KR20030069567A - Method and Apparatus for Filtering Spam Mails - Google Patents

Abstract

PURPOSE: A method and device for filtering spam mails by recognizing mass of mails is provided to block and manage the spam mails effectively. CONSTITUTION: A mail managing unit(210) supplies a mail being received from an exterior in a mail storage(220), transmits a received mail to a designated user, and selects a spam mail out of received mails in accordance with a spam mail analysis result of a spam mail analysis unit(250). The mail storage(220) records a tag with respect to the spam mail selected in the mail managing unit(210), a corresponding spam mail is displayed, and checks a stored spam mail in accordance with a request of the user. A mass mail analysis unit(230) extracts the 'n' number of characters which are used frequently out of characters included in each mail received in the mail managing unit(210) as a representative character string, classifies similar mails having the same representative character string as the extracted representative character string. If the number of persons who receive similar mails having the identical representative character string is more than a predetermined number, the mass mail analysis unit(230) judges the mails as a mass of mails. A non-similar mail analysis unit(240) excludes a mail having an identical representative character string and different contents from a similar character string. The spam mail analysis unit(250) compares a keyword of a corresponding mail with a predetermined keyword, analyzes a spam mail, and supplies a spam mail analysis result to the mail managing unit(210).

Description

Method and Apparatus for Filtering Spam Mail Based on the Identification of Bulk Mail {Method and Apparatus for Filtering Spam Mails}

The present invention relates to a method and apparatus for filtering spam mails distributed indiscriminately over the Internet, and more particularly, to classify and classify mass mails based on the number of users who have received the same mail. The present invention relates to a method and apparatus for filtering spam mail based on bulk mail.

In the Internet mail service, one of the biggest problems is advertising and commercial electronic mail (E-mail, hereinafter referred to simply as mail) distributed indiscriminately over the Internet. Advertisement and commercial messages, commonly called spam mails, are broadly intended to mean messages that the user does not need to read, that is, messages that the user wishes to delete without seeing the contents of the message. Regardless of this, it means mail distributed indiscriminately through communication or the Internet.

Many users suffer from administrative inconvenience of receiving unnecessary mails and deleting unnecessary mails regardless of their intentions due to the mass spread of commercial and commercial mails called spam mails, and the traffic of the whole Internet increases due to unnecessary spam mails. This entails enormous inefficiencies.

There are several ways to filter spam mail received through Internet mail service.

The first method is to manage the e-mail address of the sender of the spam mail as a list, and to consider the mail coming from the mail address of the list as spam mail. In other words, this method examines the mail address from which the mail server primarily sends spam, creates a opt-out list, and recognizes mail sent from that address as spam. However, this list management method requires manual management of spam mails and manual management of corresponding mail addresses, and once the mail addresses that send spam mails are registered in the list, they are sent from the corresponding addresses. The disadvantage is that all mails are treated as spam mails, so you may not be able to read even the most important mails. In addition, when a spam mail is created and sent, the blocking address of the spam mail is almost incapacitated when the spam mail is sent by randomly generating or changing the sender address whenever the sender address is not used as an existing address.

The second method analyzes the subject or content of received mail and includes more than a preset word that indicates the content of an ad or commercial phrase or promotional phrase, such as "advertisement", "money-making", or "publicity." This method is recognized as spam mail. This method differs from the first method in that it is not based on the sender's address but instead analyzes the contents of the spam to determine whether it is spam. However, there is an error that recognizes many non-spam mails containing certain words such as 'advertisement' or 'money-making' as spam mails, and it is practically impossible to analyze all words that characterize spam mails. There is this.

The third method uses a social filtering technique. The spam filtering is performed by notifying a mail server or a spam management server about whether the mail is received by the user or not. The mail server informs other users who have received the same mail that the mail is spam, for mails that are reported as spam mails from users above the preset value. Since this method is based on the statistics of the spam mail judgment of the user based on the criteria for judging whether or not the spam mail, compared to the second method described above, there is an advantage that relatively accurate spam judgment is possible from the user's point of view. . However, the disadvantages of this method are that it is not possible to accurately determine whether or not the spam mail is accurate for mails that do not have sufficient information about users' spam mails. Until the report data is accumulated, it is not possible to quickly determine whether the mail is spam.

Meanwhile, a spam mail recognition method for filtering spam mails includes the same mail recognition method. The same mail recognition method is applied to determine that a specific mail is spam mail and to process the mail corresponding to the users who have received the same mail as the spam mail as spam mail. In general, the same mail recognition method examines information such as the sender's address, the subject of the mail and the contents of the mail, or a combination of these information, and recognizes the same mail as having the same contents.

However, when the same mail recognition method determines whether the same mail is the same as the sender's address and the subject, as in the aforementioned methods, similar mails in which the entire contents of the mail are the same but certain parts of the contents of the mail are changed. For example, there is a limitation that only the recipients, such as "Hong Gil Dong", are not recognized as the same mail. Moreover, even if the mail is the same, even if the sender's address is changed, there is a problem that the same mail is not recognized.

Therefore, an object of the present invention is to provide a spam mail filtering method and apparatus that can effectively block and manage spam mail.

Another object of the present invention is to provide a method and apparatus for determining a plurality of mails having similar contents as bulk mails and filtering spam mails based on the determination of the bulk mails.

1 is a block diagram of a mail service system;

2 is a block diagram of a mail server according to the present invention;

3 is a detailed block diagram of a mass mail analyzing unit;

4 is a detailed block diagram of a dissimilar mail analysis unit;

5 is a detailed block diagram of a spam mail analyzing unit;

6 and 7 are flowcharts illustrating a post-processing process of mails respectively recognized as spam mails.

<Explanation of symbols for the main parts of the drawings>

110: external mail server 130: mail server

210: mail management unit 230: bulk mail analysis unit

240: dissimilar mail analysis unit 250: spam mail analysis unit

310: representative character extracting unit 320: same mail classification unit

330: mass mail determination unit 410: character frequency calculation unit

420: frequency average calculation unit 430: frequency average comparison unit

510: Morphological analysis unit 520: Keyword extraction unit

540: Spam mail recognition unit 550: Spam term storage unit

According to a preferred embodiment of the present invention for achieving the above object, a method for filtering spam mail in the mail server, the spam mail is determined based on the number of similar mails for each mail received from the outside; It is characterized by.

According to another embodiment of the present invention, a method for filtering spam mails in a mail server includes: (a) N (N is a natural number) characters having a high frequency of use among characters included in each mail received from the outside; Representative character extraction step of extracting the representative character string representing; (b) accumulating mails by accumulating the number of mails having the same representative string for each representative string; (c) a mass mail analyzing step of analyzing mails in which the cumulative number of mails accumulated for each representative string is greater than or equal to a predetermined number as bulk mails; And (d) a spam mail analysis step of comparing a plurality of keywords included in each mail classified as the bulk mail with a preset keyword to recognize a mail having a similarity or more than a predetermined preset value as the spam mail. It features.

According to another embodiment of the present invention, an apparatus for filtering commercial or commercial spam mails may inform a user whether spam mails are received for each of the received mails according to a spam mail recognition result among mails received from the outside. The mail management unit; And a mass mail analyzer configured to analyze contents included in each mail received by the mail manager to classify mails having similar contents, and to analyze similar mails in which the classified similar mails are larger than a predetermined number as the spam mails. It is characterized by including.

According to still another embodiment of the present invention, an apparatus for filtering commercial or commercial spam mail includes: a mail manager for managing each mail received from the outside as spam mail according to a spam mail recognition result; Among the characters included in each message received by the mail management unit, N (N is a natural number) characters having a high frequency of use are extracted as representative characters representing the mail, and the extracted representative characters have the same or more preset values. A mass mail analyzer for classifying mails into bulk mails; And among the words included in each mail classified as the bulk mail, a keyword representing the mail and a predetermined spam keyword are compared to recognize a mail having a similarity or more than a preset value as a spam mail and the spam management to the mail manager. It characterized in that it comprises a spam mail analysis unit for providing a recognition result.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in detail as follows.

Prior to the detailed description of the present invention, terms related to the present invention are defined as follows.

* Bulk Mail: Mails with similar content to the recipients over preset value

* Spam filtering: Method or service to separate indiscriminate advertising messages that are not useful to mail users, to indicate whether they are spam mails, and to block receiving similar mails in the future, such as automatically moving spam mails to a separate archive.

* Same mail: 100% identical mail with content

* Similar Mail: A message whose content is equal to or greater than a preset value.

* Spam mail:

1) Broad definition: Messages that the user does not need to read, that is, messages that the user can safely delete without seeing the contents of the message.

2) Negotiable definition: Advertising and commercial mail that is distributed indiscriminately through communication or the Internet regardless of the user's intention to receive it.

* Spam words: Words that can be recognized as advertising mail, such as 'Ad', 'Buy' or 'Chance'

Referring now to FIG. 1, a schematic block diagram of a spam mail filtering system constructed in accordance with the present invention is shown.

The external mail server 110 transmits the mail created by the external sender to the mail server 130 of the present invention via the Internet 120, and the mail server 130 sends the mail sent from the external mail server 110. Receives the received mail and delivers the received mail to the users 140 who designate the mail.

In addition, the mail server 130 determines whether the mail is sent in large quantities based on the number of the users 140 who received the mails having similar contents from among the received mails, as a criterion for determining the spam mails. In the process of judging mass mails, if a content of each mail has a similarity or more than a preset value, a content-based similar mail determination method that considers a similar mail is applied. The mail server 130 defines a mail having an advertisement or commercial spam word among spam mails belonging to the similar mail judgment criteria as spam mail, and separately manages or discards the mail defined as spam mail or receives the mail. Inform the user that the mail sent is spam.

The user 140 refers to a computer having a web browser or a user of the computer. The user 140 may discard the received mail according to the notification of the spam mail from the mail server 130.

FIG. 2 shows a detailed block diagram of the spam filtering mail server 130 shown in FIG. 1.

The mail server 130 includes a mail managing unit 210, a mail storing unit 220, a mass mail analyzing unit 230, a dissimilar mail analyzing unit 240, and a spam mail analyzing unit 250.

The mail manager 210 provides the mail received from the outside to the mail storage 220 to store the mail, delivers the received mail to the designated user 140, and analyzes the spam mail of the spam mail analyzer 250. It performs the function of screening spam mails among the received mails. The mail managing unit 210 transmits only mails except the mail analyzed as spam mails to the user 140 according to the result analyzed by the spam mail analyzing unit 250, or sends all received mails to the user 140 as it is. After providing, the user may be notified of the result analyzed by the spam mail analyzing unit 250.

The mail storage unit 220 indicates that the corresponding mail is spam mail by recording a tag on the spam mail selected by the mail management unit 210, and confirms the stored spam mail at the request of the user 140. .

The mass mail analyzing unit 230 extracts N (N is a natural number) characters having a high frequency of use among the characters included in each mail received from the mail managing unit 210 as a representative string representing the mail, and extracted. Similar mails having the same representative string as the representative string are classified, and when the number of users who receive the similar mail having the same representative string is equal to or greater than a certain user, the mails are determined to be bulk mails. The process of determining the mass mail in the mass mail analyzer 230 will be described in detail with reference to FIG. 3.

The dissimilar mail analyzer 240 excludes mails having similar representative strings from the similar mails analyzed by the mass mail analyzer 230 but having similar contents in the mail body from the similar mails. This function recognizes mails with the same representative string but only partially changed contents of the mail body as similar mails. The operation of the dissimilar mail analyzer 240 will be described in detail with reference to FIG. 4.

The spam mail analyzing unit 250 compares the keywords included in the corresponding mails with the preset keywords based on the mass mails analyzed by the mass mail analyzing unit 230, and analyzes the mails which are mutually matched as spam mails, and the mail management unit. At 210, the result of the spam analysis is provided. The operation of the spam mail analyzing unit 230 will be described in detail with reference to FIG. 5.

FIG. 3 shows a detailed block diagram of the mass mail analyzing unit 230 shown in FIG. The mass mail analyzing unit 230 includes a representative character extracting unit 310, the same mail classifying unit 320, a mail management table 330, and a mass mail determining unit 340.

The representative character extracting unit 310 calculates the frequency included in the received mail and the frequency of each character, that is, the number of times of use. For example, if the received mail contains the content "EAAEAB AD CD EEAD", the characters used in the mail are all "A B C D E". At this time, the frequency of use of each of these characters is "5 1 1 3 4", respectively. Here, a representative code composed of N codes is extracted by extracting N characters as a representative string in order of the highest frequency of use among the characters used in the mail, and then assigning a frequency of use of each extracted N character as a code of each character. Generate heat. For example, when N = 3, "AED" is selected as the representative string representing the mail, and the frequency of use of each character in the representative string representing the contents of the mail, "AED", that is, "5 4 3". "Is extracted as the representative code string of the mail. At this time, the code assigned to each character is used by extracting only the first digit from the frequency of use of each character. Of course, the frequency of use of each character appearing in the mail may be 10 units or 100 units, and the unit may be used for the representative code string as it is, but in order to simplify the representative code string, it is preferable to extract and use only the first digit. Do.

In the present invention, a method of using a representative character to generate a representative code is described. Alternatively, a method of generating a representative code based on a summary of contents using a hash function may be applied. A representative method of the hash function-based method for generating the representative code through the summary of contents is an MD5 (Message Digest5) algorithm. The MD5 algorithm is a method of digesting the contents of a message and encrypting it with a 128-bit hash code. In order to apply the MD5 algorithm in the present invention, a 128-bit hash code is generated by summarizing the contents of each received mail, and the generated 128-bit hash code is used as a representative code value for classifying the same mail as in the present invention. It may be.

The same mail classifying unit 320 classifies mails having the same representative code string in each mail received.

The mail management table 330 may be implemented with a memory such as RAM, and accumulates mail classified by the same mail classifying unit 320 for each representative code string. Table 1 below shows an example of accumulating the number of mails classified by the same mail classification unit 330 for each representative code string.

Representative code string Number of messages Mail id 543123 .. 12020 .. 111, 134, 343 ..... 3434, 434, 34, .....

In Table 1, each received message has a representative code string of "543" and "123", and mails having the same representative code string are accumulated by "120" and "20", respectively, and having the representative code string. Notice that the mail ID is listed.

The mass mail discrimination unit 340 determines the mass mail as a mass mail by referring to the mail management table 330. This means that more than 100 users 140 have all received similar mails or more than 100 similar mails have been sent. According to the determination of the mass mail discrimination unit 340, in Table 1, since the number of mails having the representative code string "543" exceeds 120 as a preset value, mails having the mail IDs 111, 134, and 343 are identified as bulk mails. do.

In the present invention, the mass mail is classified based on the number of the users 140 or the number of mails sent, and the mail classified as the bulk mail is spammed by the spam mail analyzing unit 250 described below. It is a standard for judging.

Of course, the mass mail classified by the mass mail discrimination unit 340 may be regarded as spam mail, and the user 140 receiving the mail may be notified that the mail is spam mail. In addition, when the mass mail classified by the mass mail discrimination unit 340 is regarded as spam mail as it is, as described in the first method of the prior art, and manages the mail address of the sender of the spam mail as a list, Any mail received from a mail address in the mail address list may be regarded as spam mail, and the action may be taken. In addition, when the mass mail classified by the mass mail discrimination unit 340 is regarded as a spam mail as it is, as described in the second method of the prior art, by inspecting the title or content of the spam mail having a specific advertising or commercial specific words Spam information may be managed as a list of spam information to filter all incoming mail containing the specific word as spam mail.

4 is a detailed block diagram of the dissimilar mail analyzing unit 240 shown in FIG. 2. The dissimilar mail analyzer 240 includes a text frequency calculator 410, a frequency average calculator 420, and a frequency average comparator 430.

The character frequency calculator 410 calculates the frequency for all the characters included in each similar mail analyzed by the mass mail analyzer 230 of FIG. 2 as the mass mail.

The frequency average calculator 420 calculates an average of the frequency of use of each character calculated by the character frequency calculator 410. The process of calculating the average value in the frequency average calculation unit 420 will be described with reference to Table 2 below.

Similar mailing group (A B C D E) Frequency of use A B C D E Mail 1 Mail 2 Mail 3 .. 500 10 10 300 400 510 10 10 300 400 390 300 300 500 400 ..

In Table 2, it is assumed that three mails 1, 2 and 3 are classified as similar mails by the mass mail analysis unit 230 of FIG. 2, and each mail has a string of "A B C D E". When N = 3, the representative strings of the mails 1, 2 and 3 are different from "A E D", "A E D" and "D E A", respectively, but all have the same representative code of "5 4 3". In these mails, the frequency averages of the strings "A, B, C, D, E" are 1400/3 (= 466.66), 320/3 (= 106.66), 320/3 (106.66), 1100/3 (366.66), respectively. ), 1200/3 (= 400).

The frequency average comparison unit 430 compares the average value of each character calculated by the frequency average calculation unit 420 and the frequency as a vector value, and the vector similarity between them exceeds a preset value, for example, 90% to 95%. Mail that you do not want is excluded from the mail group. Mail 3 will be excluded from this process.

In the present invention, a method of using a vector value in character units is described to express a vector representing the content of a document. Alternatively, a method of calculating a vector value representing a document content in a word unit may be applied. .

Therefore, while going through the process by the dissimilar mail exclusion unit 240, it is possible to accidentally exclude a mail that is similar to the representative code string but the contents of the mail as dissimilar mail by dissimilar mail. In addition, in the case of an e-mail in which the contents of an e-mail are partially changed, for example, an e-mail in which only the recipient's name is changed, the e-mail may be regarded as a similar e-mail. It is possible to do The result analyzed by the frequency average comparison unit 430 is provided to the spam mail analyzing unit 250.

5 is a detailed block diagram of the spam mail analyzing unit 250 shown in FIG. 2. The spam mail analyzer 250 includes a morpheme analyzer 510, a keyword extractor 520, a stop word keyword store 530, a spam mail recognizer 540, and a spam word store 550.

The morpheme analyzer 510 may be a morpheme unit, for example, a morpheme of a word unit, for a character string included in each mail analyzed as a bulk mail or a similar mail by the mass mail analyzer 230 or the dissimilar mail analyzer 240. Perform the analysis. Morphological analysis, for example, explains "free (noun) + by (probe) + easy (adjective) + (mother) + earning (noun) + method (noun) for phrases such as" how to make money for free. " This is the process of performing morphological analysis in the same manner as "." A plurality of words such as nouns and noun phrases analyzed by the morpheme analysis unit 510 are extracted, and the extracted plurality of words are provided to the keyword extraction unit 520 as keyword candidates, respectively.

The keyword extractor 520 selects a keyword representing the content of the mail from among the keyword candidates provided by the morpheme analyzer 510. In this case, the criterion for selecting a keyword extracts as a keyword all keyword candidates which are not included in the stopword keyword storage unit 530 among the keyword candidates. The stopword keyword storage unit 530 contains a pronoun, an adjective, an adverb, an adjective, and a frequently used verb that has a low value as an index word. Used as The stopword keyword storage unit 530 may be implemented as a memory device such as a ROM. Although the term extraction unit 520 has been described as using a stopword dictionary as a method of selecting a keyword, on the contrary, only a specific keyword may be selected using a term dictionary opposite to the stopword dictionary.

The spam mail recognition unit 540 compares the spam word included in the spam word storage unit 550 with the keyword selected by the keyword extraction unit 520, and has a similarity of more than a preset value, for example, 90% to 95% similarity. Recognize the mail as spam mail. The method of calculating the similarity in the spam mail recognition unit 540 may be described as follows. First, the keyword constituting the document of the mail and the weight assigned thereto are the keyword vectors of the mail document, and the similarity between the two vectors is determined using the spam word of the spam term storage unit 550 and the weight assigned thereto as the spam word vector. Calculate At this time, the weight is calculated using the term frequency (Term Frequency) indicating how many times a specific word appears in a document and the inverse frequency (frequency) indicating the frequency at which a specific word is used in the entire document. Cosine coefficients may also be used. The spam mail recognition unit 540 compares the similarity between the spam word and the keyword, recognizes the mail as spam mail, and provides the spam recognition result to the mail management unit 210.

In the case where the received mail is recognized as spam mail, the user 140 (see FIG. 1) may process the spam mail as described in FIGS. 6 and 7.

6 illustrates a case in which only a general mail is delivered to a user after checking whether a mail is spam for each mail received by the mail server 130.

In FIG. 6, the mail received from the mail server 130 determines whether spam mail is present (step S610). If it is determined that the received mail is spam mail, the process proceeds to step S620, otherwise, the process proceeds to step S630.

In step S620, the mail server 130 records a tag indicating that the mail is spam mail in a mail stored in the mail storage unit 220 or discards the spam mail.

Meanwhile, in step S630, the mail server 130 transmits the general mail to the user 140 except the mail recognized as spam mail.

Next, after the user 140 logs in to the mail server 130, the mail server 130 determines whether there is a request for inquiring about the mail that is specifically recognized as spam mail (step S640).

If there is a spam mail inquiry request from the user 140, the mail server 130 proceeds to step S650 and moves to the mail storage unit 220. The mail requested by the user 140 is displayed as spam mail. If there is a query, it is notified to the user 140.

FIG. 7 illustrates a case where each mail received by the mail server 130 is delivered to the user 140 without being checked for spam mail and then post-processed.

First, the mail received from the external mail server 110 in step S710 is delivered to the user 140 as it is by the mail server 130.

Then, the mail server 130 determines whether or not spam mail for the mail delivered to the user 140 (step S720). As a result of the determination of the spam mail, if it is determined that the mail delivered to the user 140 is spam mail, the process proceeds to step S730 to inform the user 140 that the mail delivered to the spam mail. The method of notifying the user that the spam mail has been delivered is to record a tag for the mail stored in the mail storage unit 220 to inform that the corresponding mail is spam mail.

Subsequently, the user who logs in to the mail server 130 confirms that there is spam mail in his or her mail list, requests the mail server 130 to collectively select the spam mail, and the mail server 130 requests the user ( 140, it is checked whether there is a batch of spam mail selection request (step S740).

In step S750, the mail server 130 confirming that there is a bulk mail selection request from the user 140 automatically recognizes the spam mail included in the mail list of the user 140, and creates a spam mail list to create a spam mail list. 140).

Thereafter, the mail server 130 collectively deletes or discards the spam mail stored in the mail storage unit 220 according to the request for deleting the spam mail from the user who checked the spam mail list.

It will be appreciated by those skilled in the art that the present invention is not limited to the above embodiments, and that various modifications and changes can be made without departing from the spirit of the present invention.

According to the present invention, through spam mail filtering, mail containing commercial and advertising contents can be prevented from being delivered indiscriminately to the user, thereby reducing administrative trouble using the user's mail system.

By using the spam filtering technique of the present invention, by providing conveniences such as mail recognition, blocking, and management for mails having low informationality and importance from the user's point of view, the user's efficiency of mail management can be improved.

Through accurate grasping of the bulk mail of the present invention, it is possible to grasp the exact information and sending status of the email senders who send the bulk mail, and take necessary measures for the sender based on these clear criteria.

In addition, it is possible to reduce unnecessary Internet traffic by identifying senders who send a large amount of spam mails and taking measures against them, thereby contributing to increasing data transmission speed on the Internet.

Claims (21)

In the method for filtering spam mail in the mail server, Spam mail filtering method, characterized in that for determining the spam mail for each mail received from the outside based on the number of similar mail sent. The method of claim 1, The spam mail determination step, (a) a representative character extraction step of extracting N (N is a natural number) characters having a high frequency of use from among the characters included in each mail received from the outside as a representative string representing the mail; (b) accumulating mails by accumulating the number of mails having the same representative string for each representative string; And (c) a similar mail analyzing step of analyzing the mails whose cumulative number of mails accumulated for each representative string is equal to or greater than a preset number as the similar mails; And (d) Spam mail determination step of judging the mail analyzed as the similar mail as the spam mail Spam e-mail filtering method comprising a. The method of claim 1, The similar mail analysis step (c), (c-1) calculating a frequency of use of all characters included in each similar mail; (c-2) calculating an average value of the frequency of use of each character in each similar mail; (c-3) comparing the frequency of use of each character with the average value; (c-4) recognizing, as the similar mail, an email whose similarity between the frequency of use of each character and the average value exceeds a preset value as a result of the comparison; The method for filtering spam mails, wherein the mails classified as the similar mails are recognized as the similar mails, wherein the mails having the same representative string but partially changed contents of the mails are recognized as the similar mails. The method of claim 1, The similar mail analysis step (c), (c-1) calculating a frequency of use of all characters included in each similar mail; (c-2) calculating an average value of the frequency of use of each character in each similar mail; (c-3) comparing the frequency of use of each character with the average value; And (c-4) excluding from the similar mail an email whose similarity between the frequency of use of each character and the average value does not exceed a preset value; The method of filtering spam mails, wherein the mails classified as the similar mails are recognized as the similar mails except for mails in which the representative string is the same but the contents of the mails are not similar. In the method for filtering spam mail in the mail server, (a) a representative character extraction step of extracting N (N is a natural number) characters having a high frequency of use from among the characters included in each mail received from the outside as a representative string representing the mail; (b) accumulating mails by accumulating the number of mails having the same representative string for each representative string; (c) a mass mail analyzing step of analyzing mails in which the cumulative number of mails accumulated for each representative string is greater than or equal to a predetermined number as bulk mails; And (d) a spam mail analysis step of comparing a plurality of keywords included in each mail classified as the bulk mail with a preset keyword and recognizing a mail having a similarity or more than a predetermined preset value as the spam mail; Spam mail filtering method of a mail server comprising a. The method of claim 5, The spam mail filtering method, (f) dissimilar mail exclusion step of excluding mails in which the representative strings are identical but the contents of the mails are not similar among the mails classified as the bulk mails; Spam filtering method characterized in that it further comprises. The method of claim 6, The dissimilar mail exclude step (f) (f-1) calculating a frequency of use of all characters in each mail; (f-2) calculating an average value of the frequency of use of each character in each mail; (f-3) comparing the frequency of use of each character with the average value; (f-4) excluding from the mass mail a message in which the similarity between the frequency of use of each character and the mean value does not exceed a preset value; Spam filtering method characterized in that it comprises a. The method of claim 7, wherein The step (f-4) is a method for filtering spam mails, wherein the mails classified as the bulk mails are recognized as the bulk mails, in which the representative string is the same but the contents of the mails are partially changed. The method of claim 5, The spam mail analyzing step (d), (d-1) selecting a plurality of words extracted by analyzing the character strings included in the contents of the mail in morpheme units as keyword candidates; (d-2) selecting a keyword-capable candidate excluding a stopword among the selected keyword-capable candidates as a keyword representing the mail; (d-3) comparing the selected keyword with preset spammy information; (d-4) recognizing the mail as spam mail when the similarity between the selected keyword and the predetermined spam information is equal to or greater than a preset value as a result of the comparison; Spam filtering method characterized in that it comprises a. A device for filtering commercial or advertising spam mail, A mail management unit that informs a user whether spam mail is received for each of the received mails according to a spam mail recognition result among mails received from the outside; And Mass mail analyzer that analyzes the contents included in each mail received by the mail management unit to classify the similar mails, and analyzes similar mails in which the classified mails are larger than a predetermined number as the spam mails. Spam filtering device comprising a. The method of claim 10, The mass mail analysis unit A representative character extracting unit for calculating a frequency of use of each character and extracting N characters having the most frequency of use as a representative character string representing the mail; An identical mail classifying unit for classifying the same mails with the representative string; A mail management table which accumulates the mail classified by the same mail classification unit for each representative string; And A mass mail discrimination unit for discriminating mails whose cumulative number of mails classified by the representative character string by the reference number or more as the similar mails by referring to the mail management table. Spam filtering device characterized in that it comprises a. The method of claim 10, The spam mail filtering device, Further comprising a non-like mail analysis unit for excluding the mail that is the same as the representative character, but the contents of the mail among the mail classified as similar mail by the mass mail analysis unit, The dissimilar mail analysis unit, A character frequency calculating unit that calculates a frequency of use of all characters included in the similar mails; A frequency average calculating unit that calculates an average value of the frequency of use of each character in the similar mail calculated by the character frequency calculating unit; And Frequency average comparison unit for excluding the mail in which the similarity comparing the frequency of use of each character with the average value does not exceed a preset value from the same mail Spam filtering device characterized in that it comprises a. A device for filtering commercial or advertising spam mail, A mail manager for managing each mail received from the outside as spam mail according to a spam mail recognition result; Among the characters included in each mail received by the mail management unit, N (N is a natural number) characters having a high frequency of use are extracted as representative strings representing the mails, and the extracted representative strings have the same or more predetermined values. A mass mail analyzer for classifying mails into bulk mails; And Among the words included in the mail classified as the bulk mail, a keyword representing the mail is compared with a predetermined spam keyword, and a mail having a similarity or more than a preset value is recognized as spam mail and the spam management result is recognized by the mail management unit. Spam mail analysis unit provided Spam filtering device comprising a. The method of claim 13, The mass mail analysis unit A representative character extracting unit for calculating a frequency of use of each character and extracting N characters having the most frequency of use as the representative character string; An identical mail classifying unit for classifying the same mails with the representative string; A mail management table which accumulates the mail classified by the same mail classification unit for each representative string; And A mass mail discrimination unit for discriminating mails having a cumulative number of mails belonging to the representative character string or more from a predetermined number by referring to the mail management table as the bulk mail; Spam filtering device characterized in that it comprises a. The method of claim 13, The spam mail analyzing unit, A morpheme analysis unit configured to extract at least one word analyzed by performing a morpheme unit analysis on a character string included in the contents of each mail classified as the bulk mail, and provide the extracted word as a keyword possibility candidate; A keyword extraction unit for selecting a keyword representative of the document of the mail from among the keyword possible candidates provided by the morphological analyzer; And A spam mail recognition unit that compares the keyword extracted by the keyword extracting unit with predetermined spam information and recognizes a mail having similarity or more than a preset value as spam mail and provides the spam mail recognition result to the mail management unit. Spam filtering device characterized in that it comprises a. The method of claim 15, The spam mail analyzing unit further includes a stop word keyword storing unit containing unused stop words, And the keyword extracting unit extracts, as the keyword, all keyword capable candidates not included in the stopword keyword storage unit among the keyword possible candidates. The method of claim 15, The spam mail analyzing unit further includes a spam term storing unit containing the predetermined spam information, And the spam mail recognition unit calculates a similarity between the keyword and the preset spam information by assigning a weight to the keyword and the preset spam information. The method of claim 17, The weight is a value of term frequency and inverse frequency, and the similarity is calculated by a cosine coefficient. The method of claim 13, The spam mail filtering device, It further comprises a non-like mail analysis unit for excluding the mail that is the same as the representative character, but the contents of the mail among the similar mail classified by the mass mail analysis unit, The dissimilar mail analysis unit, A character frequency calculating unit that calculates a frequency of use of all characters included in the similar mails; A frequency average calculating unit that calculates an average value of the frequency of use of each character in the similar mail calculated by the character frequency calculating unit; And Frequency average comparison unit for excluding from the similar mail a message whose similarity comparing the frequency of use of each character with the average value does not exceed a preset value Spam filtering device characterized in that it comprises a. The method of claim 13, And the mail managing unit transmits only mails except for the mail determined as the spam mail to the user according to the spam mail analysis result provided by the spam mail analyzing unit. The method of claim 13, And the mail management unit provides the received mail to the user as it is, and notifies the user of the spam mail analysis result provided by the spam mail analyzing unit.