JP6892845B2 - Email confirmation device, information processing method, and program - Google Patents

Description

The present invention relates to a mail confirmation device, an information processing method, and a program.

Conventionally, in order to prevent access to a malicious site included in an email received by a user terminal, an external device is made to perform access using the address information included in the email, and the screen image obtained as a result is transmitted to the user terminal. A technique for transmitting has been proposed (see, for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2013-246474

In the above, the address information whose access should be restricted is registered in advance, and if the access request from the user terminal that received the mail matches the address registered in advance, the address is accessed in a secure environment. It is a technology. Therefore, even if it is a malicious address, if it is an address that is not registered in advance, the user terminal may directly access the address. On the other hand, if an address that does not require much restriction is registered in advance with an emphasis on access restriction, the convenience of the user of the user terminal may be impaired.

The present invention has been made in view of these points, and an object of the present invention is to provide a technique for achieving both convenience of a user who uses an e-mail and suppression of access to malicious information contained in the e-mail. To do.

The first aspect of the present invention is a program. This program has a display operation detection function that detects an e-mail display operation performed by a mailer that manages an e-mail on a computer, and a display operation detection function that detects the display operation to detect the display operation. A character string extraction function that extracts a character string in a predetermined format from the character string included in the target e-mail, and whether the information indicated by the character string is malignant or benign by inputting the character string The character string determination function that acquires the output when the character string extracted by the character string extraction function is input to the learning model that has been machine-learned to output the indicated information, and the learning that the character string determination function has acquired. A notification function that notifies the output result of the model is realized.

The notification function corresponds to the character string extracted by the character string extraction function and the output result of the learning model in which the character string is input to a window different from the mailer in the display unit displaying the mailer. It may be attached and displayed on the display unit.

The notification function may display the character string extracted by the character string extraction function in a selectable manner, and the program may display the character string displayed by the notification function on the computer when the character string is selected. A launcher function for launching an application determined according to the type of the selected character string may be further realized.

When the output result of the learning model in which the selected character string is input is malignant, the notification function may display a new window on the display unit that displays whether or not to start the application in a selectable manner. ..

The program prohibits a selection operation in a window for displaying the mailer when the computer displays a character string on the display unit in a manner in which the notification function can be selected in a window different from the mailer. The limiting function may be further realized.

In order to provide the above program or to update a part of the program, a computer-readable recording medium on which the program is recorded may be provided, or the program may be transmitted over a communication line. ..

A second aspect of the present invention is an information processing method. In this method, in the step of detecting the display operation of the e-mail performed by the mailer that manages the e-mail, and when the processor detects the display operation, in the character string included in the e-mail to be the target of the display operation. From, to the step of extracting a character string in a predetermined format, and to a learning model machine-learned to input the character string and output information indicating whether the information indicated by the character string is malignant or benign. The step of acquiring the output when the extracted character string is input and the step of notifying the output result of the acquired learning model are executed.

A third aspect of the present invention is a mail confirmation device. This device is the target of the display operation when the display operation detection unit that detects the display operation of the e-mail performed by the mailer that manages the e-mail and the display operation detection unit detects the display operation. A character string extraction unit that extracts a character string in a predetermined format from the character string contained in the e-mail, and information indicating whether the information indicated by the character string is malignant or benign by inputting the character string. A character string determination unit that acquires an output when a character string extracted by the character string extraction unit is input to a learning model machine-learned to output, and an output of the learning model acquired by the character string determination unit. A notification unit that notifies the result and a notification unit are realized.

It should be noted that any combination of the above components and the conversion of the expression of the present invention between methods, devices, systems, computer programs, data structures, recording media and the like are also effective as aspects of the present invention.

According to the present invention, it is possible to achieve both the convenience of a user who uses an e-mail and the suppression of access to malicious information contained in the e-mail.

It is a figure for demonstrating the structure of the mail confirmation system which concerns on embodiment of this invention. It is a figure which shows typically the functional structure of the mail confirmation part which concerns on embodiment. It is a figure which shows the display example which the notification part displays on the display part when a malignant character string is not included. It is a figure which shows the display example which the notification part displays on the display part when a malignant character string is contained. It is a figure which shows an example of another window which a notification part displays on a display part when a malignant character string is contained. It is a figure which shows the screen example for selecting whether or not the application which the notification part displays on the display part can start. It is a schematic diagram for demonstrating DMZ. It is a flowchart for demonstrating the flow of the mail confirmation processing executed by the communication terminal which concerns on embodiment.

<Outline of the embodiment>
FIG. 1 is a diagram for explaining the configuration of the mail confirmation system S according to the embodiment of the present invention. The mail confirmation system S according to the embodiment is configured by connecting the communication terminal 1 to the mail server 2 and the determination server 3 via the communication network N in a manner capable of communicating with each other. Hereinafter, with reference to FIG. 1, an outline of the mail confirmation system S according to the embodiment will be described.

The communication terminal 1 is a smartphone, a tablet PC (Personal Computer), a desktop PC, a notebook PC, or the like, and is a computer having computing resources such as a CPU (Central Processing Unit) and a memory (not shown). The communication terminal 1 includes a mail confirmation unit 100, a display unit 200, and a mailer 300.

When the communication terminal 1 is a smartphone, a tablet PC, a notebook PC, or the like, the display unit 200 is integrally configured with the communication terminal 1. When the communication terminal 1 is a desktop PC, the display unit 200 can be a device independent of the communication terminal 1. FIG. 1 shows an example in which the display unit 200 is integrated with the communication terminal 1.

The mailer 300 is a general e-mail client, and is application software for sending and receiving e-mails (hereinafter, simply referred to as "mails") and managing sent and received e-mails. The mailer 300 displays a list of information indicating the subject, sender, transmission date and time, and the like of the mail addressed to the user of the mailer 300 acquired by the mail server 2.

The mail confirmation unit 100 monitors the mail display operation of the mailer 300 by the user. When the mail confirmation unit 100 detects a mail display operation by the user, the mailer 300 extracts a character string that fits a specific format included in the mail before the mailer 300 displays the mail on the display unit 200.

Here, the "specific format" extracted from the email by the email confirmation unit 100 is, for example, a URI (Uniform Resource Identifier) starting with a character string such as "http" or "ftp", or an email address including "@". It is a format provided with information for accessing a device different from the communication terminal 1 such as a telephone number and an IP (Internet Protocol) address, or a person different from the user of the communication terminal 1. The mail confirmation unit 100 is implemented as, for example, a plug-in of the mailer 300.

The mail confirmation unit 100 transmits the extracted character string to the determination server 3 and acquires the result. The judgment server 3 is a server different from the mail server 2, and machine learning (for example,) so as to input a character string applicable to a specific format and output information indicating whether the information indicated by the character string is malignant or benign. , Deep Neural Network, etc. machine learning) equipped with a learning model. The determination server 3 acquires the output of the learning model in which the character string received from the mail confirmation unit 100 is input and transmits it to the mail confirmation unit 100.

In general, a learning model created by using machine learning is highly generalized, and has high discriminating power not only for the character string used for the teacher data for model creation but also for the character string similar to the teacher data. Therefore, the determination server 3 can determine benign / malignant even if it is an unknown character string, unlike the benign / malignant determination using a general blacklist / whitelist. The determination server 3 determines that the numerical value calculated by using the sigmoid function is benign when it exceeds a predetermined threshold value and malignant when it falls below a predetermined threshold value, so that the character string received from the mail confirmation unit 100 is benign.・ You may judge malignant.

The mail confirmation unit 100 causes the display unit 200 to display the output result of the learning model acquired from the determination server 3. As a result, the user of the communication terminal 1 can confirm whether or not the e-mail containing the malicious character string is contained in the e-mail before the e-mail instructing the mailer 300 to display is displayed on the display unit 200.

If the email does not contain a malicious character string, the user can display the email on the display unit 200 as usual. If the e-mail contains a malicious character string, the user can also determine that the e-mail is not displayed on the display unit 200. As described above, the e-mail confirmation system S according to the embodiment can achieve both the convenience of the user who uses the e-mail and the suppression of access to the malicious information contained in the e-mail.

<Functional configuration of mail confirmation unit 100>
FIG. 2 is a diagram schematically showing a functional configuration of the mail confirmation unit 100 according to the embodiment. In FIG. 2, the arrows indicate the main data flows, and there may be data flows not shown in FIG. In FIG. 2, each functional block shows not a hardware (device) unit configuration but a functional unit configuration. Data can be exchanged between functional blocks via any means such as a data bus, a network, or a portable storage medium.

In the mail confirmation unit 100, a processor such as a CPU or GPU (Graphics Processing Unit) of the communication terminal 1 executes a program stored in a storage unit of the communication terminal 1 (not shown), so that the display operation detection unit 10 and a character string are executed. It functions as an extraction unit 20, a character string determination unit 30, a notification unit 40, a display control unit 50, a launcher unit 60, and an operation restriction unit 70.

The display operation detection unit 10 detects a mail display operation performed by the mailer 300 that manages the mail. When the display operation detection unit 10 detects the display operation, the character string extraction unit 20 selects a character string in a predetermined specific format from the character strings included in the mail to be displayed. Extract.

The character string determination unit 30 takes a character string as an input, and the characters extracted by the character string extraction unit 20 into a learning model machine-learned to output information indicating whether the information indicated by the character string is malignant or benign. Enter a column and get its output. Specifically, the character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 provided with the learning model, and receives the result processed by the determination server 3 from the determination server 3.

The notification unit 40 notifies the output result of the learning model acquired by the character string determination unit 30. Specifically, the notification unit 40 notifies the user by displaying the output result on the display unit 200 via the display control unit 50. At this time, the notification unit 40 may output different notification sounds to the speaker (not shown) of the communication terminal 1 depending on whether the malicious character string is included or not. As a result, the user of the communication terminal 1 can grasp the output result by the notification sound without looking at the display unit 200.

FIG. 3 is a diagram showing a display example in which the notification unit 40 displays on the display unit 200 when a malignant character string is not included. As shown in FIG. 3, the notification unit 40 causes the message display area M provided in a part of the window of the mailer 300 to display a message indicating the output result. Further, since there is no malicious character string in the character string extracted by the character string extraction unit 20, the content of the mail instructed by the user to display the mail is displayed in the window of the mailer 300.

FIG. 4 is a diagram showing a display example in which the notification unit 40 displays on the display unit 200 when a malignant character string is included. Even when the malignant character string is included, the notification unit 40 causes the message display area M to display a message indicating the output result, as in the case where the malignant character string is not included. As shown in FIG. 4, the notification unit 40 inputs the character string extracted by the character string extraction unit 20 and the character string into a separate window W different from the mailer 300 in the display unit 200 displaying the mailer 300. The output result of the learning model to be used is associated with the output result and displayed on the display unit 200. As a result, the user of the communication terminal 1 can check the output result without operating the window for displaying the mailer 300.

The notification unit 40 displays the character string extracted by the character string extraction unit 20 in the separate window W in a selectable manner. For example, when the character string extracted by the character string extraction unit 20 is a URI, the user of the communication terminal 1 can access the site indicated by the URI by selecting the character string.

Specifically, when the character string displayed by the notification unit 40 in the separate window W is selected, the launcher unit 60 starts an application determined according to the type of the selected character string. Here, a specific example of the "application determined according to the type of the selected character string" is a web browser when the character string is a URI, and a call application when the character is a telephone number. When the character string is an e-mail address, the launcher unit 60 causes the display unit 200 to display the e-mail creation screen (not shown) of the mailer 300 via the display control unit 50. As a result, the user of the communication terminal 1 can start an application for directly accessing the information indicated by each character string from the separate window W without searching for the character string from the window displaying the mailer 300. ..

FIG. 5 is a diagram showing an example of another window W to be displayed on the display unit 200 by the notification unit 40 when a malicious character string is included. FIG. 5 shows that the notification unit 40 is superimposed on the window showing the mailer 300, and the separate window W is displayed on the display unit 200. As shown in FIG. 5, it is clearly shown in the separate window W that the e-mail is suspected to be fraudulent e-mail. The user of the communication terminal 1 can access the information indicated by the character string by selecting the character string displayed in the separate window W.

Here, when the output result of the learning model in which the selected character string is input is malignant, the notification unit 40 displays a new window NW on the display unit 200 in which whether or not to start the application can be selected. Display it.

FIG. 6 is a diagram showing an example of a screen for the notification unit 40 to select whether or not to start the application to be displayed on the display unit 200. As shown in FIG. 6, the notification unit 40 superimposes on the window showing the mailer 300 to display a new window NW on the display unit 200. In the new window NW, a message calling attention to the fact that the character string selected by the communication terminal 1 is malignant is also displayed, and the notification unit 40 can call the communication terminal 1 to call attention to access. In the new window NW, the communication terminal 1 can also revoke access to the information indicated by the selected character string.

In this way, when the output result of the learning model that inputs the selected character string is malignant, the notification unit 40 warns the user when the user tries to access the information indicated by the character string from the new window NW. It can encourage arousal. At this time, if the user can directly access the information indicated by the character string from the character string displayed on the display unit of the mailer 300, the notification unit 40 may lose the opportunity to call the user's attention.

Therefore, when the notification unit 40 displays the character string on the display unit 200 in a manner that can be selected in a window different from the mailer 300, the operation restriction unit 70 prohibits the user's selection operation in the window displaying the mailer 300. To do. As a result, the operation restriction unit 70 can reduce the situation where the user mistakenly operates the learning model and the output result of the learning model accesses the information indicated by the malicious character string.

By the way, when the user accesses the information indicated by the character string whose output result of the learning model is benign, the communication terminal 1 may start a normal application. On the other hand, when the user accesses the information indicated by the malicious character string in the output result of the learning model, the communication terminal 1 preferably provides the user with a secure environment.

Therefore, even if the type of the selected character string is the same, the launcher unit 60 may start a different application if the output result of the learning model that inputs the character string is different. More specifically, the launcher unit 60 is a device installed in the DMZ (DeMilitarized Zone) segment in the network to which the communication terminal 1 is connected when the output result of the learning model that inputs the selected character string is malignant. Launch the application. The notification unit 40 causes the display unit 200 to display the output result of the application executed by the device installed in the DMZ segment.

FIG. 7 is a schematic diagram for explaining the DMZ. Since the DMZ is a known technology, detailed description thereof will be omitted, but as shown in FIG. 7, an area sandwiched between two firewalls F existing between the communication terminal 1 and a public communication network N such as the Internet. Is the DMZ segment.

In the DMZ segment, an application server 4 that executes an application for accessing the information indicated by the malicious character string in the output result of the learning model is installed. Even if the application server 4 executes a web browser application to access a malicious website, the communication terminal 1 is not affected by the website. Since the notification unit 40 acquires the result executed by the application server 4 in the form of an image and displays it on the display unit 200, the user of the communication terminal 1 can safely confirm the result of accessing the information indicated by the malicious character string. be able to.

<Processing flow of information processing method executed by communication terminal 1>
FIG. 8 is a flowchart for explaining the flow of the mail confirmation process executed by the communication terminal 1 according to the embodiment. The process in this flowchart starts, for example, when the mailer 300 is activated.

The display operation detection unit 10 waits for the user of the communication terminal 1 to perform a mail display operation on the mailer 300 (S2). While the display operation detection unit 10 does not detect the display operation (No in S4), the display operation detection unit 10 returns to step S2 and continues to wait for the mail display operation by the user.

When the display operation detection unit 10 detects the display operation (Yes in S4), the character string extraction unit 20 selects a character string in a predetermined specific format from the character strings included in the mail to be displayed. Is extracted (S6). The character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 (S8).

The character string determination unit 30 acquires an output result when the character string extracted by the character string extraction unit 20 is input to the machine learning model for determining benign or malignant character strings from the determination server 3 (S10). The notification unit 40 associates the output result acquired by the character string determination unit 30 from the determination server 3 with the character string extracted by the character string extraction unit 20 and displays it in a window different from that of the mailer 300 (S12).

When the user selects the displayed character string (Yes in S14) and the output result of the learning model that inputs the character string is malignant (Yes in S16), the notification unit 40 determines the type of the selected character string. A new window for confirming to the user whether or not to start the application determined according to the above is displayed on the display unit 200 (S18).

When the user chooses to start the application (Yes in S20), or when the output result of the learning model in which the character string selected by the user is input is good (No in S16), the launcher unit 60 is set by the user. The application corresponding to the selected character string is started (S22).

When the user does not select the displayed character string (No in S14), the user does not select to start the application (No in S20), or the launcher unit 60 starts the application, the process in this flowchart ends. To do.

<Effects of the communication terminal 1 according to the embodiment>
As described above, according to the communication terminal 1 according to the embodiment, it is possible to achieve both the convenience of the user who uses the e-mail and the suppression of access to the malicious information contained in the e-mail.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes can be made within the scope of the gist thereof. is there. For example, the specific embodiment of the distribution / integration of the device is not limited to the above embodiment, and all or a part thereof may be functionally or physically distributed / integrated in any unit. Can be done. Also included in the embodiments of the present invention are new embodiments resulting from any combination of the plurality of embodiments. The effect of the new embodiment produced by the combination has the effect of the original embodiment together.

1 ... Communication terminal 2 ... Mail server 3 ... Judgment server 4 ... Application server 10 ... Display operation detection unit 20 ... Character string extraction unit 30 ... Character string judgment unit 40 ...・ ・ Notification unit 50 ・ ・ ・ Display control unit 60 ・ ・ ・ Launcher unit 70 ・ ・ ・ Operation restriction unit 100 ・ ・ ・ Email confirmation unit 200 ・ ・ ・ Display unit 300 ・ ・ ・ Mailer F ・ ・ ・ Firewall N ・ ・・ Communication network S ・ ・ ・ Email confirmation system

Claims (7)

On the computer
Among the character string included in the subject to e-mail in the display operation of the e-mail made in the mailer for managing electronic mail and a character string extraction function for extracting a character string in the format predetermined,
A string as input, the machine learning learning model as information represented by the character string to output information indicating malignant or benign, when inputting the character string, wherein the character string extraction function and extracts The character string judgment function to acquire the output and
A notification function that notifies the output result of the learning model acquired by the character string determination function and displays the character string extracted by the character string extraction function in a selectable manner .
When the character string displayed by the notification function is selected, the launcher function that launches the application that is determined according to the type of the selected character string, and
A program that realizes. The program
The display operation detection function that detects the display operation is further realized.
The character string extraction function extracts the character string when the display operation detection function detects the display operation.
The program according to claim 1. The notification function corresponds to the character string extracted by the character string extraction function and the output result of the learning model in which the character string is input to a window different from the mailer in the display unit displaying the mailer. Attach and display on the display
The program according to claim 1 or 2. When the output result of the learning model in which the selected character string is input is malignant, the notification function causes the display unit to display a new window for displaying whether or not to start the application in a selectable manner.
The program according to claim 3. On the computer
When the notification function displays a character string on the display unit in a manner that can be selected in a window different from the mailer, an operation restriction function for prohibiting a selection operation in the window displaying the mailer is further realized.
The program according to claim 3 or 4. The processor,
Extracting from the character string included in the subject to e-mail in the display operation of the e-mail made in the mailer, a string in the format predetermined for managing electronic mail,
A step of acquiring the output when the extracted character string is input to a learning model machine-learned so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. ,
The step of notifying the output result of the acquired learning model and
A step of displaying the extracted character string in a selectable manner, and
When the displayed character string is selected, the step to start the application that is determined according to the type of the selected character string, and
Information processing method to execute. Among the character string included in the e-mail to be displayed operation of an electronic mail made in the mailer for managing electronic mail and a character string extraction unit for extracting a character string in the format predetermined,
A string as input, the machine learning learning model as information represented by the character string to output information indicating malignant or benign, when inputting the character string, wherein the character string extraction unit and extracted The character string judgment unit that acquires the output and
A notification unit that notifies the output result of the learning model acquired by the character string determination unit and displays the character string extracted by the character string extraction unit in a selectable manner .
When the character string displayed by the notification unit is selected, the launcher unit that starts the application determined according to the type of the selected character string and
Email confirmation device that realizes.

Images