited emails belonging to the cluster from the audit result storage table shown in FIG. In step S2803, the audit information generation unit 104 determines whether or not the total value calculated in step S2802 satisfies a specified condition. If the total value satisfies the specified condition, the process proceeds to step S2804. If the condition is not satisfied, the process proceeds to step S2805.

  In step S2804, the audit information generation unit 104 stores the audit result that satisfies the condition in the cluster information as a default operation when any of the transmission or deletion total values satisfies the specified condition. In step S2805, if there is next cluster information, the audit information generation unit 104 returns the process to step S2801, and starts the process for the next cluster information. If there is no next cluster information, the process is terminated.

As a result, the cluster for which the default operation is set on the cluster audit screen in FIG. 19 can be displayed with the transmission column 1901 or the deletion column 1902 corresponding to the default operation enabled, Based on the audit instruction result, a recommended audit instruction can be presented.
(Specific example of audit information generation processing using audit results)

Next, the audit information generation process of the fifth embodiment for the email stored in the audit mail storage area 111 will be specifically described. At this time, it is assumed that the audit result storage area 114 has an audit result storage table shown in FIG. Here, FIG. 27 is an example.
Similar to the second embodiment, cluster information shown in FIG. 29 is obtained in the evaluation value calculation processing step S1703.
In step S2801, the audit information generation unit 104 starts processing for the cluster information 2901 corresponding to the cluster 1.

In step S2802, the audit information generation unit 104 uses the audit result storage table shown in FIG. 27 as an aggregated value of audit results for audited emails belonging to cluster 1 (number of transmissions, number of deletions) = (2 , 0).
Here, if the specified condition is “80% or more of the total value of audit results”,

  In step S2803, the audit information generation unit 104 transfers the processing to step S2804 because the number of audit results transmitted in the audited e-mail belonging to cluster 1 is 100% and satisfies the specified condition.

In step S2804, the audit information generation unit 104 stores “transmission” in the cluster information as the default operation of the cluster 1 because the number of transmissions satisfies the prescribed condition.
In step S2805, since there is cluster information 2902 corresponding to cluster 2, the audit information generation unit 104 returns the process to step S2801.
In step S2801, the audit information generation unit 104 starts processing for the cluster information 2902 corresponding to the cluster 2.

  In step S2802, the audit information generation unit 104 uses the audit result storage table shown in FIG. 27 as an aggregated value of audit results for audited emails belonging to cluster 2 (number of transmissions, number of deletions) = (1 , 1).

In step S2803, the audit information generation unit 104 moves the process to step S2805 because the number of audit results transmitted in the audited e-mail belonging to cluster 2 is 50% and does not satisfy the prescribed condition.
In step S2805, since there is cluster information 2903 corresponding to cluster 3, the audit information generation unit 104 returns the process to step S2801.
Thereafter, the same processing is repeated for the cluster information 2903 corresponding to cluster 3.
As a result, it is possible to present a transmission instruction as a recommendation to cluster 1 and to indicate that there is no audit instruction to be recommended for cluster 2.

  Although one embodiment of the present invention has been described in detail above, the present invention can take an embodiment as, for example, a system, an apparatus, a method, a program, or a storage medium. You may apply to the system comprised from an apparatus, and may apply to the apparatus which consists of one apparatus.

  Another object of the present invention is to supply a storage medium storing software program codes for realizing the functions of the above-described embodiments to a system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the storage medium. Needless to say, this can also be achieved by reading and executing the program code stored in.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention.

  As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (basic system or operating system) running on the computer based on the instruction of the program code. Needless to say, a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.

  Further, after the program code read from the storage medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function is determined based on the instruction of the program code. It goes without saying that the CPU or the like provided in the expansion board or function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

DESCRIPTION OF SYMBOLS 100 E-mail inspection apparatus 101 Receiving part 102 Transmission control part 103 Field determination part 104 Audit information generation part 105 Evaluation value calculation part 106 Cluster generation part 107 Priority weight setting part 108 Audit processing part 109 Automatic execution processing part 110 Transmission control condition storage area 111 audit mail storage area 112 setting storage area 113 user information storage area 114 audit result storage area 120 terminal for sender 121 e-mail transmission / reception program 130 terminal for administrator 131 setting means 132 audit means 140 mail server 150 external network

Claims (8)

An information processing apparatus for auditing electronic mail,
An audit mail storage means for storing an email to be audited;
By analyzing the contents of the stored e-mail before Symbol audit mail storage means, the field composition in which the field and the e-mail to a predetermined the electronic mail is judged to belong indicates a degree of belonging to the art A field determination means for determining
Grouping means for grouping the emails stored in the audit mail storage means for each email having a similar field composition;
Audit information generating means for generating information relating to an audit screen that can accept the audit result for the e-mail in units of groups divided by the grouping means;
Output means for outputting information relating to the audit screen of the email generated by the audit information generating means;
An information processing apparatus comprising:   The information processing apparatus further includes:
  A variation in which the field composition of the group calculated by the average field composition calculating means is compared with the field composition of each email grouped in the group, and the variation in the field composition of each email in the group is calculated. A calculation means,
  The audit information generation means generates information on an audit screen capable of receiving an audit result for each group when the degree of variation calculated by the variation calculation means is smaller than a predetermined value. The information processing apparatus according to claim 1.   The information processing apparatus further includes:
  A holding time storage means for storing a holding time for holding the transmission of an e-mail for each predetermined field;
  A hold time calculating means for calculating a hold time for an e-mail using the hold time stored in the hold time storage means and the field composition determined by the field determining means;
  A transmission hold means for holding the transmission of the e-mail during the hold time calculated by the hold time calculation means;
  The information processing apparatus according to claim 1, further comprising:   The information processing apparatus further includes:
  An audit result receiving means for receiving an audit result for the suspended email;
  In accordance with the audit result received by the audit result receiving means, a determination means for determining whether or not to send an e-mail that has received the audit result;
  The information processing apparatus according to any one of claims 1 to 3, further comprising:   The information processing apparatus further includes:
  An audit result totaling unit that totals the audit results received by the audit result receiving unit for each group,
  The determining means determines whether to send an email belonging to the group according to the counting result by the audit result counting means;
  The information processing apparatus according to claim 4, further comprising: 6. The audit mail storage unit according to any one of claims 1 to 5, wherein an electronic mail suspended according to a transmission control condition indicating a condition for deferring transmission of an electronic mail is stored as an audit target. Information processing device. An information processing method in an information processing apparatus for storing an email to be audited and auditing the email,
The degree to which the field judging unit of the information processing apparatus, by analyzing the previous SL contents of the stored e-mail, the field and the e-mail to a predetermined the e-mail is determined to belong belongs to the art A field determination step for determining a field composition indicating :
A grouping step in which the grouping means of the information processing apparatus groups the stored e-mails for each e-mail having a similar field composition;
An audit information generating step of generating information related to an audit screen capable of accepting an audit result for the e-mail in units of groups divided by the grouping step;
An output step in which the output means of the information processing apparatus outputs information related to the audit screen of the email generated in the audit information generation step;
An information processing method comprising: A program that can be executed in an information processing apparatus that stores an email to be audited and audits the email,
The information processing apparatus;
By analyzing the previous SL contents of the stored e-mail, the field determination the art and the e-mail to a predetermined the electronic mail is judged to belong to determine areas compositions shown a degree of belonging to the art Means,
Grouping means for grouping the stored emails into emails with similar field composition;
Audit information generating means for generating information relating to an audit screen that can accept the audit result for the e-mail in units of groups divided by the grouping means;
A program that functions as an output unit that outputs information related to an audit screen of an electronic mail generated by the audit information generation unit.

Images