JP6578035B1 - E-mail system and program - Google Patents

Abstract

An object of the present invention is to reduce the load required to remove spam mail and increase the probability that spam mail will not be delivered. An e-mail system stores a first list including a sender domain or address of mail that is permitted to be delivered, and a second list including a domain or address that a user is permitted to receive. Deliver emails whose domains or addresses are included in the first list and the second list to the user, hold and hold emails whose sender domain or address is not included in either the first list or the second list Analyzing the contents of the e-mail and extracting mail that should be allowed to be delivered, updating the first list based on the source domain or address of the extracted mail, and including the source domain or address in the first list In addition, the domain or address designated by the user is selected from the domains or addresses from which the mail is not included in the second list. To add to the list. [Selection] Figure 3

Description

  The present invention relates to an electronic mail system and a program.

A technique is known in which it is determined whether or not an e-mail is a junk mail, and when the e-mail is determined to be a junk mail, the e-mail is automatically deleted (for example, see Patent Document 1).
[Prior art documents]
[Patent Literature]
[Patent Document 1] Japanese Patent Application Laid-Open No. 2003-131999

  Conventionally, it has been desired to increase the probability that spam mail will not be delivered while reducing the load required to remove spam mail on a server.

  According to a first aspect of the present invention, an electronic mail system is provided. The email system includes a first list that includes domains or email addresses from which emails are allowed to be delivered, and a second list that contains email domains or email addresses that the user is allowed to receive. A storage unit is provided. The e-mail system may include a distribution unit that distributes at least e-mails whose transmission source domains or e-mail addresses are included in the first list and the second list among e-mails to be distributed. The electronic mail system may include a holding unit that holds an electronic mail whose distribution source domain or mail address is not included in either the first list or the second list among the electronic mails to be distributed. The e-mail system analyzes the contents of the e-mail held in the holding unit, extracts e-mails that should be allowed to be delivered from among the e-mails held in the holding unit, and extracts the extracted e-mails A first update unit that updates the first list based on the sender domain or e-mail address may be provided. The e-mail system includes, from among the e-mails to be distributed, the domain or e-mail address of the transmission source included in the first list and the domain or e-mail address of the e-mail transmission source not included in the second list. A second updating unit for adding the domain or mail address designated by the user to the second list may be provided.

  The distribution unit is included in the first list updated by the first update unit and the second list updated by the second update unit from among the e-mails held in the holding unit. The extracted e-mail may be extracted, and the extracted e-mail may be distributed to the user.

  Even if the delivery unit domain or email address is not included in the first list, the delivery source domain or email address is included in the second list. In addition, the electronic mail may be distributed to the user.

  The e-mail system may further include an authentication unit that performs domain authentication of an e-mail transmission source domain. The distribution target e-mail may be an e-mail authenticated by the authentication unit.

  The first update unit may include an input value generation unit that generates input values from character strings in a plurality of predetermined fields included in the e-mail. The first update unit may include a discriminator that determines whether the electronic mail is to be allowed to be distributed based on a plurality of input values generated by the input value generation unit. The discriminator may be constructed by deep learning that learns an email that is allowed to be distributed using a plurality of emails.

  The e-mail system includes a sender domain or e-mail address that is included in the first list and is not included in the second list among e-mails to be distributed. A presentation unit for presenting to the user whether or not to receive the e-mail may be further provided. When the user selects to receive the electronic mail presented by the presentation unit, the second update unit includes the transmission source domain or email address in the first list and does not include the second list. The domain or email address from which the email is sent may be added to the second list.

  The second updating unit may further acquire the user processing content for the electronic mail delivered to the user, and update the second list based on the acquired processing content.

  The second update unit is an email deleted by the user within a predetermined time after being delivered to the user, or a domain or email from which the email is deleted without being opened by the user after being delivered to the user The address may be deleted from the second list.

  The second update unit may further acquire a destination domain or mail address of an electronic mail transmitted by the user, and add the acquired domain or mail address to the second list.

  The second update unit further acquires the Web proxy data, specifies the domain of the network resource accessed by the user based on the acquired Web proxy data, and adds at least a part of the specified domain to the second list. It's okay.

  The second update unit may further add the email address or URL domain included in the customer data of the user added or updated by the user to the second list.

  The second updating unit may further add the email address or the domain of the email address included in the user's address book added or updated by the user to the second list.

  According to the second aspect of the present invention, a program is provided. The program causes the computer to function as the electronic mail system.

  It should be noted that the above summary of the invention does not enumerate all the necessary features of the present invention. In addition, a sub-combination of these feature groups can also be an invention.

1 schematically shows an example of a mail system 10 according to an embodiment. The functional block of the mail server 100 is shown schematically. The processing content in the mail system 10 is shown schematically. An example of screen 500 displayed on user device 110 by a mail application is shown roughly. An example of the proxy log collected from the Web proxy server 140 is shown in a table format. An example of a mail transmission log collected from the mail transmission server 130 is shown in a table format. The contents of the business card information stored by the application server 150 are schematically shown. A valid business card information list 800 managed for each company is shown in a table format. An example of the computer 1000 which functions as the mail server 100 is shown schematically.

  Hereinafter, the present invention will be described through embodiments of the invention, but the following embodiments do not limit the invention according to the claims. In addition, not all the combinations of features described in the embodiments are essential for the solving means of the invention.

  FIG. 1 schematically illustrates an example of a mail system 10 according to an embodiment. The mail system 10 includes a mail server 100, a user device 110, a user device 120, a mail transmission server 130, a Web proxy server 140, and an application server 150. For simplicity, the e-mail may be simply called mail. For example, an e-mail address may be simply referred to as a mail address. In addition, the e-mail source mail address may be referred to as a source address, and the domain of the e-mail source mail address may be referred to as a source domain.

  In the present embodiment, the user device 120 is a device that transmits mail, and the user device 110 is a device that receives mail. The user device 110 and the user device 120 are user terminals, for example. The user device 110 and the user device 120 may be information processing apparatuses such as a smartphone, a tablet terminal, and a personal computer, for example. The user device 110 and the user device 120 may be any devices as long as they can perform operations related to mail.

  A user 80 is a user of the user device 110. The user 80 has a mail account of a business operator who operates the mail server 100. The user 90 who is a user of the user device 120 may have a mail account of a business operator who operates the mail server 100 or may not have a mail account of a business operator who operates the mail server 100.

  The mail server 100, the user device 110, the user device 120, the mail transmission server 130, the web proxy server 140, and the application server 150 are connected via the network 50. The network 50 may be any network. The network 50 includes, for example, the Internet and a telephone network. Each of the mail server 100, the mail transmission server 130, the Web proxy server 140, and the application server 150 may be realized by one or a plurality of computers. Moreover, the mail server 100, the mail transmission server 130, the Web proxy server 140, and the application server 150 may each be realized by a single computer. A plurality of functions among the functions of the mail server 100, the mail transmission server 130, the Web proxy server 140, and the application server 150 may be realized by one or more same computers.

  The outline of the operation in the mail server 100 will be described by taking up the case where the mail 20 addressed to the user 80 is transmitted from the user device 120. The mail 20 is a mail having the mail address of the user 90 as a transmission source address and the mail address of the user 80 as a destination address. The mail 20 is received by the mail server 100 through the network 50. The mail server 100 authenticates the transmission source domain of the mail 20 by domain authentication. When the domain authentication of the mail 20 is completed, the mail server 100 determines whether the transmission source domain is included in the domain reputation list 310. Further, the mail server 100 determines whether or not the transmission source address of the mail 20 is included in the white list 320.

  Domain reputation list 310 is an example of a first list. The domain reputation list 310 is a list of domains estimated to be safe by the operator of the mail server 100. A domain that is estimated to be safe is a domain that is allowed to deliver mail whose source domain is the domain. The white list 320 is an example of a second list. The white list 320 is, for example, a list of transmission source addresses that the user 80 desires to be distributed. The white list 320 may be set in association with the user. In the description of the present embodiment, it is assumed that the white list 320 is associated with the user 80 unless otherwise specified.

  The mail server 100 distributes the mail 20 to the user 80 when the transmission source domain of the mail 20 is included in the domain reputation list 310 and the transmission source address of the mail 20 is included in the white list 320. The delivery of the mail 20 to the user 80 includes, for example, storing the mail 20 in the mailbox of the user 80 existing on the network 50, transferring the mail 20 to the user device 110, and the like. Storing the mail 20 in the mailbox includes storing the mail 20 in association with the user 80.

  Further, the mail server 100 does not deliver the mail 20 to the user 80 when the transmission source domain of the mail 20 is not included in the domain reputation list 310 and the transmission source address of the mail 20 is not included in the white list 320. Held in the mail server 100. The mail server 100 determines whether or not the stored mail 20 is a mail to be delivered by a discriminator. The discriminator is constructed by deep learning based on the contents of the mail 20 so as to determine based on the contents of the mail 20 that the mail is to be distributed. When the mail server 100 determines that the mail 20 is mail to be delivered to the user 80 by the discriminator, the mail server 100 adds the transmission source address of the mail 20 to the white list 320.

  In the mail server 100, when the sender domain of the mail 20 is included in the domain reputation list 310 and the sender address of the mail 20 is not included in the white list 320, the mail from the sender address of the mail 20 is received. Recommended for user 80. When the user 80 performs an operation to receive mail from the transmission source address of the mail 20, the mail server 100 adds the transmission source address of the mail 20 to the white list 320. For example, the mail server 100 places the mail 20 in the confirmation folder of the mailbox and notifies the user 80 that the transmission source domain of the mail 20 in the confirmation folder is safe. When the user opens the mail 20, the mail server 100 adds the transmission source address of the mail 20 to the white list 320.

  Further, the mail server 100 updates the white list 320 based on the processing information of the user 80 for the mail stored in the mailbox. For example, the mail server 100 deletes the transmission source domain or the transmission source address of the mail 20 from the white list 320 when the user 80 deletes the mail 20 distributed to the user 80 without opening it.

  Further, the mail server 100 collects information indicating the domain of the site accessed by the user 80 from the network from the Web proxy server 140. Further, the mail server 100 collects the destination information of the mail transmitted by the user 80 from the mail transmission server 130. Further, the application server 150 collects customer data of the user 80 from the application server 150. The mail server 100 updates the white list 320 based on the information collected from the mail transmission server 130, the Web proxy server 140, and the application server 150 and the address book data used by the user 80 for mail transmission. For example, the mail server 100 adds the destination of the mail transmitted by the user 80 to the white list 320.

  According to the mail server 100, mail to be distributed is selected by the domain reputation list 310 and the white list 320, and mail that is not spam mail is selected from the remaining mail by a discriminator. Therefore, the load can be reduced as compared with the case where the process of detecting spam mail is performed on all mails. In particular, the mail server 100 does not detect spam mail but detects mail that is not spam mail. Therefore, even if a measure is taken to change the content of the spam mail in order to avoid the spam mail sender being detected by the spam mail detection logic, the effect can be reduced.

  FIG. 2 schematically shows functional blocks of the mail server 100. The mail server 100 includes an authentication unit 200, a first update unit 210, a second update unit 220, a filter unit 230, a holding unit 240, a distribution unit 250, a mail box 270, and a mail processing unit 280. Prepare.

  The authentication unit 200 performs domain authentication of the mail transmission source domain. As domain authentication in the authenticating unit 200, an SPF (Sender Policy Framework) that checks the validity of the outgoing mail server using the IP address of the sender and an electronic signature is not tampered with by a legitimate sender. An example is DKIM (DomainKeys Identified Mail) that checks whether or not the message is mail. The mail authenticated by the authentication unit 200 is supplied to the filter unit 230 as a mail to be distributed.

  The storage unit 290 stores a domain reputation list 310 that includes domains or email addresses from which emails are allowed to be distributed, and a white list 320 that includes domains or email addresses of emails that the user is allowed to receive. To do.

  The filter unit 230 determines whether each of the domain reputation list 310 and the white list 320 includes the domain or mail address of the transmission source mail. The distribution unit 250 distributes at least a mail whose distribution source domain or mail address is included in the domain reputation list 310 and the white list 320 among the mails to be distributed.

  The holding unit 240 holds a mail whose transmission source domain or mail address is not included in either the domain reputation list 310 or the white list 320 among the mails to be distributed. The first updating unit 210 analyzes the content of the mail held in the holding unit 240, extracts the mail that should be allowed to be distributed among the mails held in the holding unit 240, and extracts the extracted mail The domain reputation list 310 is updated based on the domain or email address of the sender.

  The second updating unit 220 includes, among the mails to be distributed, the domain or mail address of the sender included in the domain reputation list 310 and the sender domain or mail address not included in the white list 320. The domain or mail address designated by the user is added to the white list 320.

  The distribution unit 250 uses the domain reputation list 310 in which the transmission source domain or email address has been updated by the first update unit 210 and the white that has been updated by the second update unit 220 from among the emails stored in the storage unit 240. The mail included in the list 320 is extracted, and the extracted mail is distributed to the user.

  Even if the domain or mail address of the mail to be distributed is not included in the domain reputation list 310, the distribution unit 250 does not include the domain or mail address of the mail in the white list 320. In addition, the mail may be distributed to the user.

  The first update unit 210 generates an input value from character strings in a plurality of predetermined fields included in the mail, and a plurality of input values generated by the input value generation unit 211. And a discriminator 212 for discriminating whether or not the mail should be permitted to be delivered. The discriminator 212 may be constructed by deep learning that learns mail that is allowed to be distributed using a plurality of mails.

  The mail processing unit 280 communicates with the user device 110 and performs processing related to mail addressed to the user 80. The mail processing unit 280 includes the domain or mail address of the mail that is included in the domain reputation list 310 and is not included in the white list 320 among the mails to be distributed. Whether or not to receive the e-mail is presented to the user. The mail processing unit 280 is an example of a presentation unit that presents the user with respect to the domain or mail address of mail that is included in the domain reputation list 310 but not included in the white list 320. When the user selects to receive the mail presented by the mail processing unit 280, the second update unit 220 includes the domain or mail address of the transmission source in the domain reputation list 310 and the white list 320. The domain or mail address of the mail that is not included is added to the white list 320.

  The second update unit 220 may further acquire the user processing content for the mail delivered to the user, and update the white list 320 based on the acquired processing content. For example, the second update unit 220 may be configured such that the email deleted by the user within a predetermined time after being delivered to the user, or the source domain of the email deleted without being opened by the user after being delivered to the user, or The email address may be deleted from the white list 320.

  The second update unit 220 may further acquire a domain or mail address of a destination of mail transmitted by the user, and add the acquired domain or mail address to the white list 320.

  The second update unit 220 further acquires Web proxy data, specifies a domain of the network resource accessed by the user based on the acquired Web proxy data, and adds at least a part of the specified domain to the white list 320 You can do it.

  The second update unit 220 may further add the email address or URL domain included in the customer data of the user added or updated by the user to the white list 320. Examples of customer data include business card data stored in the application server 150 and address book data. As described above, the second updating unit 220 may further add the email address or the domain of the email address included in the address book of the user 80 added or updated by the user 80 to the white list 320.

  In the mail server 100, mail whose domain or mail address is not included in the domain reputation list 310 and the white list 320 is mail that has a high possibility of being spam mail. Since the discriminator 212 discriminates non-spam mails only for mails that are likely to be such spam mails, the load on the mail server 100 can be reduced. Therefore, it is possible to cause the discriminator 212 to perform discrimination processing with a large amount of calculation.

  Further, according to the mail server 100, the white list 320 is updated using data collected from the mail transmission server 130, the Web proxy server 140, and the application server 150 and the address book data of the user 80. Therefore, a white list suitable for the user 80 can be constructed.

  FIG. 3 schematically shows the processing contents in the mail system 10. In the mail server 100, the domain authentication process 300 is a process executed by the authentication unit 200. The domain authentication process 300 may be realized in the mail gateway device.

  The mail authenticated by the domain authentication process 300 is checked against the domain reputation list 310. Further, the mail authenticated by the domain authentication process 300 is checked against the white list 320.

  Of the emails authenticated by the domain authentication process 300, emails whose sender domain is included in the domain reputation list 310 and whose sender address is included in the white list 320 are stored in the receiving folder of the mailbox 270. Alternatively, it is transferred to the user device 110. Even if the sender domain is not included in the domain reputation list 310, the mail whose sender address is included in the white list 320 is stored in the receiving folder of the mailbox 270, or the user It may be transferred to the device 110.

  Among the mails authenticated by the domain authentication processing 300, the mail whose source domain is included in the domain reputation list 310 and whose source address is not included in the white list 320 is a confirmation folder different from the receiving folder in the mailbox 270. Stored in When the user 80 operates the user device 110 to perform an operation of receiving mail of the mail source address stored in the confirmation folder, the second update unit 220 sets the mail source address in the white list 320. to add.

  Of the emails authenticated by the domain authentication processing 300, emails whose sender domain is not included in the domain reputation list 310 and whose sender address is not included in the white list 320 are held in the holding unit 240. The first update unit 210 uses the discriminator 212 to discriminate the mail held in the holding unit 240. When the output indicating that the mail is a non-spam mail is obtained from the discriminator 212, the first updating unit 210 adds the sender domain of the mail to the domain reputation list 310.

  The second update unit 220 includes a mail transmission log 330 collected from the mail transmission server 130, a Web proxy log 340 collected from the Web proxy server 140, and customer data 350 and address book data of the user 80 collected from the application server 150. Based on 360, email addresses or domains to be delivered may be extracted and added to the white list 320. The first updating unit 210 determines the domain of the mail address to be distributed based on the mail transmission log 330, the Web proxy log 340, the customer data 350, and the address book data 360, and adds it to the domain reputation list 310. It's okay.

  The domain or mail address added to the domain reputation list 310 or the white list 320 may be extracted using a discriminator obtained by deep learning, or using a predetermined extraction logic.

  FIG. 4 schematically shows an example of a screen 500 displayed on the user device 110 by the mail application. The user device 110 may access the mail stored in the mail box 270 by the Web mail function provided by the mail server 100. The user device 110 may access the mail distributed to the mail box 270 by a mail application function provided by a combination of the application server 150 and the mail server 100. The user device 110 may access the mail delivered to the mailbox 270 by the local mail application function stored in the user device 110. In this case, the user device 110 may access the mail stored in the mail box 270 of the mail server 100 by the IMAP protocol.

  The screen 500 includes a folder 501 corresponding to the received folder, a folder 502a, a folder 502b, and a folder 502c created by the user, a folder 508 in which the deleted mail is stored, and a confirmation folder 509. A folder 501 is a folder stored by default when a new mail arrives.

  In the confirmation folder 509, mail whose source domain is included in the domain reputation list 310 but whose source address is not included in the white list 320 is stored. When the user 80 opens the confirmation folder 509 and selects the mail 22, a menu 510 is displayed. The menu 510 is a menu for inquiring whether the user 80 accepts mail delivery from the sender address of the mail 22. The mail processing unit 280 may display the menu 510 on the user device 110 when receiving an instruction to acquire mail stored in the confirmation folder. When the user 80 selects to receive via the button 511, the mail processing unit 280 transmits the data of the mail 22 to the user device 110, and the second update unit 220 adds the transmission source address of the mail 22 to the white list 320. .

  Even if the user 80 accepts the mail delivery of the sender address of the mail 22, the second update unit 220 sets the mail 22 to the trash folder within a predetermined time after opening the mail 22. If it is moved to 308, the sender address of the mail 22 may be deleted from the white list 320. Alternatively, even if the user 80 accepts the mail delivery of the transmission source address of the mail 22, the second update unit 220 stores the mail 22 in the trash folder 308 within a predetermined time after opening the mail 22. When the folder is moved to a folder 501, a folder 502 a, a folder 502 b, or a folder 502 c, the sender address of the mail 22 may be added to the white list 320.

  When the user 80 moves to the trash box folder 508 without opening the mail stored in the folder 501, the second update unit 220 may delete the source address of the mail from the white list 320. In addition, when the user 80 moves the mail stored in the folder 501 and moves the mail to the trash folder 508 within a predetermined time, the second update unit 220 sets the transmission source address of the mail. It may be deleted from the white list 320.

  FIG. 5 shows an example of a proxy log collected from the Web proxy server 140 in a table format. The proxy log includes date and time, connection time, connection result, transfer data amount, access type, and URL. The date / time indicates the date / time when an external web server is accessed through the web proxy server 140. The connection time indicates a time when communication with the web server is performed through the web proxy server 140. The connection result indicates whether or not the access to the external web server is successful. The transferred data amount indicates the amount of data transferred from an external web server. The access type indicates whether data is acquired from an external web server or transmitted to an external web server. URL indicates the URL of an external web server.

  The second update unit 220 acquires the URL domain of the web server accessed from the user device 110 based on the proxy log, and adds the acquired domain to the white list 320. Note that the second update unit 220 may specify a web server that has communicated for a predetermined time or more within a predetermined period, and add the domain of the URL of the specified web server to the white list 320. In addition, the second update unit 220 may add to the white list 320 on the condition that access to the same URL or the same domain has exceeded a predetermined number of times.

  FIG. 6 shows an example of a mail transmission log collected from the mail transmission server 130 in a table format. The mail transmission log includes a start date and time, a transmission source, a destination, a size, a transmission state, and a transmission completion date and time. The start date and time indicates the date and time when the mail transmission process is started. The sender indicates a mail sender address. The destination indicates a mail destination address. The size indicates the mail data size. The transmission state indicates whether transmission has been completed normally. The transmission completion date and time indicates the date and time when transmission was completed normally.

  The second updating unit 220 adds the destination address for which transmission has been completed normally to the white list 320. The second updating unit 220 may add a destination address that has been successfully sent a predetermined number of times within a predetermined period to the white list 320. Note that the second update unit 220 may add to the white list 320 on the condition that transmission of mail to the same destination address has exceeded a predetermined number of times.

  FIG. 7 schematically shows the contents of the business card information stored by the application server 150. The application server 150 stores supplier information including the company name of the customer company of the user 80, the name of the employee of the customer company, the email address of the employee of the customer company, and the URL of the customer company. These data may be registered in the application server 150 by the user 80. The application server 150 may provide a customer management application to the user 80 using the registered customer data.

  The mail server 100 acquires the email address of the employee of the supplier company from the application server 150. The second update unit 220 adds the acquired email address to the white list 320. When new business card information is registered in the application server 150, the second update unit 220 may acquire an email address included in the newly registered business card information and add it to the white list 320. When the e-mail address included in the business card information is updated in the application server 150, the second update unit 220 acquires e-mail addresses before and after update, and the e-mail addresses before update stored in the white list 320 May be rewritten to the updated email address.

  FIG. 8 shows a valid business card information list 800 managed for each company in a table format. The business card information list 800 includes business card information of employees who can be legitimate senders of mail. The business card information list 800 may be generated based on information provided from each company. The business card information list 800 includes a company name, a company employee name, a company employee email address, and a company URL. The business card information list 800 may be managed by the application server 150.

  In the mail server 100, the second update unit 220 may update the white list 320 based on the business card information list 800 acquired from the application server 150. For example, when the user 80 registers the business card information of the employee of the XX company in the application server 150 as the business card information of the supplier company, the second update unit 220 is stored in the business card information list 800 in association with the XX company. The email address of the other employee, the domain of the email address, and the domain of the URL may be acquired and added to the white list 320 of the user 80. In addition, the second update unit 220 adds the destination mail address of the mail transmitted by the user 80 to the white list 320 as described above, or receives the mail stored in the confirmation folder 509 in response to an instruction to acquire the mail. When the sender email address is added to the white list 320, the email address of the company employee associated with the email address to be added, the domain of the email address, and the URL domain are acquired from the business card information list 800. , It may be added to the white list 320 of the user 80. For example, when the new email address to be added to the white list 320 is stored in the business card information list 800 as the email address of the employee of the XX company, the second update unit 220 stores the XX company in the business card information list 800. The email addresses of other employees stored in association with each other, the domain of the email address, and the domain of the URL may be added to the white list 320.

  When the second update unit 220 updates the white list 320 of the user 80 based on the business card information list 800, the second update unit 220 updates the white list of other employees of the company to which the user 80 belongs based on the business card information list 800. You can do it. For example, if the user 80 is an employee of xx company, the second updating unit 220 adds the email address of the employee of XX company, the domain of the email address, and the domain of the URL to the white list 320 of the user 80. In this case, the email address of the employee of the XX company, the domain of the email address, and the domain of the URL may be added to the white list of all other employees of the XX company. Thereby, the possibility that mail exchanged between corporate users is processed as spam mail can be reduced. Note that information for identifying the company to which the user 80 belongs and information for identifying the employees of each company are managed in the application server 150 and the like, and the second update unit 220 is based on information acquired from the application server 150 and the like. The white list of other employees of the company to which the user 80 belongs may be updated.

  The application server 150 may store the address book data of the user 80. The address book data stored in the application server 150 may be synchronized with the address book data in the user device 110. In the mail server 100, the second update unit 220 may add the mail address to the white list 320 when the mail address is added to the address book data acquired from the application server 150. When the email address stored in the address book data acquired from the application server 150 is updated, the second update unit 220 uses the email address before update stored in the white list 320 as the email address after update. You can rewrite as

  As described above, according to the mail system 10, since the discriminator 212 discriminates mail other than the mail selected by the domain reputation list 310 and the white list 320, the load on the mail server 100 can be reduced. Can do. Further, since the discriminator 212 is constructed by learning the characteristics of non-spam mail, the effect of a workaround in which the sender of the spam mail changes the content of the spam mail can be reduced.

  Further, according to the mail system 10, the white list 320 is updated using data collected from the mail transmission server 130, the Web proxy server 140, and the application server 150, and the address book data of the user 80, so that it is suitable for the user 80. A white list can be built. Even if the mail is from a site that is generally determined to be undesirable, it is not preferable not to send the mail as long as the user 80 accepts the mail. According to the mail system 10, since the white list 320 suitable for the user 80 can be constructed for each user, mail from a sender that the user 80 desires can be distributed to the user 80.

  FIG. 9 schematically shows an example of a computer 1000 that functions as the mail server 100. A computer 1000 according to this embodiment includes a CPU peripheral unit having a CPU 1010 and a RAM 1030 that are connected to each other by a host controller 1092; a ROM 1020 that is connected to the host controller 1092 by an input / output controller 1094; a communication I / F 1040; 1,0 and an input / output unit having an input / output chip 1080.

  The CPU 1010 operates based on programs stored in the ROM 1020 and the RAM 1030 and controls each unit. The communication I / F 1040 communicates with other devices via a network by wire or wireless. The communication I / F 1040 functions as hardware that performs communication. The hard disk drive 1050 stores programs and data used by the CPU 1010.

  The ROM 1020 stores a boot program executed when the computer 1000 is started up, a program depending on the hardware of the computer 1000, and the like. The input / output chip 1080 connects various input / output devices to the input / output controller 1094 via, for example, a parallel port, a serial port, a keyboard port, a mouse port, and the like.

  A program provided to the hard disk drive 1050 via the RAM 1030 is stored in a recording medium such as an IC card and provided by the user. The program is read from the recording medium, installed in the hard disk drive 1050 via the RAM 1030, and executed by the CPU 1010.

  A program installed in the computer 1000 and causing the computer 1000 to function as the mail server 100 may work on the CPU 1010 or the like to cause the computer 1000 to function as each part of the mail server 100. The information processing described in these programs is read by the computer 1000, whereby the authentication unit 200, the first updating unit 210, which are specific means in which the software and the various hardware resources described above cooperate with each other, The second update unit 220, the filter unit 230, the holding unit 240, the distribution unit 250, the mail box 270, and the mail processing unit 280 function. And the specific mail server 100 according to the intended purpose is constructed | assembled by implement | achieving the calculation or processing of the information according to the intended purpose of the computer 1000 in this embodiment by these specific means.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above-described embodiment. It is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.

  The order of execution of each process such as operations, procedures, steps, and stages in the apparatus, system, program, and method shown in the claims, the description, and the drawings is particularly “before” or “prior to”. It should be noted that it can be realized in any order unless the output of the previous process is used in the subsequent process. Regarding the operation flow in the claims, the description, and the drawings, even if it is described using “first,” “next,” etc. for convenience, it means that it is essential to carry out in this order. It is not a thing.

10 mail system, 20, 22 mail, 50 network, 80 users, 90 users, 100 mail servers, 110 user devices, 120 user devices, 130 mail transmission servers, 140 Web proxy servers, 150 application servers, 200 authentication units, 210 1 update unit, 211 input value generation unit, 212 discriminator, 220 second update unit, 230 filter unit, 240 holding unit, 250 distribution unit, 270 mailbox, 280 mail processing unit, 290 storage unit, 300 domain authentication process, 308 folder, 310 domain reputation list, 320 white list, 340 Web proxy log, 350 customer data, 360 address book data, 500 screens, 501, 502, 508 folder, 509 confirmation file Folder, 510 menu, 511 button, 800 business card information list, 1000 computer, 1010 CPU, 1020 ROM, 1030 RAM, 1040 communication I / F, 1050 hard disk drive, 1080 input / output chip, 1092 host controller, 1094 input / output controller

Claims (13)

A storage unit for storing a first list including a domain or an e-mail address of a source of an e-mail permitted to be distributed and a second list including an e-mail domain or an e-mail address permitted to be received by a user; ,
A distribution unit that distributes to the user at least e-mails whose domain or e-mail address is included in the first list and the second list among e-mails to be distributed;
A holding unit that holds an email whose sender domain or email address is not included in either the first list or the second list among the emails to be distributed;
Analyzing the contents of the e-mail held in the holding unit, extracting e-mails that should be allowed to be delivered from among the e-mails held in the holding unit, and the source of the extracted e-mail A first updating unit for updating the first list based on a domain or an email address of
Among the emails to be distributed, the domain or email address of the sender is included in the first list, and the domain or email address of the sender of the email not included in the second list, An electronic mail system comprising: a second update unit that adds a domain or mail address designated by a user to the second list. The distribution unit is updated by the first list and the second update unit in which the domain or mail address of the transmission source is updated by the first update unit from among the emails held in the storage unit The e-mail system according to claim 1, wherein e-mail included in the second list is extracted, and the extracted e-mail is distributed to the user. The distribution unit is configured such that even if the domain or mail address of the transmission target electronic mail is not included in the first list, the domain or mail address of the electronic mail is not included in the second list. The e-mail system according to claim 1, wherein the e-mail is distributed to the user when included in the e-mail. It further includes an authentication unit that performs domain authentication of the email transmission source domain,
The electronic mail system according to any one of claims 1 to 3, wherein the electronic mail to be distributed is an electronic mail authenticated by the authentication unit. The first update unit includes:
An input value generation unit that generates input values from character strings of a plurality of predetermined fields included in the e-mail;
A discriminator that discriminates whether or not the electronic mail should be allowed to be distributed based on the plurality of input values generated by the input value generation unit;
The e-mail system according to any one of claims 1 to 4, wherein the discriminator is constructed by deep learning that learns e-mails that are allowed to be distributed using a plurality of e-mails. Of the emails to be distributed, the domain or email address of the sender is included in the first list, and the domain or email address of the sender of the email not included in the second list is the sender. A presentation unit for presenting to the user whether or not to receive an e-mail;
When the user selects to receive the email presented by the presenting unit, the second update unit includes the source domain or email address in the first list, and 6. The e-mail system according to claim 1, wherein a domain or an e-mail address of an e-mail that is not included in the second list is added to the second list. The said 2nd update part further acquires the said processing content of the said user with respect to the email delivered to the said user, and updates the said 2nd list based on the acquired processing content. The e-mail system described in the section. The second update unit transmits an email deleted by the user within a predetermined time after being delivered to the user, or an email deleted by the user without being opened after being delivered to the user The e-mail system according to claim 7, wherein an original domain or e-mail address is deleted from the second list. The said 2nd update part further acquires the domain or email address of the transmission destination of the email which the said user transmitted, and adds the acquired domain or email address to the said 2nd list | wrist. The e-mail system according to one item. The second update unit further acquires Web proxy data, specifies a domain of the network resource accessed by the user based on the acquired Web proxy data, and sets at least a part of the specified domain to the second list The electronic mail system according to claim 1, which is added to the electronic mail system. The said 2nd update part further adds the domain of the email address or URL contained in the customer data of the said user added or updated by the said user to the said 2nd list | wrist. Email system as described in. The said 2nd update part further adds the email address contained in the said user's address book or the domain of the email address added by the said user to the said 2nd list | wrist. The e-mail system according to one item.   The program for functioning a computer as an electronic mail system as described in any one of Claims 1-12.

Images