KR101857969B1 - Method and Apparatus for Determining Risk of Fraudulent Mail - Google Patents

Abstract

A method for determining the risk of a fraudulent mail and an apparatus therefor are disclosed. The present invention relates to the method for determining the risk of a fraudulent mail and the apparatus therefor, capable of determining similarity between a sending domain and a customer domain by comparing the sending domain of a received mail with the customer domain based on a character code value, and determining the risk of the fraudulent mail in the received mail based on the determined similarity. Accordingly, a receiver can proactively cope with a fraudulent mail.

Description

METHOD AND APPARATUS FOR DETERMINING RISK OF Fraudulent Mails,

This embodiment relates to a method for determining the risk of fraudulent mail and an apparatus therefor.

The contents described in this section merely provide background information on the present embodiment and do not constitute the prior art.

As the Internet infrastructure expands and develops globally, fraud incidents through the Internet are increasing, and security and fraud incidents by e-mail are increasing rapidly. Accordingly, secure reception and transmission of e-mail are becoming important problems.

In general, in a system for managing spam mail, a sender address corresponding to spam is registered in a spam list to prevent spam mail.

However, in this method, there is an inconvenience that the user who receives the mail must process the decision of receiving / deleting all the mail. In addition, when hackers send mail using a similar domain address, there is a high possibility that the user is misidentified as a safe sender, and there is a high possibility that similar domain addresses can not be registered as spam mail.

Therefore, there is a need for a security technology to cope with fraudulent methods of hackers who send mail to a similar domain that the user can not distinguish from an existing mail address and the naked eye.

The present embodiment compares the sending domain of the received mail with the customer domain based on the character code value to determine the similarity between the sending domain and the customer domain and determines the risk of fraudulent mail based on the determined degree of similarity And a device for the same.

According to an aspect of the present invention, there is provided an apparatus for determining a risk of a fraudulent mail, the apparatus comprising: a domain extracting unit for obtaining a received mail delivered from a mail server to a recipient and extracting a sending domain of the received mail; A domain comparison unit comparing the origination domain and at least one pre-stored customer domain in a contact list to determine a degree of similarity between the origination domain and the customer domain; And a risk analysis unit for determining a risk of a fraudulent mail of the received mail based on the degree of similarity.

According to another aspect of the present invention, there is provided a method of determining a risk of a fraudulent mail by a mail firewall device, the method comprising: acquiring a received mail to be delivered from a mail server to a recipient and extracting a sending domain of the received mail; ; Comparing the originating domain with at least one pre-stored customer domain in a contact list to determine a similarity between the originating domain and the customer domain; And a risk analysis step of determining a risk of a fraudulent mail of the received mail based on the degree of similarity.

According to another aspect of the present invention, there is provided a data processing apparatus including: a domain extracting step of obtaining a received mail to be delivered from a mail server to a recipient and extracting a sending domain of the received mail; Comparing the originating domain with at least one pre-stored customer domain in a contact list to determine a similarity between the originating domain and the customer domain; And a risk analysis process of determining a risk of a fraudulent mail of the received mail based on the degree of similarity.

As described above, according to the present embodiment, the mail firewall device judges the risk of fraudulent mail, so that the recipient can preliminarily respond before the fraudulent mail is damaged.

Further, the mail firewall device judges the risk level of the fraudulent mail at a plurality of levels (grades), so that the user can accurately recognize the degree of danger of the fraudulent mail.

In addition, the mail firewall device has an effect that the user can accurately detect a similar domain that is difficult to be visually recognized.

FIG. 1 is a block diagram of a mail firewall system for determining the risk of fraudulent mail according to the present embodiment.
2 is a block diagram schematically showing a mail firewall device for judging the risk of fraudulent mail according to the present embodiment.
FIGS. 3A and 3B are flowcharts illustrating a method for determining the risk of fraudulent mail according to the present embodiment.
4 is an exemplary diagram for explaining an example of a case of a fraudulent mail.
5 is an exemplary diagram for explaining an operation of comparing domains to determine the risk of fraudulent mail according to the present embodiment.
FIG. 6 is a diagram showing an example of outputting a judgment result of a fraudulent mail according to the present embodiment.

Hereinafter, the present embodiment will be described in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram of a mail firewall system for determining the risk of fraudulent mail according to the present embodiment.

The mail firewall system according to the present embodiment includes a mail server 120 and a mail firewall device 130. [

The mail server 120 is a device that operates to send and receive e-mail between the sender 110 and the recipient 140 and serves as a communication medium between the sender 110 and the recipient 140.

The mail server 120 according to the present embodiment is mainly intended to explain the operation of delivering the e-mail sent from the sender 110 to the receiver 140 in order to determine the risk of fraud of the e-mail received at the receiver 140 side, But is not limited thereto.

Meanwhile, in this embodiment, the sender 110 and the receiver 140 may be implemented as a sender terminal and a receiver terminal. The sender 110 may be a terminal that sends an e-mail to the terminal of the receiver 140 and the receiver 140 may be a terminal that receives e-mail from the terminal of the sender 110. [ The terminal of the caller 110 and the terminal of the receiver 140 are preferably at least one personal computer (PC), but may be a mobile communication terminal such as a smart phone. The terminal of the sender 110 and the terminal of the receiver 140 may be implemented as various types of terminals configured to be capable of transmitting and receiving e-mails, and may be embodied as a terminal, which is selected by a person skilled in the art, Lt; / RTI >

The mail server 120 that enables e-mail communication between the sender 110 and the recipient 140 can be variously modified by those skilled in the art who have ordinary knowledge in the related field, to be.

The mail firewall device 130 means a device for preventing fraudulent mail from being delivered to the recipient 140.

The mail firewall device 130 according to the present embodiment obtains the received mail delivered from the mail server 120 to the recipient 140 and determines the risk that the received mail is a fraudulent mail.

The mail firewall device 130 compares the sending domain of the received mail with the pre-stored customer domain in the contact list to determine the similarity between the sending domain and the customer domain, and determines the risk that the received mail is a fraudulent mail based on the similarity.

In FIG. 1, the mail firewall device 130 may be implemented as a separate device from the mail server 120. In this case, the mail firewall device 130 may maintain the existing mail server that is generally used, And it is possible to detect fraudulent mail. Meanwhile, the mail firewall device 130 may be implemented as one device combined with the mail server 120. [ For example, it may be implemented in the form of hardware such as a mail firewall processing unit (not shown) or software installed in the mail server 120 in the mail server 120. The operation of the mail firewall device 130 to determine the risk of a received mail as a fraudulent mail will be described in detail with reference to FIG.

2 is a block diagram schematically showing a mail firewall device for judging the risk of fraudulent mail according to the present embodiment.

The mail firewall device 130 includes a domain extracting unit 210, a domain comparing unit 220, a similar character DB 222, a text checking unit 224, and a risk analysis unit 230. The mail firewall device 130 shown in FIG. 2 is according to one embodiment. Not all the blocks shown in FIG. 2 are essential components, and in some embodiments, some of the blocks included in the mail firewall device 130 are added , Changed or deleted.

The domain extracting unit 210 obtains the received mail from the mail server 120 to the recipient 140 and extracts the sending domain of the received mail. The originating domain is a domain region corresponding to a 'domain name' among outgoing mail addresses composed of <user name @ domain name>. For example, when a received mail having an outgoing mail address of <AAA@KIWONTECH.com> is acquired from the mail server 120, the domain extracting unit 210 extracts a domain region of <KIWONTECH.com> as a sender domain do.

The domain extracting unit 210 extracts only the domain region. However, the present invention is not limited to this. It is possible to extract the entire outgoing mail address including the individual ID region corresponding to the 'user name' according to the setting of the user or the administrator have.

The domain comparison unit 220 compares the origination domain and at least one pre-stored customer domain in the contact list to determine the similarity between the origin domain and the customer domain. Here, the contact list is a list including mail addresses of a plurality of customers who have previously exchanged e-mail with the recipient 140. The domain comparison unit 220 compares the domain of the mail addresses of customers included in the contact list Domain is extracted as a customer domain and compared with the originating domain. The contact list may be information previously stored in the mail firewall device 130, that is, list information stored in a module such as a contact storage unit (not shown), but is not limited thereto. The contact list may include list information Lt; / RTI &gt;

Hereinafter, the operation of comparing the calling domain and the customer domain is set in the domain comparison unit 220. [

The domain comparison unit 220 compares the source domain and the customer domain using a code value for a character. Here, the code value for a character is preferably an ASCII code, but it is not limited thereto, and various types of identification values can be applied if characters can be identified.

The domain comparison unit 220 calculates the code sum value of the calling domain by summing the code values of each of the plurality of characters included in the calling domain, compares the code sum value of the calling domain with the code sum value of the customer domain, It is determined whether or not the same customer domain as the domain exists. In other words, the domain comparison unit 220 compares the code sum value of the sending domain with the code sum value of each of the customer domains included in the contact list, and if the customer domain having the same code sum value as the code sum value of the sending domain If it exists, it determines that the sending domain and the customer domain are the same domain. Here, it is preferable that the domain comparison unit 220 calculates the code sum value of each customer domain and compares the code sum value of each customer domain with the code sum value of the sending domain. However, the present invention is not limited thereto, And may be compared with the code sum value of the domain.

The domain comparison unit 220 compares the code sum values and determines that the fraudulent risk is lowest in the risk analysis unit 230 without determining a similarity degree when the source domain and the customer domain are determined to be the same domain.

On the other hand, if there is no customer domain having the same code sum value as the code sum value of the originating domain, the domain comparison unit 220 may compare the code sum value of the contact list with the code sum value of the sending domain, And determines the similarity between the originating domain and the extracted customer domain. For example, the code sum value of the originating domain for <KIWONTECH.com> is 1049, and the domain comparison unit 220 extracts a customer domain whose difference from the code sum value of the originating domain is 30 (threshold value) or less. Here, the threshold value may be changed according to the setting of the user or the administrator.

If there is no customer domain having a code sum value whose difference from the code sum value of the sending domain is less than or equal to the threshold value in the contact list, the domain comparison unit 220 compares the sending domain with the new mail address Or to be scanned for registration as a fraudulent e-mail address. The body inspection is processed in the trick inspection unit 224.

On the other hand, if at least one customer domain whose difference from the code sum value of the originating domain is equal to or less than the threshold value exists, the domain comparing unit 220 compares the extracted customer domain and the calling domain character by character. Specifically, the domain comparison unit 220 determines the number of different character pairs by sequentially comparing the codes of the characters constituting the calling domain with the codes of the characters constituting the extracted customer domain. Here, a different character pair means two characters that have been found to be different by comparing the originating domain and the extracted customer domain. For example, when comparing the originating domain < KlWONTECH.com > and the customer domain < KIWONTECH.com >, the different character pair means (l, I). The different character pairs (l, I) include lower case EL (l) and upper case child (I). Also, when comparing the originating domain < KIWONXXCH.com > with the customer domain < KIWONTECH.com >, different character pairs mean (X, T) and (X, E). The different character pairs X and T comprise an upper case X and an upper case T and the different character pairs X and E comprise an upper case X and an upper case E.

The domain comparison unit 220 determines a similarity degree between the calling domain and the extracted customer domain according to the number of different character pairs between the calling domain and the extracted customer domain. Here, the degree of similarity refers to a set value indicating a degree of similarity between a calling domain and a customer domain, and may be set to a predetermined plurality of classes such as top, top, middle, bottom, and bottom. However, Level or a predetermined numerical level such as a level.

The domain comparison unit 220 determines whether two characters constituting different character pairs are similar characters, and determines the degree of similarity based on the number of character pairs composed of similar characters. Here, the pseudo-character means two characters that are difficult to distinguish from each other by the naked eye, and may be a character set in the user's experience or a predefined character.

The domain comparison unit 220 can determine whether different character pairs are similar characters with reference to the similar character DB 222. [ For example, when different character pairs are stored in the similar character DB 222, the domain comparison unit 220 can determine that the two characters constituting different character pairs are similar characters.

According to one embodiment, the domain comparison unit 220 obtains a similar-character pair list from the similar-character DB 222 to determine whether different character pairs are pseudo-characters, and determines whether the similar-character pair list includes different character pairs .

According to another embodiment, the domain comparison unit 220 transmits character information for different character pairs to the similar character DB 222, and outputs a matching result as to whether there is a matching character pair from the similar character DB 222 And may be received as a response signal to determine whether or not the character pair is a similar character.

The domain comparison unit 220 sets the degree of similarity to a higher level (grade) as the number of different character pairs made up of similar characters is smaller, and sets the degree of similarity to a lower level (grade) as the number of different character pairs increases. As the number of different character pairs is smaller, the degree of similarity is more difficult to recognize with the naked eye, and the degree of similarity is set to be higher. For example, the domain comparison unit 220 may set the degree of similarity to 'best' if there are two different character pairs made up of similar characters and set the degree of similarity to 'upper' if there are two different character pairs. The domain comparison unit 220 increases the risk that the received mail is fraudulent mail as the degree of similarity determined according to the number of different character pairs is higher.

The domain comparison unit 220 preferably sets the degree of similarity within a predetermined level (grade) range, and the predetermined level (grade) range may be changed according to a setting of a user or an administrator.

The similar character DB 222 refers to a database for storing and managing similar characters. Here, the pseudo-character means two characters that are difficult to distinguish from each other by the naked eye, and may be a character set in the user's experience or a predefined character.

The similar character DB 222 may store similar characters such as (l, I), (l, 1), (m, rn), (O, 0) Or information collected from an external device (not shown). (l, I) contains the lower case EL (l) and the uppercase child (I), and (l, 1) contains the lower case EL (l) Also, (m, rn) includes a lowercase letter m (m) and a lowercase letter r (r) / yen (n), and (O, 0) contains an uppercase letter O and a number 0.

The body checking unit 224 performs an operation of checking the contents of the body of the received mail. If the domain comparison unit 220 determines that the customer domain corresponding to the code total value of the sending domain and the predetermined range (difference between the code total value is less than or equal to the threshold value) does not exist in the domain comparison unit 220, .

If it is determined that the content of the body of the received mail is a secure mail, the body checking unit 224 registers the sending domain of the received mail as a new mail address. On the other hand, if it is determined that the content of the body of the received mail is unsafe as a result of checking the contents of the body of the received mail, the body checking unit 224 registers the sending domain of the received mail as a fraudulent mail address.

The main body checking unit 224 preferably determines whether a word corresponding to a risk phrase is present in the main content of the received mail or performs a main body check by determining the main content through text recognition. However, the main body checking unit 224 is not limited thereto.

The risk analysis unit 230 determines the risk of fraudulent mail of the received mail based on the degree of similarity determined by the domain comparison unit 220. Here, the risk of fraudulent mail means an estimated value that the received mail is predicted to be a fraudulent mail, and may be set to a predetermined plurality of grades such as top, top, middle, bottom, and bottom. However, It may be set to a predetermined numerical level such as 10 levels.

When the degree of similarity is set to a low level, the risk analysis unit 230 determines that the received mail delivered to the recipient 140 is low in the risk of fraudulent mail. For example, when the degree of similarity is 'low', the risk analysis unit 230 determines that the received mail is a 'low' grade for the risk of fraudulent mail.

Meanwhile, when the degree of similarity is set to a high level, the risk analysis unit 230 determines that the received mail delivered to the recipient 140 is highly likely to be a fraudulent mail. If it is determined that the risk level of the fraudulent mail for the received mail is equal to or higher than the preset notification criterion level or the notification criterion value, the risk analysis unit 230 transmits an urgent warning notification message to the user or administrator of the mail server 120, And not to the receiver 140. The emergency alert message may include received mail information, a sending domain, a customer domain similar to the sending domain, different character pair information, similarity information, risk information, and the like. For example, when the degree of similarity is 'high', the risk analysis unit 230 determines that the received e-mail is a fraudulent e-mail. Here, the risk analysis unit 230 transmits an emergency alert message for the received mail to the user or administrator of the mail server 120 when the alert reference level is set to 'middle'.

The risk analysis unit 230 may process the body inspection and set the risk of the received mail using the corresponding sending domain to the lowest level, for example, 'lowest' if there is a sending domain registered with the new mail address.

FIGS. 3A and 3B are flowcharts illustrating a method for determining the risk of fraudulent mail according to the present embodiment.

3A is a flowchart schematically showing a method of determining the risk of fraudulent mail in the mail firewall device 130. [

The mail firewall device 130 obtains a received mail delivered from the mail server 120 to the recipient 140 (S310), and extracts the sending domain of the received mail (S320). Here, the sending domain means a domain region corresponding to a 'domain name' among outgoing mail addresses composed of <user name @ domain name>. For example, when a received mail having an outgoing mail address of <AAA@KIWONTECH.com> is acquired from the mail server 120, the mail firewall device 130 extracts the domain region of <KIWONTECH.com> as a sender domain do.

The mail firewall device 130 compares the origination domain and at least one pre-stored customer domain in the contact list to determine the similarity between the origin domain and the customer domain in operation S330. Here, the contact list means a list including the mail addresses of a plurality of customers who have previously exchanged e-mail with the recipient 140.

The mail firewall device 130 extracts the domain domain of the mail address of the customers included in the contact list as a customer domain, compares the domain domain with the sending domain, and determines the similarity between the sending domain and the customer domain based on the comparison result. Here, the degree of similarity refers to a set value indicating a degree of similarity between a calling domain and a customer domain, and may be set to a predetermined plurality of classes such as top, top, middle, bottom, and bottom. However, Level or a predetermined numerical level such as a level. The operation of setting the similarity is described in detail in FIG. 3B.

The mail firewall device 130 determines the risk of fraudulent mail of the received mail based on the degree of similarity (S340). Here, the risk of fraudulent mail means an estimated value that the received mail is estimated to be fraudulent mail.

When the degree of similarity is set to a low level, the mail firewall device 130 determines that the received mail delivered to the recipient 140 has a low risk of being a fraudulent mail. If the degree of similarity is set to a high level, The risk of fraudulent mail is highly judged.

The mail firewall device 130 transmits an emergency alert message to the user or administrator of the mail server 120 when the risk of fraudulent mail for the received mail is determined to be equal to or higher than the preset notification criterion grade or the notification criterion value, (140).

3A, steps S310 to S340 are sequentially executed. However, this is merely an example of the technical idea of the present embodiment, and it is obvious to those skilled in the art that the present invention is not limited to this embodiment 3A and 3B are variously modified and modified by executing one or more of the steps S310 to S340 in parallel, so that Fig. But is not limited thereto.

FIG. 3B is a flowchart illustrating the operations of steps S330 and S340 of FIG. 3A in detail.

The mail firewall device 130 calculates the code sum value of the originating domain (S350). The mail firewall device 130 calculates the code sum value of the calling domain by summing the code values of the characters included in the calling domain. Here, the code value for the character is preferably an ASCII code, but is not limited thereto.

The mail firewall device 130 compares the code sum value of the source domain with the code sum value of the customer domain (S352) and determines whether there is a customer domain having the same code sum value as the code sum value of the divergence domain (S360 ).

If there is a customer domain having the same code sum value as the code sum value of the sending domain in step S360, the mail firewall device 130 determines the sending domain and the customer domain as the same domain (S362). If there is a same customer domain as the sending domain, the mail firewall device 130 determines the received mail as the lowest level (grade) at the risk of fraudulent mail (S364).

If there is no customer domain having the same code sum value as the code sum value of the diverting domain in step S360, the mail firewall device 130 determines that the difference between the code sum value of the calling domain in the contact list and the code sum value (Step S370).

If there is no customer domain having a code sum value whose difference from the code sum value of the sending domain is less than or equal to the threshold value at step S370, the mail firewall device 130 sets the sending domain as a new mail address or The body inspection process is performed to register the fraudulent e-mail address (S372). In step S372, the mail firewall device 130 may register the sending domain for the received mail as a new mail address or a fraudulent mail address according to the result of the body check.

If there is a customer domain having a code sum value whose difference from the code sum value of the sending domain is equal to or less than the threshold value in step S370, the mail firewall device 130 extracts the corresponding customer domain (S380).

The mail firewall device 130 compares the codes of the characters constituting the calling domain and the codes of the characters constituting the extracted customer domain in order (S382), and compares the codes of the characters constituting the calling domain with the codes of the characters constituting the extracted customer domain in accordance with the number of different character pairs And determines the degree of similarity (S384). Here, the degree of similarity refers to a set value indicating a degree of similarity between a calling domain and a customer domain, and may be set to a predetermined plurality of classes such as top, top, middle, bottom, and bottom. However, Level or a predetermined numerical level such as a level.

Based on the comparison result in step S382, the mail firewall device 130 refers to the pseudo-character DB 222 to determine whether the two characters constituting the different character pairs are similar characters, and, based on the number of character pairs composed of pseudo characters The degree of similarity is determined.

The mail firewall device 130 sets the risk level of the received mail according to the degree of similarity (S390). Since the content of step S390 is similar to that of step S340 of FIG. 3A, a detailed description will be omitted.

3B, it is described that steps S350 to S390 are sequentially executed. However, this is merely an exemplary description of the technical idea of the present embodiment, and it should be understood by those skilled in the art that, It will be understood that various modifications and changes may be made to the invention without departing from the essential characteristics thereof, or alternatively, by executing one or more of the steps S350 through S390 in parallel, But is not limited thereto.

As described above, the operation of the mail firewall device 130 according to the embodiment described in Figs. 3A and 3B can be implemented by a program and recorded in a computer-readable recording medium. A program for implementing the operation of the mail firewall device 130 according to the present embodiment is recorded and a computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. The computer readable recording medium may also be distributed over a networked computer system so that computer readable code is stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present embodiment can be easily inferred by programmers in the technical field to which the present embodiment belongs.

4 is an exemplary diagram for explaining an example of a case of a fraudulent mail.

As shown in FIG. 4, 'vendor A' and 'vendor B' are companies that continuously exchanged e-mails. The 'Hacker' can monitor the mail content between 'Business A' and 'Business B' and then modulate the outgoing e-mail address into a similar domain.

For example, if "Business A" and "Business B" each deal with an email address of <A@60127406.com> and <B@60127406.com>, the "hacker" is <A@6O127406.com > And exchange mail with 'B'. The similar domain <A@6O127406.com> used by "hacker" looks identical to the e-mail address of 'A' in the eye, but actually the second number '0' in the domain domain '6O127406.com' O 'is a fraudulent e-mail address.

In the present invention, in order to prevent the above-described damage situation, the mail firewall device 130 is used to determine the risk that the received mail is a fraudulent mail.

5 is an exemplary diagram for explaining an operation of comparing domains to determine the risk of fraudulent mail according to the present embodiment.

As shown in FIG. 5, the mail firewall device 130 can detect a different character pair between the originating domain <1@KlWONTECH.com> and the customer domain <1@KIWONTECH.com> through similarity domain inspection. The mail firewall device 130 can determine the similarity between the two domain addresses and deliver the warning message to the user about the risk of the fraudulent mail.

As shown in FIG. 5, the mail firewall device 130 determines that the degree of similarity is higher as it is difficult to distinguish the person's eyes. Here, the high degree of similarity means that there is a high risk that the received mail is fraudulent mail. For example, the mail firewall device 130 may set the degree of similarity to an 'upper' rating when there are different character pairs made up of similar characters and set the degree of similarity to 'middle' if there are two different character pairs.

The mail firewall device 130 determines that the higher the degree of similarity determined based on the number of different character pairs is, the higher the risk is that the received mail is a fraudulent mail.

FIG. 6 is a diagram showing an example of outputting a judgment result of a fraudulent mail according to the present embodiment.

As shown in FIG. 6, when a received mail is received in a domain similar to < @ dhl.com >, the mail firewall device 130 detects the similar domain < @ dlhl.com & ) Or to the administrator. Here, the detected similar domain is output after determining the degree of similarity and the risk of fraudulent mail, and can provide the degree of similarity and the risk of fraudulent mail at the time of output.

The foregoing description is merely illustrative of the technical idea of the present embodiment, and various modifications and changes may be made to those skilled in the art without departing from the essential characteristics of the embodiments. Therefore, the present embodiments are to be construed as illustrative rather than restrictive, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The scope of protection of the present embodiment should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

110: sender 120: mail server
130: Mail firewall device 140: Recipient
210: domain extracting unit 220: domain comparing unit
222: similar character DB 224:
230: Risk Analysis Department

Claims (16)

1. An apparatus for determining the risk of a fraudulent mail,
A domain extracting unit for obtaining a received mail to be delivered to a receiver from a mail server and extracting a sending domain of the received mail;
Calculating a code sum value of the calling domain by summing code values of each of a plurality of characters included in the calling domain, calculating a code sum value of the calling domain and a code for each of at least one customer domain A domain comparison unit for comparing the sum values to determine similarities between the calling domain and the customer domain; And
And a risk analysis unit for determining a risk of a fraudulent mail of the received mail based on the degree of similarity,
Wherein the domain comparison unit has a code sum value in which a difference from a code sum value of the calling domain in the contact list is equal to or less than a threshold value when a customer domain having the same code sum value as the code sum value of the calling domain does not exist Extracting a customer domain, determining the similarity between the originating domain and the extracted customer domain,
Wherein the risk analysis unit determines a risk level of the fraudulent mail by processing a body inspection for registering the sending domain as a new mail address or a fraudulent mail address according to a content of a body of the received mail. delete The method according to claim 1,
Wherein the domain comparison unit comprises:
When the customer domain having the same code sum as the code sum value of the source domain exists, the source domain and the customer domain are determined to be the same domain, and the risk analysis unit determines the lowest risk of the received mail Features a mail firewall device. delete delete 1. An apparatus for determining the risk of a fraudulent mail,
A domain extracting unit for obtaining a received mail to be delivered to a receiver from a mail server and extracting a sending domain of the received mail;
Calculating a code sum value of the calling domain by summing code values of each of a plurality of characters included in the calling domain, calculating a code sum value of the calling domain and a code for each of at least one customer domain A domain comparison unit for comparing the sum values to determine similarities between the calling domain and the customer domain; And
And a risk analysis unit for determining a risk of a fraudulent mail of the received mail based on the degree of similarity,
Wherein the domain comparison unit has a code sum value in which a difference from a code sum value of the calling domain in the contact list is equal to or less than a threshold value when a customer domain having the same code sum value as the code sum value of the calling domain does not exist The customer domain is extracted and the similarity degree between the calling domain and the extracted customer domain is determined by sequentially comparing the codes of the characters constituting the calling domain and the codes of the characters constituting the extracted customer domain. Mail firewall device. The method according to claim 6,
Wherein the domain comparison unit comprises:
Wherein the degree of similarity is determined based on the number of different character pairs between the calling domain and the extracted customer domain. 8. The method of claim 7,
Wherein the domain comparison unit comprises:
Determines similarity between two characters constituting the different character pair by referring to the similar character DB storing similar character pairs, and determines the similarity according to the number of character pairs composed of the similar characters. Firewall device. 8. The method of claim 7,
The risk analysis unit,
Wherein the risk level of the fraudulent mail is set to be highest when the number of different character pairs is one and the risk level of the fraudulent mail is set to be low as the number of different character pairs increases. A method for a mail firewall device to determine the risk of fraudulent mail,
A domain extracting step of obtaining a received mail to be delivered to a receiver from a mail server and extracting a sending domain of the received mail;
Calculating a code sum value of the calling domain by summing code values of each of a plurality of characters included in the calling domain, calculating a code sum value of the calling domain and a code for each of at least one customer domain Comparing the sum values to determine a degree of similarity between the calling domain and the customer domain; And
And a risk analysis step of determining a risk of a fraudulent mail of the received mail based on the degree of similarity,
Wherein the domain comparison step comprises the steps of: if a customer domain having a code total value equal to the code total value of the source domain does not exist, comparing the code total value of the contact list with the code total value of the source domain, And comparing the codes of the characters constituting the calling domain with the codes of the characters constituting the extracted customer domain in order to determine the similarity between the calling domain and the extracted customer domain How to analyze the fraudulent mail risk. delete delete delete 11. The method of claim 10,
The domain comparison process includes:
Wherein the degree of similarity is determined according to the number of different character pairs between the originating domain and the extracted customer domain. 15. The method of claim 14,
The risk analysis process includes:
Wherein the risk level of the fraudulent mail is set to be highest when the number of different character pairs is one and the risk level of the fraudulent mail is set to be low as the number of different character pairs increases. In the data processing device,
A domain extracting step of obtaining a received mail to be delivered to a receiver from a mail server and extracting a sending domain of the received mail;
Calculating a code sum value of the calling domain by summing code values of each of a plurality of characters included in the calling domain, calculating a code sum value of the calling domain and a code for each of at least one customer domain Comparing the sum values to determine a degree of similarity between the calling domain and the customer domain; And
And a risk analysis step of determining a risk of a fraudulent mail of the received mail based on the degree of similarity,
Wherein the domain comparison step comprises the steps of: if a customer domain having a code total value equal to the code total value of the source domain does not exist, comparing the code total value of the contact list with the code total value of the source domain, And determines the similarity between the calling domain and the extracted customer domain by sequentially comparing the codes of the characters constituting the calling domain with the codes of the characters constituting the extracted customer domain A computer-readable recording medium having recorded thereon a program for causing a computer to function as:

Images