JP6531793B2 - INFORMATION PROCESSING APPARATUS, INFORMATION PROCESSING METHOD, AND PROGRAM - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  In recent years, targeted attacks aimed at stealing money and important information from specific organizations and persons have been increasing. In the targeted attack, in order to achieve the purpose, the attack is performed by combining various methods based on the information specific to the target organization or person.

  In a targeted attack, it is typical to use an email called a targeted attack email as an initial intrusion means. In targeted attack email, content that draws the interest of the targeted recipient, and content that misleads them to be related to the recipient are described in the text, and it is included in the file attached to the email or the linked destination. Aim to run a malicious program. If the target executes an illegal program, a bag door will be installed and it will be an entrance for further attacks.

  While defense against targeted attacks is basically based on the concept of defense in depth, it is most effective and desirable if targeted attack emails can be prevented at the early stage.

  Some targeted attack emails not only use the target's interest / interest or misidentification, but also disguise a person or organization closely related to the target. The targeted recipients are alerted because they think they are emails from acquaintances, and the chances of successful attacks are high.

  Patent Document 1 discloses a technology for detecting an e-mail spoofing a sender address of an e-mail that the target has received in the past.

JP, 2013-236308, A

  Patent Document 1 stores the feature of the email header extracted from the email received in the past, and when the new email is received, the feature of the header of the previous email having the same sender address and the feature of the header of the new email are similar. It is described that the degree is determined and a warning is issued when the degree of similarity is less than or equal to a prescribed value. That is, a warning is issued when the mail source is the same source but the mail text is different.

  However, although Patent Document 1 is effective for the case where the sender address is disguised, there is a problem that an attack mail by spoofing of the text can not be obtained from a completely different address.

  Generally, when receiving mail, check the subject and sender from the list of unread mails, then look at the text. In a list, a display name is often used as a sender, and when there is no sense of incongruity in the contents of the text, the sender's address may be neglected. In addition, in some cases, misleading addresses are used, for example, including words related to the target of camouflage as part of misleading.

  In the case described above, it is natural that the sender is often an unknown (new) address, and it is possible to issue a warning to that effect, but it is more preferable to warn explicitly that it is an attack .

  Therefore, the present invention prevents damage by targeted attack mail by warning about mail (spoofed mail) sent from a different address but having the same text as mail received in the past and prompting the sender to confirm it. With the goal.

  According to the information processing apparatus of the present invention, based on the knowledge learned using e-mail received in the past, determination means for determining whether the newly received e-mail is an spoofed mail and the determination result by the determination means , And notification means for notifying a warning.

  The information processing method according to the present invention is an information processing method in an information processing apparatus, and determines whether newly received e-mail is a false mail based on knowledge learned using e-mail received in the past. It is characterized by including a process and a notification process of notifying a warning based on the determination result of the determination process.

  A program according to the present invention is a determination unit that determines whether a newly received e-mail is an spoofed mail based on knowledge obtained by learning an information processing apparatus using an e-mail received in the past; A program for functioning as notification means for notifying a warning based on the result.

  According to the present invention, it is possible to reduce the damage caused by targeted attack mail.

FIG. 1 is a diagram showing an example of a system configuration of a fraudulent e-mail inspection device according to an embodiment of the present invention. It is a block diagram showing an example of hardware constitutions of a false mail inspection device and a mail server in an embodiment of the present invention. It is a figure which shows an example of a function structure of a false mail inspection apparatus in embodiment of this invention. It is a flowchart which shows an example of the process which test | inspects a mail in embodiment of this invention. It is a figure which shows an example of a structure of a mail storage area in embodiment of this invention. It is a figure which shows an example of a mail table in embodiment of this invention. It is a figure which shows an example of the screen which displays the list of mail in embodiment of this invention. It is a flow chart which shows an example of processing which acquires a user's judgment about mail in an embodiment of the present invention. It is a figure which shows an example of the screen which browses an email in embodiment of this invention. It is a flowchart which shows an example of the construction | assembly process of the knowledge made to judge in embodiment of this invention. It is a figure which shows an example of a structure of the determination knowledge preservation | save area | region in embodiment of this invention. It is a figure which shows an example of a word statistics table in embodiment of this invention. It is a figure which shows an example of the word statistics table according to sender in embodiment of this invention. It is a figure which shows an example of the fixed part word extraction result in embodiment of this invention. It is a figure which shows an example of a document vector in embodiment of this invention. FIG. 1 is a schematic diagram of a classifier according to an embodiment of the present invention. It is a flow chart which shows an example of fixed part extraction processing in an embodiment of the present invention. It is a figure which shows an example of a fixed part extraction result in embodiment of this invention. It is a figure which shows an example of the line weight list produced | generated by fixed form extraction processing in embodiment of this invention. It is a flow chart which shows an example of false detection processing in an embodiment of the present invention. It is a figure which shows an example of false mail in embodiment of this invention. It is a figure which shows an example of a sender candidate in embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an example of a system configuration of a false mail inspection apparatus according to an embodiment of the present invention.

  The false mail inspection device 100 and the mail server 120 are connected via the local area network 130. The mail server 120 is configured to be connectable to the external network 140.

  The fraudulent e-mail examination apparatus 100 has a general e-mail client function, and has an e-mail browsing function and a reception function from the mail server. Furthermore, when an e-mail is newly received, it is judged whether there is a false positive with respect to the newly received e-mail based on the knowledge obtained from the e-mail already received in the past (the text of the e-mail is an electronic message received in the past While including the same text as email (while similar text), it is judged whether the email is sent from a sender different from the sender of the email received in the past) If it is determined that there is a possibility that the e-mail is spoofing, the spoofing portion of the e-mail is highlighted to prompt visual confirmation.

  In addition, when it is determined that the newly received e-mail is not an spoofing, the spoofed mail inspection device 100 updates the knowledge for determining the spoofing.

  The mail server 120 is a general mail reception server (POP3 or IMAP server), and transfers mail received from an external or local transmission destination in response to a request from an electronic mail client.

  FIG. 2 is a block diagram showing an example of the hardware configuration of the fraudulent e-mail inspection device 100 according to the embodiment of the present invention.

  As shown in FIG. 2, the information processing apparatus includes a central processing unit (CPU) 201, a read only memory (ROM) 202, a random access memory (RAM) 203, an input controller 205, a video controller 206, and a system bus 204. The memory controller 207 and the communication I / F controller 208 are connected.

  The CPU 201 centrally controls the devices and controllers connected to the system bus 204.

  The ROM 202 or the external memory 211 is a control program executed by the CPU 201, such as a BIOS (Basic Input / Output System) or an OS (Operating System), a computer readable and executable program for realizing the information processing method, and various necessary items. It holds data (including data tables).

  The RAM 203 functions as a main memory, a work area, and the like of the CPU 201. The CPU 201 loads programs necessary for execution of processing from the ROM 202 or the external memory 211 to the RAM 203 and executes the loaded programs to realize various operations.

  The input controller 205 controls input from an input device such as a keyboard 209 and a pointing device such as a mouse (not shown). When the input device is a touch panel, various instructions can be given by the user pressing (touching with a finger or the like) according to an icon, a cursor or a button displayed on the touch panel.

  Further, the touch panel may be a touch panel capable of detecting a position touched by a plurality of fingers, such as a multi-touch screen.

  Video controller 206 controls display on an external output device such as display 210. The display shall also include the display of a notebook computer integrated with the main unit. The external output device is not limited to the display, and may be, for example, a projector. The present invention also provides an input device for a device capable of receiving the above-described touch operation.

  The video controller 206 can control a video memory (VRAM) for display control, and can use part of the RAM 203 as a video memory area, or can separately provide a dedicated video memory. It is possible.

  The memory controller 207 controls access to the external memory 211. The external memory is connected via an adapter to an external storage device (hard disk) that stores a boot program, various applications, font data, user files, editing files, various data, etc., a flexible disk (FD), or a PCMCIA card slot. Compact flash (registered trademark) memory etc. can be used.

  The communication I / F controller 209 connects / communicates with an external device via a network, and executes communication control processing in the network. For example, communications using TCP / IP, telephone lines such as ISDN, and 3G lines of mobile phones are possible.

  The CPU 201 enables display on the display 210 by executing, for example, outline font rasterization processing on a display information area in the RAM 203. In addition, the CPU 201 enables user instruction with a mouse cursor (not shown) or the like on the display 210.

  Next, with reference to FIG. 3, an example of functional configurations of various devices in the embodiment of the present invention will be described.

  The reception processing unit 301 has a function of receiving an electronic mail from the mail server 120.

  The inspection processing unit 302 is an e-mail received by the reception processing unit 301, which is an e-mail spoofed mail (a mail whose text is similar (including similar text) to an e-mail received in the past). It has a function to determine whether or not it is a mail different from the sender of

  The e-mail storage area 303 is an area for storing an e-mail, and has a function of storing e-mail in association with fraudulent information and determination information.

  The determination knowledge storage area 304 has a function of storing various information used to determine whether the e-mail is a false mail or learned knowledge.

  The browsing processing unit 305 has a function of displaying a mail browsing screen or the like and displaying a warning or the like to the effect that the mail is a false mail.

  The determination knowledge construction processing unit 306 has a function of executing a process of constructing knowledge for determining whether the email is an spoofed mail.

(E-mail inspection process)
Next, an inspection process of an electronic mail performed by the inspection processing unit 302 in the embodiment of the present invention will be described using the flowchart of FIG. 4.

  The flowchart in FIG. 4 is a process in which the CPU 201 of the false mail examination apparatus 100 reads and executes a predetermined control program. When the reception processing unit 301 receives an e-mail, there is a possibility that the e-mail is spoofed It is a flowchart which shows the process which inspects.

  In step S401, the inspection processing unit 302 receives the electronic mail received by the mail reception processing unit 301.

  In step S402, the inspection processing unit 302 determines the presence or absence of fraud (possibility of fraud) for the electronic mail received in step S401, and acquires fraud information. The details of the false detection process will be described later with reference to FIG.

  In step S403, if the inspection processing unit 302 determines in step S402 that there is a possibility of misrepresentation, the processing proceeds to step S404. If it is determined that there is no possibility of fraud, the process proceeds to step S405.

  In step S404, the inspection processing unit 302 associates the false information acquired in step S402 with the e-mail to be processed.

  In step S405, the inspection processing unit 302 stores the electronic mail in the mail table 501 of the mail storage area 303.

  FIG. 5 shows the configuration of the mail storage area 303, which has a mail table 501. Specific data contents will be described with reference to FIG.

  The e-mail table 501 shown in FIG. 6 is a table for storing the e-mail received by the inspection processing unit 302, and each item of the e-mail (specifically, the text of the e-mail, the receiver (transmission destination), the sender) , Sent date, etc.)

(Email judgment processing)
Next, mail determination processing by the user will be described using the flowchart of FIG.

  When the user is activated (or logged in), the false mail examination apparatus displays a mail list screen 701 as shown in FIG. 7 as in the case of a general mail client. The contents of the mail list screen 701 are based on the contents of the mail table 501. A warning icon 702 is displayed for a mail that has misrepresentation information and no determination information.

  When the user issues an instruction to browse an arbitrary email displayed in the list, the browse processing unit 305 executes the processing of the flowchart shown in FIG.

  In step S801, the browsing processing unit 305 displays an e-mail browsing screen 901 as shown in FIG. 9 based on the information acquired from the e-mail table 501 for the e-mail specified by the user. If there is fraudulent information in the e-mail, details of the fraudulent information are displayed in the warning display area 902.

  When the user presses the close button 905, the mail viewing screen 901 is closed, and the process proceeds to step S802.

  In step S802, the browsing processing unit 305 acquires the state of the determination instruction area 904 of the mail viewing screen 901 as determination information. If "It is an spoofed mail." Is active (if the user chooses to be an spoofed mail), "Spoofing" is acquired as the judgment information, and if "Not a spoofed mail" is active (spoofed by the user When it is selected that the mail is not mail), "non-spoofing" is acquired as the judgment information.

  The mail whose judgment information is “spoofed” may not be displayed on the list, or may be automatically deleted.

  In step S 803, the browsing processing unit 305 associates the determination information acquired in step S 802 with the corresponding e-mail in the e-mail table 501 and stores it.

(Determination knowledge construction processing)
Next, the determination knowledge construction process will be described using the flowchart of FIG. In the embodiment of the present invention, the determination knowledge construction process is executed asynchronously with the mail determination process. The determination knowledge construction processing may be configured to be periodically executed, or may be configured to determine execution based on the state of the mail saved from the previous processing.

  Further, in the embodiment of the present invention, although all the determination knowledge is configured to be reconstructed so as to facilitate the description, the determination knowledge may be partially updated.

  In step S1001, the determination knowledge construction processing unit 306 acquires, from the mail table 501, an electronic mail in which the determination information is set to “non-spoofing”. The e-mail to be acquired may be configured to limit past e-mails that are targets of knowledge construction, such as “e-mail sent in the last half year”.

  In step S1002, the determination knowledge construction processing unit 306 starts repeated processing up to step S1005 for the electronic mail acquired in step S1001.

  In step S1003, the determination knowledge construction processing unit 306 acquires, for the text of the email to be processed, words constituting the email using morphological analysis or the like. When acquiring words, additional words such as particles and auxiliary verbs may be excluded, or normalization such as using a synonym dictionary may be performed.

  In step S1004, the determination knowledge construction processing unit 306 updates the word statistics table 1101 for the words divided in step S1003. At the same time, the per-sender word statistics table 1102 is updated in association with the sender.

  In step S1005, if the e-mail to be processed is still present, the determination knowledge construction processing unit 306 executes the iterative process from step S1002. If there is no e-mail to be processed, the process moves to step S1006.

  In step S1006, the determination knowledge construction processing unit 306 calculates the word appearance probability from the word counting result acquired in step S1004 and updates the word statistics table 1101 and the sender-by-sender word statistics table 1102.

  In step S1007, the determination knowledge construction processing unit 306 starts repeated processing up to step S1010 on the electronic mail acquired in step S1001.

  In step S1008, the determination knowledge construction processing unit 306 extracts a fixed form part from the e-mail that is the processing countermeasure. The extraction process of the fixed form part will be described later with reference to FIG.

  In step S1009, the determination knowledge construction processing unit 306 stores the words constituting the fixed form part of the electronic mail extracted in step S1008 in the temporary area in association with the target electronic mail. The word extraction may be configured to reuse the result of step S1003.

  In step S1010, if the e-mail to be processed is still present, the determination knowledge construction processing unit 306 executes the repetitive processing from step S1007. If there is no e-mail to be processed, the process moves to step S1011.

  In step S1011, the determination knowledge construction processing unit 306 vectorizes the combination of the e-mail and the word of the fixed form portion stored in the temporary area, and information necessary for vectorization is the vectorization information table 1103 in the determination knowledge storage area 304. Save to Vectorization is by a general method such as tf and idf. Emails that do not have a set of words or have fewer words than a prescribed number may be excluded.

  In step S1012, the determination knowledge construction processing unit 306 performs learning by associating the sender of the associated email (From :) with the vector acquired in step S1011, and learning is performed in the determination knowledge storage area 304. It is stored in the learning knowledge table 1104.

  Use a general classifier that can perform multi-class classification for learning

(Specific example of judgment knowledge construction process)
Next, as a specific example of the determination knowledge construction process, a case where the process shown in FIG. 10 is performed on the mail table 501 shown in FIG. 6 will be described.

  In step S1001, the determination knowledge construction processing unit 306 acquires a series of electronic mail starting from the electronic mail 601.

  In step S1002, the determination knowledge construction processing unit 306 starts repeated processing up to step S1005 for the email 601.

  In step S1003, the determination knowledge construction processing unit 306 acquires “New Select”, “Kondo”, “Like”, “Take Care”, “Tosa Logistics”, “Sakamoto”, “Invoice”, “Case”, etc. as words from the text of the email 601. (In this specific example, adjuncts such as particles and auxiliary verbs are excluded).

  In step S1004, the determination knowledge construction processing unit 306 updates the word statistics table 1101 for the words divided in step S1003. Specifically, if there is no word, the word is added to the word statistics table 1101, and the appearance frequency (the number of appearing documents) is set to 1. If there is a word, the appearance frequency (the number of appearing documents) is incremented by one. Similarly, the per-sender word statistics table 1102 is also updated in association with the sender “sakamoto@tosa.co.jp”.

  In step S1005, the determination knowledge construction processing unit 306 executes the repetitive processing from step S1002 because there is the electronic mail 602 to be processed.

  Thereafter, the same processing is repeated for all e-mails.

  In step S1006, the determination knowledge construction processing unit 306 calculates the word appearance probability with respect to the word statistics table 1101 updated in steps S1001 to S1005, and updates the word statistics table 1101. As a result, the words shown in FIG. Get statistics table. The occurrence probability of the word is similarly obtained and updated in the word-by-sender word statistics table 1102 as well.

  In step S1007, the determination knowledge construction processing unit 306 starts repeated processing up to step S1010 for a series of electronic mail starting from the electronic mail 601.

  In step S1008, as a result of the routine extraction processing on the email 601, the determination knowledge construction processing unit 306 determines that “New Select Kondo has been indebated as a routinely described part such as a greeting or a signature at the beginning of the email. Tosa Logistics Sakamoto. ”And“-Tosa Logistics Co., Ltd. Tel: 123-4567 Fax: 123-4568 Sakamoto Ikuo ”are extracted. A specific example of fixed part extraction will be described later.

  In step S1009, the determination knowledge construction processing unit 306 sets “new select”, “Kondo”, “like”, “care”, “Tosa logistics”, “words” as the words constituting the fixed form part of the e-mail extracted in step S1008. "Sakamoto", "More than", "Regards", "Please", "Shares", "Company", "tel", "123-4567", "fax", "123-4568", "Mio", E-mail Associate with 601 and save in temporary area.

  In step S1010, the determination knowledge construction processing unit 306 executes the iterative process from step S1007 because there is the electronic mail 602.

  Thereafter, the same process is repeated to obtain the result of FIG. 14 in the temporary area.

  In step S1011, the determination knowledge construction processing unit 306 vectorizes the combination of the electronic mail and the fixed word stored in the temporary area to obtain a vector shown in FIG. Information required for vectorization is stored in the vectorization information table 1103 in the determination knowledge storage area 304.

  In step S1012, the determination knowledge construction processing unit 306 performs learning by associating the sender of the associated electronic mail with the vector acquired in step S1011, and performs the learned knowledge in the learning knowledge table in the determination knowledge storage area 304. Save to 1104.

  As a result, by using the vectorization information acquired in step S1011 and the learning knowledge acquired in step S1012, the erroneous transmission preventing apparatus 100 can estimate the transmission destination candidate for the greeting part of the electronic mail with certainty. Become. Figure 16 shows an overview of destination candidate guessing by the classifier.

(Fixed part extraction process)
Next, with reference to the flowchart of FIG. 17, the fixed form part extraction processing will be described in which the determination knowledge construction processing unit 306 extracts the fixed form part from the electronic mail in step S1008.

  In the description of the embodiment of the present invention, the fixed part is specified using the appearance frequency and the appearance probability of the appearing word, but may be configured to be extracted by another method.

  In step S1701, the determination knowledge construction processing unit 306 acquires the text from the processing target electronic mail.

  In step S1702, the determination knowledge construction processing unit 306 starts repeated processing up to step S1706 for each line of the text acquired in step S1701.

  In step S1703, the determination knowledge construction processing unit 306 divides the processing target line into words.

  In step S1704, the determination knowledge construction processing unit 306 acquires the appearance probability from the word statistics table 1101 for each of the words acquired in step S1703 as the all document appearance probability. Further, the appearance probability is acquired from the sender-by-sender word statistics table 1102 as the transmission probability by transmitter. From the per-sender word statistics table 1102, a plurality of appearance probabilities can be obtained for one word. The largest of all document appearance probability and the appearance probability by sender is regarded as the appearance probability of the word.

  In step S1705, the determination knowledge construction processing unit 306 calculates the harmonic mean of the appearance probabilities acquired in step S1704 as the row weight. If no valid words appear in the line, the line weight is set to 0.

  In step S1706, if there is still a row to be processed, the determination knowledge construction processing unit 306 executes the iterative process from step S1702. If there is no row to be processed, the process moves to step S1707.

  In step S1707, the determination knowledge construction processing unit 306 extracts a row whose line weight is equal to or more than a specified value as a fixed portion. If all lines do not meet the specified value, it is determined that there is no fixed part.

  By configuring as described above, it is possible to extract the fixed form part described in the e-mail

(Specific example of fixed part extraction process)
Next, as a specific example of the fixed form part extraction process, a case where the process shown in FIG. 17 is performed on the electronic mail 1801 shown in FIG. 18 will be described.

  In step S1701, the determination knowledge construction processing unit 306 acquires the text 1802 from the email 1801 to be processed.

  In step S1702, the determination knowledge construction processing unit 306 starts repeated processing up to step S1706 for the text 1802 acquired in step S1701.

  In step S1703, the determination knowledge construction processing unit 306 divides the first line "New Select Kondo-like" in the text 1802 into words, and obtains "New Select", "Kondo", and "like".

  In step S1704, the determination knowledge construction processing unit 306 executes, from the word statistics table 1101, “1.000”, “0.630”, and “0.630” for the words “new select”, “Kondo”, and “like” acquired in step S1703. "Is obtained as an appearance probability. Similarly, "1.000", "1.000" and "1.000" are obtained from the per-sender word statistics table 1102. Finally, "1.000", "1.000", and "1.000" are obtained as the appearance probabilities for the words "New Select", "Kondo", and "Like".

  In step S1705, the determination knowledge construction processing unit 306 obtains the harmonic mean "1.00" of "1.000" "1.000" "1.000" as the row weight.

ステップＳ１７０６では、判定知識構築処理部３０６は、本文１８０２にまだ行があるので、ステップＳ１７０２からの繰り返し処理を実施する。以下、同様の処理を繰り返した結果として、図１９に示すような各行に対する重みを取得する。

In step S1706, the determination knowledge construction processing unit 306 executes the repetitive processing from step S1702 because there is still a line in the text 1802. Hereinafter, as a result of repeating the same process, weights for each row as shown in FIG. 19 are acquired.

  In step S1707, the determination knowledge construction processing unit 306 extracts the fixed form unit 1803 as a line whose line weight is equal to or greater than a specified value (0.3 in this embodiment).

(Spoofing judgment processing)
Next, the details of the false recognition process in step S402 in the mail inspection process executed by the inspection processing unit 302 will be described using the flowchart in FIG.

  In step S2001, the inspection processing unit 302 extracts the fixed form part from the target electronic mail. The fixed form part extraction process is the same as the fixed form part extraction process in the determination knowledge construction processing unit 306 shown in FIG.

  In step S2002, if there is no fixed form part in step S2001, the inspection processing unit 302 shifts the process to step S2003. If there is a fixed form part, the process moves to step S2004.

  In step S2003, the inspection processing unit 302 determines that the target electronic mail is "no fixed portion".

  In step S2004, the inspection processing unit 302 divides the fixed form part extracted in step S2001 into words.

  In step S2005, the inspection processing unit 302 vectorizes the set of words extracted in step S2006 with reference to the vectorization information table 1103.

  In step S2006, the inspection processing unit 302 acquires, for the vector acquired in step S2005, a sender having a certainty or more of the specified value as a candidate using a classifier that refers to the learning knowledge table 1104.

  In step S2007, if there is no sender candidate estimated in step S2006, the test processing unit 302 shifts the process to step S2008. If there is a sender candidate, the process proceeds to step S2011.

  In step S2008, the inspection processing unit 302 refers to the mail table 501 to determine whether the transmission result from the sender of the target electronic mail is in the past. If there is no transmission record, the process proceeds to step S2009. If there is a transmission record, the process proceeds to step S2010.

  In step S2009, the inspection processing unit 302 determines that the target electronic mail is a "new sender".

  In step S2010, the inspection processing unit 302 determines that the target electronic mail is “sender confirmation required”.

  In step S2011, the inspection processing unit 302 determines whether the sender of the target electronic mail is included in the sender candidates. If the sender candidate is not included in the sender candidate, the process proceeds to step S2012. If the sender is included, the process proceeds to step S2013.

  In step S2012, the inspection processing unit 302 determines that the target electronic mail is “spoofing”. In addition, the sender candidate with the highest probability is configured to be presented as a correct sender at the time of warning.

  In step S2013, the inspection processing unit 302 determines whether the probability of the transmission destination candidate that matches the transmission destination is the highest. If the certainty is not the highest value, the process moves to step S2010. If the accuracy is the highest value, the process ends

(A specific example of the false recognition process)
Next, a case where the process shown in FIG. 20 is performed on the e-mail 2101 shown in FIG. 21 will be described as a specific example of the false detection process.

  In step S2001, the inspection processing unit 302 extracts the fixed form part 2102 from the target electronic mail 2101.

  In step S2002, since the inspection processing unit 302 has acquired the fixed form unit 2102 in step S2001, the processing proceeds to step S2004.

  In step S2004, the inspection processing unit 302 divides the fixed form unit 2102 extracted in step S2001 into words, and selects "New Select", "Kondo-sama", "Aoi Sangyo", "Takasugi", "Thank you", "Request" , "Estimate", "Sending", "Attachment", "File", "Confirmation", "Share", "East Japan Sales Department", "Shintaro", "tel", "987-6543", "email", Get "takasugi@hagi.com".

  In step S2005, the inspection processing unit 302 vectorizes the set of words extracted in step S2006 with reference to the vectorization information table 1103.

  In step S2006, the inspection processing unit 302 transmits the candidate 2201 (takasugi@hagi.com) and transmission shown in FIG. 22 to the vector acquired in step S2005 using the classifier that refers to the learning knowledge table 1104. Candidate 2202 (kogoro@hagi.com) is acquired.

  In step S2007, since there are sender candidates estimated in step S2006, the test processing unit 302 shifts the process to step S2011.

  In step S2011, the inspection processing unit 302 transfers the process to step S2012 because the sender candidate 2103 (a2b3c4@attacker.com) is not included in the sender candidates.

  In step S2012, the inspection processing unit 302 determines that the target electronic mail is “spoofing”. In addition, the highest possible sender candidate 2201 (takasugi@hagi.com) is acquired as the correct sender, and the process ends.

  As a result, it is determined that the sender 2103 (a2b3c4@attacker.com) for the fixed form part 2102 is not consistent and there is a possibility of falsehood, and the sender candidate 2201 (takasugi@hagi.com) is presented as a candidate of the correct sender. It is possible to The user can easily judge that the sender 2103 (a2b3c4@attacker.com) has misrepresented the candidate for the candidate 2201 (takasugi@hagi.com) and sent a mail.

  By configuring as described above, it is possible to determine the case where the sender who has sent an e-mail with similar fixed part of e-mail in the past and the sender of the target e-mail are different, and there is a possibility of spoofing It is possible to detect a high state. Further, it is possible to present a sender that is presumed to be correct when it is determined to be a false statement, and easy confirmation is possible.

  In the embodiment of the present invention, although the case where it implements as a mail client was explained, it may constitute as a system which provides what is called Web mail, and a function of mail filtering.

  The present invention can be embodied as, for example, a system, an apparatus, a method, a program, or a recording medium. Specifically, the present invention may be applied to a system constituted by a plurality of devices, or may be applied to an apparatus comprising a single device.

  Further, the program in the present invention is a program that enables a computer to execute the processing method of the flowcharts shown in FIGS. 4, 8, 10, 17 and 20, and the storage medium of the present invention is FIG. A program that can execute a computer on the processing methods shown in FIGS. 10, 17 and 20 is stored. Note that the program in the present invention may be a program for each processing method of each device in FIG. 4, FIG. 8, FIG. 10, FIG. 17, and FIG.

  As described above, the recording medium recording the program for realizing the functions of the above-described embodiments is supplied to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by reading and executing.

  In this case, the program itself read out from the recording medium realizes the novel function of the present invention, and the recording medium recording the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, non-volatile memory card, ROM, EEPROM, silicon A disk etc. can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiment are realized, but also an operating system (OS) or the like running on the computer is actually executed based on the instructions of the program. It goes without saying that the processing is partially or entirely performed, and the processing realizes the functions of the above-described embodiments.

  Furthermore, after the program read from the recording medium is written to the memory provided to the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is read based on the instruction of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiment are realized by the processing.

  Further, the present invention may be applied to a system constituted by a plurality of devices or to an apparatus comprising a single device. It goes without saying that the present invention can also be applied to the case where it is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can receive the effects of the present invention.

  Further, by downloading and reading out a program for achieving the present invention from a server on a network, a database or the like by a communication program, the system or apparatus can receive the effects of the present invention. In addition, the structure which combined each embodiment mentioned above and its modification is also contained in this invention altogether.

100 Spoofed Email Inspection System (Information Processing System)
120 Mail Server 130 LAN
140 External network

Claims (7)

Computer,
From the text of the e-mail received in the past, using the appearance frequency of the character string for each transmission source, a fixed form part specifying means for specifying the fixed form part of the e-mail;
Storage means for storing the feature of the fixed form part specified by the fixed part specification means and the transmission source of the electronic mail in association with each other;
Estimating means for estimating a sender of the newly received e-mail based on the information stored in the storage means ;
A program for functioning as notification means for notifying a warning based on a transmission source estimated by the estimation means and an actual transmission source of the newly received e-mail.   The said character string is a word, The program of Claim 1 characterized by the above-mentioned. The notification means is transferred as a means for notifying a warning when the sender of the newly received e-mail estimated by the estimation means and the actual sender of the newly received e-mail do not match The program according to claim 1 or 2. Said notification means,
A sender of electronic mail newly received estimated by the estimation means, if the actual source of the newly received e-mail does not coincide, as a means for notifying the source estimated by said estimating means The program according to any one of claims 1 to 3 for functioning. The method according to any one of claims 1 to 4, for causing the fixed form part specifying means to function as a means for specifying the fixed form part from the text of the e-mail determined by the user not to be an spoofed mail among e-mails received in the past. Or the program described in paragraph 1. From the text of the e-mail received in the past, using the appearance frequency of the character string for each transmission source, a fixed form part specifying means for specifying the fixed form part of the e-mail;
Storage means for storing the feature of the fixed form part specified by the fixed part specification means and the transmission source of the electronic mail in association with each other;
Estimating means for estimating a sender of the newly received e-mail based on the information stored in the storage means ;
Notification means for notifying a warning based on the transmission source estimated by the estimation means and the actual transmission source of the newly received e-mail;
An information processing apparatus comprising: A fixed form specification step of specifying a fixed form part of the electronic mail from the text of the e-mail received in the past using the appearance frequency of the character string for each transmission source;
A storage process in which storage means of the information processing apparatus stores the feature of the fixed form part specified in the fixed form part specification process in association with the transmission source of the electronic mail;
An estimation step of estimating the transmission source of the newly received electronic mail based on the information stored in the storage step, the estimation means of the information processing apparatus;
A notification step of notifying a warning based on the transmission source estimated in the estimation step and the actual transmission source of the newly received electronic mail, by the notification means of the information processing apparatus;
An information processing method comprising:

Images