TWI317471B - - Google Patents

Download PDF

Info

Publication number
TWI317471B
TWI317471B TW93108239A TW93108239A TWI317471B TW I317471 B TWI317471 B TW I317471B TW 93108239 A TW93108239 A TW 93108239A TW 93108239 A TW93108239 A TW 93108239A TW I317471 B TWI317471 B TW I317471B
Authority
TW
Taiwan
Prior art keywords
mail
communication behavior
policy
behavior
communication
Prior art date
Application number
TW93108239A
Other languages
Chinese (zh)
Other versions
TW200415458A (en
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed filed Critical
Priority to TW93108239A priority Critical patent/TW200415458A/en
Publication of TW200415458A publication Critical patent/TW200415458A/en
Application granted granted Critical
Publication of TWI317471B publication Critical patent/TWI317471B/zh

Links

Description

1317471 九、發明說明: 【發明所屬之技;^領域】 本發明係有關-種管控電子郵件之方法,制是關於一種 利用郵件SMTP通斯為赠以餘轩郵件之方法。 【先前技術】 企業郵件資訊安全問題從病毒、.駿客,乃至於垃圾郵件猎 、巴大心的郵件猶稽核、病毒魅加值與贱郵件防堵 軟體A司,係奠基於獻:雜庫的運算與分析技術,以希冀藉 由匯集大量城的「郵件_」,加鄉加_與智慧崎 方法’來達到「卿卩件_」魏。然㈣知缺失為分類認 定過於主觀’例如色情、發財、藥物、商業等,非決定性、可 能誤判’以及郵件内容掃描過濾、造成系統資源耗費和通訊效率 降低。 馬抵做圾郵件,各國補立法,_紐共識,郵钭 致區分為垃_似廣告鱗,故桃論「崎郵件防堵」^ 我們必須___細件。物「⑽_」「 贿為規範」為例:寄件者必彡綱身分:禁止匿名、偽造 >導) 生的郵件標題。寄件者須有正當意圖:禁止欺雛的表 意心。寄件細_身分:必賴供真實電子郵件地址讓 7 件者回覆。寄件者必須處理回饋:商業電子郵件例如廣告,必 須讓收件者可以「選擇訂閱」或「取消訂閲」。由美國聯邦貿易 員會(FTC)制疋。CAN_Spam立法下之垃圾郵件係指以匿名、 偽造、濫發或非法(變動資訊或隱藏資訊等)等行逕傳送電子郵 件者*廣告郵件谢旨寄件者經轉定管道取得收件者地址, 以正吊公财式傳送電子郵件者’餅者可追絲源地並有權 利經正式管道取消訂閱。 習知垃圾郵件過據阻隔技術大致可分為内容過滤、數值計 及啟發技術。麵術。崎過叙餘储解件者、收件 者、郵件主旨、郵件内容、副檔名、檔案名稱和擋案内文等之 過濾阻隔,其係透過黑名單收集方式,以防堵垃圾郵件;但具 有名單收鮮胃、;g單建立費時、阻齡不高、黑名單誤判等 缺點。數值計算之做法則係奠基於龐大資料庫的運算與分析技 術’藉由匯集大Ϊ垃圾的「郵件内容」,加以數值加權計算方法, 以達成垃_件防堵之侧;細具有分綱定過社觀(例如 色情、發財、藥物、商業等)、非決定性、可能誤判、郵件内容 掃描過獻使m源耗f和通訊效料低等缺點。啟發技術 則與前述數值計算方法類似,其亦係奠基於龐大資料庫的運算 與分析以義大量垃圾的「郵制容」,除了將郵件内容加以數 值加權計算之外’同時亦加時慧啟發方法,因此除了具有數 值計算方法之缺失外,當龍麵大時,!彳誤判率越高。 有鑑於此,本發明係針對上述之種種問題,提出一種利用 郵件SMTP通訊行騎__雜電子郵件之紋,以有效 克服習知之該等缺失。 【發明内容】 本發明之主要目的,係在提供—種·郵件賺通訊行 為即時解析崎控電子郵件之方法,輯成郵件糾控管之目 的 本U之另目的’係在提供一種利用郵件謝p通訊行 為即時解析咐冑刪娜,咏竭峨郵件防堵 之功效 本發明之再一目的,孫力;担 、 #、在域—__#SMTP通訊 為即時解析以管控電子郵件 / ,不僅可精確地管控郵件 達成點對點、多點對多點、 對夕點、多點對點,且具有節 網路頻寬、系統資源與硬介 硬碟二間之優點,藉叫時兼顧高網 安全性及高郵件通訊效率之雙重效兴。 本發明之又一目的,係在 、在k供一種利用郵件SMTp通訊 為即時解析以管控電子郵之1317471 IX. Description of the invention: [Technology of invention] Field of the invention The invention relates to a method for controlling emails, and relates to a method for using mail SMTP to provide gifts to Yuxuan. [Prior Art] Enterprise mail information security issues from viruses, . Junke, and even spam hunting, Ba Daxin's mail is still auditing, virus charm bonus and 贱 mail anti-blocking software A, the foundation is based on: miscellaneous library The operation and analysis technology, in hopes of bringing together a large number of "mail_", plus the township plus _ and the wisdom of the method to achieve "Qing _ _" Wei. However, (4) the lack of knowledge is classified as too subjective, such as pornography, wealth, drugs, business, etc., non-deterministic, may be misjudged, and scanning and filtering of mail content, resulting in system resource consumption and communication efficiency. Ma arrived as spam, and the countries supplemented the legislation. The _New Zealand consensus, the postal code was divided into garbage-like advertising scales, so the peach theory "Saki mail anti-blocking" ^ We must ___ fine pieces. The article "(10)_" "Brit is a norm" as an example: the sender's identity: prohibiting anonymous, forged > The sender must have a legitimate intent: the ambition of bullying is prohibited. Shipment _ identity: must rely on the real email address for 7 people to reply. The sender must process the feedback: commercial emails such as advertisements must allow the recipient to "opt in" or "unsubscribe". It is produced by the US Federal Trade Union (FTC). The spam under CAN_Spam legislation refers to the transmission of emails by anonymous, forged, spammy or illegal (changing information or hiding information, etc.) *Advertising mail thank you senders to obtain the recipient's address through the transfer pipeline, It is the source of the e-mail that is being sent to the public. The cake can be traced to the source and has the right to cancel the subscription through the official channel. The conventional spam blocking technology can be roughly divided into content filtering, numerical calculation and heuristic technology. Face surgery. The filtering barriers of the surrender, the recipient, the subject of the email, the content of the email, the name of the email, the name of the file, and the text of the file are all collected through blacklists to prevent spam; The list of fresh stomach, g, the establishment of time-consuming, low age, blacklist misjudgment and other shortcomings. The numerical calculation method is based on the calculation and analysis technology of the huge database. By collecting the "mail content" of the garbage, it is numerically weighted to calculate the side of the anti-blocking; Cross-community views (such as pornography, wealth, drugs, business, etc.), inconclusive, possible misjudgment, scanning of e-mail content, such as m source consumption and low communication efficiency. The heuristic technique is similar to the above numerical calculation method. It is also based on the calculation and analysis of a huge database to define the "postal capacity" of a large amount of garbage. In addition to numerically weighting the contents of the mail, it also adds time and wisdom. Method, so in addition to the lack of numerical calculation methods, when the dragon face is large,! The higher the false positive rate. In view of the above, the present invention is directed to the above-mentioned various problems, and proposes to use the mail SMTP communication line to ride the __hee email pattern to effectively overcome the above-mentioned shortcomings. SUMMARY OF THE INVENTION The main object of the present invention is to provide an instant analysis of the control of the e-mail by means of a kind of mail-to-mail communication behavior, and to compose the purpose of the mail rectification control unit. p communication behavior instant analysis 咐胄 娜 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 咏 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨 峨Accurately control the mail to achieve point-to-point, multi-point to multi-point, eve, multi-point, and have the advantages of network bandwidth, system resources and hard disk, and pay attention to high network security and high The dual efficiency of mail communication efficiency. Another object of the present invention is to provide an instant analysis for controlling e-mail by using a mail SMTp communication.

,,具有節省營運成本之優I 1317471 根據本發明’ 一種利用郵件 通況仃為即時解析以管控電 子郵件之方法係包括下列 .先,利用郵件傳輪值與郵件 標題的資訊預設複數不同The invention has the advantages of saving operating costs. According to the present invention, a method for controlling electronic mail by using the mail condition is as follows. First, the mail passing value is different from the information preset of the mail header.

’件通§fUr為模型政策;當代理器 (Agent)收到一電子郵件時, TO '、轉郵件if崎賴型政策逐 一對該電子郵件之郵件傳 〆進仃比對,以驗證該電子郵件 之行為是否符合該等郵件诵 ^ ° 丁為板型政策,並依據驗證結果 採取-相對應之阻擋/傳送的行動。 底下藉由具體實施例配合所附的圖式詳加說明,當更容易 瞭解本發明之目的、技術内容、特點及其所達成之功效。 【實施方式】 本發明係麵件觀代__ transfer agent,MTA)執行 利用預叹之郵件通訊行為模型政策來驗證一電子郵件之 郵牛傳輸㈣’透輕卩件触值鱗件標題等郵件傳輸資料的 解析’以主動判斷該電子郵件之行為是否符合系統所允許之行 為進而達成郵件進出控管及垃圾郵件防堵之目的。 封π整的電子郵件稱為郵件文本(Mail咖)。一般而言, 文本係3括郵件傳輸值(Maii transfer data)、郵件標題(厘沾 c〇ntent)。一封完整的電子郵件在饲服 器與用戶端將會有經過郵件傳送代理器(腫t聰鈿㈣, 10 1317471 剛和郵件用戶代·陶咖獅,魏)處理的過程, 此為電子郵件本傳輪模式。本發日脚此電子郵件之郵 件特性及傳_,經由即時麵_,赫—電子郵件的 郵牛傳輸值」與「郵件標題」等郵件傳輸資料的真假值加以 解析,且以精確歸納與演繹出上百種郵件行為類型,進而達成 管控電子郵件之進出以及垃圾郵件防堵之作用。 由於本發明會使用到一 電子郵件的郵件傳輸值來設定管理郵件 之郵件通訊行為模型政策 因此在說明本發明之方法之前,必 須先說明郵件傳輸值之内容。電子郵件之郵件傳輸值通常為寄 件者帳號、收件者帳號、收件者主機地址、寄件者主機地址、 回覆地址、網域名稱伺服器(DNS)及電子郵戰等資訊;其中, 電子郵件軸發信端條11、局___概務提供者 ㈣飼服器等代靖送後,每—所經過之代理器係會在該電 子郵件上加註一電子郵戳。 11 1317471 郵伴通訊行為褀曳政11'Frequently §fUr is the model policy; when the agent receives an e-mail, the TO', the e-mail, and the e-mail policy are sent to each other to verify the e-mail. Whether the behavior of the mail complies with the above-mentioned mail 诵 ^ ° is a plate type policy, and according to the verification result - the corresponding blocking / transmitting action. The purpose, technical contents, features and effects achieved by the present invention will be more readily understood by the detailed description of the embodiments and the accompanying drawings. [Embodiment] The invention of the invention is carried out by using the pre-spoken mail communication behavior model policy to verify the mail transmission of an e-mail (4) The analysis of the transmitted data 'actively determines whether the behavior of the e-mail conforms to the behavior allowed by the system to achieve the purpose of mail access control and spam prevention. The sealed email is called the mail text (Mail coffee). In general, the text system 3 includes the Maii transfer data and the message header (c沾ntent). A complete e-mail will be processed by the mail delivery agent (swollen t (X), 10 1317471 and mail user generation Tao Caishi, Wei) in the feeding machine and the client. This is an email. This pass mode. The characteristics and transmission of this e-mail in this e-mail are analyzed by the true and false values of the mail transmission data such as the instant message _, the e-mail postal mail transmission value and the "mail header", and are accurately summarized and Deducted hundreds of types of mail behaviors, in order to control the entry and exit of e-mail and spam prevention. Since the present invention uses the mail transmission value of an e-mail to set the mail communication behavior model policy for managing mail, it is necessary to explain the contents of the mail transmission value before explaining the method of the present invention. Email mail value is usually the sender's account number, the recipient's account number, the recipient's host address, the sender's host address, the reply address, the domain name server (DNS), and the electronic mail war. After the e-mail axis sends the end bar 11, the bureau ___ the general provider (4), the feeding device, etc., after the delivery, the agent will pass an e-postmark on the e-mail. 11 1317471 Post-Communication Behavior

行為模式1 採取行動 行為模式2 行為模式3Behavior pattern 1 take action behavior pattern 2 behavior pattern 3

採取行動 採取行動 採取行動 印伴通訊行為梢型政箓2 郵件通訊行為梢型政策3 第一圚 第-圖為树簡_件行如管㈣子鱗的方和音 圖,係_师仏_觀_嫌、標„ 訊、内容娜賴軸物㉔術㈣件妨 行為模型政策1G,且每—郵件通訊行為模型政策ω係包括有 複數規則12。 12 10 10 1317471Taking action, taking action, printing, communication, behavior, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics, tactics _ suspicion, standard „ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

第二圖 其中’第二圖所示’每-政策10之設定係包含有[郵件傳 輸值]和[郵件標題]二規貝,112,上述三項規則12之設定必須同 時符合’系統才會執行。關於規則12之設$,使用者可指定符 合、不符合以及略過不比對其中之一者,亦即使用者可指定[信 封寄件者]或[韻收件者],碑寫職補有;村選擇比對 或略過[郵件&題]’且所有規則12間之關聯性為[和],必須全 部付合該些4才視為成立條件,线才會執行以採取適當之 打動同樣地’在⑨定該等郵件通訊行為模型政策1G時,係可 依需求指定符合、不符合以及略過不比對其中之一者。 在-又疋好郵件通訊行為模型政策及其規則12後,當代 理器(Agent)收到一雷 子郵件時,係以鱗郵件通訊行為模型政 13 1317471 朿ι〇逐-對該電子郵件之郵件傳輸資料進行比對,所比對之郵 牛傳輸貝料係指包含有該電子郵件所屬之郵件傳輸值及標題資 π,甚至是内容及附加檔案,端視所預歧定之郵件通訊行為 杈!政策1G及其酬u蚊,藉峨賴電預件之行為是 ’夺口該等郵件通訊行為模型政策1〇,並依據驗證結果採取— 相對應之阻擋/傳送的行動。 -中’轉料通訊行為姻政策1()及其酬Η係可由 設定者絲成垃簡叙行域級料之行為,以判斷—電 子郵件是轉輯郵件,或靖—電子料衫錢檢之禮遇 郵件° δ該等郵件通訊行為模型政策ω及其規則㈣定義成 垃圾郵狀行為,__細_子餐崎證該電子 郵件時’係包括下列步驟:以該等郵件細于為模型政策ι〇逐 -對該電子郵件之郵件傳輸f料進行比對,以驗證該電子郵件 之行為是否符合該等郵件通訊行為模型政策,若是,則代表該 電子郵件為崎郵件,進而阻獅電子郵件;若否,則傳送該X 電子郵件。 相反地,當該等郵件通訊行為模型政策10及其規則12係 定義成免檢郵件之行為時’則此時代理器在收到電子郵件而以 該等郵件通訊行為模型政策10逐—對其郵件傳輸資料進行比 14 1317471 :=郵件之行為符合該等_訊行為模型政策 ,:電子郵件為免檢郵件,故傳送該電子郵件;若不 I’則崎該電子畴。糾免_件之奴,係可設定企 政策之錄禮觸象,免撿餐讀岭可輕公司、 子么司、重要客戶、往來麻 來廠商、§τ_子報_域名稱或固定 ΙΡ者,或者物允物______ 工豕中、協鳩、特物_),間企_禮遇對象則 優先放行。 由於代理器所採取之行動係依據郵件通訊行為模型政策之 設定内容之呈現減結果,抑卩當郵件通崎_型政策係模 擬垃圾郵件行為時,齡符合政策_崎郵件,·郵_ 訊行為模财㈣級郵件行树,财符合政策時係放 m僅針對垃圾郵件之管控流程 來詳細說明’關於免檢郵件之模擬則不再贅述。 15 1317471 S12 'XJ 允許傳送 . 是 粉播電手#件是否符合第一邾件通訊杆為楛变政蒗? 是 否 r 驗逋f手郵件是否符合第二郵件行為椹Φ政蒗? 是 1 否 « 堪續以下一鄄件道訊行為棋曳政泼驗級是否符合? 是 ‘ 是否符合最後一邾件遑訊行為棋银政鼓? r < 不允許該電手鄄件傳送 S14 |yS16 LT S18 U-S20 第三圖 其中,以垃圾郵件之管控為例,在驗證該電子郵件是否符 合該等郵件通訊行為_政策1G時,其詳蚊步驟如第三圖所 示,當該代理器收到該電子郵件時,係以第一郵件通訊行為模 型政策對電子郵件之郵件傳輸資料進行真假驗證,簡斷其是 否符合該第-郵件馳行為_錢,若符合則進行步驟 阳,即允許該電子郵件可傳送出去,若不符合則進行步驟似。 在步驟Μ中’代理器係繼續以第二郵件通訊行為模型政 策追溯電子郵叙雜,以觸肢贿合鱗二郵件通 為模型政I,若符合社許辦子郵件可傳糾去,即進行步 驟S12,右不符合,則進行步驟邮,繼續以下—郵件通訊行為 模型政策追聽f子郵件之键,朗最後—個畴通訊行為 16 1317471 拉型政策用完為止;當_最後—郵件通訊行為模型政策,如 步驟S18卿’以最後-郵件物f為翻政__子郵 ^時,若該電子郵件符合此郵件通訊行為模型政策,則進行步 驟S12,若該電子郵件仍不符合此郵件軌行城型政策之規 則’則可顧該電子郵件確實係不被允許傳送者,此時則進行 步驟S2〇 ’代理器係採取適當之行動使該電子郵件不被傳送。 其中,當不傳送電子郵斜,此時之處理方·可拒絕接 收電子郵件朗傳-錯誤代碼和難訊息,或直_除該電子 郵件,而此贿送電伟狀處财•可在驗料通訊行 為模型政策時,即加以指定。 另外,在第三圖之之流程中,每當在利用其中一郵件通訊 行為模型絲對f子郵狀觸資_概辦,其詳細 步驟可參第二圖所示,茲說明如下: ⑻首先’以第-規則對電子郵件之郵件傳_料進行真假 驗證’以判斷其是否符合該第一則彳,若是則進行步驟⑼,若 否則進行步驟(c); (b)以第二規則繼續對該電子郵件之郵件傳輸資料進行真 假驗證,以判斷其是否符合該第二規則,若否則進行步驟⑹, 若是則繼續以下一規則追溯該電子郵件之行徑,直到最後一規 17 1317471 、病止’且依顧使狀最彳I—朗之繼結果決定該電 子郵件是钟合該郵件魏行為_政策,若符合則允許該電 郵件可傳送出去’若不符合則進行步驟(C);以及 ⑷繼續以下-轉通訊行為模财策中之朗來追湖該電 2郵件之彳恤,以_其技符合此鱗通崎賴型政策, 右付合’社許該電子郵件可傳送出去,若不符合,則以又下 -郵件通訊行為_政策_追_電子料之行徑,直到最 後-郵件通訊行為模型政朗完為止。 因此,本發明藉由掌握電子郵件的全面性重要資訊進行管 制,只要正確設定郵件行為及其處理方式,魏有效達成管制 電子郵件之目的。 由於垃圾郵件係以匿名、偽造、濫發或非法(變動資訊或隱 藏資訊等购fit傳送電子料者,硕於私郵件可追溯來源 地並有_正_取_,如果驗實寄件者刻意以匿 名、偽造、濫發或非法(變動資訊或隱藏資訊等)行逕傳送電子 郵件即可辨識其為可能的垃圾郵件濫發者。 上述郵件通訊行為模型政策係可用以判斷該電子郵件是否 為垃圾郵件,㈣斷依據係触靖該電子郵件衫有反常行 為,該反常行騎常繼、偽造、濫發_等行為食 18 1317471 ,兄後魏錢子郵件猶反f行為,則可敏其為垃圾郵 牛例來說’匿名行為之態樣可财標題資訊列;寄件者 主機與回覆輪㈣;_細_她服務供應商 ()主機等仃為。偽造行為則係來源地主機為外部網域,但寄 件者地址偽领内部域:或峨的峨名_職(刪)不 正確專仃為者。濫發行為則係寄送方式異常且變動頻仍者。非 法行為則細覆地址為租賃主機者。 其中,關於匿名行為之解析,本發明之方法除了可判別上 述列舉彻輪,㈣卿、輯權送之電子 子件’例如_郵政局錄—㈣、郵件核心_^ 或郵件列表做n(Listse·)等所發送之電子郵件。 本發月利用郵件SMTP通訊行為即時解析以管控電子郵件 之方法通常係在—代理器内實施,較常使用者為郵件傳送代理 器陳),藉以在郵件傳送代理器_)執行階段,利用預設垃 圾郵件行為模擬,經由掌握「郵件傳輸值」與「郵件標題」等 資訊’以及回溯解析郵件傳輸資料的真假值,得以正確驗證出 該行為是賴合「概郵件狀」,射,郵件傳秋萄(MTA) 可為一路由器。 19 1317471 管控 至此本發明之利用郵件sMTp通訊行為即時解析以— 電子郵件之方法的精神已說畢,町特以三個具體範例來 雜驗證崎翻之方法,以蝴此項技蝴可參酌此 範例之描述而獲得足夠的知識而據以實施。 範例-:郵件進出控f —特定内部伽者僅鱗送電子 郵件給特定内部使用者。 啟用 0 信封 寄件者 0 信封 收件者 0 郵件傳輸 值 if 祕田 >件標題 比對項目 Host 比對項目 Host 比對項目 Host 比對◎略過 缝經 函口]......... 含/非 + 含/非 含/非 比對項目 要件 比對方式 含/非 Header Element Method +/- 選取名早或自行填寫The second picture, in the second picture, shows that the setting of each policy 10 includes [mail transmission value] and [mail header] two rules, 112, the above three rules 12 must be set to match the system. carried out. Regarding the setting of $12, the user can specify the match, the non-conformity, and the one of the unmatched ones, that is, the user can specify [envelope sender] or [rhythm recipient]. The village chooses to compare or skip [mail & title] and the correlation between all the rules 12 is [and], all must be paid for the 4 is considered as a condition, the line will be executed to take appropriate action Similarly, when the 1G mail communication behavior model policy 1G is determined, it is possible to specify compliance, non-conformity, and skipping one of the requirements according to the requirements. After the mail communication behavior model policy and its rules 12, when the agent receives a mine mail, it is a scale mail communication behavior model 13 1317471 朿 〇 〇 - - - The mail transmission data is compared. The mail delivery data is compared with the mail transmission value and the title capital π of the email, and even the content and the attached file, and the pre-determined mail communication behavior is considered. ! Policy 1G and its rewards are based on the behavior of the e-mail communication behavior model, and the corresponding blocking/transmission actions are taken according to the verification results. - In the 'transfer communication behavior marriage policy 1 () and its rewards can be set by the setter to simplify the behavior of the domain level material to judge - e-mail is a relay mail, or Jing - electronic shirt money check The courtesy mail δ δ these mail communication behavior model policy ω and its rules (4) defined as spam behavior, __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ The policy is to compare the email transmission of the email to verify whether the behavior of the email conforms to the policy of the email communication behavior model, and if so, the email is represented by the email, and then the lion electronic Mail; if not, the X email is sent. Conversely, when the email communication behavior model policy 10 and its rules 12 are defined as the behavior of the exemption mail, then the agent receives the email and uses the email communication behavior model policy 10 The transmission of data is consistent with the behavior of the 13 1317471 := mail in accordance with the behavioral model policy: e-mail is exempt from e-mail, so the e-mail is transmitted; if not I's the electronic domain. Correction _ pieces of slaves, can set the corporate policy of the ceremony, free of charge to read the ridge can light company, Zimen, important customers, contacts Malay manufacturers, §τ_子报_domain name or fixed ΙΡ , or the object of the object ______ work, the agreement, the special _), the inter-enterprise _ courtesy object is preferred. Because the action taken by the agent is based on the presentation of the content of the mail communication behavior model policy, the result is that when the mail tsusaki _ type policy simulates the spam behavior, the age meets the policy _ Saki mail, mail _ message behavior Model money (four) level mail line tree, when the financial compliance policy is released m only for the control process of spam to elaborate "the simulation of the exemption mail will not repeat. 15 1317471 S12 'XJ Allowed to transfer. Yes Is the powder broadcaster's hand piece suitable for the first piece of communication pole? Yes No r Check whether the mail of the f-mail conforms to the second mail behavior 椹 Φ 蒗? Yes 1 No « Can you continue the following one-way behavior? Yes ‘Is it consistent with the last piece of the game? r < This handcuff is not allowed to transmit S14 |yS16 LT S18 U-S20 Third figure, in the case of spam control, when verifying that the email meets the mail communication behavior_policy 1G, its The detailed mosquito step is as shown in the third figure. When the agent receives the email, it uses the first email communication behavior model policy to verify the email transmission data of the email, and whether it meets the first- E-mail behavior _ money, if it is met, the step is positive, that is, the e-mail can be transmitted, if not, the steps are similar. In the step Μ, the agent system continues to trace the e-mail narration with the second e-mail communication behavior model policy, and the escaping bribes and the squad are used as the model politics I. Proceed to step S12, if the right does not match, then proceed to the step mail, continue the following - the mail communication behavior model policy to follow the key of the sub-mail, the last - domain communication behavior 16 1317471 pull type policy is exhausted; when _ last - mail The communication behavior model policy, such as step S18, when the last-mail item f is the government policy__, if the email meets the email communication behavior model policy, then step S12 is performed, if the email still does not match The rule of this mail track type policy can consider that the email is indeed not allowed to be transmitted. In this case, proceed to step S2, where the agent takes appropriate action to prevent the email from being transmitted. Among them, when the e-mail is not transmitted, the processing party at this time can refuse to receive the e-mail rumor-error code and difficult message, or directly _ _ _ _ _ _ _ _ _ _ _ _ _ When the communication behavior model policy is specified, it is specified. In addition, in the flow of the third figure, whenever using one of the mail communication behavior models, the detailed description of the steps can be found in the second figure, as explained below: (8) First 'Take the true/false verification of the e-mail message by the first rule to determine whether it meets the first rule, if yes, proceed to step (9), otherwise if step (c); (b) use the second rule Continue to verify the e-mail transmission data of the e-mail to determine whether it complies with the second rule. If otherwise, proceed to step (6). If yes, continue with the following rule to trace the e-mail until the last rule 17 1317471, The disease is stopped and the result of the final decision I-lang determines that the email is the message of the message. If it is met, the email can be sent out. If not, proceed to step (C). ; and (4) continue to the following - transfer communication behavior model money in the Langlai chasing the lake 2 electric mail, to _ its skills in line with this scale Tongsaki Lai policy, right Fuhe 'Society can send this email can be transmitted Go out, if not, then Under - mail traffic behavior policy _ _ _ to recover practices of electronic material, until the most - mail traffic behavior model Zheng Long last. Therefore, the present invention manages by grasping the comprehensive and important information of the e-mail, and as long as the mail behavior and the processing method thereof are correctly set, Wei effectively achieves the purpose of controlling the e-mail. Since spam is anonymous, forged, spammy or illegal (change information or hidden information, etc.), the source of the private mail can be traced back to the source and has _ positive_take _, if the verified sender deliberately Identifying possible spammers by sending emails anonymously, forged, spammed, or illegally (changing information or hiding information, etc.) The above email communication behavior model policy can be used to determine if the email is spam. E-mail, (4) breaks the basis of the contact with the e-mail shirt has abnormal behavior, the abnormal line riding often, forgery, spamming _ and other behavioral food 18 1317471, the brother Wei Qianzi mail is still anti-f behavior, it can be sensitive In the case of junk mail cattle, the status of the anonymous behavior can be the title information column; the sender host and the reply round (4); _ fine _ her service provider () host, etc.. The forgery behavior is the source host is external Domain, but the sender's address is pseudo-collected within the domain: or the nickname _ job (deletion) is incorrectly specified. If the issue is excessive, the delivery method is abnormal and the frequency of the change is still frequent. For the lease host Among them, regarding the analysis of the anonymous behavior, the method of the present invention can distinguish the above-mentioned enumeration of the round, (4) Qing, the electronic component sent by the copyright, such as _ post office record - (four), mail core _^ or mailing list to do n (Listse ·) E-mail sent by the e-mail. This month's e-mail SMTP communication behavior is used to instantly control the e-mail. The method is usually implemented in the agent, and the more frequent users are the mail delivery agent. Agent _) Execution stage, using the default spam behavior simulation, by grasping the "mail transmission value" and "mail header" and other information, and backtracking the true and false values of the mail transmission data, it is possible to correctly verify that the behavior is appropriate "General mail form", shot, mail pass autumn (MTA) can be a router. 19 1317471 Controlling the use of the mail sMTp communication behavior of the present invention to the instant analysis - the spirit of the e-mail method has been said, the town has three specific examples to verify the method of rugged, to capture this technology can be considered The description of the examples is obtained with sufficient knowledge to be implemented. Example -: Mail in and out f - Specific internal gambling only sends e-mails to specific internal users. Enable 0 Envelope Sender 0 Envelope Recipient 0 Mail Transfer Value if 秘田> Title Alignment Item Host Alignment Item Host Alignment Item Host ◎ Slightly Sewed Letters]... ... with / not + with / not included / non-aligned items requirements comparison method with / non-Header Element Method +/- select the name early or fill out

選取名單 特定内部使用 選取名單 特定内部使用 選取名單 特定内部使用 ◎符合〇不符合上述政策者’依照下述處理方式執行 ◎拒絕接收’回傳錯誤代碼和錯誤訊息 〇刪除郵件,不回傳錯誤代碼和錯誤訊息 〇直接傳送 20 1317471 範例二:垃圾郵件防堵一匿名行為舉例說明,寄件者主 機與回覆信箱主機不同。 啟用 郵件傳輸值:規則間關聯性為[和],全部符合才視為成立條件。 □ 信封 寄件者 .比對項目 含/非 選取名單 EnvelopFrom +/- □ 信封 收件者 比對項目 含/非 選取名單 EnvelopTo +/- 1 1 □ 郵件傳輸值 比對項目 含/非 選取名單 EnvelopTo +/- 郵件標題 ◎比對 〇略過 啟用 郵件標題:規則間關聯性為[和],全部符合才視為成立條件。 0 比對項目 要件 比對方式 含/非 選取名單或自行填寫 From Host Cache +/- 0 比對項目 要件 比對方式 含/非 選取名單或自行填寫 Return-Path Host Match Cache +/- 符合條件 〇符合◎不符合上述政策者,依照下述處理方式執 行。 處理方式 ◎拒絕接收,回傳錯誤代碼和錯誤訊息 〇刪除郵件,不回傳錯誤代碼和錯誤訊息 〇直接傳送 ’ 21 1317471Select list specific internal use pick list specific internal use pick list specific internal use ◎ 〇 〇 〇 符合 上述 上述 ' 依照 依照 依照 依照 依照 依照 依照 依照 依照 拒绝 拒绝 拒绝 拒绝 拒绝 ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' And error message 〇 direct transmission 20 1317471 Example 2: Spam anti-blocking An anonymous behavior example, the sender host is different from the reply mailbox host. Enable Mail Transfer Value: The correlation between rules is [and], and all matches are considered as conditions. □ Envelope sender. Comparison item with/non-selection list EnvelopFrom +/- □ Envelope recipient comparison item with/non-selection list EnvelopTo +/- 1 1 □ Mail transmission value comparison item with/non-selection list EnvelopTo +/- Mail Header ◎ Compare 启用 Skip to enable mail heading: The correlation between rules is [and], and all matches are considered as conditions. 0 Compare the project requirements. Compare/exclude the list or fill in the From Host Cache +/- 0. Compare the requirements of the project. Compare/exclude the list or fill in the Return-Path Host Match Cache +/-. Those who do not meet the above policies in accordance with ◎ shall be executed in accordance with the following methods. Processing method ◎ Refuse to accept, return error code and error message 〇 Delete mail, do not return error code and error message 〇 Direct transmission ‘ 21 1317471

比對項目 含/非 EnvelopFrom +/- 項目 含/非 EnvelopTo +/- 郵件傳輸 值 範例三:垃圾郵件防堵-偽造行為舉例說明,來源地主 機為外部網域,寄件者地址偽造成内部主機 選取名單 饴封 比對項目 合/韭 —~~=— 郵件標題................................®lb# _~~ — * 比對項目 含^ EnvelopTo +/-Alignment project with / non EnvelopFrom +/- project with / non EnvelopTo +/- mail transmission value Example 3: spam anti-blocking - forgery behavior example, the source host is an external domain, the sender address is pseudo-intra-host Select the list and compare the items to /合—~~=—mail header................................ Lb# _~~ — * Comparison item contains ^ EnvelopTo +/-

内部主機 符合條系 處理方式 〜~·......——.................◦.........ϋ全.......上述政策者,依照下流韋 τφ ◎拒絕接收,回每 —--..-—... 選取名單 -要件或自碎 一 ~~~~~~—___The internal host conforms to the processing method of the strip system~~·......——..............◦.........ϋ全... .... The above policy, according to the downstream Wei τφ ◎ refused to receive, back to each ---..--... Select list - requirements or self-breaking one ~~~~~~____

*鱗驗代碼和錯誤訊^*Square code and error message ^

因此,本發明利用電子郵件之郵件特性及傳輸原則,將一 電子郵件的「郵件傳驗」舆「咖題」_件傳輸資料的 真假值細解析,且經由反覆回溯驗證,以射歸納與演繹出 牛之仃為疋否為預設之郵件通訊行為模型政策所允許者,進 而達成管控電子郵件進·及輯郵件防堵之伽。故本發明 不射精確管控郵件,有效防堵垃圾郵件,以提高網路安全, 且了即省網路頻寬、系統資源與硬碟賴,以達成增進郵件通 22 1317471 訊*效率及節省營運成本之功效 不之精神所完成之 清專利範圍中。 以上所述係藉由實施修觸本發明之特點,其目Μ 習該技術者能_本發明之内容並據以實施,㈣限定 之專利範®,故,凡其他未脫離本發騎揭 發明 等效修飾或修改,仍銳含細τ所述之申 【圖式簡單說明】 圖式說明: 郵伴通訊行為模型政策} 採取行動胃 行為稍式1 行為褀式2 行為模式3 郭件通訊行為楛型政箓2 ίΡ伴通訊行為模型政箓3Therefore, the present invention utilizes the mail characteristics and transmission principle of an e-mail to analyze the true and false values of an e-mail "mail test", "coffee question", and the transmission data, and to verify and verify the data through repeated retrospective verification. Deducting the ambiguity of the cow is whether it is allowed by the default e-mail communication behavior model policy, and then achieves the control of e-mail and the anti-blocking of the mail. Therefore, the present invention does not shoot precise control mail, effectively prevents spam, so as to improve network security, and saves network bandwidth, system resources and hard disk, in order to achieve the efficiency and efficiency of the mail communication. The cost is not in the spirit of the patent. The above description is made by implementing the features of the present invention, which can be used by the skilled person to implement the contents of the present invention, and (4) the limited patent patent®, so that the others have not deviated from the invention. Equivalent modification or modification, still containing the fine τ described in the application [simplified description of the schema] Schematic description: postal communication behavior model policy} take action stomach behavior slightly 1 behavior 褀 2 behavior pattern 3 Guo piece communication behavior楛-type political 箓 2 Ρ Ρ 通讯 communication behavior model political 箓 3

採取行動 採取行動 採取行動 弟一圊 第一圖為本發明解析郵件行為以營 控電子郵件的方法 示意圖 23 1317471Take action Take action Take action Brother 圊 The first picture shows the method of parsing mail behavior to control emails in the present invention. Schematic diagram 23 1317471

10 第二圊 第二圖為本發明在利用一郵件通訊行為模型政策中之數規則對電子 郵件進行驗證時之詳細流程示意圖。 24 131747110 Second 圊 The second figure is a detailed flow chart of the invention in the process of verifying the e-mail by using the rule of the mail communication behavior model policy. 24 1317471

第三圖 第三圖為本發明以預設之郵件通訊行為模型政策驗證電子郵件之流 程圖。 【主要元件符號說明】 ίο郵件通訊行為模型政策 12規則 25The third figure is a flow chart of the policy verification email in the default mail communication behavior model of the present invention. [Main component symbol description] ίοEmail communication behavior model policy 12 rules 25

Claims (1)

1317471 、申請專利範®·· -種利用郵件SMTP通訊行為即時解析以 包括下列步驟·· 利用郵件之郵件傳輪值及標费 管控電子郵件之方法 訊行為模型政策; 訊設定複數不同之郵件通 當代理器(Agent)收到—電子郵 模型政第、 . ’、遠專郵件通訊行為 政朿逐-_電子郵件 證詩W 午傳輪貝科進行行為比對,以驗 7模型政 據驗〜β切4❺縣轉飾__翻政策,並依 I結果電子郵件之行為是否符合該等郵件通訊行為 策,若是.,戰表該電子郵件為垃件 '、 以及料,卿錄電子郵件她擋輯子郵件; 析以管控電子郵件之方法。 為即時解 2. 以e控電子郵件之方法,其 ^郵件通訊行為模型政策係屬 於門禁料,肋絲免檢郵件 • 仃為,則此時該代理器在收到 該電子郵件書該電子郵件之方法係包括下列步驟: 以該等郵件通訊行為麵政策逐1該電子郵件之郵件傳輸資料 進行比對’以驗證該電子郵件之行為是否符合該等郵件通訊行為 翻政f,刪蝴Μ議,㈣送該電 26 1317471 子郵件;以及若否,則阻撞該電子郵件。 如申請專利範圍第2項所述之利用郵件SMTp通訊行為即時解析 以管控電子郵狀綠,射,該免檢郵狀翻㈣包括母公 司子公司、重要客戶、往來薇商、訂閱電子報的網域名稱以及 固定IP者所組成之群組的至少其中之—者。 4. ”請專利範圍第i項所述之利用郵件腑通訊行為即日撫 叫控電子郵件之方法,其巾,在物_件通訊行為獅 策之步财,係包括錢定每—辑件通訊行械财策之齡 準則,該驗證準則係選自符合、不符合以及略過不比對其中之_ 者。 5. 如申期爾i顧㈣物恤了_行為即時解析 以管控電子郵件之方法,其中,該郵件傳輸細包含有該電子 郵件所屬之郵件傳輪值及標題資訊。 如^專Μ_ i項所述之利用郵件§Μτρ通訊行為即時解析 以官控電子郵件之方法,复 件驗《電子郵件是否符合該等郵 =、、、《政策之錢郵件行輪法更包括下 ()*該代理子郵件時,㈣-郵件觀行為模做 27 1317471 策m電子郵件之郵件傳輪資料進行真假驗證,簡斷其是 否符合該第-郵件通訊行為模型政策,若是則進行步驟⑼, 若否則進行步驟⑹; ⑼允許該電子崎哪如去·以及 二郵件通訊行為翻政策追猶電子郵件之行徑,以 _其疋否符合該第二郵件通訊行為模型政策,若是則進行步 驟⑼,若否則繼續藉由下—該郵件通訊行為模型政策追舰 電子郵件之行徑,直到最後—該郵件通訊行為模型政策用完為 止,且當該電子郵件仍不符合最後-該郵件通訊行為模型政策 時,則該代理器雜擒該電子郵件。 . 7. 如懈利觸1項输軸件瞻咖為即時解析 以官控電子郵件之方法,i 、 /、中母一該郵件通訊行為模型政策更 已括有複數規則’在利用其中—該郵件通訊行為模型政策對該電 子郵件之郵件傳輸資料進行驗證時,更包括下列步驟: ⑻以第—酬對該電子郵件之郵件傳輪資料進行真假驗證,以判 斷其是否符合該第-規則,若是則進行步驟⑼,若否則進行 步驟⑹; (b)以第二規則繼續對該電子郵件之郵件傳輸資料進行真假驗 證,以判斷其是否符合該第二規則 j右否則進仃步驟(C),若是 28 131747 職續以τ-魏财軸轩郵狀雜,錢最後一該規 則用完為止,且依據所使用之最後—該規則之驗證結果決定該 電子郵件是否符合該郵件通訊行為模型政策,若是則允許該電 子郵件可傳送出去,若否則進行步驟(c);以及 (0繼續以下-觸件軌行雜麵妓舰電子郵件之行 徑,以判斷其是研合該下_郵件通訊行為模型政策,且重複 上述⑻、(b)步驟。 如申請專利麵7撕㈣_件瓣撕為即時解析 以管控電子郵件之方法,其中,以每一該規則驗證該電子郵件之 驗證準則係選自符合、不符合以及略過不比對其中之一者,且該 驗證準廳在設定該_件觀行為模型政策之步驟中所設定 者〇 .如申糊卿丨斯狀卿㈣瞻物^即時解析 以管控電子郵件之方法’其中,該等郵件通訊行為模型政策係用 从判斷該電子郵件是否有反f行為,該反常行為係包含有選自匿 名、偽造、濫發及非法所組成之群組的至少其中之—行為者。 1〇·如申請專利範圍第9項所述之利用郵件瞻通訊行為即時解析 以管控電子鱗嫩,其巾,峨賴包蝴自標題資 29 1317471 訊不明、寄件者主機與回霜卢&+ ^ 覆心相主機不同以及回覆信箱主機為網 路服務供應商_主機所組成之群組的至少其中之一行為者。 11.如申明專利觀圍第9項所述之利用郵件通訊行為即時解析 以管控電子郵狀方法,射,雜造行為餘含絲源地主機 為外部網域但寄件者地址偽造成内部主機以及網域的網域名稱 伺服器(DNS)不正確其中之—行為者。 •如申請專侧第9躺述之·郵件瞻通訊行為即時解析 以管控細件之方法,其巾,雜發行減包含有寄送方式異 常且變動頻仍之行為者。 、 13. 如申請專纖圍第9撕述之彻郵件SMTp通訊行為即時解析 以管控電子郵叙雜,針,該麵行騎包含有賴地址為 租賃主機之行為者。 认如:請專利範阶項所述之利轉件撕通訊行為即時解析 2控電子郵件之方法,射之魄及附加檀案 作為該等郵件通訊料模型政策之設定内容。 30 1317471 15.如申請專利範圍第 攻之利用郵件讀通訊行為即時解析 以管控電子郵件之方法, 勹丨叶解析 (MTA) 4 郵件傳送代理器 SMTP通訊行為即時解 該郵件傳送代理器(MTA)可為 16.如申請專利範圍第15項所述之利用郵件 析以管控電子郵件之方法,其中, 一路由器。 17.如h專利粑圍第1項所述之_郵件請通訊彳亍為即時解析 以官控電子郵件之方法,其中,該郵件傳輸值係選自寄件者帳 號、收件者帳號、收件者主機地址、寄件者主機地址、回覆地址、 網域名稱伺服器(DNS)及電子郵戳所組成之群組的至少其中之一 者。 1S.如申睛專利範圍第17項所述之利用郵件SMTp通訊行為即時解 析以官控電子郵件之方法’其中,該電子郵戳之提供者係選自發 信端伺服器、局端伺服器以及聯網路服務提供者(ISp)伺服器所組 成之群組的至少其中之一者。 31 1317471 19.如申請專利範圍第 以管控電子郵件之方法, 自拒絕接收該電子郵件、 、、所迷之利用郵件SMTp通訊行為即時解析 其中, 阻擋該電子郵件之處理方式係 選 冊!I除該電子郵件其中之— 方式者 见如申物獅,切晴_喊行為即時解 析以^控電子郵件之方法, 〃中’當拒絕接收該電子郵件時,係 同时回傳一錯誤代碼和錯誤訊息。 ’、 32 1317471 七、指定代表圖: (一)本案指定代表圖為:第(一)圖。 採取行動 郵伴通訊行為模型政II 行為模式1 行為模式2 -12 行為模式3 10~^™ 郵#通訊行為模曳政12 郵#通訊行為模3H政13 'i f·* »« ..................... .............................^ -^ 採取行動 採取行動 採取行動 第一圖 (二)本代表圖之元件符號簡單說明: 10郵件通訊行為模型政策 12規則 1317471 八、本案若有化學式時,請揭示最能顯示發明特徵的化 學式:1317471, application for patents®··-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Agent (Agent) received - e-mail model government, . ', remote mail communication behavior political tactics - _ e-mail poetry W afternoon pass round Beca conduct behavior comparison, to test 7 model political test ~ Beta cut 4 ❺ 转 转 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ The series of emails; the method of controlling emails. For the instant solution 2. The method of e-mail control, the policy of the e-mail communication behavior model belongs to the door ban, and the rib wire exempts the mail • 仃, then the agent receives the e-mail from the e-mail. The method includes the following steps: comparing the e-mail communication information of the e-mail with the e-mail communication behavior policy to verify whether the e-mail behavior conforms to the e-mail communication behavior, and deletes the proposal. (4) sending the electricity to the 26 1317471 sub-mail; and if not, blocking the e-mail. As described in the second paragraph of the patent application scope, the use of the SMTp communication behavior of the mail immediately analyzes to control the electronic postal green, the shot, the exemption of the postal inspection (four) including the parent company subsidiary, important customers, the exchange of Wei business, the subscription of the electronic newspaper network The domain name and at least one of the groups of fixed IP parties. 4. "Please use the method of mail, communication, and daily call to control e-mail as described in item i of the patent scope, and the towel, in the matter of communication, the tactics of the tactics, including Qian Ding. The age of the policy, which is selected from the criteria of conformity, non-conformity, and skipping the comparison. 5. If the application is based on the method of real-time analysis to control the e-mail The mail transmission detail includes the mail passing value and the headline information to which the email belongs. For example, the method of using the mail § Μτρ communication behavior to immediately analyze the official mail by the mail, the duplicate test "electronics" Whether the mail meets the mail =,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, False verification, whether it complies with the policy of the first-mail communication behavior model, if yes, proceed to step (9), otherwise if step (6); (9) allow the electronic saki as if to go and the second mail communication behavior policy Follow the e-mail behavior, to _ whether it meets the second e-mail communication behavior model policy, and if so, proceed to step (9), otherwise continue to follow the e-mail communication behavior model policy to chase the e-mail, until the end - The e-mail communication behavior model policy is exhausted, and when the e-mail still does not meet the final-mail communication behavior model policy, the agent hogs the e-mail. For the instant analysis of the officially controlled e-mail method, the i, /, and the mother-in-the-mail communication behavior model policy include a plural rule 'in use—the e-mail communication behavior model policy email to the e-mail When transmitting data for verification, the following steps are further included: (8) Performing a true/false verification on the mail routing information of the email to determine whether it meets the first rule, and if so, performing step (9), if otherwise, performing the step (6); (b) continue to verify the e-mail transmission data of the e-mail by the second rule to determine whether it complies with the second regulation Then j right or advance step (C), if it is 28 131747, the τ-Wei Cai axis quotation, the last rule of the money is used up, and according to the final use - the verification result of the rule determines Whether the e-mail conforms to the e-mail communication behavior model policy, and if so, allows the e-mail to be transmitted, if otherwise, proceed to step (c); and (0 continue to the following - touch track orbital e-mail e-mail to determine It is to study the policy of the next _mail communication behavior model, and repeat the above steps (8) and (b). For example, the application for patenting 7 tearing (four) _ piece tearing is a method of instant analysis to control email, wherein each of these The rule verifies that the verification criteria of the email is selected from the compliance, non-conformity, and skipping one of the steps, and the verification authority is set in the step of setting the policy of the behavior model. Qing Shusi Qing (4) prospective ^ instant analysis to control the method of e-mail 'where the e-mail communication behavior model policy is used to determine whether the e-mail has anti-f behavior, the abnormal behavior package There are selected from anonymous, forgery, illegal spamming, and a group consisting of at least of which - actors. 1〇·If you apply for the instant analysis of the mail-based communication behavior as described in item 9 of the patent application scope, you can control the electronic scales, and its towel, 峨 蝴 蝴 自 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 29 ;+ ^ The host is different and the reply mailbox host is at least one of the groups consisting of the network service provider_host. 11. If the application of the mail communication behavior described in item 9 of the patent view is to be analyzed in real time to control the electronic mail method, the host and the miscellaneous behavior are the external domain but the sender address is pseudo-initiated as the internal host. And the domain name server (DNS) of the domain is incorrect - the actor. • If you apply for the exclusive side of the ninth lie, the mail-by-mail communication behavior is analyzed immediately. The method of controlling the fine parts, the towel, and the miscellaneous distribution include those who have abnormal shipping methods and frequent changes. 13. If the application for the special fiber around the 9th tears the message SMTp communication behavior instant analysis to control the e-mail, the needle, the face of the ride includes the address of the owner of the rental host. Recognized as follows: Please refer to the method described in the patent paradigm for the instant change of the tear-off communication behavior. The method of controlling the e-mail, the shooting of the e-mail and the additional Tan case as the setting content of the mail communication material model policy. 30 1317471 15. If the patent application scope is the first method to use the mail to read the communication behavior to analyze and control the email, the leaf analysis (MTA) 4 mail delivery agent SMTP communication behavior instant solution to the mail transfer agent (MTA) The method of using the mail to analyze and control the email as described in claim 15 of the patent application, wherein a router. 17. As described in the first paragraph of the patent of h patent, the mail communication method is an instant analysis method for officially controlling emails, wherein the mail transmission value is selected from the sender account, the recipient account number, and the receipt. At least one of a group consisting of a host address, a sender host address, a reply address, a domain name server (DNS), and an electronic postmark. 1S. The method for real-time analysis of officially controlled e-mail by using the mail SMTp communication behavior as described in claim 17 of the scope of the patent application, wherein the provider of the electronic postmark is selected from a sender server, a central server, and a network At least one of a group of Road Service Provider (ISp) servers. 31 1317471 19. If the method of patent application is to control the e-mail, the self-rejection of the e-mail, the scam, and the SMTp communication behavior of the e-mail are analyzed immediately, and the processing method of blocking the e-mail is selected! Among the e-mails, the way to see such as Shen Shi lion, Che Qing _ shout behavior instant analysis to ^ control e-mail method, 〃中 'When refusing to receive the e-mail, the system returns an error code and error message at the same time . ’, 32 1317471 VII. Designated representative map: (1) The representative representative of the case is: (1). Take action mail companion communication behavior model politics II behavior pattern 1 behavior pattern 2 -12 behavior pattern 3 10~^TM mail #通信行为模曳政12 mail#communication behavior model 3H politics 13 'if·* »« .... ...............................................^^^ Take Action Take Action Take Action 1 (2) Simple description of the symbol of the representative map: 10 Mail Communication Behavior Model Policy 12 Rule 13174471 8. If there is a chemical formula in this case, please reveal the chemical formula that best shows the characteristics of the invention:
TW93108239A 2004-03-26 2004-03-26 Method using mail behavior analysis to control e-mail TW200415458A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
TW93108239A TW200415458A (en) 2004-03-26 2004-03-26 Method using mail behavior analysis to control e-mail

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
TW93108239A TW200415458A (en) 2004-03-26 2004-03-26 Method using mail behavior analysis to control e-mail

Publications (2)

Publication Number Publication Date
TW200415458A TW200415458A (en) 2004-08-16
TWI317471B true TWI317471B (en) 2009-11-21

Family

ID=45073374

Family Applications (1)

Application Number Title Priority Date Filing Date
TW93108239A TW200415458A (en) 2004-03-26 2004-03-26 Method using mail behavior analysis to control e-mail

Country Status (1)

Country Link
TW (1) TW200415458A (en)

Also Published As

Publication number Publication date
TW200415458A (en) 2004-08-16

Similar Documents

Publication Publication Date Title
US9576253B2 (en) Trust based moderation
US20060047766A1 (en) Controlling transmission of email
JP4717886B2 (en) Method and system for regulating email
US7085745B2 (en) Method and apparatus for identifying, managing, and controlling communications
Goodman et al. Stopping outgoing spam
US20060149823A1 (en) Electronic mail system and method
TW201036399A (en) Feedback loop for spam prevention
US20060184635A1 (en) Electronic mail method using email tickler
US20050210272A1 (en) Method and apparatus for regulating unsolicited electronic mail
Leiba et al. A Multifaceted Approach to Spam Reduction.
Gburzynski et al. Fighting the spam wars: A remailer approach with restrictive aliasing
TWI317471B (en)
Erickson et al. The Effectiveness of Whitelisting: a User-Study.
Hedley A brief history of spam
Banday et al. SPAM--Technological and Legal Aspects
Miszalska et al. Selected methods of spam filtering in email
ES2558740T3 (en) System implemented in computer and procedure to detect the improper use of an email infrastructure in a computer network
Erickson WHITELISTING IN PRACTICE
Valeeva SPAM AND ANTI-SPAM METHODS
Vokorokos et al. Security issues of email marketing service
Park et al. Anti-spam approaches: analyses and comparisons
Longe et al. Enhanced content analysis of fraudulent Nigeria electronic mails using e-STAT
Spykerman Typical spam characteristics
Figliola " Spam": An Overview of Issues Concerning Commercial Electronic Mail
Kepczyk CPA's guide to understanding and controlling spam