KR100702661B1 - Method for preventing spam through assumption of IP address from domain information - Google Patents

Abstract

The present invention relates to a method and a system for blocking spam mail sent from a plurality of IP addresses. Specifically, the method includes: (a) obtaining a sending IP address of a received mail and domain information of a sender described in the mail; (b) querying a predetermined IP address that can be extracted using the sender's domain information described in the mail; (c) comparing a predetermined area selected by a predetermined criterion among the inquired IP addresses with a corresponding area of the sending IP address; And (d) processing the received mail as spam mail if the predetermined area of the inquired IP address and the corresponding area of the sending IP address are not the same. A method for preventing and a system for the same.

According to the present invention, there is an advantage that a spam mail sender sends his own spam mail through a general PC, not a mail server, to block spam mail that is not blocked by a conventional statistical spam blocking filter.

Spam, Block, IP Address

Description

Method for preventing spam through estimation of domain IP domain and its system {Method for preventing spam through assumption of IP address from domain information}

1 is a block diagram showing the configuration of the system of the present invention.

2 to 5 are flow charts showing one embodiment of the method of the present invention.

6 is a view for explaining an embodiment of the present invention.

7 and 8 show the scheme of an IP address.

The present invention relates to a method and system for blocking spam mail, and more particularly, to a method and system for blocking spam mail sent from an IP address rather than a normal mail server.

With the recent increase in the use of the Internet, many Internet users suffer from indiscriminate spam mails. Spam mail refers to an e-mail that delivers a large amount of information regardless of the user's will regardless of whether the content is commercial or non-commercial. Senders who send spammy advertisements send a lot of mails unlike general mail servers, because the advertisements need to be sent in bulk.

When a lot of mail comes in from a short time on a particular computer (ie a specific IP address), most spam blocking systems detect it and immediately block it. The blocking system used at this time is called a statistical spam blocking filter. Because of the widespread use of statistical spam filters, spammers have recently realized that sending large amounts of spam from one computer (one IP) is less effective as a spammer.

More advanced spammers send small amounts of mail using a large number of PCs (hereafter referred to as a large number of IP addresses) rather than repeatedly sending to a specific IP address in order for their messages to look the same as normal mail. The method was used. In a specific way, a very large number of PCs can be used to infect advertising PCs in the form of viruses and then send spam through those PCs.

In case of sending spam mail in the above manner, spam mail is sent from very many PCs, and only a few spam mails are sent from each IP address. Therefore, a large amount of mail is received from one IP address. There is a problem that can not be blocked by the current spam blocking system that only processes as spam.

In order to solve the above problems, an object of the present invention is to provide a method for processing spam mails even if spam mails are received from PCs having different IP addresses.

Another object of the present invention is to provide a system capable of implementing the above method.

In order to achieve the above object, the present invention comprises the steps of: (a) obtaining the sending IP address of the received mail and the domain information of the sender described in the mail; (b) querying a predetermined IP address that can be extracted using the sender's domain information described in the mail; (c) comparing a predetermined area selected by a predetermined criterion among the inquired IP addresses with a corresponding area of the sending IP address; And (d) processing the received mail as spam mail if the predetermined region of the inquired IP address and the corresponding region of the sending IP address are not the same. Provides a way to prevent spam mail.

Here, the step (b) includes (ba) receiving hint information which is information that can be described in the domain information of the sender described in the mail; (bb) configuring a predetermined domain name by using the hint information and the domain information, and searching an IP address corresponding to the configured domain name; and may include the domain information of the sender described in the mail. (B) receiving hint information that is information that can be written in the sender's domain information described in the mail; (bb) configuring a predetermined domain name using the hint information and the domain information, and searching an IP address corresponding to the configured domain name; And (bc) inquiring a mail exchange field (MX field) using the sender's domain information described in the mail to look up an IP address.

Also, the step (c) may include (ca) extracting a continuous and common region from the most significant bits of the plurality of inquired IP addresses when there are a plurality of IP addresses inquired through the step (b); And (cb) comparing an area corresponding to the extracted area among the IP address areas of the received mail with an area extracted from the inquired IP address.

Further, in the step (c), it is preferable that the predetermined area selected by the predetermined criterion is an address area from the most significant bit to a predetermined bit among the areas of the IP address.

In addition, in the step (c), the predetermined area selected by the predetermined criterion is an address area up to an upper bit corresponding to the network address area of the class to which the originating IP address or the inquired IP address belongs.

In addition, when there are a plurality of IP addresses inquired in the step (b), the step (d) corresponds to a corresponding area of the sending IP address among the predetermined areas of the inquired plurality of IP addresses. If not, it is desirable to treat the mail as spam.

On the other hand, the present invention to achieve the above object is an input means for obtaining the sending IP address of the received mail and the domain information of the sender described in the mail; IP address lookup means for searching a predetermined IP address that can be extracted using the sender's domain information described in the mail; IP address comparing means for comparing a predetermined area selected by a predetermined criterion among the inquired IP addresses with a corresponding area among the sending IP addresses; And spam mail processing means for processing the received mail as spam mail if the predetermined area of the inquired IP address and the corresponding area of the sending IP address are not the same. Provides a spam mail prevention system.

Here, the spam mail prevention system further includes hint information storage means for storing hint information, which is information that can be described in the domain information of the sender described in the mail, wherein the IP address lookup means is connected to the hint information storage means. It is preferable to configure a predetermined domain name by using the stored hint information and the domain information, and to query an IP address corresponding to the configured domain name.

In addition, the IP address lookup means preferably inquires the IP address by performing a mail exchange field (MX field) query using the sender's domain information described in the mail.

The IP address comparing means extracts a contiguous and common area from the most significant bit of the plurality of inquired IP addresses when there are a plurality of IP addresses inquired through the IP address lookup means. It is preferable to compare an area corresponding to the extracted area among the sending IP address areas with an area extracted from the inquired IP address.

Further, it is preferable that the predetermined area selected by the predetermined criterion in the IP address comparing means is an address area from the most significant bit to a preset bit in the area of the IP address.

Further, when there are a plurality of IP addresses inquired by the IP address lookup means, the spam mail processing means is identical to a corresponding area of the originating IP address among respective predetermined regions of the inquired plurality of IP addresses. If not, it is desirable to treat the mail as spam.

On the other hand, in order to achieve the above object, the present invention provides a computer readable recording medium having recorded thereon a program for realizing the above method.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of the system of the present invention.

The system of the present invention comprises an input means 101, an IP address lookup means 102, a hint means 103, an IP address comparison means 104, and may further comprise a domain name database 110. .

When the mail is received, the input means 101 obtains the sending IP address of the received mail and domain information of the sender described in the mail.

When the mail server receives mail from another mail server, both mail servers are connected to each other by the Internet protocol. In this process, the receiving server knows the IP address of the server sending the mail. The input means 101 extracts the sending IP address of the mail obtained in this process.

The conventional statistical spam blocking filter compares only the IP addresses thus obtained, and when it is determined that a plurality of mails are sent from the same IP address, it is treated as spam mail. Therefore, each spam mail is transmitted through a different PC (another IP). In this case, it could not be treated as spam.

In order to solve this problem, the present invention extracts the IP address from the domain information described in the mail in addition to the sending IP address and compares both to determine whether the message is spam mail.

To this end, the input means 101 of the present invention obtains the domain information from the mail address described by the sender in each received mail in addition to the sending IP address of the received mail. If the sender's e-mail address is written in abc@abc.com format, then the abc.com part is the domain information.

In the case of normal mail, such domain information becomes domain information used by an outgoing mail server. However, in the case of a spammer, a spam mailer modifies the domain information so that the mail is sent to a desired domain name. Therefore, the domain information corresponding to the IP address to which the mail is actually sent differs from the domain information described in the mail.

In the case of the conventional statistical spam blocking filter, the domain information described in the mail is not necessary because only the sending IP address of the mail is used to determine whether the spam mail is used. However, in the present invention, the spammer sends the spam mail to the desired domain name. The domain described by the sender is different from the PC to which the mail is sent, but the IP address of the PC to which the mail is actually sent will be processed so that even the spam mail that cannot be processed by the conventional statistical spam blocking filter is processed. Use the information to block spam.

The IP address lookup means 102 inquires a predetermined IP address that can be extracted using the sender's domain information described in the received mail obtained by the input means 101.

When retrieving an IP address, a predetermined domain name database 110 that stores a domain name and an IP address corresponding to the domain name is used. In order to inquire this IP address, the domain name database 110 may be built in the system itself and inquired using the same.

However, it is difficult for a system operator to continuously update and update the database by collecting domain names and IP addresses that are added or changed. Therefore, without establishing a separate database in the system, an IP address is established by connecting to a DNS (Domain Name Server) through the Internet. It is more desirable to have it queried.

There are several ways to look up an IP address using the domain information described in the mail.

First, MX (Mail Exchange) field lookup can be performed using domain information. The MX field inquiry is to inquire the IP address of the receiving mail server using the domain using the domain information described in the mail. That is, in the above example, if the MX field is queried to DNS 110 using domain information of abc.com, the IP address of the receiving mail server can be queried among the mail servers corresponding to the domain information.

If the incoming mail server and the outgoing mail server of the server that sent the mail are the same, and the mail normally sent, the IP address thus obtained (or one of the IP addresses when multiple IP addresses are queried) is input means. It will exactly match the sending IP address obtained at 101, but will not match if the spam mail user sends the mail through another person's PC.

Therefore, if the incoming mail server and the outgoing mail server of the server that sent the mail are the same, it is possible to determine whether the received mail is spam mail only by looking up the MX field. If the mail servers are not the same, you can use other methods besides MX field lookup.

Alternatively, the domain name can be estimated from the domain information described in the mail, and the IP address can be retrieved using the domain name.

That is, the domain name of the web server used by the mail user using abc@abc.com is likely to be www.abc.com, and the mail server is likely to be mail.abc.com or mailserver.abc.com.

If a domain name such as www, mail, mailserver, etc. is added in front of abc.com, which is the domain information described in the mail, a possible domain name is formed, and if the A field query is performed on the DNS 110 using the domain name configured as described above, The IP address corresponding to the name can be inquired.

In the present invention, the words www, mail, mailserver, etc. are called hint information, which is input by the operator of the system of the present invention and stored in the hint means 103. In addition to the above examples, various hint information may be stored, and the type of the hint information stored may be arbitrarily determined by an operator of the system.

The IP address lookup means 102 constructs a domain name using the domain information obtained from the input means 101 and the hint information stored in the hint means 103, and uses the domain name to construct the DNS name. Inquire A field and perform IP address inquiry.

The IP address lookup means 102 may perform the IP address lookup of the receiving mail server through the MX field lookup described above and the IP address lookup through the A field lookup.

The IP address comparing means 104 compares a predetermined area selected by a predetermined criterion among the IP addresses queried by the IP address lookup means 102 with a corresponding area of the sending IP addresses obtained by the input means 101. do.

The area used for the comparison can be set variously by the setting of the operator.

First, a network address area of a class to which the dispatching IP address obtained through the input means 101 and the inquired IP address belongs may be extracted and compared with each other. The network address of class A starts with binary 0 (first octet range: 00000001 to 01111110), and the class B network address starts with binary 10 (first octet range: 10000000 ~ 10111111), and the class C network address Starting with the binary number 110 (the range of the first octet: 11000000 to 1101111111), the originating IP address and the lookup IP address can be used to determine which class the IP address belongs to, and thus the network address area of the identified class. Can be extracted and compared.

An example is demonstrated using FIG. 7 and FIG. Since the IP addresses shown in FIGS. 7 and 8 are addresses of the C class area, the areas corresponding to the upper 24 bits, which are the network address areas of the C class (192.1228.17 in FIG. 7 and 11000000.11100100.00010001 in FIG. 8) are compared. do.

In addition, the area to be compared in advance is set by the operator of the system, and the area corresponding to the set area among the dispatched IP address and the inquired IP address obtained through the input means 101 may be extracted and compared with each other.

An example is demonstrated using FIG. 7 and FIG. 7 and 8 illustrate a system of IP addresses, FIG. 7 is shown in decimal form, and FIG. 8 is shown in binary form.

If the operator sets only the upper 8 bits, that is, the address area corresponding to the network address area of the A class level, the area corresponding to the upper 8 bits of the sending IP address and the inquiry IP address (192 in FIG. 7 and FIG. 8). 11000000) is compared with each other.

In addition, when the system operator sets only the upper 16 bits, that is, the address area corresponding to the network address area of the B class level, as the area to be compared, the area corresponding to the corresponding area (192.228 in FIG. 7 and 11000000.11100100 in FIG. 8). Is compared, and if only the address area corresponding to the upper 24 bits, that is, the C class level network address area is set as the comparison area, the corresponding area (192.228.17 in FIG. 7 and 11000000.11100100.00010001 in FIG. 8) is included. The corresponding areas are compared.

In addition, many network systems are assigned an IP address using a subnet mask due to the convenience of routing, etc., and therefore, it is not necessary to set the unit in units as shown in FIGS. 7 and 8. The comparison target area may be set in units. For example, the most significant bit to 26 bits (11000000.11100100.00010001.00 in FIG. 8) may be set as a comparison target.

As another method of setting the area to be compared, when a plurality of IP addresses are inquired, an area matching each other among the inquired IP address areas is extracted, and an area extracted from the sending IP addresses obtained through the input means 101. It can be compared with the area corresponding to.

Referring to FIG. 6, when the IP address lookup means 102 of the system 100 of the present invention looks up the DNS 110 to the IP addresses 60.92.1.27, 60.92.3.10, and 60.92.3.11, these three IPs are used. You can extract matching areas from addresses and use them to perform comparisons.

In this case, how to extract the area to be compared may be determined by the operator of the system. For example, if the extraction is performed in fixed bit units (8 bits, 16 bits, and 24 bits) corresponding to the network address area of the class, only the area corresponding to the upper 16 bits (60.92) will be compared in the above example. .

In addition, the above three addresses are 00111100.01011100.00000001.00011011, 00111100.01011100.00000011.00001010 and 00111100.01011100.00000011.00001011 when extracted in the common bit unit, so the area to be compared is the area from the most significant bit to the 22nd bit (00111100.01011100.000000). will be.

The IP address of the web server or the incoming mail server will be similar. However, if there are multiple outgoing mail servers but all IP addresses are not inquired through the IP address lookup means 102, the outgoing mail server will not be viewed. There is also a possibility that the address will have an address other than the above-mentioned range. For example, if the IP address of an outgoing outgoing mail server is 00111100.01011100.00000111.00001111 (60.92.7.15), an error may occur in the above case.

Therefore, when extracting a comparison target area in units of common bits, it is preferable to set the comparison target area to be smaller than a matching area among the inquired IP addresses in order to prevent an error from occurring. For example, if the matching area is 00111100.01011100.000000 as in the above example, the comparison target area may be set to be 00111100.01011100.000 by setting 3 bits less than the matching area.

When a plurality of IP addresses have been queried but there is no address area that is common to each of the queried IP addresses, each area extracted by extracting an area preset by the operator of the system from each IP address as an area to be compared It is desirable to compare the data with the corresponding area of the sending IP address.

The spam mail processing means 105 uses the result compared in the IP address comparison means 104 to compare any of the areas to be compared with one or more IP addresses whose area to be compared with the source IP address is inquired using the domain information described in the mail. If no match is found, it is treated as spam. In other words, such mail is different from the IP address of the PC that is actually sent and the IP address estimated from the domain information described in the mail, that is, a spammer infiltrates another PC by sending a virus or the like to another PC. Corresponds to the e-mail sent through the mail will be treated as spam.

The method of treating as spam mail may cause the spam mail to be deleted without being sent to the recipient described in the mail, or may be marked as spam mail and sent to the recipient's mailbox.

Mail determined to be not spam mail is normally delivered to the recipients listed in the mail.

2 is a flow chart illustrating a method of the present invention.

First, when the mail is received, the input means 101 obtains the sending IP address of the received mail and domain information of the sender described in the mail (201).

When the sending IP address of the mail and the domain information of the sender described in the mail are obtained, the IP address lookup means 102 inquires a predetermined IP address that can be extracted using the sender's domain information obtained by the input means 101. (202).

The process of querying the IP address has already been described with reference to FIG. 1. As shown in FIG. 3, the IP address of the receiving mail server may be inquired through MX (Mail Exchange) field inquiry (211), and as shown in FIG. 4, hint information (www, mail to be added to the domain information described in the mail). , the mail server, ...) is entered by the operator of the system received by the hint means (103) (221) to form a domain name using this (222), using the configured domain name to obtain an IP address In addition, as illustrated in FIG. 5, the IP address may be inquired in parallel with the method of FIG. 3 and the method of FIG. 4.

When the IP address is queried in this way, the IP address comparing means 104 sends out a predetermined IP selected by the predetermined means from among the IP addresses queried by the IP address lookup means 102. The corresponding area of the address is compared (203).

In the comparison, the area to be compared is extracted by the area set by the operator of the system in advance, or the area to be compared is extracted from a common area among the inquired IP addresses or a predetermined area smaller than the area. The comparison with the corresponding area of the originating IP address is already described with reference to FIG. 1.

As a result of the comparison (204), if it is determined that the sending IP address of the mail is the same in the area to be compared with at least one of the inquired IP addresses, the mail is sent to the recipient of the mail by a general mail processing procedure (205). If not, processing such as deletion is performed by processing as spam mail (206).

Figure 6 illustrates a preferred embodiment of the present invention.

As shown in FIG. 6, many mails 120 have been received in the form of xx@mydomain.com, such as aa@mydomain.com, bb@mydomain.com, and the like. In all other cases, the IP address lookup means 102 of the present invention inquires the DNS address 110 using the domain information mydomain.com described in the mail.

As a result, it is assumed that 60.92.3.11 is inquired through the MX field inquiry, 60.92.1.27 is inquired when using the hint information www, and 60.92.3.10 is inquired when the hint information mail is used.

If the area to be compared is set to the class B level (upper 16 bits) by the system operator, the address to be compared is 60.92.

Looking at the corresponding area in the sending IP address of the received mail 120,

{211.192, 211.192, 210.41, 214.92, 124.41, 129.47, 210.14, 214.92, 121.41, 129.47, 210.14, 60.92, 60.92, 129.47,... }

Becomes The mail having the same address as the IP address queried in the area to be compared is the mail 120-1 having the IP address starting with 60.92.

Therefore, the spam mail processing means 105 of the system 100 of the present invention passes only the mail 120-1 to the mail server 130, and the other mails are regarded as spam mail and blocked.

The method of the present invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, according to the present invention, there is an advantage in that a spammer sends a spam mail through a large number of PCs to block spam mail that is not blocked by a conventional statistical spam blocking filter.

Claims (16)

(a) input means for obtaining a sending IP address of the received mail and domain information of the sender described in the mail; (b) an IP address inquiry means for searching for an extractable IP address using the sender's domain information described in the mail; (c) comparing, by the IP address comparing means, a predetermined region selected by a predetermined criterion among the inquired IP addresses with a corresponding region of the sending IP address; And (d) the spam mail processing means processing the received mail as spam mail if the predetermined area of the inquired IP address and the corresponding area of the sending IP address are not the same; How to avoid spam mail by IP range estimation. The method of claim 1, wherein step (b) (ba) receiving, by the hint information storage means, hint information which is information that can be described in the domain information of the sender described in the mail; (bb) the IP address lookup means constructing a domain name using the hint information and the domain information, and searching an IP address corresponding to the configured domain name; How to stop spam via email. The method of claim 1, wherein step (b) And the IP address lookup means performs a mail exchange field (MX field) lookup using the sender's domain information described in the mail to look up an IP address. The method of claim 1, wherein step (b) (ba) receiving, by the hint information storage means, hint information which is information that can be described in the domain information of the sender described in the mail; (bb) the IP address lookup means constructing a domain name using the hint information and the domain information, and retrieving an IP address corresponding to the configured domain name; And (bc) the IP address lookup means performing a mail exchange field (MX field) inquiry using the sender's domain information described in the mail to look up the IP address; To prevent spam via e-mail. The method of claim 1, wherein step (c) (ca) the IP address comparing means, when there are a plurality of IP addresses queried through the step (b), extracting a continuous and common region from the most significant bit of the plural IP addresses queried; (cb) comparing, by the IP address comparing means, an area corresponding to the extracted area among the IP address areas of the received mail and an area extracted from the inquired IP address; How to avoid spam mail by IP range estimation. The method of claim 1, wherein the predetermined area selected by the predetermined criterion in the step (c) is an address area ranging from the most significant bit to a predetermined bit of the area of the IP address. How to prevent mail. 2. The method of claim 1, wherein the predetermined area selected by the predetermined criterion in the step (c) is an address area up to a higher bit corresponding to a network address area of a class to which the originating IP address or the inquired IP address belongs. Spam prevention method through domain IP area estimation, characterized in that. The method of claim 1, wherein when there are a plurality of IP addresses inquired in step (b), step (d) corresponds to a corresponding area of the sending IP address among respective predetermined areas of the inquired plurality of IP addresses. The method of preventing spam mail by estimating the domain IP area, characterized in that the mail is treated as spam when there is no match. Input means for obtaining a sending IP address of the received mail and domain information of the sender described in the mail; IP address lookup means for searching for extractable IP address using domain information of sender described in the mail; IP address comparing means for comparing a predetermined area selected by a predetermined criterion among the inquired IP addresses with a corresponding area among the sending IP addresses; And Through the domain IP area estimation, comprising: spam mail processing means for processing the received mail as spam mail if a predetermined area of the inquired IP address and a corresponding area of the sending IP address are not the same. Anti-spam system. 10. The method of claim 9, wherein the anti-spam system is Hint information storage means for storing hint information that is information that can be described in the domain information of the sender described in the mail; The IP address inquiry means constructs a domain name by using the hint information and the domain information stored in the hint information storage means, and inquires an IP address corresponding to the configured domain name. Anti-spam system through. The method of claim 9, wherein the IP address lookup means The spam mail prevention system by estimating a domain IP area, wherein the IP address is searched by performing a mail exchange field (MX field) inquiry using the sender's domain information described in the mail. 10. The method of claim 9, wherein the anti-spam system is Hint information storage means for storing hint information that is information that can be described in the domain information of the sender described in the mail further comprises: wherein the IP address lookup means A domain name is constructed using the hint information and the domain information, an IP address corresponding to the configured domain name is inquired, and a mail exchange field (MX field) inquiry is performed using the sender's domain information described in the mail. Spam prevention system through domain IP area estimation, characterized in that to look up the IP address. The method of claim 9, wherein the IP address comparison means When there are a plurality of IP addresses inquired through the IP address lookup means, a continuous and common area is extracted from the most significant bits of the inquired plurality of IP addresses, and the extracted IP address area of the received IP address is extracted. Spam prevention system through domain IP area estimation, characterized in that the area corresponding to the area and the area extracted from the inquired IP address is compared. 10. The method according to claim 9, wherein the predetermined area selected by the predetermined criterion in the IP address comparing means is an address area from the most significant bit to a predetermined bit in the area of the IP address. Anti-spam system. 10. The method of claim 9, wherein when there are a plurality of IP addresses inquired by the IP address lookup means, the spam mail processing means corresponds to a corresponding area of the originating IP address among respective predetermined regions of the inquired plurality of IP addresses. Anti-spam system by domain IP area estimation, characterized in that the mail is treated as spam when there is no match. A computer-readable recording medium having recorded thereon a program for realizing the method according to any one of claims 1 to 8.

Images