JP6493497B1 - Information processing apparatus, information processing method, and program - Google Patents

Abstract

[PROBLEMS] To prevent damage by targeted attack emails by alerting based on the organization specified from the email text and the sender's address [Solution] Extract the organization name from the text of the received email Identify the domain corresponding to the extracted organization name. Based on the identified domain and the domain of the sender address of the e-mail, the possibility of organization spoofing is notified.
[Selection] Figure 1

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  In recent years, targeted attacks for the purpose of stealing money and important information from specific organizations and persons are increasing. In the targeted attack, in order to achieve the objective, the attack is performed by combining various methods based on information specialized for the target organization or person.

  As an initial intrusion means in a targeted attack, a method using electronic mail called a targeted attack mail is typical. In targeted attack emails, the content that attracts the interest of the targeted recipient or the content that the recipient misidentifies as being related to the subject is described in the main text, and the file is attached to the email or the linked destination It aims to execute the malicious program. If the target executes a malicious program, a bag door is installed and becomes an entry point for further attacks.

  There are two types of targeted attack emails. The first is an “interactive attack” that targets specific individuals, and the second is to send people with specific attributes by sending an email about the attributes that apply to many people to an unspecified number of people. The target is a “scattering attack”.

  In “scattering attacks”, attributes that apply to many people are used, so notifications and communications from organizations that handle services and products with many users are often disguised.

  An organization that is misrepresented generally has a high level of recognition and reliability, and a target user tends to trust unconditionally only by the name of the organization. Further, in order to determine that a mail address or URL actually belongs to the corresponding organization, it is necessary to determine the mail address from the domain part corresponding to the organization in the URL, which is difficult for general users.

  In Patent Document 1, a URL described in an e-mail body and an organization name registered in advance are extracted, and the extracted URL and the organization name are associated with each other based on the positional relationship between the extracted URL and the organization name. A technique for determining validity based on whether a URL is previously included in a URL list associated with an organization name is disclosed.

  Patent Document 2 discloses a technique for extracting a URL described in the body of an email, comparing the URL domain and the sender address domain of the email, and issuing a warning if they do not match.

JP 2007-156690 A Japanese Patent No. 4429971

  Both Patent Document 1 and Patent Document 2 are anti-phishing technologies and are means for verifying the legitimacy of URLs, and because they do not determine fraud by email itself, they cannot respond to attacks by attached files. There are challenges.

  Patent Document 2 is effective when an attacker uses a legitimate address to misrepresent the sender, but uses a domain that the attacker misidentifies as a legitimate address. If the domain of the address matches, there is a problem that it cannot be detected.

  Therefore, it is desirable to be able to determine whether or not the received electronic mail has been transmitted from a legitimate address of the organization that is self-proclaimed in the name identification or the signature at the end of the text.

  Therefore, an object of the present invention is to prevent damage caused by targeted attack emails by calling attention based on the organization specified from the body of the email and the address of the sender.

  An information processing apparatus according to the present invention includes an extraction unit that extracts an organization name from an e-mail body, a domain identification unit that identifies a domain corresponding to the organization name extracted by the extraction unit, and a domain identification unit And a notification means for notifying the possibility of organization fraud based on the domain and the domain of the sender address of the e-mail.

  According to the present invention, it is possible to prevent damages due to targeted attack emails by calling attention based on the organization specified from the email text and the address of the sender.

It is a figure which shows an example of the system configuration | structure of the organization fraud mail inspection apparatus in embodiment of this invention. It is a block diagram which shows an example of the hardware constitutions of the organization fraud mail detection apparatus in embodiment of this invention. It is a figure which shows an example of a function structure of the organization fraud mail detection apparatus in embodiment of this invention. It is a flowchart which shows an example of the process which test | inspects mail in embodiment of this invention. It is a flowchart which shows an example of the process which extracts the organization name of the greeting part in the mail text in embodiment of this invention. It is a figure which shows an example of a structure of the determination knowledge storage area | region in embodiment of this invention. It is a figure which shows an example of a line classification table in embodiment of this invention. It is a figure which shows an example of the organization domain table in embodiment of this invention. It is a figure which shows an example of the email in embodiment of this invention. It is a flowchart which shows an example of the process which extracts the organization name of the signature part in the mail text in embodiment of this invention. It is a flowchart which shows an example of the process which determines the organization fraud of mail in embodiment of this invention. It is a figure which shows an example of the mail browsing screen in embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of a system configuration of an organization spoofing mail inspection apparatus according to an embodiment of the present invention.

  The organization spoofing mail inspection device 100 and the mail server 120 are connected via a local area network 130. The mail server 120 is configured to be connectable to the external network 140.

  The organization spoofing mail inspection device 100 has a function of a general electronic mail client, and has an electronic mail browsing function and a receiving function from a mail server.

  Furthermore, when displaying the received e-mail, it is determined whether or not there is any organization misrepresentation for the e-mail to be displayed. Display and prompt visual confirmation.

  The mail server 120 is a general mail receiving server (POP3 or IMAP server), and transfers mail received from an external or local destination in response to a request from the electronic mail client.

  In the present embodiment, a case where the organization spoofing mail inspection apparatus is an e-mail client will be described, but it may be implemented as a gateway-type e-mail audit system or a Web mail system.

  FIG. 2 is a block diagram illustrating an example of a hardware configuration of the organization spoofing mail inspection apparatus (information processing apparatus) 100 according to the embodiment of this invention.

  As shown in FIG. 2, the information processing apparatus includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, an input controller 205, a video controller 206, a system bus 204, and the like. A memory controller 207 and a communication I / F controller 208 are connected.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 204.

  The ROM 202 or the external memory 211 includes a BIOS (Basic Input / Output System) and an OS (Operating System) that are control programs executed by the CPU 201, and a computer-readable program and various necessary programs for realizing the information processing method. Holds data (including data table).

  The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for executing the processing from the ROM 202 or the external memory 211 to the RAM 203 and executing the loaded program.

  The input controller 205 controls input from an input device such as a keyboard 209 or a pointing device such as a mouse (not shown). When the input device is a touch panel, the user can perform various instructions by pressing (touching with a finger or the like) in accordance with an icon, a cursor, or a button displayed on the touch panel.

  The touch panel may be a touch panel capable of detecting a position touched with a plurality of fingers, such as a multi-touch screen.

  The video controller 206 controls display on an external output device such as the display 210. The display includes a display of a notebook computer integrated with the main body. The external output device is not limited to a display, and may be a projector, for example. An input device is also provided for the device that can accept the touch operation described above.

  Note that the video controller 206 can control a video memory (VRAM) for display control, and a part of the RAM 203 can be used as a video memory area, or a dedicated video memory can be provided separately. Is possible.

  The memory controller 207 controls access to the external memory 211. The external memory is connected via an adapter to an external storage device (hard disk), flexible disk (FD), or PCMCIA card slot that stores boot programs, various applications, font data, user files, editing files, and various data. A compact flash (registered trademark) memory or the like can be used.

  The communication I / F controller 209 connects and communicates with an external device via a network, and executes communication control processing on the network. For example, communication using TCP / IP, telephone lines such as ISDN, and communication using 3G lines of mobile phones are possible.

  Note that the CPU 201 enables display on the display 210 by executing outline font rasterization processing on a display information area in the RAM 203, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display 210.

  Next, the function of the organization fraud mail inspection device (information processing device) will be described with reference to FIG.

  The list display unit 301 has a function of displaying a list of e-mails received from the mail server 120 on the display unit. The processing shown in the flowchart of FIG. 4 is executed by accepting selection of the displayed e-mail (accepting a browsing request).

  The inspection processing unit 302 has a function of executing processing shown in the flowcharts of FIGS. 4, 5, 10, and 11. Details will be described using each flowchart.

  The judgment knowledge storage area is an area in which data shown in FIGS. 7 and 8 is stored.

  The browsing processing unit 304 has a function of displaying an e-mail that has received a browsing request, and a function of notifying that there is a possibility of organization fraud.

(Mail inspection process)
Next, an e-mail inspection process executed by the inspection processing unit 302 according to the embodiment of the present invention will be described with reference to the flowchart of FIG.

  The flowchart of FIG. 4 is a process in which the CPU 201 of the organization fraud mail inspection device 100 reads and executes a predetermined control program, and the process executed before displaying the e-mail instructed to browse in the list display unit 301. It is a flowchart to show.

  In step S <b> 401, the inspection processing unit 302 acquires an email instructed to be browsed by the mail reception processing unit 301.

  In step S402, the inspection processing unit 302 identifies a greeting part at the beginning of the e-mail text from the e-mail received in step S401, and extracts an organization name described in the greeting part. Details of this step will be described later with reference to the flowchart of FIG.

  In step S403, the inspection processing unit 302 specifies the signature part at the end of the email body from the email received in step S401, and extracts the organization name described in the signature part. Details of the processing in this step will be described later using the flowchart of FIG.

  In step S404, the inspection processing unit 302 extracts the organization name from the real name part of the sender field (From) in the email header.

  In step S405, the inspection processing unit 302 determines the presence / absence of organization spoofing from the organization name and sender address acquired in steps S402 to S404. Details of this step will be described later with reference to the flowchart of FIG.

(Greeting department organization name extraction process)
Next, the greeting part organization name extraction process in step S402 will be described with reference to the flowchart of FIG.

  In step S501, the inspection processing unit 302 removes blank lines and quoted lines from the body of the electronic mail acquired in step S401. The quoted line is a part described in the reply mail or the forwarding mail in the reply mail or the forwarding mail. This can be determined based on the fact that “>” is added to the beginning of the line.

  In step S502, the inspection processing unit 302 acquires a prescribed number of lines from the top of the text from which blank lines and quoted lines have been removed in step S501.

  In step S503, the inspection processing unit 302 starts the iterative process up to step S508 for the row acquired in step S502.

  In step S504, the examination processing unit 302 determines the type of the target row using the row type table 601 in the determination knowledge storage area 303 illustrated in FIG.

  The line type is determined as a type that matches the pattern (regular expression) registered in the line type table 601. If there is no matching pattern, the type is “none”. An example of the row type table 601 is shown in FIG.

  In the embodiment of the present invention, a regular expression is used. However, a determination may be made based on the appearance frequency or ratio of words or specific character strings.

  In step S505, the inspection processing unit 302 moves the process to step S506 when it is determined that the line type of the target line is “greeting”, “address” or “named” as a result of the process in step S504. If it is determined that the line type is neither “greeting”, “address” or “named”, the process is terminated.

  In step S506, the inspection processing unit 302 moves the process to step S507 if it is determined that the row type of the target row is “named” as a result of the processing in step S504. If it is determined that the line type is not “named”, the process proceeds to step S508.

  In step S507, the examination processing unit 302 extracts the organization name from the target row and ends the process.

  Although the details of the extraction of the organization name are omitted, character strings registered in “organization name” and “alias / brand name” in the organization domain table 602 in the determination knowledge storage area 303 are extracted. An example of the organization domain table 602 is shown in FIG.

  In step S508, the inspection processing unit 302 performs the repetitive processing from step S503 if there are more rows to be processed. If there is no line to be processed, the process ends.

  As a result, in the greeting part at the beginning of the email, get the name of the organization that the sender is referring to

(Example of greeting department organization name extraction process)
Next, a case where the process shown in FIG. 5 is performed on the e-mail 901 shown in FIG. 9 will be described as a specific example of the greeting part organization name extraction process.

  In step S501, the inspection processing unit 302 removes blank lines and quoted lines from the body 904 of the email 901.

  In step S502, the inspection processing unit 302 acquires a specified number of lines from the top of the text 904 from which blank lines and quoted lines are removed in step S501 (905). In this specific example, the specified number is 5.

  In step S503, the inspection processing unit 302 starts the iterative process up to step S508 for the row “New Select Kondo-sama” acquired in step S502.

  In step S504, the inspection processing unit 302 uses the row type table 601 in FIG. 7 to determine that the type of the target row “New Select Kondo-sama” is “address” (matches 701).

  In step S505, the inspection processing unit 302 determines that the row type of the target row is “address” as a result of the processing in step S504, and moves the processing to step S506.

  In step S506, the inspection processing unit 302 determines that the row type of the target row is “address” as a result of the processing in step S504, and moves the process to step S508.

  In step S508, the inspection processing unit 302 performs the process from step S503 because there is a row “Thank you for your attention” as a processing target.

  In step S503, the inspection processing unit 302 starts the iterative process up to step S508 for the next line “Thank you for your help”.

  In step S504, the inspection processing unit 302 determines that the type of the target row “I am indebted” is “greeting” (matches 702) using the row type table 601 of FIG.

  In step S505, the inspection processing unit 302 determines that the line type of the target line is “greeting” as a result of the process in step S504, and moves the process to step S506.

  In step S506, the inspection processing unit 302 determines that the line type of the target line is “greeting” as a result of the process in step S504, and thus moves the process to step S508.

  In step S508, the inspection processing unit 302 performs the repetitive processing from step S503 because there is still a line “Omura of Choho Silver” to be processed.

  In step S503, the inspection processing unit 302 starts the iterative processing up to step S508 for the next line “It is Oomura of Choho Silver.”

  In step S504, the inspection processing unit 302 uses the row type table 601 in FIG. 7 to determine that the type of the target row “is Omura of Nagaho Silver” is “named” (matches 703).

  In step S505, as a result of the processing in step S504, the inspection processing unit 302 determines that the row type of the target row “It is Omura of Choho Silver” is “named”, so the processing moves to step S506.

  In step S506, as a result of the processing in step S504, the inspection processing unit 302 determines that the row type of the target row “It is Omura of Choho Silver” is “named”, so the processing moves to step S507.

  In step S507, the inspection processing unit 302 extracts the organization name “Chogo Silver” (matches 801) from the target row “Chogo Silver Omura” and ends the process.

  As a result, from the beginning of the e-mail 901, “Chogo Silver” is acquired as the organization name that the sender is referring to.

(Signature department organization name extraction process)
Next, the signature part organization name extraction process in step S403 will be described with reference to the flowchart of FIG.

  In step S1001, the inspection processing unit 302 secures and initializes a signature part buffer in the temporary area.

  In step S1002, the inspection processing unit 302 removes blank lines and quoted lines from the body of the electronic mail acquired in step S401.

  In step S1003, the inspection processing unit 302 acquires a prescribed number of lines from the end of the text from which blank lines and quoted lines have been removed in step S1002.

  In step S1004, the inspection processing unit 302 starts the iterative process from the end to step S1008 for the row acquired in step S1003.

  In step S1005, the inspection processing unit 302 determines the row type of the target row using the row type table 601 in the determination knowledge storage area 303, as in step S504.

  In step S1006, if the result of step S1005 determines that the line type of the target line is “text” or “end of text”, the inspection processing unit 302 moves the process to step S1009. If it is determined that the line type is not “text” or “end of text”, the process proceeds to step S1007.

  In step S1007, the inspection processing unit 302 adds the target line to the signature buffer.

  In step S1008, the inspection processing unit 302 performs the repetition processing from step S1004 if there is still a row to be processed. If there is no row to be processed, the process proceeds to step S1009.

  In step S1009, the inspection processing unit 302 extracts the organization name from the line added to the signature part buffer, as in step S507.

  As a result, in the signature part at the end of the email, get the name of the organization that the sender is referring to

(Specific example of signature part organization name extraction processing)
Next, as a specific example of the signature part organization name extraction process, a case where the process shown in FIG. 10 is performed on the e-mail 901 shown in FIG. 9 will be described.

  In step S1001, the inspection processing unit 302 secures and initializes a signature part buffer in the temporary area.

  In step S1002, the inspection processing unit 302 removes blank lines and quoted lines from the body 904 of the email 901.

  In step S1003, the inspection processing unit 302 acquires a prescribed number of lines from the end of the text 904 from which blank lines and quoted lines have been removed in step S1002 (907). In this specific example, the specified number is eight.

  In step S1004, the inspection processing unit 302 performs the process from the last line “■■■■■■■■■■■■■■■■■■■■■■” acquired in step S1003 to step S1008. The repetition process is started.

  In step S1005, the inspection processing unit 302 matches the target row “■■■■■■■■■■■■■■■■■■■■■■" using the row type table 601 of FIG. Since there is no rule, the line type is determined as “none”.

  In step S1006, the inspection processing unit 302 determines that the row type of the target row “■■■■■■■■■■■■■■■■■■■■■■” is “None” as a result of the processing in step S1005. Therefore, the process moves to step S1007.

  In step S1007, the inspection processing unit 302 adds the target line “■■■■■■■■■■■■■■■■■■■■■■” to the signature buffer.

  In step S <b> 1008, the inspection processing unit 302 performs the repetitive processing from step S <b> 1004 because there is still a row “Masuji Omura” to be processed.

  “Masuji Omura”, “E-Mail: oomura@chobo-bank.co.jp”, “Tel: XXXXXX FAX: YYYYYYY”, “Changho Bank Head Office Sales Department”, “Chogo Bank Head Office Sales Department” The same processing is performed for each row.

  In step S1004, the inspection processing unit 302 starts the iterative processing from the end to step S1008 for the row “above” acquired in step S1003.

  In step S1005, the inspection processing unit 302 determines that the line type of the target line “above” is “end of text” (matches 704) using the line type table 601 in FIG.

  In step S1006, the inspection processing unit 302 determines that the line type of the target line “above” is “end of text” as a result of the process of step S1005, and thus moves the process to step S1009.

  In step S1009, as in step S507, the inspection processing unit 302 extracts the organization name “Chungho Bank” from the line (the same content as 908) added to the signature part buffer.

  As a result, “Chogo Bank” is acquired from the end signature part of the e-mail 901 as the organization name that the sender himself / herself describes.

(Organization fraud determination processing)
Next, the organization misrepresentation determination process in step S405 will be described using the flowchart of FIG.

  In step S1101, the inspection processing unit 302 secures and initializes a result buffer in the temporary area.

  In step S1102, the inspection processing unit 302 acquires the domain portion as the sender domain from the address of the sender (From) in the header of the email acquired in step S401.

  In step S1103, the examination processing unit 302 starts the iterative process from step S402 to step S1109 on the organization name acquired in step S404.

  In step S1104, the examination processing unit 302 uses the organization domain table 602 to acquire a domain for the target organization name as the organization domain.

  In step S1105, the examination processing unit 302 starts the iterative process up to step S1107 for the tissue domain acquired in step S1104.

  In step S1106, the examination processing unit 302 compares the target organization domain and the sender domain, and if they match, the processing moves to step S1109. If not, the process proceeds to step S1107.

  In step S1107, if there is still a tissue domain to be processed, the examination processing unit 302 performs the repetition processing from step S1105. If there is no organization domain to be processed, the process proceeds to step S1108.

  In step S1108, the examination processing unit 302 adds the combination of the sender domain and the organization name to the result buffer.

  In step S1109, if there is still an organization name to be processed, the examination processing unit 302 performs the repetition process from step S1103. If there is no line to be processed, the process ends.

  As a result, although the organization is self-named in the body of the e-mail, if the domain of the sender address is different from the domain used by the self-named organization, the difference between the sender address and the self-named organization is acquired in the result buffer.

  If the result buffer is empty, it can be determined that there is no spoofing, indicating that there is a legitimate domain to which all sender domains correspond. If the result buffer is not empty, it indicates that there is no legitimate domain corresponding to the sender's domain, and there is a high possibility that the organization is misrepresented.

(Specific example of organization fraud determination processing)
Next, the case where the process shown in FIG. 11 is implemented with respect to the electronic mail 901 shown in FIG. 9 is demonstrated as a specific example of the organization fraud determination process.

  In step S1101, the inspection processing unit 302 secures and initializes a result buffer in the temporary area.

  In step S1102, the inspection processing unit 302 obtains the domain portion “chobo-bank.attacker.com” from the address “omura@chobo-bank.attacker.com” of the sender (From) 903 in the header 902 of the e-mail 901. Get as.

  As shown in the specific example described above, “Chogo Silver” is acquired as the organization name in Step S402 and “Chogo Bank” is acquired in Step S403. In Step S404, the real name part of the sender 903 is acquired from the real name part. It is assumed that “Chao Bank” has been extracted and “Chao Silver” and “Chao Bank” have been acquired as organization names.

  In step S1103, the inspection processing unit 302 starts the iterative process up to step S1109 with respect to the organization name “long silver prevention”.

  In step S1104, the inspection processing unit 302 acquires “chobo-bank.co.jp” using the organization domain table 602 of FIG.

  In step S1105, the examination processing unit 302 starts the iterative process up to step S1107 for the organization domain “chobo-bank.co.jp” acquired in step S1104.

  In step S1106, the examination processing unit 302 compares the target organization domain “chobo-bank.co.jp” with the sender domain “chobo-bank.attacker.com”, and moves to step S1107 because they do not match.

  In step S1107, since there is no organization domain to be processed, the examination processing unit 302 moves the process to step S1108.

  In step S1108, the inspection processing unit 302 adds a combination of the sender domain “chobo-bank.attacker.com” and the organization name “Chogo Silver” to the result buffer.

  In step S1109, the inspection processing unit 302 performs the repetitive processing from step S1103 because there is still an organization name “Changho Bank” to be processed.

  In step S1103, the inspection processing unit 302 starts the iterative process up to step S1109 for the organization name “Changho Bank”.

  In step S1104, the inspection processing unit 302 uses the organization domain table 602 in FIG. 8 to obtain “chobo-bank.co.jp” with the domain for the target organization name “Changho Bank” as the organization domain.

  In step S1105, the examination processing unit 302 starts the iterative process up to step S1107 for the organization domain “chobo-bank.co.jp” acquired in step S1104.

  In step S1106, the examination processing unit 302 compares the target organization domain “chobo-bank.co.jp” with the sender domain “chobo-bank.attacker.com”, and moves to step S1107 because they do not match.

  In step S1107, since there is no organization domain to be processed, the examination processing unit 302 moves the process to step S1108.

  In step S1108, the inspection processing unit 302 adds a combination of the sender domain “chobo-bank.attacker.com” and the organization name “Changho Bank” to the result buffer.

  In step S1109, the examination processing unit 302 ends the process because there is no more organization name to be processed.

  As a result, in the temporary area result buffer, the sender domain “chobo-bank.attacker.com”, the organization name “Chogo Silver” and the sender domain “chobo-bank.attacker.com”, the organization name “Chobo Bank To get two combinations of

(Mail browsing process)
Next, using the result buffer information acquired by the inspection processing unit 302 through the mail inspection processing, the browsing processing unit 304 displays the content of the e-mail to the user and determines that the organization is misrepresented. FIG. 12 shows an example of a mail browsing screen for encouraging the determination of the presence or absence of misrepresentation by emphasizing the location that is the basis for the above.

  In the mail browsing screen shown in FIG. 12, the organization name included in the result buffer acquired by the examination processing unit 302 and the organization domain for the organization name are highlighted. Also, the sender domain included in the result buffer is highlighted with different expressions. As a result, since the domain that does not correspond to the organization name is displayed in another expression, the user can easily understand that the organization is spoofed.

  In the embodiment of the present invention, if there is no greeting part or signature part in the e-mail, the organization name cannot be extracted and no warning is given. You may comprise.

  In the embodiment of the present invention, the address of the sender (From) described in the header of the e-mail has been described as an object. However, an actual sender address (envelope From) may be configured. .

  The embodiment as the information processing apparatus has been described above, but the present invention can take an embodiment as a system, apparatus, method, program, recording medium, or the like. Specifically, the present invention may be applied to a system composed of a plurality of devices, or may be applied to an apparatus composed of a single device.

  The program according to the present invention is a program that allows a computer to execute the processing methods of the flowcharts shown in FIGS. 4, 5, 10, and 11, and the storage medium according to the present invention is illustrated in FIGS. A program capable of being executed by the computer in the processing method of FIG. 11 is stored. Note that the program in the present invention may be a program for each processing method of each apparatus in FIGS. 4, 5, 10, and 11.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by reading and executing.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium recording the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  The present invention may be applied to a system constituted by a plurality of devices or an apparatus constituted by a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 Organizational spoofing email inspection device (information processing device)
120 mail server

Claims (7)

A computer that stores an organization name and information related to an email transmission source in association with each other .
A line type specifying means for specifying a line type for each line of the received email body;
Extracting means for extracting an organization name from a line whose line type specified by the line type specifying means is a predetermined line type ;
Identifying means for identifying information relating to a transmission source stored in association with the organization name extracted by the extracting means ;
A program for causing a function to function as a notification unit that notifies a warning when the information related to the transmission source specified by the specifying unit and the information related to the transmission source of the electronic mail do not match .   The program according to claim 1, wherein the extracting unit functions as a unit that extracts an organization name from a row whose row type is specified as a name by the row type specifying unit.   The program according to claim 1 or 2, wherein the extraction unit functions as a unit that extracts an organization name from a row whose row type is specified as a signature part by the row type specifying unit. The program according to any one of claims 1 to 3, which causes the extraction unit to function as a unit that extracts an organization name from header information of the electronic mail.   Claims for causing the notification means to function as means for notifying a warning by displaying the transmission source specified from the organization name extracted by the extraction means and the transmission source of the e-mail in different forms. The program according to any one of 1 to 4. Storage means for storing an organization name and information related to an email transmission source in association with each other;
A line type specifying means for specifying a line type for each line of the received email body;
Extracting means for extracting an organization name from a line whose line type specified by the line type specifying means is a predetermined line type ;
Identifying means for identifying information relating to a transmission source stored in association with the organization name extracted by the extracting means ;
A notification means for notifying a warning when the information related to the transmission source specified by the specifying means and the information related to the transmission source of the e-mail do not match ;
An information processing apparatus comprising: An information processing method in an information processing apparatus that stores an organization name and information related to an email transmission source in association with each other,
The row type specifying unit of the information processing apparatus specifies a row type for each row of the received e-mail body, and a row type specifying step;
An extraction step in which the extraction means of the information processing apparatus extracts an organization name from a row whose row type specified by the row type specifying step is a predetermined row type ;
A specifying step of specifying information relating to a transmission source stored in association with the organization name extracted by the extraction step, by the specifying unit of the information processing device ;
A notification step of notifying the information processing device when the information related to the transmission source specified in the specifying step and the information related to the transmission source of the e-mail do not match ;
An information processing method comprising:

Images