KR100576316B1 - Spam webmail blocking apparatus based of network through analyzing web contents - Google Patents

Abstract

The present invention is installed in a router or gateway operated by an autonomous system such as an Internet service provider, and inspects web content passing through it, and blocks it if it is determined to be spam mail, thereby dramatically improving the blocking efficiency of spam mail. The present invention relates to a network-based anti-spam device through web content analysis.

The network-based spam mail blocking device through the web content analysis of the present invention is installed in a router / gateway of an autonomous system, and includes a webmail analysis server and a spam / virus blocking server, wherein the webmail analysis server is the router. It is determined whether the web content received from the gateway is mail content or general content. If the web content is general content, the web content is delivered to the router / gateway. And the spam / virus blocking server determines whether the received mail content is spam mail or virus mail. If the mail is normal, the spam / virus blocking server delivers the mail content to the router / gateway. In the case of mail or virus mail, The blocking one content.

Web Content, Analytics, Network, Webmail, Spam, Virus, Block

Description

Spam webmail blocking apparatus based on network through analyzing web contents}

1 is a network diagram illustrating a network-based spam blocking device based on web content analysis of the present invention;

2 is a flowchart illustrating an operation of a network-based spam blocking device through web content analysis.

*** Explanation of symbols on main parts of drawing ***

10: web browser,

20: autonomous system,

30: router or gateway, 40: mail processing agent,

41: web mail analysis server, 42: spam / virus blocking server,

43: virus filter DB, 44: spam filter DB,

50: internet, 60: webmail server,

70: Member DB

The present invention relates to a network-based spam mail blocking device through web content analysis. In particular, web content analysis for blocking spam or virus infected mail distributed in the form of web mail by analyzing the content of web content at the network level It relates to a network-based spam blocking device through.

In recent years, with the rapid development of the communication environment, electronic mail is widely used. In such an e-mail system, an e-mail sent by an originating client through an internal mail server or an external mail server is represented by an e-mail address of a receiving mail client by the Simple Mail Transfer Protocol (SMTP). Stored after being transferred to a mailbox on an internal or external mail server. Thereafter, the receiving mail client can access his mailbox via the Internet and read the e-mail stored there.

On the other hand, the receiving client reads the received e-mail by the POP3 (Post Office Protocol # 3; mail server), which copies the e-mail stored in the mailbox of the mail server to the hard disk of the mail client computer. Post Office Protocol for receiving e-mails from the Internet, and IMAP (Internet Message Access Procotol) for making self-received e-mails stored in a mailbox without having to copy them to the mail client's computer. This type of POP3 or IMAP is commonly adopted by internal mail server systems.

Recently, in addition to IMAP, a web mail service has appeared to store incoming mail on the Internet and make it accessible from anywhere. Briefly, the web mail service is a combined service of a mail server and a web server. In other words, the webmail server seen from the mail client has the same form as a general web server. Thus, the mail client only needs a web browser to access the webmail server, and no e-mail software is required. These webmail services are usually provided free of charge at various portal sites or ISPs (Internet Service Providers) as a means of attracting customers, and may be provided for a fee for commercial use.

On the other hand, as e-mail is becoming more common, various spam mails are on the rise. Spam mail refers to e-mail that promotes unhealthy sites such as commercial advertisements or promotional mails or adult sites that the recipient does not want to receive. . Since spam mails are sent indiscriminately to a large number of unspecified people, the spam mails have undesired harm to the recipients, and particularly, in the case of unhealthy site promotion mails, there is a problem that seriously harms the education of children. To solve this problem, the government regulates the display of [advertisement] or [adult advertisement] in the subject of spam mail. In addition, there is a problem that serious damage to the user's PC when the e-mail infected by various viruses are spread.

Meanwhile, in order to protect users from such spam mails or virus infected mails (hereinafter referred to simply as 'virus mails'), software for blocking spam mails or virus mails in advance has been developed and widely used. Software is typically installed and operated on a user's PC. The spam mail blocking software lists site addresses of various web mail servers that provide web mail services. The spam mail blocking software has a predetermined cycle when there is a web mail server site subscribed to by the user. After automatically logging in to the webmail server, the mail is read and inspected, and as a result, if it is determined to be spam, the user is blocked or notified to the user. Here, the determination of the spam mail is performed by the presence or absence of a specific keyword of the self setting or the user setting, for example.

However, according to the conventional spam mail blocking method as described above, a new web mail server site that is not listed in the spam mail blocking software is newly opened, and a user can newly register or change the address of an existing web mail server site. In this case, even if the anti-spam software developer does not check or update the webmail server's site address at that time or updates it, the user cannot block the spam mail unless the user downloads and updates it on his PC. There was a problem.

The present invention has been proposed to solve the problems of the prior art, and an object of the present invention is to install a router or gateway operating in an autonomous system such as an Internet service provider, and inspect the web content passing therethrough and determine that it is spam. In this case, it is to provide a network-based spam mail blocking device through web content analysis that can dramatically block spam mails by blocking them.

Network-based spam mail blocking device through the web content analysis of the present invention for achieving the above object is installed in the router / gateway of the autonomous system, including a webmail analysis server and spam / virus blocking server, The webmail analysis server determines whether the web content received from the router / gateway is mail content or general content. If the web content is general content, the webmail analysis server delivers the web content to the router / gateway. If the message is delivered to the spam / virus blocking server, the spam / virus blocking server determines whether the received mail content is spam or virus mail, and if the result is normal mail, the router / gateway. Deliver the mail content and send spam or bar In the case of e-mail, the mail content is blocked.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the network-based spam mail blocking device through the analysis of the web content of the present invention.

Figure 1 is a network configuration that implements a network-based spam mail blocking device through the analysis of the web content of the present invention. As shown in FIG. 1, according to a network configuration in which a network-based spam mail blocking device through a web content analysis of the present invention is implemented, various web mail servers 60 providing a web mail service are connected to the Internet 50. A user PC that is connected and installed in a home, business, or school refers to a set of routers and networks that are unified with an autonomous system (one management policy). According to this definition, an ISP is also an AS number as an AS. 20, i.e., access to the webmail server 60 through various access networks provided by ISPs or corporate private networks, for example, PSTN, ISDN, wireless networks, or optical / coaxial cable networks. In the autonomous system 20 or the like for routing, the router or gateway 30 is operated. A user's PC should have a predetermined web browser 10, for example, Microsoft's Internet Explorer.

On the other hand, the mail processing agent 40 of the present invention is installed in such a router / gateway 30 to operate with the router / gateway 30, largely webmail analysis server 41 and spam / virus blocking server 42 ), A spam filter DB 44 storing various data for determining spam mail and a virus filter DB 43 storing various data for determining whether a virus is infected. In the above-described configuration, the webmail analysis server 41 receives the web content from the router / gateway 30 and analyzes whether it is mail content or general content (non-mail content). It is handed over to the router / gateway 30 to be processed by the web browser 10, and in the case of mail contents, it is handed over to the spam / virus blocking server 42 to check whether spam mail is present. The spam / virus blocking server 42 analyzes the contents of the mail contents handed over from the web mail analysis server 41 by various data in the spam filter DB 44 and the virus filter DB 43 to detect spam or virus mail. If it is determined whether or not the spam mail or virus mail is not delivered to the router / gateway 30, it is delivered to the router / gateway 30 only in the case of normal mail. Of course, even if it is determined that the spam mail may be delivered to the router / gateway 30 with a message called spam mail so that the user can finally choose whether or not to read the spam mail. In FIG. 1, reference numeral 70 denotes a member DB in which member related information operated by the webmail server 60 is stored.

Figure 2 is a flowchart for explaining the operation of the network-based spam mail blocking device through the analysis of the web content of the present invention, the mail processing agent 40 is performed as a subject unless otherwise described. First, in order to receive a webmail service, a user runs a web browser 10 on his PC, accesses a webmail server 60 to which he subscribes, and selects to read mail. Accordingly, the webmail server 60 In the mail information, such as various information related to the mail stored in the user's mail account, such as 'Inbox', 'Sent Mail' or 'New Letter', etc. in the form of web content to the web browser 10 of the user's PC Will be sent. In this state, when the user selects, for example, 'inbox' or 'new letter', the webmail server 60 again provides information related to this, for example, information such as 'sender' or 'title'. It is delivered to the web browser 10 of the PC. In this state, when a user selects a subject of a mail to be read and requests the user to deliver the details of the mail, the URL information linked here is sent to the webmail server 60 via the router / gateway 30. In response, the webmail server 60 delivers the contents of the mail to the web browser 10 of the user PC via the router / gateway 30 in response to the request.

On the other hand, the format in which the web browser 10 of the user PC requests web content from the web mail server 60 may be, for example, "GET http: // (URL) HTTP / 1.1". The format in which the server 60 responds to this request, that is, the format in which the requested web content is delivered, may be, for example, "HTTP / 1.1 ...". As a result, the router / gateway 30 can check the request format or the response format and check the web content delivered from the webmail server 60 as a response. Thus, the webmail server 60 delivers the response. If the web content is passed, it is handed over to the mail processing agent 40 to request whether it is spam or virus mail.

On the other hand, the web mail analysis server 41 of the mail processing agent 40 determines whether or not the web content is received in step S11, that is, determine whether there is delivery of the web content from the router / gateway 30 is received If it is, step S12 is performed again to determine whether the web content is mail content. This judgment is equivalent to the header of the SMTP content (hereinafter referred to as 'header equivalent') in the contents of the web content, such as the phrase 'sender', 'recipient' and 'title', or equivalent. This may be done by the presence or absence of a statement.

As a result of the determination in step S12, if the web content is general content instead of mail content, the web mail analysis server 41 does not need to check the content and returns it to the router / gateway 30 as it is. After that, the router / gateway 30 transmits it to the web browser 10 of the user PC. On the other hand, as a result of the determination in step S12, when the web content is mail content, the webmail analysis server 41 delivers the mail content to the spam / virus blocking server 42 to determine whether it is spam or virus mail. After requesting to check, the spam / virus blocking server 42 checks whether the mail content is spam mail by the spam filter DB 43 in step S13. In this step S13, the determination of whether or not the spam mail may be performed by, for example, whether a predetermined spam phrase exists in the content of the mail.

As a result of the determination in step S13, when the mail content corresponds to spam mail, the spam / virus blocking server 42 transmits a predetermined phrase to the router / gateway 30 to guide the spam mail instead of the spam mail. do. On the other hand, if the mail content is not spam mail, the spam / virus blocking server 42 performs step S15 to determine by the virus filter DB 44 whether the mail is a virus mail. As a result of the determination in step S15, when the mail is a virus mail, the spam / virus blocking server 42 performs the step S16 and instead of sending the mail, a notification message indicating that the mail is a virus mail is displayed on the router / gateway 30. ). On the other hand, if it is not a virus mail, it corresponds to a normal mail. Therefore, step S17 is performed to deliver the mail to the router / gateway 30, and the router / gateway 30 transmits the mail to the web browser 10 of the user PC. Users will be able to read the contents of webmail normally.

Through the web content analysis of the present invention, the network-based spam mail blocking device is not limited to the above-described embodiments, but may be variously modified and implemented within the range allowed by the technical idea of the present invention.

According to the network-based spam mail blocking device through the web content analysis of the present invention as described above, the spam / virus blocking software for webmail is not based on the user PC but based on a network called an autonomous system. As a result, the original blocking of spam / viruses is possible.

 That is, spam mail or virus mail can be blocked regardless of the change of the address of the web mail server site, the opening of a new web mail server site, or the existence of a web mail service having a different form from the existing protocol.

Claims (2)

delete Installed in the router / gateway of the autonomous system, including webmail analysis server and spam / virus blocking server, The webmail analysis server classifies the web content into mail content or general content according to whether a web header received from the router / gateway includes a predetermined mail header equivalent portion, and the web content is general content. In the case of delivering the web content to the router / gateway, and in the case of the mail content delivered to the spam / virus blocking server, The spam / virus blocking server determines whether the received mail content is spam mail or virus mail. If the mail is normal, the spam / virus blocking server delivers the mail content to the router / gateway. In the case of the network-based spam mail blocking device through the web content analysis to block the mail content.

Images