KR101086547B1 - System and method for processing spam by analysis of accompanying url in mail - Google Patents

Abstract

Disclosed are a system and method for processing spam by analyzing URLs attached to mail. The spam processing system includes: a collecting unit for collecting a domain of a reporting URL, which is a URL (uniform resource locator) attached to a spam reported mail, and a server IP set to be connected through the reporting URL; A URL analyzer configured to analyze a server configured to be connected through a domain of a received URL, which is a URL attached to a received mail received in real time, using the domain of the collected report URL and a server IP; And a spam processing unit for spamming the received mail according to the domain and server of the analyzed received URL.

Mail, spam, URL, hacked site, domain, IP

Description

SYSTEM AND METHOD FOR PROCESSING SPAM BY ANALYZING A BRL attached to E-mail {SYSTEM AND METHOD FOR PROCESSING SPAM BY ANALYSIS OF ACCOMPANYING URL IN MAIL}

Embodiments according to the present invention relate to a system and method for processing spam by analyzing URLs attached to the contents of an electronic mail.

With the development of high speed internet network, users can use the internet anytime and anywhere. In particular, the e-mail service is one of the Internet services that users use most, and is one of the services that can quickly transfer text and files to other users.

In recent years, the capacity of electronic web mail services has gradually increased, and the types of services have been gradually diversified. In the early days, e-mail services were mainly used for personal use. However, as convenience and advantages of e-mail are known, in recent years, e-mail has become an essential means of communication in business.

Openness to free text and file exchange with anyone is an advantage of e-mail, but it can also be used to e-mail spam, such as sending random e-mails or posting advertising information to a large number of people. It is a big inconvenience for mail users.

E-mail users have to designate and delete such spam mails, and it takes a lot of time to delete spam mails, and there is a need for a faster and more efficient way of dealing with spam and mails that users do not need. have.

A spam processing system and method are provided that can automatically detect spam mail even if the user does not specify the spam mail.

There is provided a spam processing system and method for analyzing spam URLs attached to mail contents more accurately and efficiently.

Spam processing system according to an embodiment of the present invention, the domain of the report URL that is a URL (uniform resource locator) attached in the spam-reported mail, and the collecting unit for collecting the server IP set to be connected through the report URL; A URL analyzer configured to analyze a server configured to be connected through a domain of a received URL, which is a URL attached to a received mail received in real time, using the domain of the collected report URL and a server IP; And a spam processing unit for spamming the received mail according to the domain and server of the analyzed received URL.

According to an aspect of the present invention, the report URL means a URL configured to link to a spam advertisement site provided by the spammer, which is composed of a domain of a normal site hacked by a spammer and a service page address that does not exist in the normal site. can do.

According to an aspect of the present invention, the collection unit may collect the server IP of the spam advertising site that provides the service page by clustering (clustering) the IP of the service page set in the report URL.

According to an aspect of the present invention, the URL analyzer may include a domain analyzer configured to analyze whether the received URL includes one of the collected domains, and the received URL may be a spam advertisement site through the collected server IP. It may include a server analysis unit for analyzing whether or not the connection is provided to the IP of the spam server.

In a method for processing spam in a spam processing system, a spam processing method according to an embodiment of the present invention includes a domain of a report URL, which is a URL attached to an e-mail reported by a spam collector, and the report URL. Collecting a server IP set to be connected through; The URL analyzer of the spam processing system analyzes a server configured to be connected through a domain of a received URL, which is a URL attached to a received mail received in real time, using the domain of the collected report URL and a server IP, and the received URL. step; And spam processing the received mail according to a domain and a server of the analyzed received URL in a spam processing unit of the spam processing system.

In a method for processing spam in a spam processing system, a spam processing method according to an embodiment of the present invention includes a domain of a report URL, which is a URL attached to an e-mail reported by a spam collector, and the report URL. Collecting a server IP set to be connected through; Analyzing whether a received URL, which is a URL attached to a received mail received in real time by a domain analyzer of the spam processing system, includes one of the collected domains; In the server analyzing unit of the spam processing system, if the received URL includes one of the collected domains, the received URL is set to connect to the IP of a spam server providing a spam advertisement site through the collected server IP. Analyzing whether there is; And processing the received mail as spam when the receiving URL is set to be connected to an IP of the spam server in the spam processing unit of the spam processing system.

According to an embodiment of the present invention, by analyzing the URL attached to the mail automatically detects the spam set to be connected to the spam advertising site it can be easier to process and manage spam.

According to an embodiment of the present invention, by detecting spam mail using a URL of a service page that does not exist in a normal site, it is possible to detect a modified spam in the form of not directly exposing a spam advertisement site to the contents of mail. You can filter it.

Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

The spam processing system and method according to an embodiment of the present invention can be applied to a system for providing an e-mail service on the web, and provides a function of detecting spam to filter spam in an e-mail.

In the case of spam mails, spammers may insert an image URL to directly expose the content they want to advertise, or insert a site URL that provides a service page so that the advertisement contents are displayed by moving to a service page. The recent trend in spam is that URLs in spam mails do not directly reveal spam advertising sites. In other words, the spammer hacks a normal site and sets up a page that does not exist in the normal site to go to the spam advertisement site that the spammer wants to provide. Then, the spammer inserts a page URL that does not exist in the hacked site. It is.

According to the spam mail described above, spammers have a lot of hacked sites, and the domain of spam advertisement sites is limited, but the server IP serviced by spam advertisement sites is more limited. Moreover, domains of hacked sites are constantly being reused by spammers.

Therefore, the spam processing system and method according to an embodiment of the present invention may provide a function for detecting spam mail using a service page that does not exist in the normal site.

1 is a block diagram illustrating an internal configuration of a spam processing system according to an embodiment of the present invention.

Spam processing system according to an embodiment of the present invention may include a collecting unit 110, URL analysis unit, spam processing unit 140. At this time, the spam processing system may be configured to work with a mailbox (not shown).

A mail box refers to a database that stores e-mail. The mail box is stored and managed in association with each user. Mailboxes generally store mail data of the Multipurpose Internet Mail Extension (MIME) type. Typically, a mailbox may manage mail data as one file, and may manage the storage location of each mail data through a file pointer.

The collecting unit 110 collects a server IP set to be connected through a domain of a URL (hereinafter, referred to as a “reporting URL”) and a report URL attached to the spam-reported mail. 2 is a view for explaining an example of spam report data for use in a spam processing system according to an embodiment of the present invention. When a user opens an inbox from a web page that provides an e-mail service, the user can easily check whether the spam is based on the mail subject or the sender's name or the contents of the mail. Referring to FIG. 2, when the received mail is determined to be spam, the user may report spam for the received mail through the spam report button 201. In this case, the mailbox may move the spam reported mail from the user to the spam mailbox 203 and store the mail. The collecting unit 110 utilizes the received mail stored in the spam mailbox 203, that is, the spam reported mail from the user. Can collect the domain and server IP of the report URL. Here, the spam-reported mail may refer to a mail in which a spammer hacks a normal site and inserts a URL of a service page that does not exist in the normal site. That is, the report URL is a URL configured to link to a spam advertisement site provided by a spammer in the form of a domain of a normal site hacked by a spammer and a service page address that does not exist in the normal site. The collector 110 may collect the server IP of the final spam advertisement site that provides the service page by clustering where the service page is set in the report URL and the corresponding service server IP. In addition, the collector 110 may extract and collect a domain from the report URL. For example, if the report URL is 'fff.co.kr/nopage', 'fff.co.kr' is recognized as a hacked site by spammers and the domain 'fff.co.kr' is collected from the URL.

The URL analysis unit analyzes a server configured to connect through a domain and a receiving URL of a URL (hereinafter, referred to as a 'receiving URL') attached to an incoming message received in real time using the domain of the collected report URL and a server IP. Play a role. The URL analyzer may be configured of a domain analyzer 120 that analyzes a domain of a received URL, and a server analyzer 130 that analyzes a server set in the received URL. The domain analyzer 120 may analyze whether the received URL includes one of the domains collected through the collector 110, that is, whether the received URL uses the domain of the hacked site. The server analyzer 130 may analyze whether the received URL is set to be connected to an IP of a spam server providing a spam advertisement site through the server IP collected through the collector 110. If there is a receiving URL including one of the domains of the collected report URL in the received mail, the server analyzing unit 130 may analyze the server set through the corresponding receiving URL. At this time, the server analysis unit 130 transmits a communication request signal (http request) to the receiving URL to check whether a redirection response signal (http 302 redirection response) is received, the location URL corresponding to the redirection response signal (redirection location URL) ) By checking the IP of the location URL through DNS resolving and the server IP set through the receiving URL.

The spam processing unit 140 performs a role of spam processing the received mail according to a result of analyzing the domain and the server of the received URL. When the receiving URL includes one of the domains of the collected report URL and the receiving URL is set to be connected to the spam server's IP, the spam processing unit 140 may recognize the received mail as spam and process the spam.

Such a spam processing system can automatically handle spam in the form of hacked sites without directly exposing spam advertising sites.

3 is a flowchart illustrating the entire process of a spam processing method according to an embodiment of the present invention. The spam processing method according to an embodiment of the present invention may be performed through the spam processing system described with reference to FIG. 1. In FIG. 3, a spam processing method will be described by describing a process in which each step is performed through a spam processing system.

In operation S310, the spam processing system may collect and maintain a domain of a report URL, which is a URL attached to a spam report mail, and a server IP set to be connected through the report URL. In this case, the report URL is a URL configured to link to a spam advertisement site provided by a spammer in the form of a domain of a normal site hacked by a spammer and a service page address that does not exist in the normal site. The spam processing system may collect the server IP of the final spam advertisement site that provides the service page by clustering where the service page is set in the report URL and the corresponding service server IP. In addition, the spam processing system may extract and collect a domain from the report URL.

In operation S320, the spam processing system may analyze whether the reception URL, which is a URL attached to the received mail received in real time, includes one of the domains collected in operation S310. That is, the spam processing system may analyze whether there is a receiving URL including the domain of the hacked site in the received mail.

In step S330 and step S340, the spam processing system connects through the receiving URL based on the server IP collected in step S310 if there is a receiving URL that includes one of the domains of the report URL collected in the received mail. You can analyze the servers that are set up. The spam processing system may analyze whether the received URL is set to be connected to the IP of the spam server providing the spam advertisement site through the server IP collected in step S310. At this time, the spam processing system transmits a communication request signal to the reception URL to check whether the redirection response signal is received, and analyzes the server IP set through the reception URL by checking the location URL corresponding to the redirection response signal and the IP of the location URL. can do.

In step S350 and step S360, the spam processing system may recognize the received mail as spam and process spam when the received URL is set to be connected to the IP of the spam server. The spam processing system may spam the mail if there is a receiving URL set to be connected to the spam server's IP in the received mail. In this case, the spam processing system may move the received mail recognized as spam to a spam mailbox or move it to a trash after deleting.

As such, when using a spam processing system or a spam processing method according to an embodiment of the present invention, the server IP of the site hacked by spammers and spam advertisement sites by using spam reported mail is collected and then based on this. URL analysis in one incoming mail can detect and handle spam in the form of hacking sites without directly exposing spam advertising sites.

Embodiments according to the present invention can be implemented in the form of program instructions that can be executed by various computer means can be recorded on a computer readable medium. The computer readable medium may include program instructions, file data, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all of the equivalents or equivalents of the claims as well as the claims to be described later will belong to the scope of the present invention. .

1 is a block diagram illustrating an internal configuration of a spam processing system according to an embodiment of the present invention.

2 is a view for explaining an example of spam report data for use in a spam processing system according to an embodiment of the present invention.

3 is a flowchart illustrating the entire process of a spam processing method according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: collector

120: domain analyzer

130: server analysis unit

140: spam processing unit

Claims (15)

A collecting unit for collecting a domain of a reporting URL which is a URL (uniform resource locator) attached to a spam-reported mail, and a server IP set to be connected through the reporting URL; A URL analyzer configured to analyze a server configured to be connected through a domain of a received URL, which is a URL attached to a received mail received in real time, using the domain of the collected report URL and a server IP; And, Spam processing unit for spam processing the received mail according to the domain and server of the analyzed receiving URL Including, The URL analysis unit A domain analyzer for analyzing whether the received URL includes one of the collected domains; A server analyzer which analyzes whether the received URL is set to be connected to an IP of a spam server providing a spam advertisement site through the collected server IP when the received URL includes one of the collected domains; Including, The spam processing unit, And processing the received mail as spam when the received URL is set to connect to the IP of the spam server. The method of claim 1, And the report URL is a URL configured to link to a spam advertisement site provided by the spammer, which is composed of a domain of a normal site hacked by a spammer and a service page address that does not exist in the normal site. The method of claim 1, And the collecting unit collects a server IP of a spam advertisement site that provides the service page by clustering the IP of the service page set in the report URL. The method of claim 1, And the server analyzer transmits a communication request signal to the received URL to receive a redirect response signal for the communication request signal and then analyzes the IP of the location URL corresponding to the redirect response signal. delete delete delete delete delete delete In a method for processing spam in a spam processing system, Collecting, by a collecting unit of the spam processing system, a domain of a report URL, which is a URL attached to a spam report mail, and a server IP set to be connected through the report URL; Analyzing whether a received URL, which is a URL attached to a received mail received in real time by a domain analyzer of the spam processing system, includes one of the collected domains; In the server analyzing unit of the spam processing system, if the received URL includes one of the collected domains, the received URL is set to connect to the IP of a spam server providing a spam advertisement site through the collected server IP. Analyzing whether there is; And, Processing the received mail as spam when the received URL is set to be connected to the IP of the spam server by a spam processing unit of the spam processing system; Spam processing method comprising a. The method of claim 11, And the reporting URL is a URL configured to link to a spam advertisement site provided by the spammer, which is composed of a domain of a normal site hacked by a spammer and a service page address that does not exist in the normal site. The method of claim 11, Collecting the server IP of the report URL, And collecting server IPs of spam advertisement sites that provide the service pages by clustering IPs of the service pages set in the report URL. The method of claim 11, Analyzing whether or not the spam server is set to connect to the IP, Transmitting a communication request signal to the received URL to receive a redirection response signal for the communication request signal, and analyzing the IP of the location URL corresponding to the redirection response signal. A computer-readable recording medium having recorded thereon a program for performing the method of claim 11.

Images