KR102348239B1 - Method for Analyzing Keywords in Email - Google Patents

Abstract

The present invention relates to a keyword analysis method executed in an environment including: an e-mail server; an e-mail client program module processing an e-mail received from the e-mail server; and a keyword analysis program module. The keyword analysis method comprises: a first step that the keyword analysis program module analyzes and extracts morphemes from text data included in the e-mail; a second step that the keyword analysis program module tags, with word classes, the morphemes analyzed and extracted in the first step; a third step that the keyword analysis program module extracts the morphemes, classified into a noun in the second step; a fourth step that the keyword analysis program module excludes words, set to be excluded, through machine learning among the extracted morphemes; a fifth step that the keyword analysis program module calculates a frequency with respect to each of the morphemes remaining after the fourth step; and a sixth step that the keyword analysis program module performs statistical analysis with respect to predetermined higher ranked morphemes based on the frequency. The present invention can be used for malicious code detection.

Description

Method for Analyzing Keywords in Email}

The present invention relates to a keyword analysis method of an email, and more particularly, to a method for analyzing text included in an email and extracting a keyword that becomes a trend or an issue therefrom.

From daily life to work, e-mail has become an indispensable means of communication. Modern people transmit and receive a variety of information from business message exchange to personal shopping, news, and advertisements via e-mail.

With the activation of e-mail, corporate marketing using e-mail is becoming more active, and customized e-mail content is widely used based on the recipient's online activity and interest. In the past, it was common to spam shopping-inducing e-mails or newsletters that were heavily promotional, but recently, e-mail recipients are increasingly receiving related e-mails by voluntarily specifying specific news, trends, and tastes.

On the other hand, in the case of e-mails containing malicious code, the latest trends or issues are included in the e-mail to stimulate the recipient's curiosity or soften their alertness to induce actions such as clicking on attachments. Seeing what words indicate trends or issues is also useful in malware detection.

[Prior Patent Literature]

Korean Patent Publication No. 10-2005-0102574 (published on October 26, 2005)

The present invention provides a method for finding out what a trend is and what is an issue by extracting a keyword based on the content included in the email that is being personalized due to the growth of the subscription economy and performing statistical analysis. aim to

The present invention relates to a keyword analysis method performed in an environment including an email server, an email client program module for processing email received from the email server, and a keyword analysis program module, wherein the keyword analysis program module is included in the email a first step of analyzing and extracting morphemes from the text data; a second step of tagging, by the keyword analysis program module, parts of speech to the morphemes extracted and analyzed in the first step; a third step of extracting, by the keyword analysis program module, the morphemes classified as nouns in the second step; a fourth step of excluding, by the keyword analysis program module, a word designated to be excluded from the extracted morphemes through machine learning; a fifth step of calculating, by the keyword analysis program module, a frequency for each morpheme remaining after the fourth step; and a sixth step in which the keyword analysis program module performs statistical analysis on a predetermined upper morpheme based on the frequency.

The fourth step is

A step 4-1 of excluding nouns having one syllable may be included.

The fourth step includes: step 4-1 of determining whether a predetermined word is a word included in the remaining morpheme or a word based on a word included in the remaining morpheme; a step 4-2 of receiving a predetermined word as a separate response by the BPE algorithm if it is determined that the step 4-1 does not; If the predetermined word appears more than a predetermined number of times, the predetermined word is not excluded, otherwise, a step 4-3 of selecting a word to be excluded may be included.

The keyword analysis method according to the present invention may be executed by a computer program included in a computer-readable recording medium.

According to the present invention, by analyzing the text included in the e-mail, it is possible to know the word expressing the latest trend or issue, thereby providing an effect that can be usefully used for detecting malicious code.

1 is an example of an environment in which the present invention is practiced;
2 is a flowchart of a keyword analysis method according to the present invention.
3 is a diagram schematically illustrating a process according to a keyword analysis method according to the present invention.
Fig. 4 is a visualization of keywords statistically analyzed by the keyword analysis method according to the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Encryption/decryption may be applied as necessary to the information (data) transmission/reception process performed in this specification, and the expressions describing the information (data) transmission process in the present specification and claims are all encrypted/decrypted even if not separately mentioned. It should be interpreted as including the case of decryption. In the present specification, expressions such as “transfer from A to B (transfer)” or “A receives from B” include transmission (transmission) or reception with another medium included in the middle, and directly from A to B It does not represent only what is transmitted (transferred) or received. In the description of the present invention, the order of each step should be understood as non-limiting unless the preceding step must be logically and temporally performed before the subsequent step. That is, except for the above exceptional cases, even if the process described as a subsequent step is performed before the process described as the preceding step, the essence of the invention is not affected, and the scope of rights should also be defined regardless of the order of the steps. And in the present specification, "A or B" is defined to mean not only selectively pointing to any one of A and B, but also including both A and B. In addition, in the present specification, the term "comprising" has the meaning of encompassing the inclusion of other components in addition to the elements listed as being included.

In this specification, “module” or “unit” or “~ unit” refers to a logical combination of general-purpose hardware and software that performs its function.

In this specification, only the minimum components necessary for the description of the present invention are described, and components not related to the essence of the present invention are not mentioned. And it should not be construed in an exclusive sense including only the mentioned components, and it should be construed in a non-exclusive sense that may also include other components not mentioned.

The method according to the present invention may be executed by an electronic computing device such as a computer, a tablet PC, a mobile phone, a portable computing device, or a stationary computing device. It should also be understood that one or more methods or aspects of the present invention may be executed by at least one processor. The processor may be installed in a computer, a tablet PC, a mobile device, a portable computing device, or the like. A memory adapted to store computer program instructions may be installed in such a device such that the program is specifically programmed to cause the processor to execute the stored program instructions to execute one or more processes as described herein. In addition, it should be understood that the information and methods described herein may be implemented by a computer, tablet PC, mobile device, portable computing device, etc. including one or more additional components and a processor. In addition, the control logic may be implemented in a non-volatile computer-readable medium including program instructions executable by a processor, a controller/control unit, or the like. Examples of computer-readable media include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, flash drive, smart card, optical data storage device, and the like. In addition, the computer-readable recording medium may be distributed in computers connected to a network, and the computer-readable medium may be stored and executed in a distributed manner, for example, by a remote server or a controller area network (CAN).

The exemplary embodiments described herein provide a general understanding of the principles of the structure, function, manufacture and use and methods of the devices disclosed herein. One or more such embodiments are illustrated in the accompanying drawings. It will be understood by those skilled in the art that the apparatus and methods specifically described herein and illustrated in the accompanying drawings are non-limiting exemplary embodiments and that the scope of the present invention is defined by the claims. Features shown and described in connection with one exemplary embodiment may also be combined with features of another embodiment. Such modifications or variations are intended to be included within the scope of the present invention.

1 shows an example of an environment in which the present invention may be practiced. As shown in FIG. 1 , the environment in which the present invention is implemented includes a user terminal 10 , an email server 20 , and a keyword analysis server 30 . The user terminal 10 is provided with an email client module 12 and a keyword analysis program module 14 .

Email client module 12 and email server 20 may be conventional email client modules and email servers. Since a typical e-mail transmission and reception protocol is a well-known technique, a detailed description thereof will be omitted.

A result analyzed by the keyword analysis program module 14 may be transmitted to the keyword analysis server 30 . Alternatively, the keyword analysis server 30 may receive text information included in the email from the user terminal and perform keyword analysis. The keyword analysis server 30 may receive a keyword analysis result from the plurality of user terminals 10 or may receive text information of an extracted email to perform keyword analysis.

FIG. 2 is a flowchart of a keyword analysis method of an email according to the present invention, and FIG. 3 shows an example of a process performed in each step of FIG. 2 .

The e-mail client module 12 receives an e-mail from the e-mail server 20 and extracts data included in the received e-mail (step 200; 300 in FIG. 3).

The keyword analysis program module 14 performs morphological analysis on the characters included in the received e-mail (step 210; 310 in FIG. 3). For morphological analysis, a conventional morphological analysis tool, for example, KoNLPy (KoNL Py) may be used.

In step 220, the keyword analysis program module 14 executes part-of-speech tagging on each of the analyzed and extracted morphemes ( 320 of FIG. 3 ). As part of speech tagging, only morphemes classified as nouns from among the morphemes tagged in this way are extracted (step 230; 330 of FIG. 3 ).

Unnecessary words are excluded from the noun morphemes extracted in step 230 (step 240; 340 of FIG. 3).

For words to be excluded, a specific word to be excluded is initially input, and similar patterns or meaningless words can be set through machine learning. In addition, in the case of spam e-mails that intentionally change the spelling or use different spacing, it is cumbersome to manually set the words to be excluded each time, so those words can be automatically learned and excluded through machine learning.

As words to be excluded, for example, a noun with one syllable, such as "number", "minute", "thing", etc. can be set, and although it is frequently extracted from a large number of data, it is not suitable for keyword analysis according to the present invention. You can exclude words such as "advertisement", "free", "reject", etc.

According to the present invention, words not to be excluded can also be automatically set through machine learning.

Words not to be excluded are learned using nouns (preselected words) selected in statistical analysis to be described later. Function, for example, using Google's Sentencepiece library to receive a response in which words are separated.

In general, when machine learning is performed, if it is not a word that is already included or is not a word based on the word, it is processed as OOV (Out-of-Vocabulary) or UNK (Unknown Token). In order to solve this problem, the BPE algorithm can be used

According to the present invention, even if it is not a previously selected word or a word based thereon, it is not excluded when a predetermined number or more appears, and can be used to select a word not to be excluded by using it for subsequent machine learning.

In step 250, the frequency of the remaining keywords is calculated (350 in FIG. 3).

Ranking is performed based on the frequency calculated in this way, and statistical analysis may be performed on keywords having a predetermined higher rank (step 260).

The keyword analysis method according to the present invention may be executed by the keyword analysis program module 14 and the analysis result may be transmitted to the keyword analysis server 30 , and the keyword analysis program module 14 is only sent to the email client module 12 . The received text data is extracted and sent to the keyword analysis server 30 , and the analysis process according to the present invention may be executed in the keyword analysis server 30 . In the latter case, some functions of the keyword analysis program module may be executed by a program module mounted on the keyword analysis server 30 , and in this specification, the keyword analysis program module 14 is provided to the user terminal 10 as well as Rather, it should be understood to include what is provided to the keyword analysis server 30 or another third medium.

FIG. 4 is a view showing results of statistical analysis performed on keywords included in emails received in a specific month, that is, the top 50 keywords based on frequency. When visualizing, the higher the ranking, the larger the size of the keyword, and the arrangement can be placed in the center of the screen. In addition, the higher the rank, the horizontally arranged, and the lower rank keywords can be arranged vertically. The visualization rule may be set differently as needed, and it should not be construed as being limited to the rule.

If the keyword analysis according to the present invention is performed, it may be useful to detect spam mail or malicious code including words related to the latest trend.

The present invention has been described above with reference to the accompanying drawings, but the scope of the present invention is determined by the following claims and should not be construed as being limited to the above-described embodiments and/or drawings. And it should be clearly understood that improvements, changes and modifications obvious to those skilled in the art of the invention described in the claims are also included in the scope of the present invention.

10: user terminal
12: Email client module
14: Keyword Analysis Program Module
20: Email Server
30: keyword analysis server

Claims (5)

A keyword analysis method performed in an environment including an email server, an email client program module for processing email received from the email server, and a keyword analysis program module, the keyword analysis method comprising:
A first step in which the keyword analysis program module analyzes and extracts morphemes from text data included in the email;
A second step of tagging, by the keyword analysis program module, the part-of-speech to the morphemes analyzed and extracted in the first step;
A third step in which the keyword analysis program module extracts morphemes classified as nouns in the second step;
a fourth step of excluding, by the keyword analysis program module, a word designated to be excluded through machine learning from among the extracted morphemes;
A fifth step of calculating, by the keyword analysis program module, the frequency for each morpheme remaining after the fourth step;
a sixth step of performing, by the keyword analysis program module, statistical analysis on a predetermined higher-order morpheme based on the frequency,
The fourth step is
Step 4-1 of not excluding the word when the predetermined word is a pre-selected word or a word based on the pre-selected word;
Step 4-2 of receiving the word as a separate response by the BPE algorithm when it is determined that the predetermined word is not a pre-selected word or a word based on the pre-selected word;
If the predetermined word appears more than a predetermined number of times, the predetermined word is not excluded; otherwise, the 4-3 step of selecting a word to be excluded.
How to analyze keywords in emails.
The method according to claim 1,
The fourth step is
Further comprising a step 4-4 of excluding nouns with one syllable,
How to analyze keywords in emails.
delete A computer program recorded on a computer-readable recording medium for executing the steps of the method of claim 1 or 2.
A computer-readable recording medium in which a computer program for executing the steps of the method of claim 1 or 2 is recorded.

Images