US20150256505A1 - Electronic mail monitoring - Google Patents

Electronic mail monitoring Download PDF

Info

Publication number
US20150256505A1
US20150256505A1 US14/425,476 US201314425476A US2015256505A1 US 20150256505 A1 US20150256505 A1 US 20150256505A1 US 201314425476 A US201314425476 A US 201314425476A US 2015256505 A1 US2015256505 A1 US 2015256505A1
Authority
US
United States
Prior art keywords
identification information
section
communication terminal
electronic mail
user identification
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US14/425,476
Other languages
English (en)
Inventor
Rihito Kato
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Biglobe Inc
Original Assignee
Biglobe Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Biglobe Inc filed Critical Biglobe Inc
Publication of US20150256505A1 publication Critical patent/US20150256505A1/en
Assigned to BIGLOBE INC. reassignment BIGLOBE INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: KATO, Rihito
Priority to US15/590,636 priority Critical patent/US10467596B2/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • H04L51/34—
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/10—Office automation; Time management
    • G06Q10/107—Computer-aided management of electronic mailing [e-mailing]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/222—Monitoring or handling of messages using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/224—Monitoring or handling of messages providing notification on incoming messages, e.g. pushed notifications of received messages
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/234—Monitoring or handling of messages for tracking messages
    • H04L51/24—
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/30—Profiles
    • H04L67/306—User profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/535—Tracking the activity of the user

Definitions

  • the present invention relates to an electronic mail monitoring apparatus, a transmission mail server, an electronic mail monitoring method, and a program for monitoring transmitted electronic mails.
  • Patent Document 1 Japanese Patent Laid-Open Publication No. 2006-128917
  • Patent Document 1 has a problem that transmission of electronic mails transmitted in a large number is suppressed even when they are transmitted by an authorized user.
  • An object of the present invention is to provide an electronic mail monitoring apparatus, a transmission mail server, an electronic mail monitoring method, and a program for resolving the above-mentioned problem.
  • the electronic mail monitoring apparatus of the present invention includes:
  • an extraction section for, from the electronic mail acquired by the acquisition section, extracting user identification information indicating a user having transmitted the electronic mail and communication terminal identification information imparted to the communication terminal having transmitted the electronic mail;
  • a calculation section for, for each user identification information extracted by the extraction section within a unit time, calculating a uniqueness number of the communication terminal identification information
  • a verification section for judging whether the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded a predetermined first threshold
  • a notification section for, when the verification section has judged that the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded the first threshold, performing predetermined first notification to a notification destination set up in advance.
  • the electronic mail monitoring apparatus of the present invention includes:
  • an extraction section for, from the electronic mail acquired by the acquisition section, extracting user identification information indicating a user having transmitted the electronic mail and communication terminal identification information imparted to the communication terminal having transmitted the electronic mail;
  • a calculation section for calculating a uniqueness number of countries or regions corresponding to the communication terminal identification information for each user identification information extracted by the extraction section within a unit time;
  • a verification section for judging whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded a predetermined second threshold
  • a notification section for, when the verification section has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded the second threshold, performing predetermined second notification to a notification destination set up in advance.
  • the transmission mail server of the present invention includes:
  • a storage section for storing authentication information used for the authentication
  • an acquisition section for, when the authentication section has succeeded in authentication of the user by using the authentication information stored in the storage section, acquiring electronic mails transmitted from communication terminals;
  • an extraction section for extracting user identification information indicating the user having transmitted the electronic mail, from the authentication information and then extracting communication terminal identification information imparted to the communication terminal having transmitted the electronic mail, from the electronic mail acquired by the acquisition section or connection processing with the communication terminal;
  • a calculation section for, for each user identification information extracted by the extraction section within a unit time, calculating a uniqueness number of the communication terminal identification information
  • a verification section for judging whether the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded a predetermined first threshold
  • a notification section for, when the verification section has judged that the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded the first threshold, performing predetermined first notification to a notification destination set up in advance.
  • the transmission mail server of the present invention includes:
  • an authentication section for authenticating a user
  • a storage section for storing authentication information used for the authentication
  • an acquisition section for, when the authentication section has succeeded in authentication of the user by using the authentication information stored in the storage section, acquiring electronic mails transmitted from communication terminals;
  • an extraction section for extracting user identification information indicating the user having transmitted the electronic mail, from the authentication information and then extracting communication terminal identification information imparted to the communication terminal having transmitted the electronic mail, from the electronic mail acquired by the acquisition section or connection processing with the communication terminal;
  • a calculation section for calculating a uniqueness number of countries or regions corresponding to the communication terminal identification information for each user identification information extracted by the extraction section within a unit time;
  • a verification section for judging whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded a predetermined second threshold
  • a notification section for, when the verification section has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded the second threshold, performing predetermined second notification to a notification destination set up in advance.
  • an electronic mail monitoring method of monitoring electronic mails transmitted from communication terminals performing:
  • an electronic mail monitoring method of monitoring electronic mails transmitted from communication terminals performing:
  • FIG. 1 is a diagram showing an embodiment of a communication system including an electronic mail monitoring apparatus of the present invention.
  • FIG. 2 is a diagram showing an example of internal configuration of an electronic mail monitoring apparatus shown in FIG. 1 .
  • FIG. 3 is a diagram showing an example of correspondence stored in a storage section shown in FIG. 2 .
  • FIG. 4 is a diagram showing another example of correspondence stored in a storage section shown in FIG. 2 .
  • FIG. 5 is a flow chart for describing an example of an electronic mail monitoring method in an electronic mail monitoring apparatus shown in FIG. 1 .
  • FIG. 6 is a diagram showing an example of country information stored in a storage section shown in FIG. 2 .
  • FIG. 7 is a flow chart for describing an example of an electronic mail monitoring method employing country information in an electronic mail monitoring apparatus shown in FIG. 1 .
  • FIG. 8 is a diagram showing an embodiment of a communication system including a transmission mail server of the present invention.
  • FIG. 9 is a diagram showing an example of internal configuration of a transmission mail server shown in FIG. 8 .
  • FIG. 10 is a diagram showing an example of authentication information stored in a storage section shown in FIG. 9 .
  • FIG. 11 is a flow chart for describing an example of an electronic mail monitoring method in a transmission mail server shown in FIG. 8 .
  • FIG. 12 is a flow chart for describing an example of an electronic mail monitoring method employing country information in a transmission mail server shown in FIG. 8 .
  • FIG. 1 is a diagram showing an embodiment of a communication system including an electronic mail monitoring apparatus of the present invention.
  • the present mode is constructed from an electronic mail monitoring apparatus 100 of the present invention, a transmission mail server 200 , a receiving mail server 300 , an administrator terminal 400 , and communication terminals 500 - 1 to 500 - n (n is an integer).
  • the electronic mail monitoring apparatus 100 monitors electronic mails transmitted from the communication terminals 500 - 1 to 500 - n.
  • FIG. 2 is a diagram showing an example of the internal configuration of the electronic mail monitoring apparatus 100 shown in FIG. 1 .
  • the electronic mail monitoring apparatus 100 shown in FIG. 1 is provided with an acquisition section 101 , an extraction section 102 , a calculation section 103 , a verification section 104 , a notification section 105 , a transmission control section 106 , and a storage section 107 .
  • the acquisition section 101 acquires electronic mails transmitted from the communication terminals 500 - 1 to 500 - n through the transmission mail server 200 to the receiving mail server 300 .
  • the extraction section 102 extracts: user identification information such as the electronic mail address of transmission source indicating the user having transmitted the electronic mail; and communication terminal identification information such as the IP (Internet Protocol) address imparted to the communication terminal having transmitted the electronic mail. In general, these information pieces are contained in the header of the electronic mail acquired by the acquisition section 101 . Further, the extraction section 102 writes the user identification information and the communication terminal identification information having been extracted, into the storage section 107 in correspondence to date and time information.
  • user identification information such as the electronic mail address of transmission source indicating the user having transmitted the electronic mail
  • communication terminal identification information such as the IP (Internet Protocol) address imparted to the communication terminal having transmitted the electronic mail.
  • these information pieces are contained in the header of the electronic mail acquired by the acquisition section 101 .
  • the extraction section 102 writes the user identification information and the communication terminal identification information having been extracted, into the storage section 107 in correspondence to date and time information.
  • the calculation section 103 calculates the uniqueness number of IP addresses (the number of mutually different IP addresses) for each electronic mail address extracted by the extraction section 102 .
  • the calculation section 103 calculates the uniqueness number of IP addresses of the electronic mails acquired by the acquisition section 101 within a unit time (e.g., 1 minute and 1 hour) set up in advance. Further, the calculation section 103 outputs the calculated uniqueness number of IP addresses to the verification section 104 .
  • the verification section 104 compares the uniqueness number of IP addresses outputted from the calculation section 103 with a threshold (a first threshold) set up in advance. Further, as a result of comparison, the verification section 104 judges whether the uniqueness number of IP addresses has exceeded the first threshold.
  • the first threshold is stored in the storage section 107 . Further, the verification section 104 notifies the result of judgment to the notification section 105 and the transmission control section 106 .
  • the notification section 105 When the notification from the verification section 104 indicates that the uniqueness number of IP addresses has exceeded the first threshold, the notification section 105 performs predetermined notification (first notification) to the administrator terminal 400 serving as a notification destination set up in advance.
  • This notification contains the mail address of the electronic mail whose uniqueness number of IP addresses has exceeded the first threshold. Further, the IP address and the date and time information thereof may also be contained.
  • the transmission control section 106 stops transmission of electronic mails having a transmission source equal to the mail address of the electronic mail whose uniqueness number of IP addresses has exceeded the first threshold. Further, when the notification from the verification section 104 indicates that the uniqueness number of IP addresses does not exceed the first threshold, the transmission control section 106 transmits electronic mails having a transmission source equal to the mail address of the electronic mail, to the receiving mail server 300 .
  • the storage section 107 stores the user identification information and the communication terminal identification information having been written in by the extraction section 102 , in correspondence to the date and time information.
  • FIG. 3 is a diagram showing an example of correspondence stored in the storage section 107 shown in FIG. 2 .
  • the storage section 107 shown in FIG. 2 stores a mail address serving as the user identification information of the transmission source of the electronic mail, an IP address serving as the communication terminal identification information of the transmission source of the electronic mail, and date and time information in correspondence to each other. Further, the number of destinations of the electronic mail may also be in correspondence to the above-mentioned information. As shown in FIG. 3 , some electronic mails transmitted from mutually the same mail address have mutually different IP addresses.
  • the date and time information indicates the date and time at which the transmission mail server 200 has received the electronic mail, the date and time at which the transmission mail server 200 has transmitted the electronic mail, the date and time at which the acquisition section 101 has acquired the electronic mail, the date and time at which the storage section 107 has stored the correspondence, or the like.
  • the acquisition section 101 may acquire a member ID corresponding to the mail address from the transmission mail server 200 and then the storage section 107 may store the member ID, the IP address, and the date and time information in correspondence to each other.
  • FIG. 4 is a diagram showing another example of correspondence stored in the storage section 107 shown in FIG. 2 .
  • the storage section 107 shown in FIG. 2 stores a member ID serving as the user identification information of the transmission source of the electronic mail, an IP address serving as the communication terminal identification information of the transmission source of the electronic mail, and date and time information in correspondence to each other. Further, the number of destinations of the electronic mail may also be in correspondence to the above-mentioned information.
  • the member ID may be one not acquired from the transmission mail server 200 by the acquisition section 101 .
  • a member ID corresponding to the mail address may be registered in advance and then the member ID may be stored in the storage section 107 in correspondence to the mail address.
  • the transmission mail server 200 authenticates a user who uses the communication terminals 500 - 1 to 500 - n having performed connection. At that time, the transmission mail server 200 authenticates the user by using authentication information consisting of an electronic mail address or a member ID (member identification information) of the user set up in advance and a password. Further, when having succeeded in authentication, the transmission mail server 200 transmits electronic mails transmitted from the communication terminals 500 - 1 to 500 - n , to the electronic mail monitoring apparatus 100 .
  • FIG. 1 shows an example that only one transmission mail server 200 is provided. However, a plurality may be provided.
  • the receiving mail server 300 transmits the electronic mail transmitted from the communication terminals 500 - 1 to 500 - n through the transmission mail server 200 and the electronic mail monitoring apparatus 100 , to a destination indicated by the destination information contained in the header of the electronic mail.
  • the administrator terminal 400 is a communication device operated by an administrator who administers the electronic mail monitoring apparatus 100 .
  • the administrator terminal 400 includes an output section such as a display and a speaker. This output section outputs a notification from the notification section 105 . By virtue of this, the administrator can recognize the notification from the notification section 105 .
  • the communication terminals 500 - 1 to 500 - n are communication devices that are operated by users and thereby can transmit electronic mails. Further, the communication terminals 500 - 1 to 500 - n are operated by an authorized user in some cases and, in other some cases, operated by a user having an evil intention of transmitting junk mails as described above.
  • FIG. 5 is a flow chart for describing an example of an electronic mail monitoring method in the electronic mail monitoring apparatus 100 shown in FIG. 1 .
  • the acquisition section 101 at step 1 acquires the received electronic mail.
  • the extraction section 102 extracts the mail address of transmission source and the IP address of transmission source from the electronic mail acquired by the acquisition section 101 .
  • the extraction section 102 writes the mail address and the IP address having been extracted, into the storage section 107 in correspondence to the date and time information.
  • the calculation section 103 refers to the storage section 107 for each unit time and thereby calculates the uniqueness number of IP addresses extracted by the extraction section 102 within the unit time, for each mail address. Then, at step 4 , the verification section 104 judges whether the uniqueness number of IP addresses for each mail address calculated by the calculation section 103 has exceeded a first threshold set up in advance.
  • the calculation section 103 calculates the uniqueness number of IP addresses for the mail address “aaa@mail.***.jp” as being “4”. Further, the calculation section 103 calculates the uniqueness number of IP addresses for the mail address “bbb@mail.***.jp” as being “2”. Then, when the first threshold is “3”, the verification section 104 judges that the uniqueness number of IP addresses for the mail address “aaa@mail.***.jp” exceeds the first threshold. Further, the verification section 104 judges that the uniqueness number of IP addresses for the mail address “bbb@mail.***.jp” does not exceed the first threshold.
  • the notification section 105 at step 5 performs notification (first notification) indicating a possibility that junk mails (spoofing mails) have been transmitted, to the administrator terminal 400 serving as the notification destination.
  • This notification contains the mail address of the corresponding transmission source. Further, this notification may contain the IP address and the date and time information of the transmission source.
  • the transmission control section 106 at step 6 may stop transmission of electronic mails having been transmitted from the corresponding mail address.
  • the transmission control section 106 at step 7 performs transmission of electronic mails having been transmitted from the corresponding mail address.
  • the IP addresses imparted to the communication terminals 500 - 1 to 500 - n are semi-fixed.
  • a high possibility is concluded that another person has maliciously used the mail address.
  • the electronic mails have a high transmission frequency (the number of times of transmission within a unit time)
  • a high possibility can be concluded that these electronic mails are junk mails (spoofing mails).
  • the above-mentioned processing is performed by using these properties so that identification of junk mails (spoofing mails) can easily be achieved.
  • the country of transmission source may also be employed.
  • the IP address a usable range is determined for each country. That is, when predetermined bits of the IP address is referred to, the country where the IP address is used can be judged.
  • the range of IP address and information (a country identifier) indicating the country in correspondence to each other may be stored in advance in the storage section 107 as country information and then, on the basis of the country information, the verification section 104 may judge a possibility that the transmitted electronic mails are junk mails (spoofing mails).
  • FIG. 6 is a diagram showing an example of the country information stored in the storage section 107 shown in FIG. 2 .
  • the storage section 107 shown in FIG. 2 stores a range of IP address and a country identifier in correspondence to each other.
  • the range of IP address corresponding to each country is determined in advance for the world. Further, it is sufficient that the country identifier can identify the country. That is, a country code or the like set up in advance for each country may be employed.
  • FIG. 7 is a flow chart for describing an example of the electronic mail monitoring method employing country information in the electronic mail monitoring apparatus 100 shown in FIG. 1 .
  • the acquisition section 101 at step 11 acquires the received electronic mail.
  • the extraction section 102 extracts the mail address of transmission source and the IP address of transmission source from the electronic mail acquired by the acquisition section 101 .
  • the extraction section 102 writes the mail address and the IP address having been extracted, into the storage section 107 in correspondence to the date and time information.
  • the calculation section 103 calculates the uniqueness number of IP addresses extracted by the extraction section 102 within the unit time, for each mail address. Then, at step 14 , the verification section 104 judges whether the uniqueness number of IP addresses for each mail address calculated by the calculation section 103 has exceeded a first threshold set up in advance.
  • the calculation section 103 When the verification section 104 has judged that the uniqueness number of IP addresses for each mail address calculated by the calculation section 103 has exceeded the first threshold, the calculation section 103 at step 15 extracts the country information corresponding to the IP address on the basis of the IP address corresponding to the mail address extracted by the extraction section 102 within a unit time and the country information stored in the storage section 107 , and then calculates the uniqueness number of countries of transmission source within a unit time, for each mail address. Then, at step 16 , the verification section 104 judges whether the uniqueness number of countries for each mail address calculated by the calculation section 103 has exceeded a second threshold set up in advance.
  • the notification section 105 at step 17 performs notification (second notification) indicating a possibility that junk mails (spoofing mails) have been transmitted, to the administrator terminal 400 serving as the notification destination.
  • This notification contains the mail address of the corresponding transmission source. Further, this notification may contain the IP address, the date and time information, and the country name of the transmission source.
  • the first threshold is “5” and the second threshold is “3”.
  • the IP addresses of electronic mails transmitted from the mail address “aaa@mail.***.jp” within a unit time are two items of “133.***.***.010(JP)”, one item of “133.***.***.012(JP)”, one item of “134.**, ***.023(DE)”, one item of “134.***.***.024(DE)”, two items of “135.***.***.009(US)”, and one item of “139.***.***.123(DE)”.
  • the uniqueness number of IP addresses is “6” and the uniqueness number of countries is “4”.
  • the notification section 105 performs notification. Further, a case is considered that the IP addresses of electronic mails transmitted from the mail address “aaa@mail.***.jp” within a unit time are two items of “133.***.***.014(JP)”, one item of “133.***.***.018(JP)”, two item of “133.***, ***.015(JP)”, one item of “133.***.***.024(JP)”, two items of “133.***.***.033(JP)”, and one item of “133.***.***.123(JP)”. In this case, the uniqueness number of IP addresses is “6” and the uniqueness number of countries is “1”. Thus, the notification section 105 does not perform notification.
  • the transmission control section 106 at step 18 may stop transmission of electronic mails having been transmitted from the corresponding mail address.
  • the transmission control section 106 at step 19 performs transmission of electronic mails having been transmitted from the corresponding mail address.
  • the processing may be such that: the extraction section 102 writes the mail address and the IP address having been extracted, into the storage section 107 in correspondence to the date and time information; then the processing of steps 13 and 14 are not performed; and then at step 15 , on the basis of the IP address corresponding to the mail address extracted by the extraction section 102 within a unit time and the country information stored in the storage section 107 , the calculation section 103 extracts the country information corresponding to the IP address and then calculates the uniqueness number of countries of transmission source within a unit time, for each mail address.
  • the verification section 104 can judge whether the uniqueness number of countries of transmission source for each mail address has exceeded the second threshold.
  • the uniqueness number of countries is employed as the judgment criterion so that the identification accuracy for junk mails (spoofing mails) can be improved. That is, it is difficult to transmit electronic mails from a plurality of countries within a short time. Thus, when the unit time is set short and then the country of transmission source is judged on the basis of the range to which the IP address belongs, electronic mails transmitted from countries in a number greater than or equal to a predetermined number can be concluded as having a high possibility of junk mails (spoofing mails).
  • the user identification information may be the member ID acquired by the acquisition section 101 from the transmission mail server 200 with using the mail address as a key.
  • the region may be employed in a case that the region (e.g., the Kanto district and the Asia region) of transmission source can be identified on the basis of the IP address of transmission source.
  • the function of the electronic mail monitoring apparatus 100 described above may be provided in the transmission mail server 200 .
  • FIG. 8 is a diagram showing an embodiment of a communication system including a transmission mail server of the present invention.
  • the present mode is constructed from a transmission mail server 210 of the present invention, a receiving mail server 300 , an administrator terminal 400 , and communication terminals 500 - 1 to 500 - n (n is an integer).
  • the receiving mail server 300 , the administrator terminal 400 and the communication terminals 500 - 1 to 500 - n are respectively the same as those shown in FIG. 1 .
  • the transmission mail server 210 is a communication device having both of the function owned by the transmission mail server 200 shown in FIG. 1 and the function owned by the electronic mail monitoring apparatus 100 .
  • FIG. 9 is a diagram showing an example of the internal configuration of the transmission mail server 210 shown in FIG. 8 .
  • the transmission mail server 210 shown in FIG. 8 is provided with an acquisition section 201 , an extraction section 202 , a calculation section 203 , a verification section 204 , a notification section 205 , a transmission control section 206 , a storage section 207 , and an authentication section 208 .
  • FIG. 9 shows an example of main components concerning the present embodiment among the components provided in the transmission mail server 210 shown in FIG. 8 .
  • the extraction section 202 has the same function as the extraction section 102 shown in FIG. 2 .
  • the calculation section 203 has the same function as the calculation section 103 shown in FIG. 2 .
  • the verification section 204 has the same function as the verification section 104 shown in FIG. 2 .
  • the notification section 205 has the same function as the notification section 105 shown in FIG. 2 .
  • the transmission control section 206 has the same function as the transmission control section 106 shown in FIG. 2 .
  • the authentication section 208 authenticates a user who operates the communication terminals 500 - 1 to 500 - n . At that time, the authentication section 208 authenticates the user by comparing the authentication information transmitted from the communication terminals 500 - 1 to 500 - n with the authentication information stored in the storage section 207 .
  • This authentication information is the user identification information such as the mail address and the member ID of the user and the password. Further, the detailed authentication method may be the same as general one.
  • the storage section 207 may store authentication information used for authenticating a user who operates the communication terminals 500 - 1 to 500 - n.
  • FIG. 10 is a diagram showing an example of authentication information stored in the storage section 207 shown in FIG. 9 .
  • the storage section 207 shown in FIG. 9 stores the mail address, the member ID, and the password as the authentication information. These are stored in advance.
  • the acquisition section 201 acquires electronic mails transmitted from the communication terminals 500 - 1 to 500 - n.
  • FIG. 11 is a flow chart for describing an example of the electronic mail monitoring method in the transmission mail server 210 shown in FIG. 8 .
  • the authentication section 208 at step 21 compares the transmitted authentication information with the authentication information stored in advance in the storage section 207 and thereby authenticates the user.
  • the electronic mail transmitted from the communication terminals 500 - 1 to 500 - n is received by the transmission mail server 210 .
  • the acquisition section 201 acquires the received electronic mail.
  • the extraction section 202 extracts the IP address of transmission source from the electronic mail acquired by the acquisition section 201 or from connection processing (e.g., an SMTP session) with the communication terminals 500 - 1 to 500 - n .
  • the extraction section 202 writes the extracted IP address and the mail address or the member ID (the member ID is employed as an example in the following description) used for authentication by the authentication section 208 , into the storage section 207 in correspondence to the date and time information (e.g., the correspondence shown in FIG. 4 ).
  • This date and time information indicates the date and time at which the transmission mail server 210 has received the electronic mail, the date and time at which the transmission mail server 210 has transmitted the electronic mail, the date and time at which the acquisition section 201 has acquired the electronic mail, the date and time at which the storage section 207 has stored the correspondence, or the like.
  • the calculation section 203 calculates the uniqueness number of IP addresses extracted by the extraction section 202 within the unit time, for each member ID. Then, at step 25 , the verification section 204 judges whether the uniqueness number of IP addresses for each member ID calculated by the calculation section 203 has exceeded a first threshold set up in advance.
  • the notification section 205 at step 26 performs notification (first notification) indicating a possibility that junk mails (spoofing mails) have been transmitted, to the administrator terminal 400 serving as the notification destination.
  • This notification contains the mail address of the corresponding transmission source. Further, this notification may contain the IP address and the date and time information of the transmission source.
  • the transmission control section 206 at step 27 may stop transmission of electronic mails having been transmitted from the mail address corresponding to the corresponding member ID.
  • the transmission control section 206 at step 28 performs transmission of electronic mails having been transmitted from the mail address corresponding to the corresponding member ID.
  • the country of transmission source may also be employed.
  • FIG. 12 is a flow chart for describing an example of the electronic mail monitoring method employing country information in the transmission mail server 210 shown in FIG. 8 .
  • the authentication section 208 at step 31 compares the transmitted authentication information with the authentication information stored in advance in the storage section 207 and thereby authenticates the user.
  • the electronic mail transmitted from the communication terminals 500 - 1 to 500 - n is received by the transmission mail server 210 .
  • the acquisition section 201 acquires the received electronic mail.
  • the extraction section 202 extracts the IP address of transmission source from the electronic mail acquired by the acquisition section 201 .
  • the extraction section 202 writes the extracted IP address and the mail address or the member ID used for authentication by the authentication section 208 , into the storage section 207 in correspondence to the date and time information. This date and time information is the same as that is written into the storage section 207 by the extraction section 202 after step 23 .
  • the calculation section 203 calculates the uniqueness number of IP addresses extracted by the extraction section 202 within the unit time, for each member ID. Then, at step 35 , the verification section 204 judges whether the uniqueness number of IP addresses for each member ID calculated by the calculation section 203 has exceeded a first threshold set up in advance.
  • the calculation section 203 judges whether the uniqueness number of countries for each member ID calculated by the calculation section 203 has exceeded a second threshold set up in advance.
  • the notification section 205 at step 38 performs notification (second notification) indicating a possibility that junk mails (spoofing mails) have been transmitted, to the administrator terminal 400 serving as the notification destination.
  • This notification contains the mail address of transmission source corresponding to the corresponding member ID. Further, this notification may contain the IP address, the date and time information, and the country name of the transmission source.
  • the transmission control section 206 at step 39 may stop transmission of electronic mails having been transmitted from the mail address corresponding to the corresponding member ID.
  • the transmission control section 206 at step 40 performs transmission of electronic mails having been transmitted from the mail address corresponding to the corresponding member ID.
  • the processing may be such that: the extraction section 202 writes the extracted IP address and the member ID used for authentication, into the storage section 207 in correspondence to the date and time information; then the processing of steps 34 and 35 is not performed; and then at step 36 , on the basis of the IP address extracted by the extraction section 202 within a unit time and the country information stored in the storage section 207 , the calculation section 203 extracts the country information corresponding to the IP address and then calculates the uniqueness number of countries of transmission source within a unit time, for each member ID.
  • the verification section 204 can judge whether the uniqueness number of countries of transmission source for each member ID has exceeded the second threshold.
  • the region may be employed in a case that the region (e.g., the Kanto district and the Asia region) of transmission source can be identified on the basis of the IP address of transmission source.
  • the processing of calculating the uniqueness number of IP addresses for each mail address or member ID and the processing of calculating the uniqueness number of countries or regions for each mail address or member ID may be performed for each predetermined unit time (periodically). Further, these processing pieces may be performed at each timing that the acquisition section 101 or 201 has acquired an electronic mail and then the extraction section 102 or 202 has extracted the IP address (at each time of receiving an electronic mail).
  • the uniqueness number of IP addresses or of countries or regions is calculated for the mail addresses (the member IDs) of the electronic mails having already been received within a predetermined time (e.g., 5 seconds) counted from the date and time of having received the electronic mail.
  • each component provided respectively in the electronic mail monitoring apparatus 100 and the transmission mail server 210 may be performed by a logic circuit fabricated in accordance with the individual object.
  • a computer program (referred to as a program, hereinafter) describing the contents of processing as a procedure may be recorded on a recording medium readable individually by the electronic mail monitoring apparatus 100 and the transmission mail server 210 . Then, the program recorded on the recording medium may be read and executed individually by the electronic mail monitoring apparatus 100 and the transmission mail server 210 .
  • the recording medium readable individually by the electronic mail monitoring apparatus 100 and the transmission mail server 210 indicates a portable recording medium such as a floppy (registered trademark) disc, a magneto-optical disc, a DVD, and a CD as well as a memory such as a ROM and a RAM and an HDD built individually in the electronic mail monitoring apparatus 100 and the transmission mail server 210 .
  • the program recorded on the recording medium is read by a CPU (not shown) provided individually in the electronic mail monitoring apparatus 100 and the transmission mail server 210 . Then, by virtue of the control by the CPU, similar processing to that described above is achieved.
  • the CPU operates as a computer for executing the program read from the recording medium on which the program is recorded.
  • An electronic mail monitoring apparatus including:
  • an extraction section for, from the electronic mail acquired by the acquisition section, extracting user identification information indicating a user having transmitted the electronic mail and communication terminal identification information imparted to the communication terminal having transmitted the electronic mail;
  • a calculation section for, for each user identification information extracted by the extraction section within a unit time, calculating a uniqueness number of the communication terminal identification information
  • a verification section for judging whether the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded a predetermined first threshold
  • a notification section for, when the verification section has judged that the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded the first threshold, performing predetermined first notification to a notification destination set up in advance.
  • the calculation section calculates a uniqueness number of countries or regions on the basis of the communication terminal identification information for each user identification information extracted by the extraction section within a unit time;
  • the verification section judges whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded a predetermined second threshold
  • the notification section does not perform the first notification and, when the verification section has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded the second threshold, performs predetermined second notification to the notification destination.
  • a transmission control section for stopping transmission of electronic mails having a transmission source equal to the user identification information whose uniqueness number of the communication terminal identification information has been judged by the verification section as having exceeded the first threshold or, alternatively, equal to the user identification information whose uniqueness number of countries or regions has been judged by the verification section as having exceeded the second threshold.
  • the acquisition section acquires member identification information of the user having transmitted the electronic mail, from a transmission mail server connected to the electronic mail monitoring apparatus;
  • the calculation section calculates the uniqueness number of communication terminal identification information or, alternatively, the uniqueness number of countries or regions, for each of the member identification information.
  • An electronic mail monitoring apparatus including: an acquisition section for acquiring electronic mails transmitted from communication terminals;
  • an extraction section for, from the electronic mail acquired by the acquisition section, extracting user identification information indicating a user having transmitted the electronic mail and communication terminal identification information imparted to the communication terminal having transmitted the electronic mail;
  • a calculation section for calculating a uniqueness number of countries or regions corresponding to the communication terminal identification information for each user identification information extracted by the extraction section within a unit time;
  • a verification section for judging whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded a predetermined second threshold
  • a notification section for, when the verification section has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded the second threshold, performing predetermined second notification to a notification destination set up in advance.
  • the extraction section extracts an electronic mail address or member identification information as the user identification information and extracts an IP address as the communication terminal identification information.
  • a transmission mail server including:
  • an authentication section for authenticating a user
  • a storage section for storing authentication information used for the authentication
  • an acquisition section for, when the authentication section has succeeded in authentication of the user by using the authentication information stored in the storage section, acquiring electronic mails transmitted from communication terminals;
  • an extraction section for extracting user identification information indicating the user having transmitted the electronic mail, from the authentication information and then extracting communication terminal identification information imparted to the communication terminal having transmitted the electronic mail, from the electronic mail acquired by the acquisition section or connection processing with the communication terminal;
  • a calculation section for, for each user identification information extracted by the extraction section within a unit time, calculating a uniqueness number of the communication terminal identification information
  • a verification section for judging whether the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded a predetermined first threshold
  • a notification section for, when the verification section has judged that the uniqueness number of communication terminal identification information for each of the user identification information calculated by the calculation section has exceeded the first threshold, performing predetermined first notification to a notification destination set up in advance.
  • a transmission mail server including:
  • an authentication section for authenticating a user
  • a storage section for storing authentication information used for the authentication
  • an acquisition section for, when the authentication section has succeeded in authentication of the user by using the authentication information stored in the storage section, acquiring electronic mails transmitted from communication terminals;
  • an extraction section for extracting user identification information indicating the user having transmitted the electronic mail, from the authentication information and then extracting communication terminal identification information imparted to the communication terminal having transmitted the electronic mail, from the electronic mail acquired by the acquisition section or connection processing with the communication terminal;
  • a calculation section for calculating a uniqueness number of countries or regions corresponding to the communication terminal identification information for each user identification information extracted by the extraction section within a unit time;
  • a verification section for judging whether the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded a predetermined second threshold
  • a notification section for, when the verification section has judged that the uniqueness number of countries or regions for each of the user identification information calculated by the calculation section has exceeded the second threshold, performing predetermined second notification to a notification destination set up in advance.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Human Resources & Organizations (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Strategic Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Information Transfer Between Computers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
US14/425,476 2012-09-04 2013-05-09 Electronic mail monitoring Abandoned US20150256505A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/590,636 US10467596B2 (en) 2012-09-04 2017-05-09 Electronic mail monitoring

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
JP2012-193748 2012-09-04
JP2012193748A JP5668034B2 (ja) 2012-09-04 2012-09-04 電子メール監視装置、送信メールサーバ、電子メール監視方法およびプログラム
PCT/JP2013/063010 WO2014038246A1 (ja) 2012-09-04 2013-05-09 電子メール監視

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2013/063010 A-371-Of-International WO2014038246A1 (ja) 2012-09-04 2013-05-09 電子メール監視

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/590,636 Continuation US10467596B2 (en) 2012-09-04 2017-05-09 Electronic mail monitoring

Publications (1)

Publication Number Publication Date
US20150256505A1 true US20150256505A1 (en) 2015-09-10

Family

ID=50236871

Family Applications (2)

Application Number Title Priority Date Filing Date
US14/425,476 Abandoned US20150256505A1 (en) 2012-09-04 2013-05-09 Electronic mail monitoring
US15/590,636 Active 2034-02-17 US10467596B2 (en) 2012-09-04 2017-05-09 Electronic mail monitoring

Family Applications After (1)

Application Number Title Priority Date Filing Date
US15/590,636 Active 2034-02-17 US10467596B2 (en) 2012-09-04 2017-05-09 Electronic mail monitoring

Country Status (3)

Country Link
US (2) US20150256505A1 (ja)
JP (1) JP5668034B2 (ja)
WO (1) WO2014038246A1 (ja)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160164888A1 (en) * 2014-12-03 2016-06-09 International Business Machines Corporation Detection of false message in social media

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6614920B2 (ja) * 2015-10-30 2019-12-04 サイバネットシステム株式会社 送信制御装置、送信制御方法及び送信制御プログラム
EP3297221B1 (en) * 2016-09-19 2018-11-14 retarus GmbH Technique for detecting suspicious electronic messages
CN113329016A (zh) * 2021-05-28 2021-08-31 北京天空卫士网络安全技术有限公司 一种处理邮件的方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050188036A1 (en) * 2004-01-21 2005-08-25 Nec Corporation E-mail filtering system and method
US20060259558A1 (en) * 2005-05-10 2006-11-16 Lite-On Technology Corporation Method and program for handling spam emails
US7590697B2 (en) * 2003-11-04 2009-09-15 Ntt Docomo, Inc. Mail server, mobile communication system, and program therefor
US20110252043A1 (en) * 2008-10-01 2011-10-13 Network Box Corporation Limited Electronic communication control
US9092761B2 (en) * 2003-05-29 2015-07-28 Dell Software Inc. Probability based whitelist

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004021700A (ja) * 2002-06-18 2004-01-22 Konica Minolta Holdings Inc 情報管理システム
JP4484663B2 (ja) * 2004-02-02 2010-06-16 株式会社サイバー・ソリューションズ 不正情報検知システム及び不正攻撃元探索システム
JP2006128917A (ja) 2004-10-27 2006-05-18 Canon Inc 電子メール制御装置、電子メール制御方法、プログラムおよび記憶媒体
JP2006310902A (ja) * 2005-04-26 2006-11-09 Hitachi Ltd 電子メールサービス制御システム、装置、方法及びメールサービス停止システム、装置、方法
US20080313704A1 (en) * 2005-10-21 2008-12-18 Boxsentry Pte Ltd. Electronic Message Authentication
JP4739077B2 (ja) * 2006-03-28 2011-08-03 ニフティ株式会社 メール制御方法及びサーバ装置
JP2008193538A (ja) * 2007-02-07 2008-08-21 Hitachi Ltd ネットワークへの攻撃監視装置および攻撃証跡管理装置
JP5036742B2 (ja) * 2009-02-18 2012-09-26 日本電信電話株式会社 電子メール送信ホスト分類システムおよび電子メール送信ホスト分類方法ならびにそのためのプログラム

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9092761B2 (en) * 2003-05-29 2015-07-28 Dell Software Inc. Probability based whitelist
US7590697B2 (en) * 2003-11-04 2009-09-15 Ntt Docomo, Inc. Mail server, mobile communication system, and program therefor
US20050188036A1 (en) * 2004-01-21 2005-08-25 Nec Corporation E-mail filtering system and method
US20060259558A1 (en) * 2005-05-10 2006-11-16 Lite-On Technology Corporation Method and program for handling spam emails
US20110252043A1 (en) * 2008-10-01 2011-10-13 Network Box Corporation Limited Electronic communication control

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160164888A1 (en) * 2014-12-03 2016-06-09 International Business Machines Corporation Detection of false message in social media
US9887944B2 (en) 2014-12-03 2018-02-06 International Business Machines Corporation Detection of false message in social media
US9917803B2 (en) * 2014-12-03 2018-03-13 International Business Machines Corporation Detection of false message in social media

Also Published As

Publication number Publication date
US20170255905A1 (en) 2017-09-07
US10467596B2 (en) 2019-11-05
JP5668034B2 (ja) 2015-02-12
WO2014038246A1 (ja) 2014-03-13
JP2014050057A (ja) 2014-03-17

Similar Documents

Publication Publication Date Title
US9356920B2 (en) Differentiating between good and bad content in a user-provided content system
US10467596B2 (en) Electronic mail monitoring
CN105847245B (zh) 一种电子邮箱登录认证方法和装置
US20120239751A1 (en) Multi-dimensional reputation scoring
US20170208075A1 (en) Smart Lockout
US20200259933A1 (en) Method and system for processing data packages
CN107733581B (zh) 基于全网环境下的快速互联网资产特征探测方法及装置
CN112134893B (zh) 物联网安全防护方法、装置、电子设备及存储介质
KR20160090905A (ko) 보안 규칙 평가를 포함하는 보호 시스템
US20150350193A1 (en) Authentication information theft detection method, authentication information theft detection device, and computer-readable recording medium storing program for the same
CN107508822B (zh) 访问控制方法及装置
CN104426835B (zh) 一种登录检测的方法、服务器、登录检测装置及其系统
US11329997B2 (en) Signed message header storing sender account authentication method
CN109729000A (zh) 一种即时通信方法及装置
CN102769629B (zh) 客户端密码存储方法及服务系统
JP6039378B2 (ja) 不正メール判定装置、不正メール判定方法、及びプログラム
US9338112B2 (en) Safety protocols for messaging service-enabled cloud services
CN104660480B (zh) 一种帐号异常处理的方法、装置及系统
JP5846590B2 (ja) 電子メール監視装置、送信メールサーバ、電子メール監視方法およびプログラム
CN108243034B (zh) 一种故障确定方法、接收机及发射机
JP6316380B2 (ja) 不正メール判定装置、不正メール判定方法、及びプログラム
US10235541B2 (en) System and method for confidential data management
JP4334605B2 (ja) 不正アクセス防止装置および不正アクセス防止プログラム
CN114666129B (zh) 网络安全认证方法、系统、计算机设备、存储介质
GB2581189A (en) Method and system for processing data packages

Legal Events

Date Code Title Description
AS Assignment

Owner name: BIGLOBE INC., JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:KATO, RIHITO;REEL/FRAME:036813/0387

Effective date: 20150224

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO PAY ISSUE FEE