JP6329458B2 - Mail judging device, mail judging method and computer program - Google Patents

Description

The present invention relates to a mail determination device , a mail determination method, and a computer program related to electronic mail.

  2. Description of the Related Art Conventionally, an SPF (Sender Policy Framework) method is known as a technique for discriminating spam mails that are sent by spoofing senders of electronic mails (hereinafter simply referred to as mails) exchanged over the Internet. (For example, refer nonpatent literature 1). In the SPF method, sender authentication of the received mail is performed based on sender authentication information registered in advance in a DNS (Domain Name System) server of the mail transmission source domain of the received mail. Specifically, if the sender authentication information registered in the DNS server of the domain that sent the received mail contains the sender information that the received mail has, the sender authentication of the received mail is If it is determined to be successful and the sender information included in the received mail is not included, it is determined that the sender authentication of the received mail is unsuccessful.

JP 2014-63402 A

“Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail”, [online], [Search April 3, 2014], Internet <URL: http://www.ietf.org/rfc/rfc4408 .txt>

  In the conventional SPF method described above, it is possible to prevent a spam mail sender from spoofing a sender domain to an existing legitimate domain and sending a spam mail. However, when a spam mail sender acquires a unique domain by himself / herself and sends the spam mail by registering the address of the mail transmission server in the sender authentication information of the acquired unique domain, In the SPF method, since the sender authentication is successful, such spam mail cannot be detected. In order to cope with this, the present inventor in Japanese Patent Application Laid-Open No. 2004-228561 uses the comprehensive feature of the sender authentication information registered in the DNS server of the mail transmission source domain of the received mail to transmit the received mail. Proposed a conventional technique for performing person authentication (referred to herein as junk mail discrimination method A). Specifically, a white list and a black list used for determining the junk mail of the received mail are created based on the comprehensive feature.

  However, in the spam mail discrimination method A, the white list and the black list are updated by changing the comprehensive characteristics of the sender authentication information registered in the DNS server, but this can be a weak point. For example, sender authentication information irrelevant to sender information used for actual mail transmission (for example, the IP (Internet Protocol) address of the mail transmission terminal) is included in the sender authentication information already registered in the DNS server. Suppose that it was added. Then, the comprehensive characteristics of the sender authentication information registered in the DNS server change. If the white list or black list is changed based on the change in the characteristics, the changed white list or black list is displayed. This reflects the characteristics of the sender authentication information unrelated to the sender information used for actual mail transmission. As a result, there is a possibility that the changed white list and black list will not work effectively.

The present invention has been made in consideration of such circumstances, and in a mail determination apparatus that performs sender authentication of received mail using the SPF method, the spam mail determination accuracy for received mail that has been successfully authenticated by the sender is improved. An object is to provide a mail determination device , a mail determination method, and a computer program that can be improved.

One aspect of the present invention is a mail determination device that performs sender authentication of a received mail using an SPF (Sender Policy Framework) method, and the SPF authentication successful reception in which the sender authentication of the received mail using the SPF method is successful. A mail discriminating unit for discriminating junk mail using the sender authentication information and white list or black list referred to in the sender authentication for the mail, and DNS of the mail transmission source domain of the SPF authentication success received mail (Domain Name System) Among sender authentication information elements constituting sender authentication information registered in a server, a sender authentication related element including a sender IP address of the SPF authentication success received mail, or the transmission 's quasi sender authentication related elements associated with the authentication-related element, or a non-sender authentication related elements associated with the sender authentication-related element, or The combination of sender authentication-related element and the quasi sender authentication-related element, or, the sender authentication the related elements and the quasi sender authentication-related element from a combination of non-sender authentication ally, the whitelist and the A list creation unit that creates a black list, and the mail determination unit is unable to determine both non-spam e-mail determination using the white list and junk e-mail determination using the black list. When the authentication success received mail is determined, mail determination is performed using a predetermined junk mail determination method, and the list creation unit is configured to determine whether the mail determination result using the predetermined junk mail determination method is a non-spam mail. , The sender authentication related element relating to the SPF authentication success received mail that is the object of the mail discrimination, the quasi-sender authentication related element, The non-sender authentication related element, the combination of the sender authentication related element and the semi-sender authentication related element, or the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element. The mail determination device adds a combination to the white list and deletes the combination from the black list .

One aspect of the present invention is the above-described mail determination device, wherein the list creation unit is an object of the mail determination when the result of the mail determination using the predetermined spam mail determination method is a spam mail. The sender authentication related element regarding the SPF authentication success received mail, the semi-sender authentication related element, the non-sender authentication related element, or the combination of the sender authentication related element and the semi-sender authentication related element is the white When not registered in the list, the mail determination apparatus adds an unregistered item to the black list .

One aspect of the present invention is a mail determination device that performs sender authentication of a received mail using an SPF (Sender Policy Framework) method, and SPF authentication successful reception in which the sender authentication of a received mail using the SPF method is successful. A mail discriminating unit for discriminating junk mail using the sender authentication information and white list or black list referred to in the sender authentication for the mail, and DNS of the mail transmission source domain of the SPF authentication success received mail (Domain Name System) Among sender authentication information elements constituting sender authentication information registered in a server, a sender authentication related element including a sender IP address of the SPF authentication success received mail, or the transmission A semi-sender authentication related element related to the sender authentication related element, or a non-sender authentication related element related to the sender authentication related element, or From the combination of the sender authentication related element and the quasi-sender authentication related element, or the combination of the sender authentication related element, the quasi-sender authentication related element and the non-sender authentication related element, the white list and the A list creation unit that creates a black list, and the mail determination unit is unable to determine both non-spam e-mail determination using the white list and junk e-mail determination using the black list. For authentication successful received mail, perform mail determination using a predetermined junk mail determination method, the list creation unit, when the result of mail determination using the predetermined junk mail determination method is junk mail, The sender authentication related element related to the SPF authentication success received mail that is the object of the mail discrimination, the semi-sender authentication related The non-sender authentication related element or the combination of the sender authentication related element and the quasi-sender authentication related element when the white list is not registered in the whitelist. It is a mail determination device to be added to .

One aspect of the present invention is a mail determination method of a mail determination device that performs sender authentication of a received mail using an SPF (Sender Policy Framework) method, and the mail determination device uses the SPF method to receive a received mail. A mail determination step of performing spam determination using a sender authentication information and a white list or a black list referred to in the sender authentication for an SPF authentication success received mail in which the sender authentication is successful; The apparatus transmits the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. sender authentication-related element encompasses's IP address, or quasi sender authentication related elements associated with the sender authentication-related element Or, non-sender authentication related elements associated with the sender authentication-related element, or a combination of the sender authentication-related element and the quasi sender authentication-related element, or, the said sender authentication-related element level sender a combination of authentication-related element and the non-sender authentication-related element, a list creating step of creating the whitelist and the blacklist, look including the said email determining unit, the non-junk mail by using the whitelist Both the determination and the determination of the spam mail using the black list are performed on the SPF authentication success received mail, and a mail determination using a predetermined spam mail determination method is performed. When the result of mail discrimination using a predetermined spam mail discrimination method is non-spam mail, the SPF that is the target of the mail discrimination The sender authentication related element related to the successful authentication received mail, the semi-sender authentication related element, the non-sender authentication related element, the combination of the sender authentication related element and the semi-sender authentication related element, or the sender In the mail determination method, a combination of an authentication related element, the semi-sender authentication related element, and the non-sender authentication related element is added to the white list and deleted from the black list .
One aspect of the present invention is the above-described mail determination method, wherein the mail determination device is an object of the mail determination when the result of the mail determination using the predetermined spam mail determination method is a spam mail. The sender authentication related element regarding the SPF authentication success received mail, the semi-sender authentication related element, the non-sender authentication related element, or the combination of the sender authentication related element and the semi-sender authentication related element is the white This is a mail determination method for adding an unregistered item to the black list when it is not registered in the list.
One aspect of the present invention is a mail determination method of a mail determination device that performs sender authentication of a received mail using an SPF (Sender Policy Framework) method, and the mail determination device uses the SPF method to receive a received mail. A mail determination step of performing spam determination using a sender authentication information and a white list or a black list referred to in the sender authentication for an SPF authentication success received mail in which the sender authentication is successful; The apparatus transmits the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. A sender authentication related element including a sender IP address or a semi-sender authentication related element related to the sender authentication related element Or a non-sender authentication related element related to the sender authentication related element, a combination of the sender authentication related element and the quasi-sender authentication related element, or the sender authentication related element and the quasi-sender. A list creation step of creating the whitelist and the blacklist from a combination of authentication-related elements and non-sender authentication-related elements, wherein the mail determination device determines non-spam mail using the whitelist And the SPF authentication success received mail that cannot be determined both by using the blacklist, the mail determination apparatus performs mail determination using a predetermined spam mail determination method. If the result of e-mail discrimination using the junk e-mail discrimination method is junk e-mail, the S that is the target of the e-mail discrimination The sender authentication related element regarding the PF authentication success received mail, the semi-sender authentication related element, the non-sender authentication related element, or the combination of the sender authentication related element and the semi-sender authentication related element is the white This is a mail determination method for adding an unregistered item to the black list when it is not registered in the list.

One aspect of the present invention is the success of SPF authentication in which the sender authentication of the received mail using the SPF method is successfully performed on the computer of the mail determination apparatus that performs the sender authentication of the received mail using the SPF (Sender Policy Framework) method. A mail determination step of performing spam determination on the received mail using the sender authentication information referred to in the sender authentication and a white list or a black list, and a mail source domain of the SPF authentication successful received mail Among sender authentication information elements constituting sender authentication information registered in a DNS (Domain Name System) server, a sender authentication related element including a sender IP address of the SPF authentication success received mail, or quasi sender authentication related elements associated with the sender authentication-related element, or a non-sender certification associated with the sender authentication-related element Related elements, or a combination of the sender authentication-related element and the quasi sender authentication-related element, or a combination of the sender authentication-related element and the quasi sender authentication-related element the non-sender authentication-related element, The SPF authentication success received mail in which both the white list and the black list creation step and the determination of the non-spam mail using the white list and the spam mail determination using the black list cannot be determined On the other hand, if the result of the mail discrimination using the predetermined junk mail discrimination method and the result of the mail discrimination using the predetermined junk mail discrimination method is a non-spam mail, it is a target of the mail discrimination The sender authentication related element related to the SPF authentication success received mail, the semi-sender authentication related element, the non-sender authentication A related element, a combination of the sender authentication related element and the semi-sender authentication related element, or a combination of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element. Adding to the list and deleting from the black list .
In one aspect of the present invention, in the above computer program, when the result of mail determination using the predetermined junk mail determination method is junk mail, the SPF authentication success received mail that is a target of the mail determination When a sender authentication related element, the semi-sender authentication related element, the non-sender authentication related element, or a combination of the sender authentication related element and the semi-sender authentication related element is not registered in the white list And a computer program for causing the computer to further execute the step of adding the unregistered one to the black list.
One aspect of the present invention is the success of SPF authentication in which the sender authentication of the received mail using the SPF method is successfully performed on the computer of the mail determination apparatus that performs the sender authentication of the received mail using the SPF (Sender Policy Framework) method. A mail determination step of performing spam determination on the received mail using the sender authentication information referred to in the sender authentication and a white list or a black list, and a mail source domain of the SPF authentication successful received mail Among sender authentication information elements constituting sender authentication information registered in a DNS (Domain Name System) server, a sender authentication related element including a sender IP address of the SPF authentication success received mail, or Quasi-sender authentication related elements related to the sender authentication related elements or non-sender authentication related to the sender authentication related elements From a related element, or a combination of the sender authentication related element and the semi-sender authentication related element, or a combination of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element, The SPF authentication success received mail in which both the white list and the black list creation step and the determination of the non-spam mail using the white list and the spam mail determination using the black list cannot be determined On the other hand, the step of performing mail determination using a predetermined junk mail determination method, and the result of mail determination using the predetermined junk mail determination method is junk mail, the target of the mail determination The sender authentication related element relating to the SPF authentication success received mail, the semi-sender authentication related element, the non-sender When an authentication-related element or a combination of the sender authentication-related element and the semi-sender authentication-related element is not registered in the whitelist, adding the unregistered one to the blacklist; Is a computer program for executing

  According to the present invention, in the mail determination device that performs sender authentication of received mail using the SPF method, it is possible to improve the junk mail determination accuracy for the received mail that has been successfully authenticated by the sender.

It is a block diagram which shows the structure of the mail determination apparatus 1 which concerns on one Embodiment of this invention. It is a block diagram which shows the structure of the electronic mail system which concerns on one Embodiment of this invention. It is a flowchart which shows the procedure of the mail determination method which concerns on one Embodiment of this invention. It is a flowchart which shows the procedure of the list preparation method which concerns on one Embodiment of this invention. It is a figure which shows the example of the sender authentication information which concerns on one Embodiment of this invention. It is a figure for demonstrating the list creation method which concerns on one Embodiment of this invention.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a mail determination device 1 according to an embodiment of the present invention. FIG. 2 is a block diagram showing a configuration of the electronic mail system according to the present embodiment.

  First, an electronic mail system according to the present embodiment will be described with reference to FIG. The mail determination device 1 is connected to the received mail server 30. The mail determination device 1 may be directly connected to the received mail server 30 or may be connected to the received mail server 30 via a communication line. The mail determination device 1 is connected to the communication network 50. The mail determination device 1 communicates with other devices via the communication network 50. The communication network 50 is configured from the Internet or the like.

  The received mail server 30 receives mail via the communication network 50. The mail receiving terminal 40 receives mail addressed to itself from the received mail server 30.

  The outgoing mail server 60, the DNS server 70, and the outgoing mail terminal 80 belong to the same domain. The transmission mail server 60 transmits the mail transmitted from the mail transmission terminal 80 to the reception mail server 30 related to the destination of the mail via the communication network 50. In the DNS server 70, sender authentication information related to its own domain is registered. The DNS server 70 publishes the sender authentication information registered in itself via the communication network 50.

  In FIG. 2, for convenience of explanation, a domain (mail transmission source domain) to which the transmission mail server 60, the DNS server 70, and the mail transmission terminal 80 belong is referred to as “example.com”. The IP address of the mail transmission terminal 80 is assumed to be “1.2.3.4 (IPv4)”.

  Next, the mail determination device 1 according to the present embodiment will be described with reference to FIG. In FIG. 1, a mail determination device 1 includes a received mail input unit 11, a sender authentication unit 12, a mail determination unit 13, a list creation unit 14, a determination result output unit 15, a sender authentication information element storage unit 16, and a list storage unit. 17 and a communication unit 18. The list storage unit 17 stores a white list 171 and a black list 172.

  The received mail input unit 11 inputs received mail from the received mail server 30. The input received mail is a mail received from the outgoing mail server 60 via the communication network 50 by the incoming mail server 30.

  The sender authentication unit 12 performs sender authentication of received mail using the SPF method. In this sender authentication, the conventional SPF method is used. Specifically, when the sender authentication information registered in the DNS server 70 of the mail sender domain of the received mail contains the sender information that the received mail has, the sender authentication of the received mail Is determined to be successful, and if the sender information included in the received mail is not included, it is determined that the sender authentication of the received mail is unsuccessful.

  The mail discriminating unit 13 discriminates spam mail. The mail discriminating unit 13 performs spam mail discrimination using a predetermined spam mail discrimination method. In this spam mail discrimination, a conventional spam mail discrimination method is used. As a conventional spam mail detection method, a spam mail is determined based on the content of the body of the mail, and it is determined that a mail is a spam mail when it arrives at a decoy mail address that can be regarded as spam mail. Method, etc.

  In addition, the mail determination unit 13 performs junk mail determination of received mail using the white list 171 or the black list 172.

  The list creation unit 14 creates a white list 171 and a black list 172. The white list 171 and the black list 172 are used for junk mail discrimination of received mail. The determination result output unit 15 outputs a determination result for the received mail to the received mail server 30. The determination result for the received mail indicates that the received mail is spam mail or that the received mail is not spam mail (non-spam mail).

  The sender authentication information element storage unit 16 stores a sender authentication information element. The sender authentication information element is an element constituting sender authentication information registered in the DNS server 70 of the mail transmission source domain of the received mail.

  The communication unit 18 communicates with other devices via the communication network 50.

  Next, the operation of the mail determination device 1 shown in FIG. 1 will be described with reference to FIGS. 3, 4, 5, and 6. FIG. 3 is a flowchart showing the procedure of the mail determination method according to the present embodiment. FIG. 4 is a flowchart showing the procedure of the list creation method according to the present embodiment. FIG. 5 is a diagram illustrating an example of sender authentication information registered in the DNS server 70 according to the present embodiment. FIG. 6 is a diagram for explaining a list creation method according to the present embodiment.

  FIG. 5 shows sender authentication information 100 registered in the DNS server 70 of the mail transmission source domain “example.com”. The sender authentication information 100 includes a host name “spf.example.com” and a host name “spf.dummy.com” as sender authentication information elements constituting the sender authentication information of the mail source domain “example.com”. IP address information “ip4: 10.1.1.0/24”, IP address information “ip4: 10.1.2.0/24”, IP address information “ip4: 10.1.3.0/24” and IP address information “ip4: 1.2.3.0/ 24 ”. IP address information “ip4: 10.1.1.0/24”, “ip4: 10.1.2.0/24”, “ip4: 10.1.3.0/24” and “ip4: 1.2.3.0/24” This indicates a range that can be taken by the IP address (sender IP address) of the mail transmission terminal 80 belonging to “.com”. “Ip4” refers to IPv4.

  Sender authentication information elements “ip4: 1.2.3.0/24” and “ip4: 10.1.3.0/24” are associated with the sender authentication information element “spf.example.com”. The sender authentication information element “ip4: 10.1.2.0/24” is associated with the sender authentication information element “spf.dummy.com”. The DNS server 70 publishes the sender authentication information 100 via the communication network 50.

  In the following description, for convenience of explanation, the sender authentication information 100 of FIG. 5 is used as an example of the sender authentication information registered in the DNS server 70, and the received mail 200 illustrated in FIG. Is used. The received mail 200 shown in FIG. 6 is sent from the mail sending terminal 80 shown in FIG. 2. The sender information 200 is the sender domain “example.com” and the IPv4 sender IP address “1.2.3.4” as sender information. Have

  In FIG. 6, “ip4: 1.2.3.0/24” is a sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200. The sender authentication related element is a sender authentication information element including the sender IP address of the received mail. “Ip4: 10.1.3.0/24” is a quasi-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200. The quasi-sender authentication related element is a sender authentication information element of an IP prefix having an associated host name (“spf.example.com” in the example of FIG. 6) in common with the sender authentication related element. “Ip4: 10.1.2.0/24” and “ip4: 10.1.1.0/24” are non-sender authentication related elements for the sender IP address “1.2.3.4” of the received mail 200. The non-sender authentication related element is a sender authentication information element of an IP prefix other than the sender authentication related element and other than the semi-sender authentication related element.

  First, referring to FIG. 3, an operation related to junk mail discrimination of the mail judgment device 1 shown in FIG. 1 will be described with an example of a junk mail discrimination method.

[Example 1 of junk mail discrimination method]
In example 1 of the junk mail determination method, only the sender authentication related elements are used among the sender authentication related elements, the semi-sender authentication related elements, and the non-sender authentication related elements. Hereinafter, Example 1 of the junk mail discrimination method will be described with reference to FIG.

(Step S <b> 11) The received mail input unit 11 inputs the received mail 200 from the received mail server 30.

(Step S <b> 12) The sender authentication unit 12 performs sender authentication on the received mail 200 using the SPF method. More specifically, the sender authentication information 100 registered in the DNS server 70 of the mail source domain “example.com” of the received mail 200 includes the sender information (the mail source domain “example.com” included in the received mail 200). com ”and the sender IP address“ 1.2.3.4 ”), it is determined that the sender authentication of the received mail 200 is successful, and the sender information included in the received mail 200 is not included. In this case, it is determined that the sender authentication of the received mail 200 has failed. Here, as shown in FIG. 6, the sender authentication information 100 includes the sender information of the received mail 200 (mail sender domain “example.com”, sender IP address “1.2.3.4”). Therefore, the sender authentication using the SPF method for the received mail 200 is successful.

(Step S13) If the sender authentication in step S12 is successful, the process proceeds to step S14. If the authentication is unsuccessful, the process proceeds to step S15.

(Step S14) The mail discriminating unit 13 uses the communication unit 18 to acquire the sender authentication information 100 from the DNS server 70 of the mail source domain “example.com” of the received mail 200 for which the sender authentication in step S12 was successful. . Next, the mail discriminating unit 13 stores only the sender authentication related elements for the sender IP address “1.2.3.4” of the received mail 200 among the sender authentication information elements of the sender authentication information 100. Store in unit 16. Here, as shown in FIG. 6, only the sender authentication-related element “ip4: 1.2.3.0/24” for the sender IP address “1.2.3.4” of the received mail 200 is the sender authentication information element storage unit 16. Stored in

  In this example, only one of “ip4: 1.2.3.0/24” is stored in the sender authentication information element storage unit 16 as a sender authentication related element regarding the received mail 200. When there are a plurality of related elements, all of the plurality of sender authentication related elements are stored in the sender authentication information element storage unit 16. For example, when there are two elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” as sender authentication related elements for the sender IP address “1.2.3.4” of the received mail 200 Both of the two sender authentication related elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” are stored in the sender authentication information element storage unit 16.

(Step S15) The mail determination unit 13 determines that the received mail 200 for which the sender authentication in Step S12 has failed is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 16) The mail determination unit 13 refers to the white list 171 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 "is registered in the white list 171. As a result of the determination, if the sender authentication related element “ip4: 1.2.3.0/24” is registered in the white list 171, the process proceeds to step S 17. If the element is not registered in the white list 171, the process proceeds to step S 18. Proceed to

  In this example, the sender authentication related element relating to the received mail 200 stored in the sender authentication information element storage unit 16 is one of “ip4: 1.2.3.0/24”. If there are a plurality of authentication-related elements, in step S16, if any of the sender authentication-related elements is registered in the white list 171, the process proceeds to step S17. If it is not registered in the white list 171, the process proceeds to step S18. For example, when two elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” are stored in the sender authentication information element storage unit 16 as the elements related to the sender authentication regarding the received mail 200. If at least one of the two sender authentication related elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” is registered in the whitelist 171, the process proceeds to step S 17. If both the sender authentication information elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” are not registered in the white list 171, the process proceeds to step S 18.

(Step S <b> 17) The mail determination unit 13 determines that the received mail 200 that has been successfully authenticated in step S <b> 12 is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S18) The mail discriminating unit 13 refers to the black list 172 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 "is registered in the black list 172. As a result of the determination, if the sender authentication related element “ip4: 1.2.3.0/24” is registered in the black list 172, the process proceeds to step S19. If the element is not registered in the black list 172, the process proceeds to step S20. Proceed to

  In this example, the sender authentication related element relating to the received mail 200 stored in the sender authentication information element storage unit 16 is one of “ip4: 1.2.3.0/24”. If there are a plurality of authentication-related elements, in step S18, if any of the sender authentication-related elements is registered in the black list 172, the process proceeds to step S19, and all the sender authentication information elements are If it is not registered in the black list 172, the process proceeds to step S20. For example, when two elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” are stored in the sender authentication information element storage unit 16 as the elements related to the sender authentication regarding the received mail 200. If any one of the two sender authentication-related elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” is registered in the black list 172, the process proceeds to step S19. If both the user authentication information elements “ip4: 1.2.3.0/24” and “ip4: 1.2.3.0/28” are not registered in the black list 172, the process proceeds to step S20.

(Step S19) The mail discriminating unit 13 determines that the received mail 200 that has been successfully authenticated in step S12 is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S20) The mail determination unit 13 performs mail determination using a predetermined conventional junk mail determination method for the received mail 200 for which the sender authentication has been successful in step S12. The mail determination unit 13 determines that the received mail 200 is a spam mail if the result of the mail determination is a spam mail, and determines that the received mail 200 is a non-spam mail if it is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 21) The determination result output unit 15 outputs the determination result of the received mail 200 notified from the mail determination unit 13 to the received mail server 30. Thereafter, the process of FIG. 3 is terminated.

  The above is the description of the first example of the spam mail discrimination method.

[Example 2-1 of Junk E-mail Discrimination Method]
In the example 2-1 of the junk mail determination method, only the sender authentication related element and the quasi-sender authentication related element among the sender authentication related element, the quasi-sender authentication related element, and the non-sender authentication related element are used. . Hereinafter, an example 2-1 of the junk mail determination method will be described with reference to FIG.

  Steps S11, S12, and S13 are the same as those in Example 1 of the spam mail determination method described above. If the sender authentication in step S12 is successful, the process proceeds to step S14, and if it is unsuccessful, the process proceeds to step S15.

(Step S14) The mail discriminating unit 13 uses the communication unit 18 to acquire the sender authentication information 100 from the DNS server 70 of the mail source domain “example.com” of the received mail 200 for which the sender authentication in step S12 was successful. . Next, the mail discriminating unit 13 includes only the sender authentication related elements and the quasi-sender authentication related elements for the sender IP address “1.2.3.4” of the received mail 200 among the sender authentication information elements of the sender authentication information 100. Is stored in the sender authentication information element storage unit 16. Here, as shown in FIG. 6, the sender authentication related element “ip4: 1.2.3.0/24” and the semi-sender authentication related element “ip4: for the sender IP address“ 1.2.3.4 ”of the received mail 200. Only “10.1.3.0/24” is stored in the sender authentication information element storage unit 16.

  In this example, only two elements “ip4: 1.2.3.0/24” and “ip4: 10.1.3.0/24” are sent as elements related to sender authentication and quasi-sender authentication related to received mail 200. Stored in the sender authentication information element storage unit 16, but when there are a plurality of the sender authentication related elements and quasi-sender authentication related elements, the plurality of sender authentication related elements and the quasi-sender authentication related elements All of them are stored in the sender authentication information element storage unit 16.

(Step S15) The mail determination unit 13 determines that the received mail 200 for which the sender authentication in Step S12 has failed is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 16) The mail determination unit 13 refers to the white list 171 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 "is registered in the white list 171. As a result of the determination, if the sender authentication related element “ip4: 1.2.3.0/24” is registered in the white list 171, the process proceeds to step S 17. If the element is not registered in the white list 171, the process proceeds to step S 18. Proceed to

  In this example, the sender authentication related element relating to the received mail 200 stored in the sender authentication information element storage unit 16 is one of “ip4: 1.2.3.0/24”. If there are a plurality of authentication-related elements, in step S16, if any of the sender authentication-related elements is registered in the white list 171, the process proceeds to step S17. If it is not registered in the white list 171, the process proceeds to step S18.

(Step S <b> 17) The mail determination unit 13 determines that the received mail 200 that has been successfully authenticated in step S <b> 12 is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S18) The mail discriminating unit 13 refers to the black list 172 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 '' and quasi-sender authentication related element `` ip4: 10.1.3.0/24 '', sender authentication-related element `` ip4: 1.2.3.0/24 '' or quasi-sender authentication related element `` ip4: 10.1 It is determined whether at least one of “.3.0 / 24” is registered in the black list 172. As a result of this determination, if at least one of them is registered in the black list 172, the process proceeds to step S19, and if both are not registered in the black list 172, the process proceeds to step S20.

  In this example, there is one sender authentication-related element and one quasi-sender authentication-related element for the received mail 200 stored in the sender authentication information element storage unit 16. If there are a plurality of elements and quasi-sender authentication related elements, in step S18, if at least one of the sender authentication-related elements or quasi-sender authentication related elements is registered in the black list 172 Advances to step S19, and if all of the sender authentication related elements and quasi-sender authentication related elements are not registered in the black list 172, the process advances to step S20.

(Step S19) The mail discriminating unit 13 determines that the received mail 200 that has been successfully authenticated in step S12 is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S20) The mail determination unit 13 performs mail determination using a predetermined conventional junk mail determination method for the received mail 200 for which the sender authentication has been successful in step S12. The mail determination unit 13 determines that the received mail 200 is a spam mail if the result of the mail determination is a spam mail, and determines that the received mail 200 is a non-spam mail if it is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 21) The determination result output unit 15 outputs the determination result of the received mail 200 notified from the mail determination unit 13 to the received mail server 30. Thereafter, the process of FIG. 3 is terminated.

  The above is the description of the example 2-1 of the spam mail determination method.

[Example 2-2 of Junk E-mail Discrimination Method]
In the example 2-2 of the junk e-mail discrimination method, as in the example 2-1 of the junk e-mail discrimination method described above, the transmission is performed among the sender authentication related elements, the semi-sender authentication related elements, and the non-sender authentication related elements. Only the authentication related elements and the semi-sender authentication related elements are used. Hereinafter, an example 2-2 of the junk mail determination method will be described with reference to FIG.

  Steps S11, S12, and S13 are the same as in Example 2-1 of the junk mail discrimination method described above. If the sender authentication in step S12 is successful, the process proceeds to step S14, and if it is unsuccessful, the process proceeds to step S15.

(Step S14) The mail discriminating unit 13 uses the communication unit 18 to acquire the sender authentication information 100 from the DNS server 70 of the mail source domain “example.com” of the received mail 200 for which the sender authentication in step S12 was successful. . Next, the mail discriminating unit 13 includes a sender authentication related element and a quasi-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200 among the sender authentication information elements of the sender authentication information 100. Only the combination is stored in the sender authentication information element storage unit 16. Here, as shown in FIG. 6, the sender authentication related element “ip4: 1.2.3.0/24” and the semi-sender authentication related element “ip4: for the sender IP address“ 1.2.3.4 ”of the received mail 200. Only the combination of “10.1.3.0/24” is stored in the sender authentication information element storage unit 16.

  In this example, a combination of “ip4: 1.2.3.0/24” and “ip4: 10.1.3.0/24” is used as a combination of a sender authentication related element and a quasi-sender authentication related element regarding the received mail 200. Are stored in the sender authentication information element storage unit 16, but when there are a plurality of combinations of the sender authentication related elements and quasi-sender authentication related elements, the plurality of sender authentication related elements and quasi-sender authentication related elements All combinations of the sender authentication related elements are stored in the sender authentication information element storage unit 16.

(Step S15) The mail determination unit 13 determines that the received mail 200 for which the sender authentication in Step S12 has failed is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 16) The mail determination unit 13 refers to the white list 171 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 ”and the quasi-sender authentication related element“ ip4: 10.1.3.0/24 ”are determined to be registered in the white list 171. As a result of this determination, when the combination of the sender authentication related element “ip4: 1.2.3.0/24” and the semi-sender authentication related element “ip4: 10.1.3.0/24” is registered in the white list 171 The process proceeds to step S17, and if not registered in the white list 171, the process proceeds to step S18.

  In this example, there is only one combination of the sender authentication related element and the quasi-sender authentication related element related to the received mail 200 stored in the sender authentication information element storage unit 16. If there are a plurality of combinations of related elements and quasi-sender authentication related elements, the combination of any of the sender authentication-related elements and quasi-sender authentication related elements is registered in the white list 171 in step S16. In this case, the process proceeds to step S17. If any combination of the sender authentication related elements and the quasi-sender authentication related elements is not registered in the white list 171, the process proceeds to step S18.

(Step S <b> 17) The mail determination unit 13 determines that the received mail 200 that has been successfully authenticated in step S <b> 12 is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S18) The mail discriminating unit 13 refers to the black list 172 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 ”and the quasi-sender authentication related element“ ip4: 10.1.3.0/24 ”are determined to be registered in the black list 172. If the result of this determination is that it is registered in the black list 172, the process proceeds to step S19, and if both are not registered in the black list 172, the process proceeds to step S20.

  In this example, there is only one combination of the sender authentication related element and the quasi-sender authentication related element related to the received mail 200 stored in the sender authentication information element storage unit 16. If there are a plurality of combinations of related elements and quasi-sender authentication related elements, at least one of the combinations of the sender authentication-related elements and quasi-sender authentication related elements is registered in the black list 172 in step S18. If YES in step S19, the process advances to step S19. If all combinations of the sender authentication-related elements and quasi-sender authentication-related elements are not registered in the black list 172, the process advances to step S20.

  Steps S19, 20, and 21 are the same as in Example 2-1 of the junk mail discrimination method described above.

  The above is the description of the example 2-2 of the spam mail determination method.

[Example 3-1 of Spam E-mail Discrimination Method]
In the example 3-1 of the junk mail discrimination method, a sender authentication related element, a semi-sender authentication related element, and a non-sender authentication related element are used. Hereinafter, an example 3-1 of the junk mail determination method will be described with reference to FIG.

  Steps S11, S12, and S13 are the same as those in Example 1 of the spam mail determination method described above. If the sender authentication in step S12 is successful, the process proceeds to step S14, and if it is unsuccessful, the process proceeds to step S15.

(Step S14) The mail discriminating unit 13 uses the communication unit 18 to acquire the sender authentication information 100 from the DNS server 70 of the mail source domain “example.com” of the received mail 200 for which the sender authentication in step S12 was successful. . Next, the mail discriminating unit 13 includes a sender authentication related element and a semi-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200 among the sender authentication information elements of the sender authentication information 100. The non-sender authentication related elements are stored in the sender authentication information element storage unit 16. Here, as shown in FIG. 6, “ip4” is a sender authentication related element, a semi-sender authentication related element, and a non-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200. : 1.2.3.0/24 "," ip4: 10.1.3.0/24 "," ip4: 10.1.2.0/24 ", and" ip4: 10.1.1.0/24 "are stored in the sender authentication information element storage unit 16. .

(Step S15) The mail determination unit 13 determines that the received mail 200 for which the sender authentication in Step S12 has failed is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 16) The mail determination unit 13 refers to the white list 171 stored in the list storage unit 17 and refers to the sender authentication related element “ip4 regarding the received mail 200 stored in the sender authentication information element storage unit 16. : 1.2.3.0/24 "is registered in the white list 171. As a result of the determination, if the sender authentication related element “ip4: 1.2.3.0/24” is registered in the white list 171, the process proceeds to step S 17. If the element is not registered in the white list 171, the process proceeds to step S 18. Proceed to

  In this example, the sender authentication related element relating to the received mail 200 stored in the sender authentication information element storage unit 16 is one of “ip4: 1.2.3.0/24”. If there are a plurality of authentication-related elements, in step S16, if any of the sender authentication-related elements is registered in the white list 171, the process proceeds to step S17. If it is not registered in the white list 171, the process proceeds to step S18.

(Step S <b> 17) The mail determination unit 13 determines that the received mail 200 that has been successfully authenticated in step S <b> 12 is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 18) The mail determination unit 13 refers to the black list 172 stored in the list storage unit 17, and associates the sender authentication-related elements related to the received mail 200 stored in the sender authentication information element storage unit 16 with It is determined whether at least one of a sender authentication related element and a non-sender authentication related element is registered in the black list 172.

  In this example, sender authentication related elements, semi-sender authentication related elements and non-sender authentication related elements `` ip4: 1.2.3.0/24 '', `` ip4: 10.1.3.0/24 '' and `` ip4: It is determined whether at least one of “10.1.2.0/24” and “ip4: 10.1.1.0/24” is registered in the black list 172. As a result of the determination, if at least one of them is registered in the black list 172, the process proceeds to step S19, and if not all of them are registered in the black list 172, the process proceeds to step S20.

(Step S19) The mail discriminating unit 13 determines that the received mail 200 that has been successfully authenticated in step S12 is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S20) The mail determination unit 13 performs mail determination using a predetermined conventional junk mail determination method for the received mail 200 for which the sender authentication has been successful in step S12. The mail determination unit 13 determines that the received mail 200 is a spam mail if the result of the mail determination is a spam mail, and determines that the received mail 200 is a non-spam mail if it is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 21) The determination result output unit 15 outputs the determination result of the received mail 200 notified from the mail determination unit 13 to the received mail server 30. Thereafter, the process of FIG. 3 is terminated.

  The above is the description of the example 3-1 of the spam mail determination method.

[Example 3-2 of spam mail discrimination method]
In the example 3-2 of the spam mail determination method, the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element are used, as in the above-described spam mail determination method example 3-1. Hereinafter, an example 3-2 of the junk mail determination method will be described with reference to FIG.

  Steps S11, S12, and S13 are the same as in Example 3-1 of the junk mail discrimination method described above. If the sender authentication in step S12 is successful, the process proceeds to step S14, and if it is unsuccessful, the process proceeds to step S15.

(Step S14) The mail discriminating unit 13 uses the communication unit 18 to acquire the sender authentication information 100 from the DNS server 70 of the mail source domain “example.com” of the received mail 200 for which the sender authentication in step S12 was successful. . Next, the mail discriminating unit 13 includes a sender authentication related element and a semi-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200 among the sender authentication information elements of the sender authentication information 100. Only the combination of non-sender authentication related elements is stored in the sender authentication information element storage unit 16. Here, as shown in FIG. 6, as a combination of a sender authentication related element, a semi-sender authentication related element, and a non-sender authentication related element for the sender IP address “1.2.3.4” of the received mail 200, “ The combination of “ip4: 1.2.3.0/24”, “ip4: 10.1.3.0/24”, “ip4: 10.1.2.0/24” and “ip4: 10.1.1.0/24” is sent to the sender authentication information element storage unit 16. Stored.

(Step S15) The mail determination unit 13 determines that the received mail 200 for which the sender authentication in Step S12 has failed is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 16) The mail determination unit 13 refers to the white list 171 stored in the list storage unit 17 and refers to the sender authentication related elements and the quasi-related items regarding the received mail 200 stored in the sender authentication information element storage unit 16. It is determined whether each combination of the sender authentication related element and the non-sender authentication related element is registered in the white list 171.

  In this example, the combinations of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element are “ip4: 1.2.3.0/24”, “ip4: 10.1.3.0/24” and “ There is a combination of "ip4: 10.1.2.0/24" and "ip4: 10.1.1.0/24". For this reason, at least some of the combinations of “ip4: 1.2.3.0/24”, “ip4: 10.1.3.0/24”, “ip4: 10.1.2.0/24” and “ip4: 10.1.1.0/24” (for example, It is determined whether “ip4: 1.2.3.0/24” and “ip4: 10.1.3.0/24”) are registered in the white list 171. If it is determined that at least a part of the combinations is registered in the white list 171, the process proceeds to step S17. If all combinations are not registered in the white list 171, the process proceeds to step S18.

(Step S <b> 17) The mail determination unit 13 determines that the received mail 200 that has been successfully authenticated in step S <b> 12 is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 18) The mail determination unit 13 refers to the black list 172 stored in the list storage unit 17, and associates the sender authentication-related elements related to the received mail 200 stored in the sender authentication information element storage unit 16 with It is determined whether each combination of the sender authentication related element and the non-sender authentication related element is registered in the black list 172.

  In this example, the combinations of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element are “ip4: 1.2.3.0/24”, “ip4: 10.1.3.0/24” and “ There is a combination of "ip4: 10.1.2.0/24" and "ip4: 10.1.1.0/24". Therefore, at least a part of the combination of “ip4: 1.2.3.0/24”, “ip4: 10.1.3.0/24”, “ip4: 10.1.2.0/24” and “ip4: 10.1.1.0/24” is black. It is determined whether it is registered in the list 172. If it is determined that at least a part of the combinations is registered in the black list 172, the process proceeds to step S19. If all combinations are not registered in the black list 172, the process proceeds to step S20.

(Step S19) The mail discriminating unit 13 determines that the received mail 200 that has been successfully authenticated in step S12 is a spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S20) The mail determination unit 13 performs mail determination using a predetermined conventional junk mail determination method for the received mail 200 for which the sender authentication has been successful in step S12. The mail determination unit 13 determines that the received mail 200 is a spam mail if the result of the mail determination is a spam mail, and determines that the received mail 200 is a non-spam mail if it is a non-spam mail. The mail determination unit 13 notifies the determination result output unit 15 of the determination result.

(Step S <b> 21) The determination result output unit 15 outputs the determination result of the received mail 200 notified from the mail determination unit 13 to the received mail server 30. Thereafter, the process of FIG. 3 is terminated.

  The above is the description of Example 3-2 of the spam mail determination method.

  The above is an explanation of an example of the spam mail discrimination method.

  Each example of the junk e-mail discrimination method described above can be used properly based on, for example, an operation policy that places importance on the reduction of missed miss or the reduction of false detection in junk e-mail discrimination. Examples 3-1> Example 2-1> Example 1> Example 2-2> Example 3-2 are the ratios for determining non-spam mail as spam mail. On the other hand, the ratio of determining spam mail as non-spam mail is Example 3-1 <Example 2-1 <Example 1 <Example 2-2 <Example 3-2. Based on this, it is possible to use each example of the junk mail discrimination method.

  The received mail server 30 determines a treatment for the received mail 200 based on the determination result of the received mail 200 input from the mail determination device 1 (determination result output unit 15). For example, when the determination result of the received mail 200 is a non-spam mail, transmission of the received mail 200 to the mail receiving terminal 40 is permitted. On the other hand, when the determination result of the received mail 200 is a junk mail, the received mail 200 is stopped from being sent to the mail receiving terminal 40. For the received mail 200 whose transmission to the mail receiving terminal 40 is stopped, for example, a transmission stop guide is transmitted to the mail receiving terminal 40, and the mail is received only when the mail receiving terminal 40 requests transmission of the received mail 200. For example, sending the received mail 200 to the terminal 40 may be performed in consideration of safety with respect to the mail receiving terminal 40.

  Next, with reference to FIG. 4, the operation | movement which concerns on the list preparation of the mail determination apparatus 1 shown in FIG. 1 is demonstrated. In the following description, the sender authentication information element set means a semi-sender authentication related element related to the sender authentication related element, a non-sender authentication related element related to the sender authentication related element, and It refers to a combination of a sender authentication related element and a semi-sender authentication related element, and a combination of a sender authentication related element, a semi-sender authentication related element, and a non-sender authentication related element.

(Step S51) The list creation unit 14 confirms whether the sender authentication (step S12 in FIG. 3) using the SPF method for the received mail 200 is successful. The result of the sender authentication using the SPF method for the received mail 200 is notified from the sender authentication unit 12 to the list creation unit 14. As a result of the confirmation, if successful, the process proceeds to step S52. If unsuccessful, the process of FIG. 4 is terminated.

(Step S52) The list creation unit 14 confirms the result of the determination by the mail determination unit 13 for the received mail 200 (step S20 in FIG. 3). The determination result of the mail determination unit 13 for the received mail 200 is notified from the mail determination unit 13 to the list creation unit 14. As a result of the confirmation, if it is a non-spam mail, the process proceeds to step S53, and if it is a junk mail, the process proceeds to step S56.

(Step S <b> 53) The list creation unit 14 stores the “sender authentication related element and sender authentication information element set regarding the received mail 200” stored in the sender authentication information element storage unit 16 in the list storage unit 17. To the white list 171. As this addition method, for example, a method for adding to the white list 171 may be determined based on an operation policy on whether to focus on the reduction of missed detection or the reduction of false detection in spam mail determination. For example, when importance is placed on the reduction of oversight, all of the “sender authentication related elements and sender authentication information element sets related to the received mail 200” stored in the sender authentication information element storage unit 16 are stored in the white list 171. To add. On the other hand, when emphasizing reduction of false detection, it is possible to add only “sender authentication related elements related to received mail 200” stored in the sender authentication information element storage unit 16 to the white list 171.

(Step S <b> 54) The list creation unit 14 refers to the black list 172 stored in the list storage unit 17, and stores “sender authentication related elements related to the received mail 200” stored in the sender authentication information element storage unit 16. Is registered in the black list 172, and “sender authentication information element set related to received mail 200” stored in the sender authentication information element storage unit 16 is registered in the black list 172. . If it is determined that there is a sender authentication related element or a sender authentication information element set registered in the black list 172, the process proceeds to step S55, and the sender authentication related element registered in the black list 172 is also transmitted. If there is no person authentication information element set, the processing in FIG. 4 is terminated.

(Step S55) The list creation unit 14 is a “sender authentication related element regarding the received mail 200” stored in the sender authentication information element storage unit 16 and registered in the black list 172. The black list 172 stored in the list storage unit 17 and the “sender authentication information element set regarding the received mail 200” stored in the authentication information element storage unit 16 and registered in the black list 172 Delete from. Thereafter, the process of FIG. 4 is terminated.

(Step S56) The list creation unit 14 refers to the white list 171 stored in the list storage unit 17, and stores “sender authentication related elements regarding the received mail 200” stored in the sender authentication information element storage unit 16. Is registered in the white list 171, and “sender authentication information element group related to received mail 200” stored in the sender authentication information element storage unit 16 is registered in the white list 171. . If all of the sender authentication related elements and the sender authentication information element set are registered in the white list 171 as a result of this determination, the processing in FIG. On the other hand, if at least one of the sender authentication related element and the sender authentication information element set is not registered in the white list 171, the process proceeds to step S 57.

(Step S <b> 57) The list creation unit 14 transmits all of the “sender authentication related elements related to the received mail 200” stored in the sender authentication information element storage unit 16 and not registered in the white list 171. All of the “sender authentication information element sets relating to the received mail 200” stored in the user authentication information element storage unit 16 and not registered in the white list 171 are stored in the black stored in the list storage unit 17 Add to list 172. Thereafter, the process of FIG. 4 is terminated. Here, the combination of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element may not be added to the black list 172.

  According to the above-described embodiment, an annoyance using the white list 171 or the black list 172 for a received mail that has been successfully authenticated by the sender of the received mail using the SPF method (hereinafter referred to as a SPF authentication successful received mail). Perform mail discrimination. The white list 171 and the black list 172 are SPF authentication success received mails among the sender authentication information elements constituting the sender authentication information registered in the DNS server 70 of the mail transmission source domain of the SPF authentication successful reception mail. It consists only of a sender authentication related element and a sender authentication information element set for the sender IP address.

  Here, the IP address (that is, the sender IP address) of the mail transmitting terminal 80 is properly assigned from an Internet service provider (ISP) or the like. For this reason, among the sender authentication information elements constituting the sender authentication information registered in the DNS server 70, the sender authentication information element indicating the sender IP address is freely changed with respect to the DNS server 70. I can't. Therefore, it can be said that the “sender authentication information element indicating the sender IP address” registered in the DNS server 70 is reliable information.

  Therefore, it is composed only of a sender authentication related element which is a “sender authentication information element indicating a sender IP address” registered in the DNS server 70 and a sender authentication information element set related to the sender authentication related element. It can be said that the result of the spam mail determination using the white list 171 or the black list 172 is highly reliable. Thereby, in the mail determination apparatus 1 that performs the sender authentication of the received mail using the SPF method, it is possible to improve the accuracy of the junk mail determination of the received mail that has been successfully authenticated by the sender.

  Further, as described above, since the sender authentication information element indicating the sender IP address cannot be freely changed with respect to the DNS server 70, the sender authentication information of the DNS server 70 can be changed by changing the sender authentication information. It is difficult to invalidate the list 171 and the black list 172. Therefore, for example, even if a spam mail sender changes freely changeable sender authentication information of the DNS server 70, the white list 171 and the black list 172 are not invalidated. The effect which prevents is obtained.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like within a scope not departing from the gist of the present invention.

  For example, the mail determination device 1 may be connected to the received mail server 30 or may be included in the received mail server 30. For example, the function of the received mail server 30 may be realized by executing a computer program for realizing the function of the mail determination device 1.

  The list creation unit 14 may be configured as a list creation device that is separate from the mail determination device 1.

Further, a computer program for realizing the function of the mail determination device 1 described above may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed. Good. Here, the “computer system” may include an OS and hardware such as peripheral devices.
“Computer-readable recording medium” refers to a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disk), and a built-in computer system. A storage device such as a hard disk.

Further, the “computer-readable recording medium” means a volatile memory (for example, DRAM (Dynamic DRAM) in a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Random Access Memory)), etc., which hold programs for a certain period of time.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 1 ... Mail determination apparatus, 11 ... Received mail input part, 12 ... Sender authentication part, 13 ... Mail discrimination | determination part, 14 ... List preparation part, 15 ... Determination result output part, 16 ... Sender authentication information element storage part, 17 ... List storage unit, 18 ... Communication unit, 30 ... Receiving mail server, 40 ... Mail receiving terminal, 50 ... Communication network, 60 ... Sending mail server, 70 ... DNS server, 80 ... Mail sending terminal, 171 ... White list, 172 …blacklist

Claims (9)

It is a mail determination device that performs sender authentication of received mail using the SPF (Sender Policy Framework) method,
Junk mail discrimination using the sender authentication information and the white list or black list referred to in the sender authentication for the SPF authentication success received mail that has been successfully authenticated by the sender of the received mail using the SPF method. A mail discriminating unit to perform;
The sender IP address of the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. sender authentication-related element including or quasi sender authentication related elements associated with the sender authentication-related element, or a non-sender authentication related elements associated with the sender authentication-related element, or the sender From the combination of the authentication related element and the semi-sender authentication related element, or the combination of the sender authentication related element, the semi-sender authentication related element and the non-sender authentication related element, the white list and the black list A list creation unit for creating ,
The mail discriminating unit is configured to determine a predetermined junk mail for the SPF authentication success received mail in which both the judgment of non-spam mail using the white list and the judgment of spam mail using the black list are impossible. Email identification using the method,
The list creation unit, when the result of mail determination using the predetermined junk mail determination method is a non-spam mail, the sender authentication related elements related to the SPF authentication success received mail that is a target of the mail determination, The semi-sender authentication related element, the non-sender authentication related element, a combination of the sender authentication related element and the semi-sender authentication related element, or the sender authentication related element and the semi-sender authentication related element Adding the combination of non-sender authentication related elements to the white list and deleting from the black list;
Mail judgment device. The list creation unit, when the result of the mail determination using the predetermined junk mail determination method is a junk mail, the sender authentication related element related to the SPF authentication success received mail that is a target of the mail determination, A semi-sender authentication related element, the non-sender authentication related element, or a combination of the sender authentication related element and the semi-sender authentication related element is not registered when not registered in the whitelist. Add things to the blacklist,
The mail determination device according to claim 1 . It is a mail determination device that performs sender authentication of received mail using the SPF (Sender Policy Framework) method,
Junk mail discrimination using the sender authentication information and the white list or black list referred to in the sender authentication for the SPF authentication success received mail that has been successfully authenticated by the sender of the received mail using the SPF method. A mail discriminating unit to perform;
The sender IP address of the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. Including a sender authentication related element, a semi-sender authentication related element related to the sender authentication related element, or a non-sender authentication related element related to the sender authentication related element, or the sender From the combination of the authentication related element and the semi-sender authentication related element, or the combination of the sender authentication related element, the semi-sender authentication related element and the non-sender authentication related element, the white list and the black list A list creation unit for creating,
The mail discriminating unit is configured to determine a predetermined junk mail for the SPF authentication success received mail in which both the judgment of non-spam mail using the white list and the judgment of spam mail using the black list are impossible. Email identification using the method,
The list creation unit, when the result of the mail determination using the predetermined junk mail determination method is a junk mail, the sender authentication related element related to the SPF authentication success received mail that is a target of the mail determination, A semi-sender authentication related element, the non-sender authentication related element, or a combination of the sender authentication related element and the semi-sender authentication related element is not registered when not registered in the whitelist. Add things to the blacklist,
Mail judgment device. A mail determination method of a mail determination apparatus that performs sender authentication of received mail using an SPF (Sender Policy Framework) method,
For the SPF authentication success received mail in which the sender authentication of the received mail using the SPF method has succeeded, the mail determination device receives the sender authentication information and the white list or black list referred to in the sender authentication. Email discrimination step to identify used spam emails,
The mail determination device receives the SPF authentication success reception among sender authentication information elements constituting sender authentication information registered in a DNS (Domain Name System) server of a mail transmission source domain of the SPF authentication success reception mail. Sender authentication related element including sender IP address of mail, or semi-sender authentication related element related to the sender authentication related element, or non-sender authentication related element related to the sender authentication related element Or a combination of the sender authentication related element and the semi-sender authentication related element, or a combination of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element. and list creation step to create a list and the black list, only including,
The mail determination device determines a predetermined spam mail for the SPF authentication success received mail in which both the determination of non-spam mail using the white list and the determination of spam mail using the black list are impossible. Email identification using the method,
The mail determination device, when the result of mail determination using the predetermined spam mail determination method is a non-spam mail, the sender authentication related elements related to the SPF authentication success received mail that is a target of the mail determination, The semi-sender authentication related element, the non-sender authentication related element, a combination of the sender authentication related element and the semi-sender authentication related element, or the sender authentication related element and the semi-sender authentication related element Adding the combination of non-sender authentication related elements to the white list and deleting from the black list;
Email judgment method. The mail determination device, when the result of mail determination using the predetermined junk mail determination method is junk mail, the sender authentication related element related to the SPF authentication success received mail that is a target of the mail determination, A semi-sender authentication related element, the non-sender authentication related element, or a combination of the sender authentication related element and the semi-sender authentication related element is not registered when not registered in the whitelist. Add things to the blacklist,
The mail determination method according to claim 4. A mail determination method of a mail determination apparatus that performs sender authentication of received mail using an SPF (Sender Policy Framework) method,
For the SPF authentication success received mail in which the sender authentication of the received mail using the SPF method has succeeded, the mail determination device receives the sender authentication information and the white list or black list referred to in the sender authentication. Email discrimination step to identify used spam emails,
The mail determination device receives the SPF authentication success reception among sender authentication information elements constituting sender authentication information registered in a DNS (Domain Name System) server of a mail transmission source domain of the SPF authentication success reception mail. Sender authentication related element including sender IP address of mail, or semi-sender authentication related element related to the sender authentication related element, or non-sender authentication related element related to the sender authentication related element Or a combination of the sender authentication related element and the semi-sender authentication related element, or a combination of the sender authentication related element, the semi-sender authentication related element, and the non-sender authentication related element. A list creation step for creating a list and the black list,
The mail determination device determines a predetermined spam mail for the SPF authentication success received mail in which both the determination of non-spam mail using the white list and the determination of spam mail using the black list are impossible. Email identification using the method,
The mail determination device, when the result of mail determination using the predetermined junk mail determination method is junk mail, the sender authentication related element related to the SPF authentication success received mail that is a target of the mail determination, A semi-sender authentication related element, the non-sender authentication related element, or a combination of the sender authentication related element and the semi-sender authentication related element is not registered when not registered in the whitelist. Add things to the blacklist,
Email judgment method. In the computer of the mail judgment device that performs sender authentication of received mail using the SPF (Sender Policy Framework) method,
Junk mail discrimination using the sender authentication information and the white list or black list referred to in the sender authentication for the SPF authentication success received mail that has been successfully authenticated by the sender of the received mail using the SPF method. E-mail discrimination step to be performed;
The sender IP address of the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. sender authentication-related element including or quasi sender authentication related elements associated with the sender authentication-related element, or a non-sender authentication related elements associated with the sender authentication-related element, or the sender From the combination of the authentication related element and the semi-sender authentication related element, or the combination of the sender authentication related element, the semi-sender authentication related element and the non-sender authentication related element, the white list and the black list A list creation step to create,
E-mail discrimination using a predetermined junk e-mail discriminating method for the SPF authentication success received mail in which both the non-spam e-mail judgment using the white list and the junk e-mail judgment using the black list are impossible The steps of
When the result of the mail determination using the predetermined junk mail determination method is a non-spam mail, the sender authentication related element relating to the SPF authentication success received mail that is a target of the mail determination, the semi-sender authentication related Element, non-sender authentication related element, combination of sender authentication related element and semi-sender authentication related element, or sender authentication related element, semi-sender authentication related element, and non-sender authentication related Adding a combination of elements to the white list and deleting from the black list;
A computer program for running. When the result of mail discrimination using the predetermined junk mail discrimination method is junk mail, the sender authentication related element and the quasi-sender authentication related element related to the SPF authentication success received mail that is the target of the mail discrimination When the non-sender authentication related element or the combination of the sender authentication related element and the semi-sender authentication related element is not registered in the white list, the non-registered element is added to the black list. Steps to add,
A computer program for causing the computer to further execute. In the computer of the mail judgment device that performs sender authentication of received mail using the SPF (Sender Policy Framework) method,
Junk mail discrimination using the sender authentication information and the white list or black list referred to in the sender authentication for the SPF authentication success received mail that has been successfully authenticated by the sender of the received mail using the SPF method. E-mail discrimination step
The sender IP address of the SPF authentication success reception mail among the sender authentication information elements constituting the sender authentication information registered in the DNS (Domain Name System) server of the mail transmission source domain of the SPF authentication success reception mail. Including a sender authentication related element, a semi-sender authentication related element related to the sender authentication related element, or a non-sender authentication related element related to the sender authentication related element, or the sender From the combination of the authentication related element and the semi-sender authentication related element, or the combination of the sender authentication related element, the semi-sender authentication related element and the non-sender authentication related element, the white list and the black list A list creation step to create,
E-mail discrimination using a predetermined junk e-mail discriminating method for the SPF authentication success received mail in which both the non-spam e-mail judgment using the white list and the junk e-mail judgment using the black list are impossible The steps of
When the result of mail discrimination using the predetermined junk mail discrimination method is junk mail, the sender authentication related element and the quasi-sender authentication related element related to the SPF authentication success received mail that is the target of the mail discrimination When the non-sender authentication related element or the combination of the sender authentication related element and the semi-sender authentication related element is not registered in the white list, the non-registered element is added to the black list. Adding steps,
A computer program for running.

Images