KR20110047488A - System and method for detecting spam using user log - Google Patents

Abstract

PURPOSE: A system and method for detecting spam using a user log are provided to accurately filter an increased number of spam mail by judging the spam mail through the analysis of the common characteristics of the mail that plural users manage. CONSTITUTION: An analyzer(120) analyzes log information related to the execution and deletion of an e-mail, and a detector(130) detects the spam within the e-mail by using the log information. A verifier(140) analyzes the mail data of the spam and whether or not the spam exists. The log information includes the click log or duration time of the e-mail. The detection unit judges as the spam mail the e-mail which is detected while not executing the click log.

Description

Spam detection system and method using user log {SYSTEM AND METHOD FOR DETECTING SPAM USING USER LOG}

Embodiments according to the present invention relate to a system and method for detecting spam mail using log information of a user who manages e-mail.

With the development of high speed internet network, users can use the internet anytime and anywhere. In particular, the e-mail service is one of the Internet services that users use most, and is one of the services that can quickly transfer text and files to other users.

In recent years, the capacity of electronic web mail services has gradually increased, and the types of services have been gradually diversified. In the early days, e-mail services were mainly used for personal use. However, as convenience and advantages of e-mail are known, in recent years, e-mail has become an essential means of communication in business.

Openness to free text and file exchange with anyone is an advantage of e-mail, but it can also be used to e-mail spam, such as sending random e-mails or posting advertising information to a large number of people. It is a big inconvenience for mail users.

E-mail users have to designate and delete such spam mails, and it takes a lot of time to delete spam mails, and there is a need for a method that can efficiently detect spam mails and e-mails that are not needed by users. have.

There is provided a spam detection system and method that makes it easier to manage spam without the user specifying spam.

Provided are a spam detection system and method that can efficiently detect spam mail by utilizing a user log that manages e-mail.

Spam detection system according to an embodiment of the present invention includes an analysis unit for analyzing log information associated with the execution or deletion of the e-mail; And a detection unit for detecting spam in the e-mail using log information.

According to an aspect of the present invention, the log information may include a click log or duration time of the electronic mail.

According to an aspect of the invention, the detection unit may determine that the deleted mail in the non-execution state through the click log as spam, or determine that the deleted or read interrupted mail as spam when the execution time is less than a predetermined time.

According to an aspect of the present invention, it may further include a verification unit for verifying the spam by analyzing the mail data between the detected spam for a plurality of users, the mail data is the sender's mail address, mail server, subject, sender It may include at least one of a person's name.

According to one aspect of the invention, the verification unit may verify whether the spam according to the size information of the mail determined as spam, the sender's e-mail address corresponding to the spam is a list of addresses stored by the user, or sent or returned Spam can be verified based on whether it is included in the address list.

A spam detection method according to an embodiment of the present invention includes a method for detecting spam in a spam detection system, the method comprising: analyzing log information related to execution or deletion of an e-mail in an analysis unit of a spam detection system; And detecting spam in the e-mail by using the log information in the detection unit of the spam detection system.

According to an embodiment of the present invention, spam can be detected and managed automatically by analyzing spam using a user log that manages electronic mail.

According to one embodiment of the present invention, by analyzing a common characteristic of the mail managed by a plurality of users in the same pattern to determine the spam can be filtered more spam more accurately.

Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

The spam detection system and method according to an embodiment of the present invention can be applied to a system for providing an e-mail service on the web, and provides a function of detecting spam to filter spam in an e-mail.

1 is a block diagram illustrating an internal configuration of a spam detection system according to an embodiment of the present invention.

The spam detection system according to an embodiment of the present invention may include an analysis unit 120, a detection unit 130, and a verification unit 140. In this case, the spam detection system may be configured to interoperate with the mailbox 110.

The mail box 110 refers to a database that stores electronic mail, and stores and manages it in association with each user. The mailbox 110 generally stores mail data of a Multipurpose Internet Mail Extension (MIME) type. Typically, the mail box 110 may manage the mail data as one file, and may manage the storage location of each mail data through a file pointer.

The analyzer 120 analyzes log information of the user who manages the e-mail, that is, log information related to the execution or deletion of the e-mail. The log information of the user may be recorded together with the mail data in the mailbox 110 or may be recorded and maintained in a separate storage means. The analyzer 120 may collect and analyze log information for each user of the electronic mail from the mailbox 110 or the storage means. In this case, as log information, a click log of an e-mail, a duration time, or the like may be utilized. The analysis unit 120 may analyze whether the e-mail is executed, whether or not it is deleted, and the execution time through the log information.

The detector 130 detects spam in the e-mail based on the log information analyzed by the analyzer 120. The detection unit 130 determines the detected mail as spam by detecting a mail deleted while not being executed, or a mail that has been deleted or read while the execution time is less than a predetermined time (for example, 5 seconds). do. When a user opens an inbox from a web page that provides e-mail services, the user can easily check for spam by simply typing the subject or sender's name. 2 is a view for explaining an example of a pattern in which a user manages an e-mail in a spam detection system according to an embodiment of the present invention. Even if the user deletes or executes the mail subject or the sender name without checking the spam mail, it shows a behavior pattern that immediately deletes or stops reading when the spam is confirmed. That is, even if a user deletes or opens a file immediately without opening it, the mails showing a behavior pattern of deleting or stopping reading as soon as they open may be very likely to be spam from the user's point of view. As shown in FIG. 2, the detection unit 130 detects the mail that is not executed or the mail whose execution time is less than a predetermined time among the deleted mails of the recycle bin 201 using the log information to determine the corresponding mail as spam. can do.

The spam detection system having such a configuration can easily detect spam mail by using log information of a user who manages (executes or deletes) an electronic mail.

Further, the verification unit 140 performs a role of verifying whether or not the spam for the electronic mail determined as spam in the detection unit 130. One embodiment of the present invention can verify whether or not spam in consideration of the behavior patterns of the various users for the e-mail. First, the detection unit 130 may detect spam for each user by determining that a mail having a predetermined pattern as spam is deleted without being executed for each user or deleted or read stopped after an execution time of a predetermined time or less. Subsequently, the verification unit 140 verifies spam by analyzing common characteristics of mail data corresponding to the electronic mail determined as spam. At this time, the mail data may include a mail address of the sender, a mail server, a subject, a sender name, size information of mail contents, and the like. For example, the verification unit 140 calculates a frequency in which each mail data is common, such as the same e-mail address (IP) of the e-mail determined to be spam or the same mail server, and then uses the calculated e-mail as the calculated frequency. You can be sure that you are spam by sorting. Alternatively, the verification unit 140 may be sure that the mail subject of the e-mail determined to be spam is similar in a specific pattern, the sender name is longer than a certain range, or contains an automatically generated pattern. . Alternatively, even if the message has a large amount of text, the mail is deleted or read while the execution time is less than a predetermined time, and thus the spam is more likely to be spam. Verification can be performed. That is, the verification unit 140 may be assured that the message is spam when the size information of the mail content is deleted or read while the execution time is less than or equal to a predetermined time. Alternatively, the verification unit 140 may include an e-mail address of the e-mail determined to be spam in an address list (for example, a user address book) stored and managed by the user, or included in an address list of mail sent or returned by the user. In this case, the verification can be performed as non-spam.

The spam detection system having such a configuration can detect the spam mail more accurately by analyzing the mail data of the mails deleted by the various users in the same pattern and verifying the spam once again.

3 is a flowchart illustrating a whole process of a spam detection method according to an embodiment of the present invention. The spam detection method according to an embodiment of the present invention may be performed through the spam detection system described with reference to FIG. 1. In FIG. 3, a spam detection method will be described by describing a process in which each step is performed through a spam detection system.

In operation S310, the spam detection system may collect and analyze log information for each user who manages e-mail, that is, log information related to execution or deletion of the e-mail. In this case, the log information may be used as a click log of the e-mail, execution time, etc. The spam detection system may analyze whether the e-mail is executed, deleted or not, and the execution time through the log information.

In operation S320, the spam detection system may detect spam in the e-mail using the log information of the e-mail. The spam detection system can detect a message deleted while not being executed, or a message deleted or interrupted while the execution time is less than a predetermined time (for example, 5 seconds) and determine that the message is spam. have.

In step S330, the spam detection system verifies whether or not the spam for the e-mail determined to be spam. The spam detection system may verify spam by analyzing common characteristics of mail data such as an e-mail address, a mail server, a subject, and a sender name of the e-mail determined to be spam. For example, a spam detection system can determine whether or not spam is determined by calculating the frequency of common mail data, such as the same email address or the same mail server, and classifying the email by the calculated frequency. can do. In addition, the spam detection system can be assured that the e-mail determined to be spam is similar if the mail subject is similar in a certain pattern, the sender name is longer than a certain range, or contains an automatically generated pattern. In addition, the spam detection system may be assured that the spam is spam when the size information of the contents of the mail is more than a certain size among the mails deleted or read while the execution time is less than the predetermined time. In addition, the spam detection system verifies that the e-mail address of the e-mail determined to be spam is included in the address list stored and managed by the user, or is included in the address list of the e-mail sent or returned by the user. can do.

As such, when the spam detection system or the spam detection method according to an embodiment of the present invention is used, spam can be detected and managed automatically by analyzing spam by using a user log that manages an e-mail. Furthermore, by analyzing the common characteristics of the mails managed by the same pattern by multiple users, the spam can be filtered more accurately by verifying the spam once again.

Embodiments according to the present invention can be implemented in the form of program instructions that can be executed by various computer means can be recorded on a computer readable medium. The computer readable medium may include program instructions, file data, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by specific embodiments such as specific components and the like. For those skilled in the art to which the present invention pertains, various modifications and variations are possible.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all of the equivalents or equivalents of the claims as well as the claims to be described later will belong to the scope of the present invention. .

1 is a block diagram illustrating an internal configuration of a spam detection system according to an embodiment of the present invention.

2 is a view for explaining an example of a pattern in which a user manages an e-mail in a spam detection system according to an embodiment of the present invention.

3 is a flowchart illustrating a whole process of a spam detection method according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: Mailbox

120: analysis unit

130: detector

140: verification unit

Claims (19)

An analysis unit analyzing log information related to execution or deletion of an e-mail; And, A detection unit for detecting spam in the e-mail using the log information Spam detection system comprising a. The method of claim 1, And the log information includes a click log or duration time of the e-mail. The method of claim 1, The log information includes a click log of the e-mail, And the detection unit determines the deleted mail as spam without executing through the click log. The method of claim 1, The log information includes the execution time of the e-mail, The detection unit, the spam detection system determines that the e-mail deleted or read interrupted while the execution time is less than a predetermined time, spam detection system. The method of claim 1, Verification unit for verifying the spam by analyzing the mail data of the spam The spam detection system further comprises. The method of claim 5, And the mail data includes at least one of a sender's mail address, mail server, subject, and sender's name. The method of claim 5, And the verification unit verifies whether the spam is spam based on the size information of the contents of the mail corresponding to the spam. The method of claim 5, And the verification unit verifies whether or not the spam is in accordance with whether the mail address of the sender corresponding to the spam is included in a list of addresses stored by a user or a list of sent or returned addresses. The method of claim 5, And the verification unit verifies spam by calculating a common frequency of mail data among spam detected for a plurality of users. In a method for detecting spam in a spam detection system, Analyzing log information related to execution or deletion of an e-mail in an analysis unit of the spam detection system; And, Detecting spam in the e-mail using the log information in a detection unit of the spam detection system; Spam detection method comprising a. The method of claim 10, And the log information includes a click log or execution time of the e-mail. The method of claim 10, The log information includes a click log of the e-mail, The detecting of the spam may include determining that the deleted mail is spam as not being executed through the click log. The method of claim 10, The log information includes the execution time of the e-mail, The detecting of the spam may include determining that spam is deleted or read while the execution time is less than a predetermined time, as spam. The method of claim 10, Verifying the spam by analyzing the mail data of the spam in the verification unit of the spam detection system; Further comprising, spam detection method. The method of claim 14, And the mail data includes at least one of a sender's mail address, mail server, subject, and sender's name. The method of claim 14, The step of verifying whether or not the spam is a spam detection method for verifying whether or not spam according to the size information of the content of the mail corresponding to the spam. The method of claim 14, The step of verifying whether or not the spam is a spam detection method for verifying whether or not the spam according to whether the mail address of the sender corresponding to the spam is included in the list of addresses stored by the user or the list of sent or returned addresses. The method of claim 14, The step of verifying whether the spam is spam detection method for verifying the spam by calculating a common frequency of the mail data between the detected spam for a plurality of users. A computer readable recording medium having recorded thereon a program for performing the method of claim 10.

Images