WO2002078275A1

WO2002078275A1 - Electronic mail monitoring system and method

Info

Publication number: WO2002078275A1
Application number: PCT/JP2002/002640
Authority: WO
Inventors: Genichiro Sueki; Hiroaki Fujiki; Tohru Ohyama; Ryo Tatenoi
Original assignee: Mitsubishi Space Software Co., Ltd.
Priority date: 2001-03-27
Filing date: 2002-03-20
Publication date: 2002-10-03
Also published as: JP2002290469A

Abstract

An electronic mail monitoring system comprises a monitor server apparatus (1) having a monitoring object check block (9) for deciding whether an electronic mail is to be monitored, a search equation setting block (11) for setting a search condition for deciding a selection criterion for whether the electronic mail decided to be monitored by the monitoring object check block (9) is transmitted outside, a search processing block (12) for executing search in accordance with the search condition set by the search equation setting block (11) and classifying electronic mails decided to be monitored into at least two types in accordance with the matching with the search condition, and a mail destination editing block (14) for displaying on a search result reference block (13) a display content in accordance with the at least two types of electronic mails classified by the search processing block (12) and setting a destination to a transmission destination computer which is a client apparatus or outside of a network specified by the client apparatus.

Description

Description E-mail audit system and method

The present invention relates to so-called e-mail audits for exchanging messages with a specific party via a network. More specifically, the present invention audits e-mails delivered from a network inside a company or institution to the outside. It concerns systems and methods. Background art

Traditionally, many companies or institutions have introduced various e-mail audit systems that determine whether to allow or not to deliver depending on the content of the e-mail, and use these systems to perform specific audit operations. It is operated.

However, in the actual auditing work, detailed setting of the auditing target and selection and setting of a key for a search condition expression for extracting the auditing target were necessary, which was troublesome.

Specifically, before starting the operation, a trial operation of relaying and monitoring e-mail or a means of avoiding audit was needed to respond to unexpected situations before setting detailed audit targets.

In addition, when selecting keywords for search condition formulas, the fact is that the auditor sets these keys visually and through trial and error from the original existing document. Even in the case where the search condition expression is matched, there is only a judgment as to whether or not the search condition expression is matched.In many cases, the contents depend on the visual judgment of the auditor, and the load on the auditor is reduced. It was expensive. Disclosure of the invention

The present invention has been conceived in view of the above circumstances, and can easily implement an audit avoiding means, does not need to set a keyword for a search condition expression, and reduces a load of visual confirmation of a search result. It is an object of the present invention to provide an e-mail auditing system and an auditing method for the same.

Another object of the present invention is to distribute e-mail without delay due to an increase in search condition expressions.

In order to solve this problem, the first invention audits whether or not to transmit an e-mail to the outside of the network in response to an e-mail transmission request from a client device in a specific network In an auditing system having an audit server device, the audit server device sends an e-mail that has been audited by the audit target confirmation unit to the outside to determine whether or not the e-mail is an audit target. A search condition expression for setting a selection criterion for determining whether or not to perform the search, and a search executed by the search condition expression set by the search expression setting unit, and the e-mail subject to the audit is sent to the A search processing unit that classifies the email into at least two types according to the degree of conformity with the search condition expression; and the two or more types of email classified by the search processing unit according to the type The client device or the network of external and is the destination computer in the network and displays the shown content search results see section is characterized by comprising a mail address editing section for setting a destination.

According to this, when referring to the search results, it is easy to prioritize and narrow down the visual confirmation based on the degree of relevance, so that the load on the audit work can be reduced.

According to a second aspect of the present invention, in addition to the configuration of the first aspect, the determination of whether or not the target is the audit target in the audit target confirmation unit includes a mode for inquiring with a preset audit target definition file or the transmission request. Exclude all e-mails from auditing One of these modes is selected and executed.

According to this, in addition to the effect of the first invention, the auditor selects a mode in which all e-mails are excluded from the audit target at the time of trial operation or the avoidance of the audit due to the occurrence of an unexpected event, The countermeasures can be easily taken. According to a third aspect of the present invention, in addition to the configuration of the first or second aspect, at least two or more classifications by the search processing unit set a threshold value as a criterion for determining a degree of conformity with the search condition expression. The threshold is set to two or more types of thresholds for dividing an electronic mail that can be transmitted outside the network and an electronic mail that cannot be transmitted and the threshold of the electronic mail that can be transmitted. It is characterized by a threshold value for division.

According to this, in addition to the effects of the first or second invention, for example, by setting a rank of caution, etc. in addition to passing and failing, it is possible to indicate the degree of passing to what extent Because of this, more detailed audits are performed and motivation for users is enhanced. Also, depending on how the attention rank is handled, it is possible to respond to various audit conditions.

According to a fourth aspect of the present invention, in addition to the configuration of any one of the first to third aspects, in addition to a keyword set in advance, a natural sentence can be input to the search condition expression. In the setting unit, when a natural sentence is input, the natural sentence is divided into parts of speech, and compound words are created by performing compound word processing of connecting consecutive nouns in the words divided into parts of speech. 4. The mail auditing system according to claim 1, further comprising a compound word processing unit for adding the compound word to the search condition expression.

According to this, in addition to the effect of any one of the first to third inventions, it is not necessary to select keywords from existing documents when inputting a natural sentence. Without being particularly aware of the electronic mail associated with the document. -It is possible to detect rules.

According to a fifth aspect, in addition to the configuration according to any one of the first to fourth aspects, the audit server device further includes a mail data decompression unit that decompresses a compressed file attached to the email. It is characterized in that the mail data decompressed by the mail decompression unit is also subject to an audit as to whether or not to be transmitted to the outside.

According to this, in addition to the effect of any one of the first to fourth inventions, an appropriate audit is automatically executed not only for the mail text but also for the attached file. According to a sixth aspect of the present invention, there is provided a receiving step of receiving an electronic mail transmission request from a client device in a specific network, and a keypad or a keypad input from an auditor computer connected to the network. A search condition formula creating step of creating a search condition formula representing a selection criterion for determining whether or not to send the e-mail to the outside of the network based on a natural sentence; and transmitting the search condition formula and the e-mail to a computer. An e-mail auditing method comprising: a step of inputting and e-mailing the e-mail to the outside of the network and a step of not e-mailing the e-mail, wherein the computer is a massively parallel computer incorporating a plurality of processors. And setting a plurality of search condition expressions independent of each other on the plurality of processors, and setting the e-mail and an attached file attached to the e-mail. It is characterized in that so as to full-text search and.

According to this, when inputting a natural sentence in the setting of a search condition expression, it is not necessary to select a key word from an existing document, so that the key words of the key word are not particularly conscious, and the Related mail can be detected.

Furthermore, by performing a full-text search using a massively parallel computer, it is possible to obtain search results immediately after obtaining an e-mail, thereby speeding up mail auditing operations. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a block diagram showing the configuration of an embodiment of the mail monitoring system of the present invention.

FIG. 2 is a block diagram showing a configuration of the audit server unit of the embodiment. FIG. 3 is a schematic diagram showing a processing state in the massively parallel computer of the embodiment.

FIG. 4 is a flowchart showing the overall flow of an e-mail auditing method using the embodiment.

FIG. 5 is a flowchart when a natural sentence is input in setting the search condition expression in FIG. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, an embodiment of a mail inspection system according to the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a configuration of an embodiment of a mail audit system of the present invention. In FIG. 1, an audit server device 1 is a computer that performs overall management of a mail audit system, has a WWW server unit 2 and an audit server unit 3, and is connected to an external e-mail server 4.

The audit server device 1 is connected to a user computer 6 as a client device and an auditor computer 7 via an intranet 5 provided inside the company or institution. Further, the external destination combination G, which is the destination of the e-mail, and the audit server device 1 are connected via the e-mail server 4 via the e-mail server 8.

The user sends an e-mail using the user device 6 as a client device, and the auditor uses an auditor computer 7 as a client device to set an auditing search condition expression and check the audit status. . As shown in Fig. 2, the audit server section 3 has a mail audit target check section 9, a mail data decompression section 10, a search formula setting section 11, a search processing section 12, and a search result reference section 1. 3. It has a mail destination editing unit 14 and a mail audit log output unit 15. Also, as shown in Fig. 1 and Fig. 2, the audit server unit 3 has a massively parallel computer 21 and an audit exclusion address definition file 16, a comment definition file 17, a mail audit log file 18, The database section 20 for storing the audit data 34 is connected.

The database unit 20 may be divided for each storage file as shown in FIG. 2, or may be integrated. Therefore, in Figure 1 showing the overall configuration, the database section 20 is shown as one, but in Figure 2 showing a more detailed configuration, the audit exclusion address definition file 16 and the comment The definition file 17, the mail audit log file 18 and the audit target data 34 are shown to be stored in separate databases. The audited data 34 is stored in a dedicated search directory 19 o

The audit server section 3 transfers the search processing result to the WWW server section 2 and sends it to the auditor's view.

In addition, in order to easily take countermeasures in the event of a trial operation or the avoidance of an audit due to the occurrence of an unforeseen situation, identification of whether or not to be subject to audit is performed in a mode that is confirmed by a preset audit exclusion address definition file 16 and all modes. E-mail 30 is excluded from auditing. There are two types of modes, and either mode can be selected and executed.

Whether the mode of excluding all from the audit or the mode of not excluding from the audit is determined by the auditor inputting the conditions from the auditor computer 7 and the audit exclusion address definition file 1 of the database section 20 of the audit server section 3 6 ₍ Audit exclusion address definition file 16 and all mails are excluded from audit The specification of the code may be defined in the same file or multiple files.

In setting the search condition formula, it is necessary to detect an email 30 related to an existing document (eg, past email) that matches the search condition without being particularly aware of the key words of the keyword. To make it possible, search condition expressions are automatically generated from natural sentences in existing documents.

When referring to the search results, the judgment on whether or not to send the e-mail 30 to the outside in order to narrow down the priorities and narrow down the order for visual confirmation conforms to the search condition formula. By setting two types of thresholds, which are determined according to the degree, and using two types of thresholds, we adopt a method of classifying into three types: `` pass '', `` fail '', and `` caution '' to call attention .

In addition, as a means to speed up the e-mail audit operation after obtaining e-mails, multiple search condition expressions can be set in advance on multiple processors, and the search results can be obtained by inputting text data without indexing. By using the massively parallel computer 21 that can obtain the search condition expression and the audit target data 34 that was entered on the massively parallel computer 21 as soon as a new e-mail 30 is received. Perform a full-text search by matching. This shortens the time from receiving the e-mail 30 to obtaining the search result, and enables the distribution of the e-mail whose audit has been completed on the same day to a plurality of destinations at the same time.

The threshold value is divided into an email 40 that can be sent outside the intranet 5 and an email 50 that cannot be sent. It consists of thresholds for classifying the emails into more than one kind.E-mails that can be sent to the outside are classified as “passed”, and e-mails that cannot be sent to the outside are classified as “failed”. At the same time, it is possible to send e-mails 41 classified as "Caution" to a plurality of places, such as the external destination computer G and the source user computer 6 To be (It can be sent outside).

The threshold value is determined by the level of the pass / fail line of the audit. For example, if the maximum value is set to 100 points as the threshold value, the pass value is 0 to 1 It is conceivable to set 0 points, cautions from 11 points to 90 points, and rejects from 91 points to 100 points. In this case, a score of 9 or more will be rejected.

In addition, in addition to the above method, in addition to the above methods, a method of rejecting if at least one keyword appears, or an additional point (weight in the positive direction) and a deduction point (weight in the negative direction) that matches a specific keyword set in advance. Weights) may be used in combination with a method of obtaining the total of these points.

Each e-mail classified as “Pass”, “Fail”, or “Caution” according to the search results is edited by the e-mail destination editing unit 14 according to the following rules. Each is sent to the destination edited by the e-mail server 4 connected to the editing unit 14.

In other words, the "passed" e-mail 40 is sent to the e-mail server 4 without editing the destination of the original e-mail 30 and sent to the external destination computer G via the internet 8 . For the "Failed" e-mail 50, edit the destination of the original e-mail 30 to the user computer 6 and other necessary destinations that are the sender, and send the notification e-mail 52, which is an auditor comment (in this case, Will be a rejection notification email). For the e-mail 41 classified as “Caution”, edit the destination of the original e-mail 30 to the user computer 6 as the sender and other necessary destinations, and send the notification e-mail 5 2 In such a case, it will be sent as an advisory advisory mail) and sent to the e-mail sender 4 without editing the destination of the original e-mail 30 and sent to the outside via the Internet 8 Send to destination computer G. As described above, in the embodiment of the present invention, since the classification of “caution” is provided in addition to “pass” and “fail”, the e-mail classified as “caution” 41 By sending a notification e-mail to the user computer 6 of the originator and other necessary computers such as the computer of the supervisor of the user, for example, the notice of the cautionary recommendation of the auditor can be used to prevent recurrence.

In addition, by setting the pass line strictly so that the auditor can visually check only “fail”, the audit work of the auditor can be reduced. Alternatively, the efficiency of the confirmation work can be improved by dividing the auditor into two groups: a group that visually checks “failed” and a group that visually checks “caution”. be able to.

In any case, the handling of e-mails 41 classified as “Caution” is determined by the operation policy of the side adopting the audit system. A flag or the like that can determine whether or not to transmit to the outside may be provided.

As shown in the schematic diagram of FIG. 3, the massively parallel computer 21 has thousands to tens of thousands of processors 22, 22, 22,... (Hereinafter, these are collectively referred to as a pipeline). By incorporating it, a plurality of different search condition expressions 24 can be simultaneously set in the pipeline 23. By operating these large numbers of processors 22, 22, 22,... At the same time, when a new e-mail 30 is sent, the pipeline 23 checks the e-mail 30 for the data to be audited. Is sent, and a full-text search that matches a plurality of different search condition expressions 24 with the audit target data 34 is executed. As a result of the matching, if the audit target data 34 that matches the search condition expression 24 is found, the audit target data 34 has a function that regards it as a hit (“fail”).

Here, the massively parallel computer 21 is equipped with a device such as a full-text search engine (for example, FDF (registered trademark) 4T Text Finder, manufactured by Parac e 1). Although desirable, a device such as a workstation having the same function and performance may be used.

The audit exclusion address definition file 16 stores a domain name that is not to be audited, an email address, and a flag indicating whether or not all items are to be audited. As a result of the search and the editing of the mail destination, the e-mails 41 and 50 that were classified as “Caution” or “Failed” were deleted from the database for subsequent screen display or retransmission. Stored in 0.

The mail audit log file 18 records the judgment as to whether or not the conditions are met as a result of the audit and the degree of conformity with the search condition expression 24. Stored in 20.

Hereinafter, an audit procedure according to an embodiment of the mail audit system according to the present invention will be described with reference to FIGS. 4 and 5.

FIG. 4 is a flowchart showing an entire flow of the electronic mail auditing method according to the present invention.

First, a user inside the intranet 5 sends an e-mail 30 containing a message from his or her own user computer 6 as a client device by designating a target external destination computer G (step). S 1) Then, the monitoring server unit 3 receives the e-mail 30 without being aware of the user (step S 2).

Upon receiving the e-mail 30, the monitoring server unit 3 acquires the e-mail text 31 and the e-mail address of the user who is the sender and the destination computer G. Then, it is confirmed whether or not a mode for excluding all e-mails 30 from the audit is specified (step S3). Whether or not the received e-mail 30 is to be audited is confirmed by referring to the acquired e-mail address and the audit exclusion address definition file 16. In the mode of excluding from the audit, all the e-mails 30 without performing the audit are sent to the e-mail server 4 via the e-mail destination editing unit 14. (Step S11), and if it is not in the mode to be excluded from the audit, it is checked whether or not it is to be audited (step S4).

Next, if the received e-mail 30 is to be audited, first convert the e-mail body 31 to text format, and if there is an attached file 32 compressed into the e-mail 30 Decompress to a text format according to the file format of step 2 (step S5). Decompress the original attachment 32 and copy it, and keep the original attachment 32 as it is. The thawing means can be handled by using a thawing program which has already been released or marketed. The converted or decompressed text file is saved in the search directory 19 as audit data 34.

Then, the auditor inputs the keyword for the search condition expression 24 for audit or the natural sentence of the existing document (eg, past e-mail) from the auditor computer 6 (step S6).

The search condition expression 24 is a combination of multiple keywords, such as AND, OR, NOT, etc., but when a natural sentence is input, words that become keywords are automatically extracted from the natural sentence. It has become so. The details of the automatic generation of the search condition expression 24 will be described later.

Next, when the search condition expression 24 is given, a search is started to determine whether the received e-mail 30 matches the search condition expression 24 (step S7).

The search result is displayed on a monitor or the like (not shown) as the search result reference section 13 of the auditor computer 7. Specifically, the search results are determined by comparing the degree of conformity with the search condition expression 24 with two pre-specified thresholds, and classified into three types: "pass", "fail", and "caution". Is done.

Then, it is checked whether the search result is acceptable (step S8), and the “passed” e-mail 40 that has become “passed” is transferred to the e-mail server 4 (step S11). The "passed" e-mail 40 was not specified by the user To the destination computer G. If the e-mails 41 and 50 are not "Pass"("Caution" or "Fail"), the audit data 34 is stored in the database section 20 (step S9), and the result Check whether the message corresponds to “Caution” (step S 10). If the message corresponds to “caution”, transfer the “caution” e-mail 41 to the e-mail server 4 (step S 10). S14), transfer this e-mail to the original external destination computer G specified by the user

Those that were judged to be not "Caution" in step S10 are "Failed" e-mails 50, and the "Failed" e-mails 50 include the received e-mail body 51 and In addition to the attached document 52, an editing process is performed to add a prespecified auditor comment (step S12). "Failed" The e-mail 50 is attached with the notification e-mail 53, which is an auditor's comment, and is delivered via the e-mail server 4 to the user convenience 6, which is the sender.

Then, as a result of the search and the editing of the destination of the e-mail and the comment editing, the audit status of the e-mail 30 received from the user combination 6 is output as a log by the e-mail audit log output unit 15 (step S13). In this log, the e-mail title, sender, destination, pass / fail, notice, etc. are described and saved as the mail audit log file 18.

Next, details of the automatic generation of a search condition expression using natural sentences will be described with reference to FIG.

FIG. 5 is a flowchart when a natural sentence is input in setting the search condition expression.

First, the natural sentence input by the auditor is divided into parts of speech by morphological analysis, and the type information is obtained (step S61). Next, a compound word is created by subjecting the words divided into parts of speech to compound words processing, for example, combining consecutive nouns (step S62). Use this compound as a search keyword By doing so, it is possible to avoid the abstraction of expressions due to word division, and to extract words that accurately express conditions.

Next, based on statistical information obtained by statistically processing past e-mails 30 stored in the database section 20, keywords are selected based on part-of-speech information, the number of e-mails where words appear, the generality of words, etc. Yes (step S63).

Here, we explain in detail the part-of-speech information, the number of e-mails in which the word appears, and the conditions for selecting the generality of the word.

First, from the part-of-speech information, words of the part-of-speech representing characteristics, such as compound words, nouns, and undefined words, are extracted. The part of speech to be extracted is not limited to the above compound words, nouns, and undefined words, but specifies the part of speech that is expected to represent a characteristic for each mail to be delivered. After division into parts of speech, in some cases, words to be deleted are always kept as a list, and even if the part of speech is to be extracted, a function to delete the words may be added.

Based on the part-of-speech information, for the narrowed words, the weight for the words is calculated from the number of appearances of the words and the importance indicating the generality of the words.

The number of occurrences of a word is considered to be the word that represents the concept of the article.

The importance indicating the generality of a word is calculated, for example, by calculating the proportion of articles in which the word appears in a database that stores various articles. If the ratio is high, the word appears in various articles, so the importance is low. If the ratio is low, the word appears only in a specific article, and the importance is high. Common words can also be considered as words that appear frequently, but such words have a low importance and the weight given to the words is small, which adversely affects search results There are few things.

When a keyword is selected, a keyword (weight, weight, scoreline) for searching for e-mails related to the specified existing document, etc. based on the keyword is selected. A search condition expression is automatically generated (step S64). Examples of the scoring method include a method of calculating a score if it appears at least once in the search target, and a method of calculating a score each time it appears within the search target.

In the above-described embodiment, the intranet 5 is used as the connection means between the user computer 6 and the auditor computer 7 and the audit server device 1 as a connection means. However, other networks such as networks connectable to the WWW server unit 2 are used. A connection is fine.

The auditor computer 7 may also be used as the audit server device 1.

Further, the WWW server unit 2 may be a server other than a so-called WWW server that can set a search condition formula of an auditor, send an e-mail, and refer to an audit status.

The WWW server unit 2 and the audit server unit 3 included in the audit server device 1 may have independent configurations. Although the e-mail server 4 is separate from the audit server device 1, the e-mail server 4 may be configured by being incorporated in the audit server device 1. In other words, even if one or both of the WWW server unit 2 and the e-mail server 4 are not located at the same location as the audit server unit 3, any configuration may be used as long as they are connected via a network or the like. In addition, the audit exclusion address definition file 16, comment definition file 17, mail audit log file 18, and audit target data 34 are managed by specific software such as independent database management systems. It may be composed of files that do not have a special database structure such as a database-based or database management system.

Further, the user computer 6 may be an Internet or a mobile phone capable of receiving an e-mail service. Industrial applicability

The present invention relates to a system and a method for auditing e-mails delivered from a network inside a company or an organization to the outside, in which means for avoiding audits can be easily implemented, and setting of keywords for search condition expressions can be performed. It is not necessary to do so, and the load on visual confirmation of search results can be reduced, which is useful for improving the audit work of the system administrator.

Claims

The scope of the claims

1. In an audit system having an audit server device that audits whether or not to send an electronic mail to the outside of the network in response to an electronic mail transmission request from a client device in a specific network, The server device includes: an audit target confirmation unit that determines whether the electronic mail is an audit target; and a search that determines a selection criterion of whether to send the electronic mail that is the audit target by the audit target confirmation unit to the outside. A search expression setting unit for setting a conditional expression; and executing a search based on the search condition expression set by the search expression setting unit, and determining the e-mail to be audited according to the degree of conformity with the search condition expression. A search processing unit that classifies the email into at least two types, and a display content corresponding to the type of the two or more emails classified by the search processing unit is displayed in a search result reference unit. Email auditing system, characterized by comprising a mail address editing section for setting a destination to serial client device or the Ne Uz network outside a is the destination computers in the network.

2. In the audit target confirmation unit, whether or not the target is the audit target is determined in a mode in which a preset audit target definition file is referred to or a mode in which all e-mails corresponding to the transmission request are excluded from the audit target. 2. The e-mail audit system according to claim 1, wherein any one of the following is executed.

3. Classification of at least two or more types by the search processing unit is performed by setting a threshold value that is used as a criterion for determining the degree of conformity with the search condition expression, and the threshold value is set outside the network. A threshold for dividing the e-mail that can be transmitted and an e-mail that cannot be transmitted and a threshold for further dividing the e-mail that can be transmitted into two or more types. E-mail audit system according to paragraph 1 or 2.

4. In the search condition expression, be sure to enter a natural sentence in addition to a preset keyword. When a natural sentence is input, the search formula setting unit divides the natural sentence into parts of speech and combines continuous nouns in the words divided into parts of speech. The compound processing apparatus according to claim 1, further comprising: a compound processing unit configured to perform a word processing to generate a compound word, and to add the generated compound word to the search condition expression. Email audit system.

5. The audit server device has a mail data decompression unit for decompressing the compressed file attached to the e-mail, and also transmits the mail decompressed by the mail data decompression unit to the outside. The e-mail audit system according to any one of claims 1 to 4, wherein the e-mail audit system is set as an audit target.

6. A receiving step of receiving an e-mail transmission request from a client device in a specific network; and transmitting the e-mail based on a keyword or a natural sentence input from an auditor's view connected to the network. A search condition formula creating step for creating a search condition formula indicating a selection criterion of whether or not to transmit the search condition formula to the outside of the network; inputting the search condition formula and the email to a computer to send the email to the network; An e-mail auditing method comprising a selection step of selecting an externally transmitted one and a non-transmitted one, wherein the computer is a massively parallel computer incorporating a plurality of processors, and A plurality of independent search condition expressions are set to perform a full-text search of the e-mail and the attached file attached to the e-mail. E-mail audit method, characterized in that it was so.