KR102502096B1 - Method and System for determining the harmfulness of e-mail - Google Patents

Abstract

A method for determining the harmfulness of an e-mail by the system for determining harmfulness according to the present invention includes a characteristic information extraction step of extracting characteristic information from an e-mail, a key value conversion step of converting the extracted characteristic information into a key value, Identification data storage step of storing the converted key value as identification data subordinate to the e-mail and determining whether the characteristic information is harmful information based on the identification data when the user attempts to access the e-mail A risk assessment step may be included.

Description

Method and System for determining the harmfulness of e-mail

The present invention relates to a method and system for determining the harmfulness of e-mail, and more particularly, to a method and system for determining the harmfulness of e-mail without problems related to personal information protection.

E-mail enables sending and receiving of messages through a network, and is currently mainly used through the Internet.

As the Internet is activated and users can access the Internet anytime, anywhere through mobile devices such as smart phones, the frequency and utilization of e-mail are explosively increasing. E-mail provides convenience to many people as a fast and effective means of exchanging or communicating information, but on the contrary, due to its characteristics, it is possible to send indiscriminately to many unspecified people at will even if the recipient does not want to receive it. exist.

Most of the purposes of spam e-mail are publicity, advertising, etc., and they are also mainly used for illegal purposes. Currently, many e-mail service companies introduce automatic blocking systems to block spam e-mails, but there is a limit to blocking all spam e-mails as spam e-mail senders become increasingly sophisticated in their sending methods.

For example, a URL included in an e-mail body may be linked to a normal URL when an e-mail is received for the first time, but may be linked to a spam URL when a user browses the e-mail body due to a time lag attack. Whenever a user accesses an e-mail, it is possible to inspect the URL included in the e-mail body by parsing and rendering the contents of the body, but this method may cause performance problems and is inefficient. In addition, when an administrator such as a server accesses the body of a user's e-mail every time an e-mail is accessed, problems such as invasion of personal information or invasion of confidentiality may occur.

Therefore, there is a need for a harmfulness determination method capable of more efficiently determining the harmfulness of e-mail and solving issues related to personal information protection. Specifically, information is stored in a hash form at the time of initial e-mail inspection, and harmfulness of the e-mail is determined more efficiently by using this information to determine harmfulness, and issues related to personal information protection can be resolved.

KR 1219862 B1

The problem to be solved by the present invention is to provide a method and system for determining harmfulness of e-mail. Specifically, to provide a method and system for determining harmfulness when a user accesses an e-mail after extracting a URL from an e-mail and storing it in an e-mail header in the form of a hash key value.

Another problem to be solved by the present invention is to provide a method and system capable of determining whether a URL included in an e-mail is spam or not at various points in time other than when the e-mail is received.

A method for determining the harmfulness of e-mail by the system for determining harmfulness of the present invention for solving the above problems includes a characteristic information extraction step of extracting characteristic information from the e-mail; a key value conversion step of converting the extracted characteristic information into a key value; an identification data storage step of storing the converted key value as identification data subordinate to the e-mail; and a harmfulness determination step of determining whether the characteristic information is harmful information based on the identification data when the user attempts to access the e-mail.

In one embodiment of the present invention, the step of storing the identification data may include storing the converted key value as key value information in at least a part of the header of the e-mail.

In one embodiment of the present invention, the characteristic information may be a URL included in the e-mail.

In one embodiment of the present invention, the key value conversion step may convert the characteristic information into a hash key value through a hash function.

In one embodiment of the present invention, a hash table generating step of generating a hash table by matching the characteristic information with the hash key value may be further included.

In one embodiment of the present invention, the harmfulness determination step may include comparing the key value information and the hash table; Re-extracting characteristic information from the hash table; and determining whether the re-extracted characteristic information is harmful information.

In one embodiment of the present invention, when the characteristic information is a URL included in the e-mail, determining whether the re-extracted characteristic information is the harmful information is to determine whether the re-extracted characteristic information is URL in advance. It may be to compare against a database of determined spam URLs.

In one embodiment of the present invention, in the key value conversion step, the characteristic information may be encrypted and converted into an encryption key value.

In one embodiment of the present invention, the harmfulness determination step may include decoding the key value information in the form of the characteristic information; and determining whether the decrypted characteristic information is the harmful information.

In one embodiment of the present invention, when the characteristic information is a URL included in the e-mail, determining whether the decrypted characteristic information is the harmful information determines whether the URL, which is the decrypted characteristic information, is a predetermined spam message. It could be comparing against a database of URLs.

In an embodiment of the present invention, a unique key generating step of generating a unique key corresponding to the e-mail may be further included.

In one embodiment of the present invention, when the sender of the e-mail sends the same e-mail to a plurality of recipients, the unique key may have the same value for the same e-mail sent to the plurality of recipients.

In one embodiment of the present invention, a table creation step of generating a unique key table by matching the unique key and the key value may be further included.

In one embodiment of the present invention, the harmfulness determination step may include comparing the identification data with the unique key table; extracting the key value from the unique key table; reconverting the extracted key value into the characteristic information; and determining whether the reconverted characteristic information is the harmful information.

In addition, the system for determining the harmfulness of e-mail according to the present invention to solve the above problems includes a characteristic information extraction unit for extracting characteristic information from the e-mail; a key value conversion unit that converts the extracted characteristic information into a key value; an identification data storage unit which stores the converted key value as identification data subordinate to the e-mail; and a harmfulness determination unit determining whether the characteristic information is harmful information based on the identification data when the user attempts to access the e-mail.

In one embodiment of the present invention, the identification data storage unit may store the converted key value as key value information in at least a part of the header of the e-mail.

In one embodiment of the present invention, the characteristic information may be a URL included in the e-mail.

In one embodiment of the present invention, the key value conversion unit may convert the characteristic information into a hash key value through a hash function.

In one embodiment of the present invention, a hash table generator for generating a hash table by matching the characteristic information with the hash key value may be further included.

In one embodiment of the present invention, the harmfulness determining unit compares the key value information and the hash table, re-extracts characteristic information from the hash table, and determines whether the re-extracted characteristic information is the harmful information. can do.

In one embodiment of the present invention, when the characteristic information is a URL included in the e-mail, determining whether the re-extracted characteristic information is the harmful information is to determine whether the re-extracted characteristic information is URL in advance. It may be to compare against a database of determined spam URLs.

In one embodiment of the present invention, the key value conversion unit may encrypt the characteristic information and convert it into an encryption key value.

In one embodiment of the present invention, the harmfulness determination unit may decode the key value information in the form of the characteristic information, and determine whether the decrypted characteristic information is the harmful information.

In one embodiment of the present invention, when the characteristic information is a URL included in the e-mail, determining whether the decrypted characteristic information is the harmful information determines whether the URL, which is the decrypted characteristic information, is a predetermined spam message. It could be comparing against a database of URLs.

In one embodiment of the present invention, a unique key generating unit for generating a unique key corresponding to the e-mail may be further included.

In one embodiment of the present invention, when the sender of the e-mail sends the same e-mail to a plurality of recipients, the unique key may have the same value for the same e-mail sent to the plurality of recipients.

In one embodiment of the present invention, a unique key table generating unit for generating a table by matching the unique key with the key value may be further included.

In one embodiment of the present invention, the harmfulness determination unit compares the identification data and the unique key table, extracts the key value from the unique key table, reconverts the extracted key value into the characteristic information, and It may be determined whether the reconverted characteristic information is the harmful information.

A method and system for determining harmfulness of an e-mail according to an embodiment of the present invention extracts a URL from an e-mail and stores it in an e-mail header, and when a user accesses an e-mail, the system does not access the e-mail body. to prevent problems such as invasion of personal information or invasion of confidentiality by determining whether or not it is harmful without

In addition, the method and system for determining the harmfulness of an e-mail according to an embodiment of the present invention determines the harmfulness using information stored in the header without parsing and rendering the contents of the e-mail body when the user accesses the e-mail. By performing this, it is possible to determine whether or not it is harmful without causing a problem in the performance of the server or the like.

1 is a block diagram of a system for determining harmfulness of an e-mail according to an embodiment of the present invention.
2 is a flowchart of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.
3 is a diagram of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.
4 is a flowchart of a method for generating a hash table according to an embodiment of the present invention.
5 is a diagram of a hash table according to an embodiment of the present invention.
6 is a diagram for storing key value information in at least a part of an e-mail header.
7 is a diagram of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.
8 is a flowchart of a method of generating an encryption key value according to an embodiment of the present invention.
9 is a diagram for a method of determining harmfulness of an e-mail according to an embodiment of the present invention.
10 is a flowchart of a method of generating a unique key table according to an embodiment of the present invention.
11 is a diagram for a method of determining harmfulness of an e-mail according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in this specification will be described in detail with reference to the accompanying drawings, but the same or similar elements are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "unit" for components used in the following description are given or used together in consideration of ease of writing the specification, and do not have meanings or roles that are distinct from each other by themselves. In addition, in describing the embodiments disclosed in this specification, if it is determined that a detailed description of a related known technology may obscure the gist of the embodiment disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, the technical idea disclosed in this specification is not limited by the accompanying drawings, and all changes included in the spirit and technical scope of the present invention , it should be understood to include equivalents or substitutes.

Terms including ordinal numbers, such as first and second, may be used to describe various components, but the components are not limited by the terms. These terms are only used for the purpose of distinguishing one component from another.

It is understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, but other elements may exist in the middle. It should be. On the other hand, when an element is referred to as “directly connected” or “directly connected” to another element, it should be understood that no other element exists in the middle.

Singular expressions include plural expressions unless the context clearly dictates otherwise.

In this application, terms such as "comprise" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other features It should be understood that the presence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded.

In this specification, the communication method of the network is not limited, and connections between components may not be connected in the same network method. The network may include not only a communication method using a communication network (eg, a mobile communication network, wired Internet, wireless Internet, broadcasting network, satellite network, etc.), but also short-distance wireless communication between devices. For example, a network may include objects and all communication methods that objects may network, and is not limited to wired communication, wireless communication, 3G, 4G, 5G, or other methods. For example, a wired and/or network may include Local Area Network (LAN), Metropolitan Area Network (MAN), Global System for Mobile Network (GSM), Enhanced Data GSM Environment (EDGE), High Speed Downlink Packet Access (HSDPA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth, Zigbee, Wi-Fi, Voice over VoIP Internet Protocol), LTE Advanced, IEEE802.16m, WirelessMAN-Advanced, HSPA+, 3GPP Long Term Evolution (LTE), Mobile WiMAX (IEEE 802.16e), UMB (formerly EV-DO Rev. C), Flash-OFDM, iBurst and It may refer to a communication network using one or more communication methods selected from the group consisting of MBWA (IEEE 802.20) systems, HIPERMAN, Beam-Division Multiple Access (BDMA), Wi-MAX (World Interoperability for Microwave Access), and ultrasonic communication. However, it is not limited thereto.

Hereinafter, a method and system for determining harmfulness of an e-mail according to an embodiment of the present invention will be described with reference to FIGS. 1 to 11 attached thereto.

The present invention relates to a method and system for determining harmfulness of e-mail.

The method for judging the harmfulness of an e-mail according to the present invention is performed by a system for determining the harmfulness of an e-mail.

In the present invention, e-mail may be provided to a user through a user terminal.

User terminals described herein include mobile phones, smart phones, laptop computers, digital broadcasting terminals, personal digital assistants (PDAs), portable multimedia players (PMPs), navigation devices, and slate PCs. , tablet PC, ultrabook, wearable device (eg, watch type terminal (smartwatch), glass type terminal (smart glass), HMD (head mounted display), etc. may be included) .

The user terminal may include a communication module and complies with technical standards or communication methods for mobile communication (eg, Global System for Mobile communication (GSM), Code Division Multi Access (CDMA), and Code Division Multi Access 2000 (CDMA2000)). ), EV-DO (Enhanced Voice-Data Optimized or Enhanced Voice-Data Only), WCDMA (Wideband CDMA), HSDPA (High Speed Downlink Packet Access), HSUPA (High Speed Uplink Packet Access), LTE (Long Term Evolution), A wireless signal is transmitted and received with at least one of a base station, an external terminal, and a server on a mobile communication network built according to LTE-A (Long Term Evolution-Advanced), etc.).

1 is a block diagram of a system for determining harmfulness of an e-mail according to an embodiment of the present invention.

Referring to FIG. 1, a system 100 for determining harmfulness of e-mail includes a characteristic information extraction unit 110, a key value conversion unit 120, an identification data storage unit 130, a harmfulness determination unit 140, and a hash table. A generator 150 and a unique key table generator 160 may be included.

Hereinafter, the function of each unit included in the system 100 will be described.

The characteristic information extractor 110 may extract characteristic information from the e-mail. The key value conversion unit 120 may convert the extracted characteristic information into a key value. The identification data storage unit 130 may store the converted key value as identification data dependent on the e-mail. The harmfulness determining unit 140 may determine whether the characteristic information is harmful information based on the identification data when the user attempts to access the e-mail.

More specific functions of each unit will be described in more detail while explaining how to determine the harmfulness of an e-mail below.

2 is a flowchart of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.

Referring to FIG. 2 , the method for determining harmfulness of an e-mail may include extracting characteristic information (S210), converting key values (S220), storing identification data (S230), and determining harmfulness (S240).

Each of the above-described steps may be performed regardless of the listed order, except for the case where they must be performed in the listed order due to a special causal relationship. However, in the following description, it is assumed that the above-described steps are performed in the listed order for convenience of description.

Hereinafter, the characteristic information extraction step (S210) will be described in detail with reference to FIG. 3 .

3 is a diagram of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.

Referring to FIG. 3 , an e-mail 310 may include a sender 320, a recipient 330, and a URL 340. The URL 340 is generally provided to a mail recipient in the form of a link, and when the recipient clicks the link, a page connected to the URL 340 or another URL 340 can be accessed. At this time, at least one URL 340 may be included in the e-mail. Alternatively, in another embodiment, the extracted URL 340 may be provided to a mail recipient in the form of a button or image. Specifically, when a receiver clicks a button or an image, a page connected to the URL 340 or another URL 340 may be accessed.

In the characteristic information extraction step (S210), the characteristic information extractor 110 extracts characteristic information from the e-mail. In one embodiment, the property information may be URL 340 included in the e-mail. In another embodiment, the characteristic information may be all information that can be identified by the user in the e-mail, such as images and phrases included in the e-mail. Information such as the sender 320 and the recipient 330 included in the e-mail may also be characteristic information. In this specification, for convenience of description, it is assumed that the characteristic information is at least one URL included in the e-mail.

Hereinafter, the key value conversion step (S220) will be described in detail with reference to FIGS. 4 and 5.

4 is a flowchart of a method for generating a hash table according to an embodiment of the present invention.

The key value conversion step (S220) is a step of converting the characteristic information extracted by the key value conversion unit 120 into a key value. As an embodiment, the key value may be a character-type value corresponding to characteristic information. Specifically, when the characteristic information is https://mail.daum.net/#INBOX , which is a URL included in the e-mail, the key value may be qwe123dfg. As another embodiment, when the property information is https://mail.kakao.com/#INBOX , which is a URL included in the e-mail, the key value may be dfg123qwe. As such, the key value may be a unique value corresponding to characteristic information and may be expressed in various forms. Alternatively, the key value may be a value directly corresponding to the e-mail. Specifically, the key value may be a unique key that is any one value capable of specifying an e-mail. The unique key will be described later.

Referring to FIG. 4 , the key value converter 120 may convert the URL 340 extracted from the e-mail into a hash key value 420 through a hash function 410 . Specifically, when the URL 340 extracted as described above is https://mail.daum.net/#INBOX , the hash key value 420 converted through the hash function 410 may be qwe123dfg. The hash function 410 may generate a hash key value 420 by mapping characteristic information such as a URL to data having a predetermined length. Also, the hash table generator 150 may match the URL 340 and the hash key value 420 to generate a hash table (430). The generated hash table 510 may be stored in the system 100 or may be stored in an external server or database connected to the system 100 through a network. Hereinafter, the hash table will be described in detail with reference to FIG. 5 .

5 is a diagram of a hash table according to an embodiment of the present invention.

Referring to FIG. 5 , a URL 340 and a hash key value 420 may be matched in the hash table 510 . Although only one example is shown in the drawing, a plurality of URLs may be matched to respective hash key values in the hash table 510 . Alternatively, if the characteristic information is an image included in an e-mail rather than a URL, the hash table 510 may match an image included in the e-mail with a hash key value corresponding thereto. A hash key value corresponding to an image included in the e-mail may also be expressed in text form.

Hereinafter, the identification data storage step (S230) will be described in detail with reference to FIG. 6 .

6 is a diagram for storing key value information in at least a part of an e-mail header.

In the identification data storage step (S230), the identification data storage unit 130 stores the key value as identification data dependent on the e-mail. Here, the identification data may be a predetermined value capable of identifying the e-mail. In one embodiment, the identification data may be an identification number assigned to the e-mail by the system 100. Alternatively, the identification data may be a value obtained by converting information included in the e-mail into a key value and storing it. Specifically, when the e-mail includes a URL of www.daum.net , the key value conversion unit 120 can convert the URL into a key value of 'abcd', and the identification data storage unit 130 identifies 'abcd'. can be stored as data. At this time, the system 100 may identify the e-mail including the www.daun.net URL among all e-mails by utilizing the identification data 'abcd'. As an example of the identification data storage, the identification data storage unit 130 may store identification data dependent on the e-mail in at least a part of the e-mail header. Specifically, as in the above-described embodiment, the identification data storage unit 130 may store the key value 'abcd' as key value information in at least a part of the header of the e-mail.

Referring to FIG. 6 , the header 610 of the e-mail may include various information about the e-mail. Specifically, the header 610 may include sent time, received time, sender information, recipient information, and the like of the e-mail. The identification data storage unit 130 may store the key value as key value information 620 in the header 610 . Specifically, when the key value 420 converted in the key value conversion step (S220) is qwe123dfg, the key value information 620 may be stored in the form of X-Hera-Hashkey: qwe123dfg. Although one embodiment is shown in the drawing, a plurality of key value information 620 may be stored in one header 610 . For example, if multiple URLs such as https://mail.daum.net/#INBOX and https://mail.kakao.com/#INBOX are included in the e-mail, each URL is converted into a key value, A plurality of key value information 620 such as X-Hera-Hashkey: qwe123dfg and X-Hera-Hashkey: dfg123qwe may be stored in one header 620.

Alternatively, one key value information 620 may be stored by combining a plurality of URLs. For example, when multiple URLs such as https://mail.daum.net/#INBOX and https://mail.kakao.com/#INBOX are included in the e-mail, one key value information is included in the header 610. It can be stored in the form of (620) X-Hera-Hashkey: qwe123dfg / dfg123qwe. At this time, the method of determining harmfulness of the e-mail may further include classifying a plurality of key values in one key value information 620 . Specifically, a plurality of key values such as qwe123dfg and dfg123qwe may be classified by parsing one key value information 620 X-Hera-Hashkey: qwe123dfg / dfg123qwe.

Hereinafter, referring to FIG. 7, the harmfulness determination step (S240) will be described in detail.

7 is a diagram of a method for determining harmfulness of an e-mail according to an embodiment of the present invention.

In the harmfulness determination step (S240), when the user attempts to access the e-mail, the harmfulness determination unit 140 determines whether the characteristic information is harmful information based on the identification data. In one embodiment, after the server receives and stores the e-mail, the user may attempt to access the e-mail through the user terminal. In one embodiment, a user may attempt to access an e-mail in order to open the e-mail and check the content. At this time, if harmful information is included in the e-mail, the system 100 needs to determine whether harmful information exists and inform the user. Accordingly, the harmfulness determination unit 140 may determine whether the characteristic information is harmful information based on the identification data.

Referring to FIG. 7, the harmfulness determination step (S240) includes comparing key value information with a hash table (S710), re-extracting a URL from the hash table (S720), and determining whether the re-extracted URL is a spam URL. A step of doing (S730) may be further included. First, the harmfulness determination unit 140 may compare the key value information 620 and the hash table 510 . As in the above example, when the key value information 620 is X-Hera-Hashkey: qwe123dsf and the hash table 510 is the hash table shown in FIG. 5, the system 100 provides information included in the key value information 620. The part of qwe123dfg can be compared with the hash table 510. Also, the harmfulness determination unit 140 may re-extract URLs from the hash table. When comparing the qwe123dfg part of the information included in the key value information 620 with the hash table 510, the hash table 510 includes a URL matched to the hash key value qwe123dfg. In the hash table shown in FIG. 5, a URL matched to the hash key value qwe123dfg is https://mail.daum.net/#INBOX . Accordingly, the system 100 may re-extract the URL of https://mail.daum.net/#INBOX in response to the key value information 620 X-Hera-Hashkey: qwe123dsf. Also, the harmfulness determination unit 140 may determine whether the re-extracted URL is a spam URL. Determining whether the re-extracted URL is a spam URL may be by comparing the re-extracted URL with a predetermined database of spam URLs. The predetermined spam URL database may be an external spam database or may be a database included in the system 100 and periodically updated. In another embodiment, although not shown in the figure, the inspector may directly inspect the URL to determine whether it is a spam URL. As another embodiment, determining whether a URL is a spam URL may include generating a screenshot by accessing the URL, and determining whether the accessed URL is a spam URL based on the screenshot. Specifically, the system 100 may re-extract URLs through the above-described steps when a user accesses e-mail, access the re-extracted URL, configure a page linked to the URL, and content included in the page. You can create screenshots to analyze etc. The system 100 may determine whether the accessed URL is a spam URL based on the generated screenshot. For example, determining whether a URL accessed based on a screenshot is a spam URL may be comparing the screenshot with a pre-registered spam image. Alternatively, as a result of analyzing the phrase included in the screenshot by OCR or the like, if the content is determined to be harmful, the accessed URL may be determined as a spam URL.

Hereinafter, another embodiment of a method for determining harmfulness of e-mail will be described with reference to FIGS. 8 and 9 .

8 is a flowchart of a method of generating an encryption key value according to an embodiment of the present invention.

Referring to FIG. 8 , the key value converter 120 encrypts 810 the URL 340 extracted from the e-mail and converts it into an encryption key value 820 . Specifically, when the URL 340 extracted as described above is https://mail.daum.net/#INBOX , the encryption key value 420 converted through encryption 810 may be asdf567gh. At this time, the identification data storage unit 130 may store the encryption key value 820 as key value information 620 in the header 610 . Specifically, the key value information 620 may be stored in the form of X-Hera-Encryption-key: asdf567gh. Although one embodiment is shown in the drawing, a plurality of key value information 620 may be stored in one header 610 . The key value conversion unit 120 may convert characteristic information into an encryption key value 820 using various encryption algorithms.

9 is a diagram for a method of determining harmfulness of an e-mail according to an embodiment of the present invention.

Referring to FIG. 9 , the harmfulness determination step (S240) may further include decrypting the key value information in URL form (S910) and determining whether the decrypted URL is a spam URL (S920). First, the harmfulness determination unit 140 may decrypt the key value information 620 . As an embodiment, when the key value information 620 includes an X-Hera-Encryption-key form, the system 100 may determine that the key value information 620 needs to be decrypted. As another embodiment, as described above, when the key value information 620 includes the X-Hera-Hashkey form, the system 100 may determine that the key value information 620 and the hash table 510 should be compared. there is. The harmfulness determination unit 140 may decrypt asdf567gh included in the key value information 620 in the URL form of https://mail.daum.net/#INBOX . Also, the harmfulness determination unit 140 may determine whether the decrypted URL is a spam URL. Determining whether the decrypted URL is a spam URL may be by comparing the decrypted URL with a predetermined database of spam URLs. In addition, as described in FIG. 7, it is possible to determine whether a URL is a spam URL by various methods.

Hereinafter, another embodiment of a method for determining harmfulness of an e-mail will be described with reference to FIGS. 10 and 11 .

10 is a flowchart of a method of generating a unique key table according to an embodiment of the present invention.

Referring to FIG. 10 , the system 100 may generate 1010 a unique key corresponding to the e-mail. As described above, the unique key may be any one of key values corresponding to characteristic information. As an embodiment, the unique key may be any one value capable of specifying an e-mail. Specifically, when one e-mail sender sends the same e-mail to a plurality of recipients, the unique key may have the same value for the same e-mail sent to a plurality of recipients. More specifically, when a spam mail sender sends spam mail to 100 people using a mail delivery system of a specific domain, the system 100 for determining the harmfulness of an e-mail related to a specific domain sends mail to 100 people. For all, the same unique key value can be created. Conversely, if a spam mail sender sends spam mail to 100 people, and 30 of them are received using a mail receiving system of a specific domain, the system 100 for determining the harmfulness of e-mail related to a specific domain The same unique key value can be created for mail sent to .

When a unique key value is generated in the above-described manner, mail can be specified without storing information on the sender or recipient of the e-mail.

After the unique key corresponding to e-mail is generated, steps S210 to S230 may be performed by the above method. Specifically, the characteristic information extracted from the e-mail may be converted into a key value through a hash function or an encryption method and stored as identification data.

Thereafter, the unique key table generating unit 160 included in the system 100 may create a unique key table (1030). Although not shown in the figure, a unique key and a key value may be matched in the unique key table. Specifically, the key value may be a hash key value 420 or an encryption key value 820. As an embodiment, a unique key called aa12345 may be generated corresponding to the e-mail, and the URL 340 of https://mail.daum.net/#INBOX among the characteristic information included in the e-mail is a hash function 410 ), it can be converted into a hash key value 420 of qwe123dfg. At this time, aa12345 as a unique key and qwe123dfg as a hash key value 420 may be matched in the unique key table.

11 is a diagram for a method of determining harmfulness of an e-mail according to an embodiment of the present invention.

Referring to FIG. 11, the harmfulness determination step (S240) includes comparing identification data and a unique key table (S1110), extracting a key value from the unique key table (S1120), and reconverting the extracted key value into characteristic information. (S1130) and determining whether the reconverted characteristic information is harmful information (S1140) may be further included. First, when a user attempts to access an e-mail corresponding to the unique key aa12345, the harmfulness determination unit 140 may compare identification data with the unique key table. One embodiment of the identification data may be the hash key value 420 qwe123dfg converted in the key value conversion step (S220). Accordingly, the hash key value 420 qwe123dfg matched with the unique key aa12345 in the unique key table can be extracted. Next, the extracted key value may be reconverted into characteristic information. As an embodiment, the extracted key value 420 qwe123dfg may be reconverted into a URL 340 of https://mail.daum.net/#INBOX , which is characteristic information. At this time, it may be reconverted using the above-described hash table. Next, it may be determined whether the reconverted characteristic information is harmful information. In the present invention, for convenience of description, it is assumed that the characteristic information is a URL, and whether or not it is harmful information is assumed to be a spam URL, but it is possible to determine whether it is harmful information according to various characteristic information. As an embodiment, if the characteristic information is an image included in the e-mail, and if the image is an obscene image or a violent image, it may be determined as harmful information. As another embodiment, if the characteristic information is a phrase included in the e-mail, and the phrase includes a profanity, it may be determined as harmful information.

In the above, embodiments of the method and system for determining harmfulness of e-mail of the present invention have been described. The technical features disclosed in each embodiment of the present invention are not limited to the corresponding embodiment, and unless incompatible with each other, the technical features disclosed in each embodiment may be merged and applied to other embodiments.

The present invention is not limited to the above-described embodiments and accompanying drawings, and various modifications and variations will be possible from the viewpoint of those skilled in the art to which the present invention belongs. Therefore, the scope of the present invention should be defined by not only the claims of this specification but also those equivalent to these claims.

The above-described present invention can be implemented as computer readable code (or application or software) on a medium on which a program is recorded. The above generation method can be realized by a code stored in a memory or the like.

The computer-readable medium includes all types of recording devices in which data readable by a computer system is stored. Examples of computer-readable media include Hard Disk Drive (HDD), Solid State Disk (SSD), Silicon Disk Drive (SDD), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. , and also includes those implemented in the form of a carrier wave (eg, transmission over the Internet). Also, the computer may include a processor or a control unit. Accordingly, the above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

100: System for judging harmfulness of e-mail
110: characteristic information extraction unit
120: key value conversion unit
130: identification data storage unit
140: hazard determination unit
150: hash table generation unit
160: unique key table generation unit

Claims (28)

In the method for the harmfulness determining system to determine the harmfulness of e-mail,
a characteristic information extraction step of extracting characteristic information from the e-mail;
a key value conversion step of converting the extracted characteristic information into a key value;
an identification data storage step of storing the converted key value as identification data subordinate to the e-mail; and
When a user attempts access to check the contents of the e-mail, a harmfulness determination step of determining whether the characteristic information is harmful information based on the identification data;
The identification data storage step,
storing the converted key value as key value information in at least a part of the header of the e-mail;
The harmfulness determination step is performed using the contents stored in the header of the e-mail
How to determine the harmfulness of e-mail. delete According to claim 1,
The characteristic information is a URL included in the e-mail.
How to determine the harmfulness of e-mail. According to claim 1,
The key value conversion step,
Converting the characteristic information into a hash key value through a hash function
How to determine the harmfulness of e-mail. According to claim 4,
Further comprising a hash table generating step of generating a hash table by matching the characteristic information with the hash key value
How to determine the harmfulness of e-mail. According to claim 5,
The harmfulness determination step,
comparing the key value information with the hash table;
Re-extracting characteristic information from the hash table; and
Further comprising the step of determining whether the re-extracted characteristic information is harmful information
How to determine the harmfulness of e-mail. According to claim 6,
If the characteristic information is a URL included in the e-mail,
Determining whether the re-extracted characteristic information is the harmful information,
Comparing the URL, which is the re-extracted characteristic information, with a predetermined spam URL database
How to determine the harmfulness of e-mail. According to claim 1,
The key value conversion step,
Encrypting the characteristic information and converting it into an encryption key value
How to determine the harmfulness of e-mail. According to claim 8,
The harmfulness determination step,
decoding the key value information in the form of the characteristic information; and
Further comprising determining whether the decrypted characteristic information is the harmful information
How to determine the harmfulness of e-mail. According to claim 9,
If the characteristic information is a URL included in the e-mail,
Determining whether the decoded characteristic information is the harmful information,
Comparing the URL, which is the decrypted characteristic information, with a predetermined spam URL database.
How to determine the harmfulness of e-mail. According to claim 1,
Further comprising a unique key generation step of generating a unique key corresponding to the e-mail
How to determine the harmfulness of e-mail. According to claim 11,
If the sender of the above e-mail sends the same e-mail to multiple recipients,
The unique key is the same value for the same e-mail sent to the plurality of recipients.
How to determine the harmfulness of e-mail. According to claim 11,
Further comprising a table creation step of generating a unique key table by matching the unique key with the key value
How to determine the harmfulness of e-mail. According to claim 13,
The harmfulness determination step,
comparing the identification data with the unique key table;
extracting the key value from the unique key table;
reconverting the extracted key value into the characteristic information; and
Further comprising determining whether the reconverted characteristic information is the harmful information
How to determine the harmfulness of e-mail. The system for determining the harmfulness of e-mail is
a characteristic information extraction unit extracting characteristic information from the e-mail;
a key value conversion unit that converts the extracted characteristic information into a key value;
an identification data storage unit which stores the converted key value as identification data subordinate to the e-mail; and
When a user attempts access to check the contents of the e-mail, a harmfulness determination unit determining whether the characteristic information is harmful information based on the identification data;
The identification data storage unit,
storing the converted key value as key value information in at least a part of the header of the e-mail;
The harmfulness determination unit performs the determination using the contents stored in the header of the e-mail.
A system that determines the harmfulness of e-mail. delete According to claim 15,
The characteristic information is a URL included in the e-mail.
A system that determines the harmfulness of e-mail. According to claim 15,
The key value conversion unit,
Converting the characteristic information into a hash key value through a hash function
A system that determines the harmfulness of e-mail. According to claim 18,
Further comprising a hash table generator for generating a hash table by matching the characteristic information with the hash key value
A system that determines the harmfulness of e-mail. According to claim 19,
The hazard determination unit,
Comparing the key value information with the hash table and re-extracting characteristic information from the hash table;
Determining whether the re-extracted characteristic information is the harmful information
A system that determines the harmfulness of e-mail. According to claim 20,
If the characteristic information is a URL included in the e-mail,
Determining whether the re-extracted characteristic information is the harmful information,
Comparing the URL, which is the re-extracted characteristic information, with a predetermined spam URL database
A system that determines the harmfulness of e-mail. According to claim 15,
The key value conversion unit,
Encrypting the characteristic information and converting it into an encryption key value
A system that determines the harmfulness of e-mail. 23. The method of claim 22,
The hazard determination unit,
Decrypting the key value information in the form of the characteristic information, and determining whether the decrypted characteristic information is the harmful information
A system that determines the harmfulness of e-mail. According to claim 23,
If the characteristic information is a URL included in the e-mail,
Determining whether the decoded characteristic information is the harmful information,
Comparing the URL, which is the decrypted characteristic information, with a predetermined spam URL database.
A system that determines the harmfulness of e-mail. According to claim 15,
Further comprising a unique key generation unit for generating a unique key corresponding to the e-mail
A system that determines the harmfulness of e-mail. According to claim 25,
If the sender of the above e-mail sends the same e-mail to multiple recipients,
The unique key is the same value for the same e-mail sent to the plurality of recipients.
A system that determines the harmfulness of e-mail. According to claim 25,
Further comprising a unique key table generator for generating a table by matching the unique key with the key value
A system that determines the harmfulness of e-mail. According to claim 27,
The hazard determination unit,
comparing the identification data with the unique key table, extracting the key value from the unique key table, and reconverting the extracted key value into the characteristic information;
Determining whether the reconverted characteristic information is the harmful information
A system that determines the harmfulness of e-mail.

Images