JP6485470B2 - Information processing apparatus, information processing method, and program - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  Cyber attacks using e-mail attachments continue to decline. In recent years, targeted attacks targeting specific companies are increasing, and it may be difficult to determine whether an attack email is from the text of the email, which may cause malicious attachments to be executed. is there.

  Therefore, Patent Document 1 describes a system that determines the legitimacy of an e-mail using transmission identification information registered in advance.

JP 2004-78845 A

  In the system of the above-mentioned patent document 1, transmission identification information must be registered in advance, which is not suitable when it is necessary to receive an e-mail from an unspecified number.

  Moreover, since a key file is also required when transmitting an attached file, complicated procedures are required for the sender, such as system installation and key file attachment.

  Accordingly, an object of the present invention is to provide a mechanism that can identify whether a recipient is a suspicious electronic mail even when receiving an electronic mail from an unspecified number.

  The information processing apparatus of the present invention includes a mail category estimation unit that estimates a category of a received electronic mail, a file category estimation unit that estimates a category of an attached file of the received electronic mail, the mail category estimation unit, Notification means for notifying a warning based on the category estimated by the file category estimation means.

  The information processing method of the present invention includes a mail category estimation step in which the mail category estimation means of the information processing apparatus estimates the category of the received electronic mail, and the file category estimation means of the information processing apparatus receives the received electronic A file category estimation step for estimating a category of an attached file of a mail, and a notification step in which the notification means of the information processing apparatus notifies a warning based on the mail category estimation step and the category estimated by the file category estimation step. And.

  The program of the present invention is a program that can be executed in an information processing apparatus, and the information processing apparatus uses a mail category estimation means for estimating a category of a received electronic mail, and an attachment file of the received electronic mail. A program for functioning as a notification unit for notifying a warning based on a category estimated by the file category estimation unit, the mail category estimation unit, and the file category estimation unit.

  According to the present invention, it is possible to identify whether or not the recipient is a suspicious electronic mail.

1 is a system configuration diagram showing an example of a configuration of an e-mail inspection system of the present invention. It is a figure which shows the hardware constitutions of information processing apparatus. It is a flowchart which shows an example of the email inspection in the email client in this invention, and a warning display process. It is a flowchart which shows an example of the email inspection process in the email server in this invention. It is a flowchart which shows an example of the category estimation process of the email in the email inspection process in this invention. It is a flowchart which shows an example of the category estimation process of the attached file in the electronic mail inspection process in this invention. It is a figure which shows an example of the relationship between the estimation category of an email in this invention, and a warning display. It is a figure which shows an example of the relationship between the estimated category of an attachment file in this invention, and a warning display. It is a figure which shows an example of the warning display at the time of performing the client test | inspection in this invention. It is a figure which shows an example of the warning display at the time of performing the server test | inspection in this invention. It is a figure which shows an example of the stored mail browsing screen in the stored mail management server in this invention. It is a figure which shows an example of the preservation | save mail list screen in the preservation | save mail management server in this invention.

  FIG. 1 is a system configuration diagram showing an example of the configuration of the e-mail inspection system of the present invention.

  In FIG. 1, an e-mail server 100 or a plurality of e-mail clients 200 and a stored mail management server 300 are connected via a local area network (LAN).

  The email server 100 stores a category dictionary, and performs category estimation processing using the category dictionary and inspection processing of received email. In addition, in response to a request from the e-mail client 200, e-mail is distributed.

  The email client 200 stores a category dictionary, and performs category estimation processing using the category dictionary and received email inspection processing.

  The stored mail management server 300 is a server that stores and manages e-mails that are determined to be warnings in response to requests from the e-mail server 100.

  Next, the hardware configuration of the information processing apparatus applicable to the e-mail server 100 and the e-mail client 200 will be described with reference to FIG.

  As shown in FIG. 2, the information processing apparatus includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, an input controller 205, a video controller 206, a system bus 204, and the like. A memory controller 207 and a communication I / F controller 208 are connected.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 204.

  The ROM 202 or the external memory 211 includes a BIOS (Basic Input / Output System) and an OS (Operating System) that are control programs executed by the CPU 201, and a computer-readable program and various necessary programs for realizing the information processing method. Holds data (including data table).

  The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for executing the processing from the ROM 202 or the external memory 211 to the RAM 203 and executing the loaded program.

  The input controller 205 controls input from an input device such as a keyboard 209 or a pointing device such as a mouse (not shown). When the input device is a touch panel, the user can perform various instructions by pressing (touching with a finger or the like) in accordance with an icon, a cursor, or a button displayed on the touch panel.

  The touch panel may be a touch panel capable of detecting a position touched with a plurality of fingers, such as a multi-touch screen.

  The video controller 206 controls display on an external output device such as the display 210. The display includes a display of a notebook computer integrated with the main body. The external output device is not limited to a display, and may be a projector, for example. An input device is also provided for the device that can accept the touch operation described above.

  Note that the video controller 206 can control a video memory (VRAM) for display control, and a part of the RAM 203 can be used as a video memory area, or a dedicated video memory can be provided separately. Is possible.

  The memory controller 207 controls access to the external memory 211. The external memory is connected via an adapter to an external storage device (hard disk), flexible disk (FD), or PCMCIA card slot that stores boot programs, various applications, font data, user files, editing files, and various data. A compact flash (registered trademark) memory or the like can be used.

  The communication I / F controller 209 connects and communicates with an external device via a network, and executes communication control processing on the network. For example, communication using TCP / IP, telephone lines such as ISDN, and communication using 3G lines of mobile phones are possible.

Note that the CPU 201 enables display on the display 210 by executing outline font rasterization processing on a display information area in the RAM 203, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display 210.
<First embodiment>
With reference to FIG. 3, an embodiment in which an email inspection process is executed in the email client 200, which is the first embodiment of the present invention, will be described. This process is executed when the e-mail client 200 receives an e-mail or when the recipient browses the e-mail.

  The process shown in the flowchart of FIG. 3 is a process in which the CPU 201 of the email client 200 reads and executes a predetermined control program.

  In step S301, an email is received from the email server 100.

  In step S302, category estimation processing (details will be described later with reference to FIG. 5) is performed on the email received in step S301, and the estimated category and presence / absence of warning display are stored.

  In step S303, it is determined whether an attached file exists in the email received in step S301. If it exists (Yes in step S303), the process proceeds to step S304. If it does not exist (No in step S303), the process proceeds to step S305.

  In step S304, category estimation processing (details will be described later with reference to FIG. 6) is performed on the attached file of the e-mail, and the estimated category and necessity of warning display are stored.

  In step S305, it is determined whether or not it is determined to display a warning in step S302 or step S304, and whether or not the categories estimated in step S302 and step S304 match.

  If it is determined that a warning display is necessary, or if the categories do not match (Yes in step S305), the process proceeds to step S306. If not (No in step S305), the process ends.

In step S306, a warning for the email is displayed on the email browsing screen of the email client 200 (an example is shown in FIG. 9). Here, a button or the like for displaying the text of the attached file extracted in step S304 may be displayed (901 in FIG. 9).
<Second embodiment>
Next, with reference to FIG. 4, an embodiment in which an email inspection process is executed in the email server 100, which is a second embodiment of the present invention, will be described. This process is executed when the email server 100 receives an email.

  The process shown in FIG. 4 is a process in which the CPU 201 of the e-mail server 100 reads and executes a predetermined control program.

  In step S401, the email server 100 receives an email.

  In step S402, category estimation processing (FIG. 5) is performed on the electronic mail received in step S401, and the estimated category and necessity of warning display are stored.

  In step S403, it is determined whether or not an attached file exists in the electronic mail. If it exists (Yes in step S403), the process proceeds to step S404. If it does not exist (No in step S403), the process proceeds to step S405.

  In step S404, category estimation processing (FIG. 6) is performed on the attached file of the e-mail, and the estimated category and the necessity of warning display are stored.

  In step S405, it is determined whether warning display is required in step S402 or step S404, and whether the categories determined in step S402 and step S404 match.

  If it is determined that it is necessary to display a warning, or the categories do not match (Yes in step S405), the process proceeds to step S406. If not (No in step S405), the process proceeds to step S408.

  In step S406, the electronic mail and the text of the attached file extracted in step S404 are stored in the storage mail management server 300.

  In step S407, a warning for the e-mail is inserted into the e-mail body, and the attached file is replaced with the text extracted in step S404 (S602) (see FIG. 10). Information for browsing the electronic mail of the stored mail management server 300 may be added here (for example, 1001 in FIG. 10). In this case, the recipient manages the received mail using a management screen as shown in FIGS.

  In step S <b> 408, an email is transmitted to the email client 200 in response to a request from the email client 200.

  Next, the e-mail category estimation process will be described with reference to FIG.

  The process shown in FIG. 5 is a process executed by the e-mail client 200 in the first embodiment and by the e-mail server 100 in the second embodiment.

  In step S501, the category of the subject is estimated (determined or specified) from the subject of the email. This category estimation process uses a known technique. For example, a method of estimating the category of a subject based on a word acquired in advance from a subject and a category stored in association with the word can be considered. This method may be adopted.

  If the category cannot be estimated, such as when the subject is blank or the word registered in the category dictionary cannot be obtained, the category is set to “unknown”.

  In step S502, the category of the text is estimated from the text of the electronic mail. The processing in step S502 is also performed using a known technique as in S501. The method of category estimation may be a method using the above-described category dictionary or any method.

  If it is determined to be a reply mail (for example, “Re” is included in the subject), the category is determined based on the part other than the quoted part (content written in the reply mail). May be. By performing such control, the category can be determined based on the text written by the mail sender (reply mail creator).

  Further, the category determination may be made after excluding the greeting part written at the beginning of the e-mail and the signature at the end.

  In step S503, the category of the e-mail is estimated based on the category of the subject estimated in step S501 and the category of the text estimated in step S502.

  For example, as shown in FIG. 7, the e-mail category and the necessity of warning display are determined based on information in which a combination of the estimated category of the subject and the estimated category of the text is associated with the e-mail category. Note that the diagram shown in FIG. 7 is an example, and may be used in various combinations depending on the use and purpose of the system user.

  Next, the attached file category estimation processing will be described with reference to FIG.

  The process shown in FIG. 6 is a process executed by the email client 200 in the first embodiment and by the email server 100 in the second embodiment.

  In step S601, the category of the file name is estimated (determined or specified) from the file name of the attached file. This category estimation process is the same process as step S501 and the like, and a known technique is used.

  In step S602, text is extracted from the attached file.

  In step S603, it is determined whether text has been extracted from the attached file in the process of step S602. If extraction is possible (Yes in step S603), the process proceeds to step S604. If extraction is not possible (No in step S603), the category of the extracted text is unknown (step S605).

  In step S604, the category of the text is estimated (determined or specified) from the text extracted in step S602. This category estimation process is the same process as step S501 and the like, and a known technique is used.

  In step S606, the category of the attached file is estimated based on the file name category estimated in step S601 and the text category estimated in step S604.

  For example, as shown in FIG. 8, the attachment file category and the necessity of the warning display are determined based on information in which the combination of the estimated file name category and the estimated text category is associated with the attached file category. Note that the diagram shown in FIG. 8 is an example, and may be used in various combinations according to the use and purpose of the system user.

  FIG. 7 is a diagram illustrating a table in which data in which a combination of a subject category of an email and a body category is associated with an email category is registered.

  As shown in FIG. 7, when the category of the subject or the body is unknown, the category of which the subject or the body is specified is estimated as the category of the e-mail.

  If neither is known, the e-mail category is also unknown.

  If the subject category and the body category do not match, the categories are not matched.

  If the category of the e-mail is unknown and does not match, it is determined that a warning display is necessary.

  FIG. 8 is a diagram showing a table in which data in which a combination of the category of the file name of the attached file and the category estimated from the text extracted from the attached file is associated with the category of the attached file is registered.

  As shown in FIG. 8, when the extracted text category is specified and the file name category is unknown, the text category is estimated as the attachment category.

  Further, when the category of the extracted text is unknown, the category of the attached file is also unknown.

  Even if the category of the extracted text is specified, the category of the attached file does not match if it is different from the category of the file name.

  When the category of the attached file is unknown or does not match, it is determined that a warning display is necessary.

  FIG. 9 is an example of an email displayed on the disciple email browsing screen of the email client 200 in step S306.

  It is displayed that the category of the attached file could not be specified, or that the category of the e-mail and the category of the attached file do not match. Further, a link (button) for displaying the text of the attached file is displayed (901).

  By pressing the button 901, the user can display the text of the attached file.

  FIG. 10 is a diagram showing the mail data in which the warning text is inserted in step S407 and the attached file is converted into text.

  As shown in FIG. 10, the attached file (.doc) is converted into a text file (.txt). In addition, as a warning text, information indicating that the category of the attached file could not be specified, that the category of the mail and the attached file does not match, or that the attached file has been converted into text is inserted. Further, a link (information) to the stored mail management server 300 that is the storage destination of the original attached file is notified (1001).

  FIG. 11 is an example of a stored mail browsing screen that displays mail stored in the stored mail management server 300.

  As shown in FIG. 11, a list of warnings (1101) related to the e-mail, e-mail information (1102) such as a sender, a subject, an attached file, and a body, and a button (1103) for acquiring the attached file are provided. It is displayed. A configuration may be adopted in which display is not performed according to the determination result of the attached file. In addition, a button (1104) for acquiring the extracted text of the attached file of the electronic mail is also displayed.

  FIG. 12 is an example of a stored mail list screen that displays a list of mails stored in the stored mail management server 300.

  As shown in FIG. 12, a list (1202) of stored mail stored in the stored mail management server 300 is displayed. Note that only e-mails related to users accessing the stored mail list screen may be displayed.

  When the subject (1202) of the e-mail is pressed, the e-mail browsing screen (FIG. 11) is displayed.

  When the delete button (1203) is pressed, the electronic mail is deleted from the stored mail management server 300. You may comprise so that it may display only when the administrator of a preservation | save mail accesses.

  In the case of targeted attack emails, the email body is often attacked by setting the content of the email to be of interest to the recipient and attaching a file with malicious behavior. According to the present invention, it is possible to estimate a mail category and an attached file category, respectively, and to notify a warning when the mail category and the attached file category are different. Therefore, since the recipient can recognize that it is a targeted attack mail, it is possible to reduce damage caused by the above-described type of targeted attack mail.

  In the case of targeted attack emails, the subject name and the content of the body may not match, and the file name and content of the file that performs malicious operations often do not match. Therefore, as in the present invention, by determining whether to warn based on the subject and category of the text, or determining whether to warn based on the file name and the category of content, there is a possibility of targeted attack mail. Recipients can be made aware of a certain mail. As a result, it is possible to reduce damage from targeted attack mail.

  Although the embodiment of the information processing apparatus has been described above, the present invention can take an embodiment as a system, apparatus, method, program, recording medium, or the like. Specifically, the present invention may be applied to a system composed of a plurality of devices, or may be applied to an apparatus composed of a single device.

  The program according to the present invention is a program that allows a computer to execute the processing methods of the flowcharts shown in FIGS. 3 to 6. Is remembered. The program in the present invention may be a program for each processing method of each apparatus in FIGS.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by reading and executing.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium recording the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  The present invention may be applied to a system constituted by a plurality of devices or an apparatus constituted by a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 Email Server 200 Email Client 300 Stored Mail Management Server

Claims (6)

Computer
First category specifying means for specifying a category based on the first information included in the e-mail;
A second category specifying means for specifying a category based on the second information included in the e-mail;
A mail category specifying means for specifying a category of the e-mail based on a combination of a category specified based on the first information and a category specified based on the second information;
Determining means for determining whether or not a warning is required based on the category specified by the mail category specifying means;
A program for causing a function to serve as notification means for notifying a warning when the determination means determines that a warning is necessary . The first information is a file name of a file attached to the e-mail,
2. The program according to claim 1, wherein the second information is a content of a file attached to the electronic mail. The first information is a subject of the email,
The program according to claim 1, wherein the second information is a text of the electronic mail.   The notification means functions as means for notifying a warning when the category specified by the first category specifying means is different from the category specified by the second category specifying means. The program of any one of thru | or 3. First category specifying means for specifying a category based on the first information included in the e-mail;
A second category specifying means for specifying a category based on the second information included in the e-mail;
A mail category specifying means for specifying a category of the e-mail based on a combination of a category specified based on the first information and a category specified based on the second information;
Determining means for determining whether or not a warning is required based on the category specified by the mail category specifying means;
A notification means for notifying the warning when the determination means determines that a warning is necessary ;
An information processing apparatus comprising: A first category specifying step in which the first category specifying means of the information processing device specifies a category based on the first information included in the e-mail;
A second category specifying step in which the second category specifying means of the information processing device specifies a category based on the second information included in the e-mail;
The mail category specifying means of the information processing apparatus specifies the category of the e-mail based on the combination of the category specified based on the first information and the category specified based on the second information. Process,
A determination step of determining whether or not a warning is necessary based on the category specified by the mail category specifying step;
When the notification unit of the information processing apparatus determines that a warning is necessary in the determination step, a notification step of notifying the warning;
An information processing method comprising:

Images