JP7100178B2 - Email confirmation device, information processing method, and program - Google Patents

Description

The present invention relates to a mail confirmation device, an information processing method, and a program.

Conventionally, in order to prevent access to a malicious site included in an email received by a user terminal, an external device is made to perform access using the address information included in the email, and the screen image obtained as a result is transmitted to the user terminal. A technique for transmitting has been proposed (see, for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2013-246474

In the above, the address information whose access should be restricted is registered in advance, and if the access request from the user terminal that received the mail matches the address registered in advance, the address is accessed in a secure environment. It's a technology. Therefore, even if it is a malicious address, if it is an address that has not been registered in advance, the user terminal may directly access the address. On the other hand, if an address that does not require much restriction is registered in advance with an emphasis on access restriction, the convenience of the user of the user terminal may be impaired.

The present invention has been made in view of these points, and an object of the present invention is to provide a technique for achieving both convenience of a user who uses an e-mail and suppression of access to malicious information contained in the e-mail. do.

The first aspect of the present invention is a program. This program extracts a character string in a predetermined format from the character string contained in the e-mail that is the target of the e-mail display operation performed by the mailer that manages the e-mail on the computer. Input the character string extracted by the character string extraction function into a learning model that is machine-learned to output information indicating whether the information indicated by the character string is malignant or benign by inputting the function and the character string. The character string determination function for acquiring the output at the time of the operation and the output result of the learning model acquired by the character string determination function are notified, and the character string extracted by the character string extraction function is displayed in a selectable manner. Realize the notification function.

The program further realizes a display operation detection function for detecting the display operation, and the character string extraction function extracts the character string when the display operation detection function detects the display operation. May be good.

The notification function may display the character string extracted by the character string extraction function and the output result of the learning model in which the character string is input in a window different from the mailer.

When the output result of the learning model in which the selected character string is input is malignant, the notification function may display a new window that displays whether or not to start the application in a selectable manner.

When the computer displays a character string in a window different from the mailer in which the notification function can be selected, the operation restriction function for prohibiting the selection operation in the window displaying the mailer may be further realized. good.

In order to provide the above program or to update a part of the program, a computer-readable recording medium on which the program is recorded may be provided, or the program may be transmitted over a communication line. ..

The second aspect of the present invention is an information processing method. In this method, the processor extracts a character string in a predetermined format from the character string contained in the mail that is the target of the mail display operation performed by the mailer that manages the mail. A step of acquiring the output when the extracted character string is input to a learning model machine-trained so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. , The step of notifying the output result of the acquired learning model and the step of displaying the extracted character string in a selectable manner are executed.

A third aspect of the present invention is a mail confirmation device. This device has a character string extractor that extracts a character string in a predetermined format from the character strings included in the e-mail that is the target of the e-mail display operation performed by the mailer that manages the e-mail. When the character string extracted by the character string extraction unit is input to a learning model machine-learned so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. A character string determination unit for acquiring an output, and a notification unit for notifying the output result of the learning model acquired by the character string determination unit and displaying the character string extracted by the character string extraction unit in a selectable manner. , Is realized. The mail confirmation device further realizes a display operation detection unit that detects the display operation, and the character string extraction unit extracts the character string when the display operation detection unit detects the display operation. You may. The notification unit may display the character string extracted by the character string extraction unit and the output result of the learning model in which the character string is input in a window different from the mailer.

When the output result of the learning model in which the selected character string is input is malignant, the notification unit may display a new window for displaying whether or not to start the application in a selectable manner. The mail confirmation device further realizes an operation restriction unit that prohibits a selection operation in the window displaying the mailer when the notification unit displays a character string in a window different from the mailer in a selectable manner. You may. It should be noted that any combination of the above components and the conversion of the expression of the present invention between methods, devices, systems, computer programs, data structures, recording media and the like are also effective as aspects of the present invention.

According to the present invention, it is possible to achieve both the convenience of a user who uses an e-mail and the suppression of access to malicious information contained in the e-mail.

It is a figure for demonstrating the structure of the mail confirmation system which concerns on embodiment of this invention. It is a figure which shows typically the functional structure of the mail confirmation part which concerns on embodiment. It is a figure which shows the display example which the notification part displays on the display part when a malicious character string is not included. It is a figure which shows the display example which the notification part displays on the display part when a malignant character string is contained. It is a figure which shows an example of another window which a notification part displays on a display part when a malicious character string is contained. It is a figure which shows the screen example for selecting whether or not the application to be started to be displayed on the display part by a notification part. It is a schematic diagram for demonstrating DMZ. It is a flowchart for demonstrating the flow of the mail confirmation processing executed by the communication terminal which concerns on embodiment.

<Outline of the embodiment>
FIG. 1 is a diagram for explaining the configuration of the mail confirmation system S according to the embodiment of the present invention. The mail confirmation system S according to the embodiment is configured by connecting the communication terminal 1 to the mail server 2 and the determination server 3 via the communication network N in a manner capable of communicating with each other. Hereinafter, with reference to FIG. 1, an outline of the mail confirmation system S according to the embodiment will be described.

The communication terminal 1 is a smartphone, a tablet PC (Personal Computer), a desktop PC, a notebook PC, or the like, and is a computer having computational resources such as a CPU (Central Processing Unit) and a memory (not shown). The communication terminal 1 includes a mail confirmation unit 100, a display unit 200, and a mailer 300.

When the communication terminal 1 is a smartphone, a tablet PC, a notebook PC, or the like, the display unit 200 is integrally configured with the communication terminal 1. When the communication terminal 1 is a desktop PC, the display unit 200 can be a device independent of the communication terminal 1. FIG. 1 shows an example in which the display unit 200 is integrated with the communication terminal 1.

The mailer 300 is a general e-mail client, and is application software for sending and receiving e-mails (hereinafter, simply referred to as "mails") and managing sent and received e-mails. The mailer 300 displays a list of information indicating the subject, sender, transmission date and time, and the like of the mail addressed to the user of the mailer 300 acquired by the mail server 2.

The mail confirmation unit 100 monitors the mail display operation of the mailer 300 by the user. When the mail confirmation unit 100 detects a mail display operation by the user, the mailer 300 extracts a character string that fits a specific format included in the mail before the mailer 300 displays the mail on the display unit 200.

Here, the "specific format" extracted from the email by the email confirmation unit 100 is, for example, a URI (Uniform Resource Identifier) starting with a character string such as "http" or "ftp", or an email address including "@". It is a format provided with information for accessing a device different from the communication terminal 1 such as a telephone number and an IP (Internet Protocol) address, or a person different from the user of the communication terminal 1. The mail confirmation unit 100 is implemented as, for example, a plug-in of the mailer 300.

The mail confirmation unit 100 sends the extracted character string to the determination server 3 and acquires the result. The determination server 3 is a server different from the mail server 2, and machine learning (for example,) so as to input a character string applicable to a specific format and output information indicating whether the information indicated by the character string is malignant or benign. , Deep Neural Network, etc. machine learning) equipped with a learning model. The determination server 3 acquires the output of the learning model in which the character string received from the mail confirmation unit 100 is input and transmits it to the mail confirmation unit 100.

In general, a learning model created by using machine learning is highly generalized, and has high discriminating power not only for the character string used for the teacher data for model creation but also for the character string similar to the teacher data. Therefore, unlike the benign / malignant determination using a general blacklist / whitelist, the determination server 3 can determine benign / malignant even if it is an unknown character string. The determination server 3 determines, for example, that the numerical value calculated by using the sigmoid function is benign when it exceeds a predetermined threshold value and malignant when it falls below a predetermined threshold value, so that the character string received from the mail confirmation unit 100 is benign.・ You may judge malignant.

The mail confirmation unit 100 causes the display unit 200 to display the output result of the learning model acquired from the determination server 3. As a result, the user of the communication terminal 1 can confirm whether or not the e-mail containing the malicious character string is included in the e-mail before the e-mail instructing the mailer 300 to be displayed is displayed on the display unit 200.

When the mail does not contain a malicious character string, the user can display the mail on the display unit 200 as usual. If the e-mail contains a malicious character string, the user can also determine that the e-mail is not displayed on the display unit 200. As described above, the mail confirmation system S according to the embodiment can achieve both the convenience of the user who uses the mail and the suppression of access to the malicious information contained in the mail.

<Functional configuration of mail confirmation unit 100>
FIG. 2 is a diagram schematically showing a functional configuration of the mail confirmation unit 100 according to the embodiment. In FIG. 2, the arrows indicate the main data flows, and there may be data flows not shown in FIG. In FIG. 2, each functional block shows not a hardware (device) unit configuration but a functional unit configuration. Data can be exchanged between functional blocks via any means such as a data bus, a network, and a portable storage medium.

In the mail confirmation unit 100, a processor such as a CPU or GPU (Graphics Processing Unit) of the communication terminal 1 executes a program stored in a storage unit of the communication terminal 1 (not shown), so that the display operation detection unit 10 and a character string are executed. It functions as an extraction unit 20, a character string determination unit 30, a notification unit 40, a display control unit 50, a launcher unit 60, and an operation restriction unit 70.

The display operation detection unit 10 detects a mail display operation performed by the mailer 300 that manages the mail. When the display operation detection unit 10 detects the display operation, the character string extraction unit 20 selects a character string in a predetermined specific format from the character strings included in the mail to be the display operation. Extract.

The character string determination unit 30 takes a character string as an input, and the character extracted by the character string extraction unit 20 into a learning model machine-learned to output information indicating whether the information indicated by the character string is malignant or benign. Enter a column and get its output. Specifically, the character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 provided with the learning model, and receives the result processed by the determination server 3 from the determination server 3.

The notification unit 40 notifies the output result of the learning model acquired by the character string determination unit 30. Specifically, the notification unit 40 notifies the user by displaying the output result on the display unit 200 via the display control unit 50. At this time, the notification unit 40 may output different notification sounds to the speaker (not shown) of the communication terminal 1 depending on whether the malicious character string is included or not. As a result, the user of the communication terminal 1 can grasp the output result by the notification sound without looking at the display unit 200.

FIG. 3 is a diagram showing a display example that the notification unit 40 displays on the display unit 200 when a malicious character string is not included. As shown in FIG. 3, the notification unit 40 causes the message display area M provided in a part of the window of the mailer 300 to display a message indicating the output result. Further, since the character string extracted by the character string extraction unit 20 does not have a malicious character string, the content of the mail instructed by the user to display the mail is displayed in the window of the mailer 300.

FIG. 4 is a diagram showing a display example that the notification unit 40 displays on the display unit 200 when a malicious character string is included. Even when the malicious character string is included, the notification unit 40 causes the message display area M to display a message indicating the output result, as in the case where the malicious character string is not included. As shown in FIG. 4, the notification unit 40 inputs the character string extracted by the character string extraction unit 20 and the character string into a separate window W different from the mailer 300 in the display unit 200 displaying the mailer 300. The output result of the learning model to be used is associated with the output result and displayed on the display unit 200. As a result, the user of the communication terminal 1 can check the output result without operating the window for displaying the mailer 300.

The notification unit 40 displays the character string extracted by the character string extraction unit 20 in the separate window W in a selectable manner. For example, when the character string extracted by the character string extraction unit 20 is a URI, the user of the communication terminal 1 can access the site indicated by the URI by selecting the character string.

Specifically, when the character string displayed by the notification unit 40 in the separate window W is selected, the launcher unit 60 starts an application determined according to the type of the selected character string. Here, a specific example of the "application determined according to the type of the selected character string" is a web browser when the character string is a URI, and a call application when the character is a telephone number. When the character string is an e-mail address, the launcher unit 60 causes the display unit 200 to display the e-mail creation screen (not shown) of the mailer 300 via the display control unit 50. As a result, the user of the communication terminal 1 can start an application for directly accessing the information indicated by each character string from the separate window W without searching for the character string from the window displaying the mailer 300. ..

FIG. 5 is a diagram showing an example of another window W to be displayed on the display unit 200 by the notification unit 40 when a malicious character string is included. FIG. 5 shows that the notification unit 40 is superimposed on the window showing the mailer 300, and the separate window W is displayed on the display unit 200. As shown in FIG. 5, it is clearly shown in the separate window W that the mail is suspected to be fraudulent mail. The user of the communication terminal 1 can access the information indicated by the character string by selecting the character string displayed in the separate window W.

Here, when the output result of the learning model in which the selected character string is input is malignant, the notification unit 40 displays a new window NW in the display unit 200 in which whether or not to start the application can be selected. Display.

FIG. 6 is a diagram showing a screen example for the notification unit 40 to select whether or not to start the application to be displayed on the display unit 200. As shown in FIG. 6, the notification unit 40 superimposes the new window NW on the window showing the mailer 300 so that the display unit 200 displays the new window NW. In the new window NW, a message calling attention to the fact that the character string selected by the communication terminal 1 is malignant is also displayed, and the notification unit 40 can call the communication terminal 1 to call attention to access. In the new window NW, the communication terminal 1 can also revoke access to the information indicated by the selected character string.

In this way, if the output result of the learning model that inputs the selected character string is malignant, the notification unit 40 warns the user when the user tries to access the information indicated by the character string from the new window NW. It can encourage arousal. At this time, if the user can directly access the information indicated by the character string from the character string displayed on the display unit of the mailer 300, the notification unit 40 may lose the opportunity to call the user's attention.

Therefore, when the notification unit 40 displays the character string on the display unit 200 in a manner that can be selected in a window different from the mailer 300, the operation restriction unit 70 prohibits the user's selection operation in the window displaying the mailer 300. do. As a result, the operation restriction unit 70 can reduce the situation where the user mistakenly operates the learning model and the output result of the learning model accesses the information indicated by the malicious character string.

By the way, when the user accesses the information indicated by the character string whose output result of the learning model is benign, the communication terminal 1 may start a normal application. On the other hand, when the user accesses the information indicated by the malicious character string in the output result of the learning model, it is preferable that the communication terminal 1 provides the user with a secure environment.

Therefore, even if the type of the selected character string is the same, the launcher unit 60 may start a different application if the output result of the learning model that inputs the character string is different. More specifically, the launcher unit 60 is a device installed in the DMZ (DeMilitarized Zone) segment in the network to which the communication terminal 1 is connected when the output result of the learning model inputting the selected character string is malignant. Launch the application. The notification unit 40 causes the display unit 200 to display the output result of the application executed by the device installed in the DMZ segment.

FIG. 7 is a schematic diagram for explaining the DMZ. Since the DMZ is a known technique, detailed description thereof will be omitted, but as shown in FIG. 7, an area sandwiched between two firewalls F existing between a communication terminal 1 and a public communication network N such as the Internet. Is the DMZ segment.

In the DMZ segment, an application server 4 that executes an application for accessing the information indicated by the malicious character string in the output result of the learning model is installed. Even if the application server 4 executes a web browser application to access a malicious website, the communication terminal 1 is not affected by the website. Since the notification unit 40 acquires the result executed by the application server 4 in the form of an image and displays it on the display unit 200, the user of the communication terminal 1 can safely confirm the result of accessing the information indicated by the malicious character string. be able to.

<Processing flow of information processing method executed by communication terminal 1>
FIG. 8 is a flowchart for explaining the flow of the mail confirmation process executed by the communication terminal 1 according to the embodiment. The process in this flowchart starts, for example, when the mailer 300 is activated.

The display operation detection unit 10 waits for the user of the communication terminal 1 to perform a mail display operation on the mailer 300 (S2). While the display operation detection unit 10 does not detect the display operation (No in S4), the display operation detection unit 10 returns to step S2 and continues to wait for the mail display operation by the user.

When the display operation detection unit 10 detects the display operation (Yes in S4), the character string extraction unit 20 selects a character string in a predetermined specific format from the character strings included in the mail to be the display operation. Is extracted (S6). The character string determination unit 30 transmits the character string extracted by the character string extraction unit 20 to the determination server 3 (S8).

The character string determination unit 30 acquires an output result when the character string extracted by the character string extraction unit 20 is input to the machine learning model for determining benign or malignant of the character string from the determination server 3 (S10). The notification unit 40 associates the output result acquired by the character string determination unit 30 from the determination server 3 with the character string extracted by the character string extraction unit 20 and displays it in a window different from the mailer 300 (S12).

When the user selects the displayed character string (Yes in S14) and the output result of the learning model using the character string as an input is malignant (Yes in S16), the notification unit 40 determines the type of the selected character string. A new window for confirming to the user whether or not to start the application determined according to the above is displayed on the display unit 200 (S18).

If the user chooses to launch the application (Yes in S20), or if the output result of the learning model that inputs the character string selected by the user is benign (No in S16), the user can use the launcher unit 60. Start the application corresponding to the selected character string (S22).

When the user does not select the displayed character string (No in S14), the user does not select to start the application (No in S20), or the launcher unit 60 starts the application, the process in this flowchart ends. do.

<Effects of the communication terminal 1 according to the embodiment>
As described above, according to the communication terminal 1 according to the embodiment, it is possible to achieve both the convenience of the user who uses the e-mail and the suppression of access to the malicious information contained in the e-mail.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes can be made within the scope of the gist. be. For example, the specific embodiment of the distribution / integration of the device is not limited to the above embodiment, and all or a part thereof may be functionally or physically distributed / integrated in any unit. Can be done. Also included in the embodiments of the present invention are new embodiments resulting from any combination of the plurality of embodiments. The effect of the new embodiment produced by the combination has the effect of the original embodiment together.

1 ... Communication terminal 2 ... Mail server 3 ... Judgment server 4 ... Application server 10 ... Display operation detection unit 20 ... Character string extraction unit 30 ... Character string judgment unit 40 ...・ ・ Notification unit 50 ・ ・ ・ Display control unit 60 ・ ・ ・ Launcher unit 70 ・ ・ ・ Operation restriction unit 100 ・ ・ ・ Email confirmation unit 200 ・ ・ ・ Display unit 300 ・ ・ ・ Mailer F ・ ・ ・ Firewall N ・ ・・ Communication network S ・ ・ ・ Email confirmation system

Claims (10)

On the computer
A character string extraction function that extracts a character string in a predetermined format from the character strings included in the e-mail that is the target of the e-mail display operation performed by the mailer that manages the e-mail.
When the character string extracted by the character string extraction function is input to a learning model machine-learned so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. The character string judgment function to acquire the output and
The learning model that notifies the output result of the learning model acquired by the character string determination function, displays the character string extracted by the character string extraction function in a selectable manner, and inputs the selected character string. If the output result of is malicious, a notification function that displays whether or not to start the application in a selectable manner, and
A program that realizes. The program
The display operation detection function that detects the display operation is further realized, and the display operation detection function is further realized.
The character string extraction function extracts the character string when the display operation detection function detects the display operation.
The program according to claim 1. The notification function displays the character string extracted by the character string extraction function and the output result of the learning model in which the character string is input in a window different from the mailer.
The program according to claim 1 or 2. To the computer
When the notification function displays a character string in a window different from the mailer in a selectable manner, an operation restriction function for prohibiting a selection operation in the window displaying the mailer is further realized.
The program according to claim 1 or 3 . The processor,
A step to extract a character string in a predetermined format from the character strings included in the e-mail that is the target of the e-mail display operation performed by the mailer that manages the e-mail, and
A step of acquiring the output when the extracted character string is input to a learning model machine-learned so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. ,
The step of notifying the output result of the acquired learning model and
A step of displaying the extracted character string in a selectable manner and displaying whether or not the application can be started in a selectable manner when the output result of the learning model in which the selected character string is input is malignant .
Information processing method to execute. A character string extractor that extracts a character string in a predetermined format from the character strings included in the e-mail that is the target of the e-mail display operation performed by the mailer that manages the e-mail.
When the character string extracted by the character string extraction unit is input to a learning model machine-learned so as to input a character string and output information indicating whether the information indicated by the character string is malignant or benign. The character string judgment unit to acquire the output and
The learning model that notifies the output result of the learning model acquired by the character string determination unit, displays the character string extracted by the character string extraction unit in a selectable manner, and inputs the selected character string. If the output result of is malicious, a notification unit that displays whether or not to start the application in a selectable manner ,
Email confirmation device that realizes. A display operation detection unit that detects the display operation is further realized.
The character string extraction unit extracts the character string when the display operation detection unit detects the display operation.
The mail confirmation device according to claim 6 . The notification unit displays the character string extracted by the character string extraction unit and the output result of the learning model using the character string as an input in a window different from the mailer.
The mail confirmation device according to claim 6 or 7 . When the output result of the learning model in which the selected character string is input is malignant, the notification unit displays a new window that displays whether or not to start the application in a selectable manner.
The mail confirmation device according to claim 8 . When the notification unit displays a character string in a window different from the mailer in a selectable manner, an operation restriction unit for prohibiting a selection operation in the window displaying the mailer is further realized.
The mail confirmation device according to claim 8 or 9 .

Images