JP7227935B2 - Information processing device, information processing method, and information processing program - Google Patents

Description

TECHNICAL FIELD Embodiments of the present invention relate to an information processing apparatus, an information processing method, and an information processing program.

The so-called "spoofing" e-mail, in which the source of the e-mail is disguised and sent as if it were an appropriate e-mail, has become a problem. A malicious third party sends an e-mail with a more sophisticated disguise of the sender to a specific corporation or organization, and infects the user's terminal with malware etc. via the link destination information etc. Targeted e-mail attacks that steal data such as personal information by infecting have increased in recent years, and countermeasures against targeted e-mail attacks are required.

In particular, there are attacks that disguise the sender of the e-mail and cleverly hide the actual URL of the link destination information that the user clicks to access in the e-mail, leading to a malicious site. It has increased.

Conventionally, the URL that the user clicks to access is compared with the actual connection destination URL that is transferred (redirected) from that URL, and it is determined whether or not the connection destination URL is appropriate. A technique for doing so is disclosed.

Japanese Patent Laid-Open No. 2019-53613

On the other hand, in cases where the URL that the user clicks to access is redirected to another URL, such as shortened URL services that are widely used by companies and organizations, the actual destination URL is not appropriate. connection destination. In other words, even if the URL of the access destination is redirected, it may be an appropriate destination, and the conventional method of judging whether it is appropriate or not based on the presence or absence of redirection may result in erroneous detection of spoofed emails. be.

The present invention has been made in consideration of such circumstances, and provides an information processing apparatus, an information processing method, and an information processing program capable of accurately detecting camouflaged mail even when the link destination is cleverly camouflaged. intended to provide

An information processing apparatus according to an embodiment of the present invention is an information processing apparatus that relays an e-mail sent to a client terminal, and receives the e-mail and extracts URL information included in the e-mail. an information extraction unit; a deployment condition storage unit that pre-stores deployment conditions including a script for redirecting from a URL of an access destination when a user accesses; a verification unit that verifies whether or not information is to be redirected; and a determination unit that acquires an actual connection destination URL for the URL information determined to be redirected and determines whether or not the connection destination URL is appropriate. In addition, the expansion conditions are distributed from the distribution server at regular intervals, and the expansion condition storage unit sets whether or not to expand and acquire the connection destination URL in association with each of the expansion conditions. In addition, with regard to the expansion condition for which there is no setting as to whether or not to expand and acquire the connection destination URL, the expansion condition is set to expand and acquire the connection destination URL. When the URL is expanded based on the expansion conditions, the information is expanded by expanding the URL information, and the matching and expansion with the expansion conditions are repeated until the actual connection destination URL is acquired. Determine whether it is appropriate or not.

Embodiments of the present invention provide an information processing device, an information processing method, and an information processing program capable of accurately detecting camouflaged mail even when the link destination is camouflaged.

1 is a configuration diagram showing an example configuration of an e-mail system to which an information processing apparatus according to the present embodiment is applied; FIG. (A) A list of expansion conditions (scripts) for executing redirection, and (B) a list of expansion conditions (shortened URLs) for executing redirection. FIG. 4 is an explanatory diagram for explaining an example of an e-mail containing expansion conditions; 4 is a flow chart showing an example of a processing procedure of an information processing method according to the present embodiment;

An embodiment of the present invention will be described below with reference to the accompanying drawings.
FIG. 1 is a configuration diagram showing an example of the configuration of an e-mail system to which an information processing apparatus 10 according to the first embodiment is applied.

The information processing apparatus 10 is a server that receives an e-mail from an external terminal (not shown) via an external mail server and transmits the received e-mail to the client terminal 20 . The information processing apparatus 10 may be provided in an internal network 11 to which connection from the Internet is restricted, for example, or may be provided in a boundary (DMZ: DeMilitarized Zone) between the internal network 11 and an external network that can be arbitrarily connected to the Internet. may

The client terminal 20 is a terminal that receives e-mails from the information processing device 10 . Although an example in which three client terminals 20 are provided is shown here, the number and arrangement of the client terminals 20 are not limited to those shown in FIG. Further, like the information processing device 10, the client terminal 20 does not need to be located in the internal network 11, and may be connected to the information processing device 10 from outside the internal network 11, for example.

The communication unit 12 is a relay device that transfers an e-mail sent from an external terminal to the information processing device 10 . The communication unit 12 may be provided at the boundary connecting the internal network 11 and the external network, or may be provided in the external network. An MTA (Message Transfer Agent) is exemplified as the communication unit 12 .

The external name resolution device 13 is a server that holds identification information for identifying whether or not the sender of an e-mail is appropriate, such as a DNS (Domain Name System) server. Examples of the determination information include a combination of a source domain and an IP address. When receiving an e-mail, the information processing device 10 inquires of the external name resolution device 13 via the communication unit 12 whether or not the sender of the received e-mail matches the identification information of the external name resolution device 13. It may be determined whether or not the sender of the e-mail is appropriate by collating whether or not.

The information processing apparatus 10 according to the present embodiment includes a transmission/reception unit 14, a URL information extraction unit 15, a deployment condition storage unit 16, a collation unit 17, and a determination unit 18.

It should be noted that the function of each unit constituting the information processing apparatus 10 may be realized by executing a predetermined program code using a processor. It may be implemented by hardware processing, or may be implemented by combining software processing and hardware processing.

The transmission/reception unit 14 executes reception control of electronic mail transferred from the communication unit 12 and received, and transmission control of electronic mail sent from the client terminal 20 .

The URL information extractor 15 extracts URL information from the received e-mail. Here, the URL information means a continuous character string including the URL of the user's access destination. It becomes the entire character string that is continuous from the URL of the access destination. The URL information is extracted by searching within the e-mail. Further, URL information is extracted not only for the text of the mail but also for all information related to link destinations obtained from attachments attached to e-mails, macros of attachments, and the like.

The expansion condition storage unit 16 pre-stores expansion conditions for redirecting from the URL of the access destination when the user accesses. The deployment condition means a condition for transferring (redirecting) from the URL accessed by the user to another URL. As a deployment condition, a redirecting character string pattern (regular expression) may be saved, or a redirecting domain, script, or URL may be set. For example, a case where the URL information includes a shortened URL domain is exemplified. In this case, the deployment condition storage unit 16 stores in advance a list of domains of shortened URLs. Further, as a deployment condition, the URL information may include a script for redirecting from the accessed URL to another URL. In this case, the deployment condition storage unit 16 stores in advance a script to be redirected.

The development conditions stored in the development condition storage unit 16 may be distributed at regular intervals from a development condition distribution server 19 arranged outside the information processing apparatus 10 for distributing the development conditions. A new development condition is updated in the development condition distribution server 19 .

A shortened URL is a shortened URL of a long character string, and is a URL for transferring to the original long URL using redirection.

Further, the expansion condition storage unit 16 may store a setting as to whether or not to expand and acquire the actual connection destination URL in association with each expansion condition. Specifically, for each expansion condition, the determination unit 18, which will be described later, sets whether or not to acquire the actual connection destination by redirection. On the other hand, if "not expanded" is set, the actual connection destination will not be obtained.

For example, for a shortened URL service that needs to be expanded to determine whether the URL is appropriate or not, set it to "expand", and for the shortened URL domain set by a company or organization, set it to "expand" because there is no risk of malicious intent. You can set it to "No". In addition, a deployment condition that does not correspond to any of the settings may be set to "develop" as a condition that needs to be determined as to whether it is appropriate or not.

A collation unit 17 collates whether or not the URL information redirects based on the extracted URL information and expansion conditions. Specifically, it is determined whether or not the extracted URL information includes the expansion conditions stored in the expansion condition storage unit 16 . If the deployment condition is included, the URL information will redirect.

For example, the matching unit 17 determines whether or not to redirect from the URL of the access destination by matching the domain of the URL of the access destination included in the extracted URL information with the saved domain. Alternatively, the collation unit 17 determines whether or not to redirect from the access destination URL, depending on whether or not the extracted URL information includes a redirect script.

The determination unit 18 acquires the actual connection destination URL for the URL information determined to be redirected, and determines whether or not the connection destination URL is appropriate. Here, an inappropriate (harmful) URL means a URL that leads the client terminal 20 to download a malicious file or connect to a website when accessed by the user. To determine whether the URL is appropriate or not, specifically, malicious information such as the domain and IP address of the URL, which may be a malicious site such as malware, is recorded in advance, and the malicious information and the connection destination URL are recorded. Appropriateness is determined by collation. Further, with respect to the extension of the URL, it is possible to set a prohibited extension that may download malware or the like, and determine whether or not it is appropriate by comparing the extension with the extension of the destination URL. Appropriate (harmless to access) URLs may be stored in advance as a whitelist, and if a connection destination URL does not fall under this whitelist, it may be determined that it is not appropriate.

Further, if the information acquired by expanding from the URL information further includes expansion conditions as a result of matching with the expansion conditions in the expansion condition storage unit, the determination unit 18 determines whether to obtain the actual connection destination URL. , may be further expanded to acquire the connection destination URL.

In addition, in the expansion condition storage unit 16, when it is set whether or not to expand and acquire the actual connection destination URL in association with each expansion condition, the determination unit 18 stores If expansion conditions set to be acquired by expansion are included, the actual connection destination URL may be acquired and whether or not the connection destination URL is appropriate may be determined. If it is determined that the connection destination URL is not appropriate, the e-mail is determined to be suspected of being a disguised e-mail.

The e-mail whose URL information contained in the e-mail is determined to be appropriate by the determination unit 18 is transferred to the client terminal 20 (the terminal corresponding to the destination set in the e-mail) via the transmission/reception unit 14. . On the other hand, when the URL information included in the e-mail is determined to be inappropriate, the transmission/reception unit 14 does not send the e-mail to the client terminal 20 and isolates the e-mail inside the information processing apparatus 10 . This avoids the risk that the client terminal 20 that receives the e-mail is infected with a virus, and ensures the safety of the terminal.

Further, a server for developing URL information that matches the expansion condition is separately arranged, and the determination unit 18 transmits the URL information to this server and acquires the actual connection destination URL to be redirected on the server. may The determination unit 18 may receive a connection destination URL from the server and determine whether or not the connection destination URL is appropriate.

FIG. 2A is a list of deployment conditions (scripts) for executing redirection. For example, in "scriptA", the URL to be accessed by the user is placed at the top, and the actual connection destination URL is written with the script interposed to execute redirection. The collation unit 17 collates whether or not the extracted URL information includes expansion conditions. Further, for each of the deployment conditions, the determination unit 18 sets whether or not to acquire the actual connection destination by redirection. On the other hand, "scriptB" is set to "x" for whether to expand or not, so that the actual connection destination is not acquired. The URL is determined to be an appropriate URL for the condition that expansion is not required and the actual connection destination is not acquired.

FIG. 2B is an explanatory diagram showing a list of expansion conditions (shortened URLs) for executing redirection. The collation unit 17 collates whether or not the extracted URL information includes a shortened URL. For each expansion condition, whether or not to acquire the actual connection destination by redirection is set in the determination unit 18. For "tanshukuA", the expansion status is set to "O" and the actual connection destination is acquired. On the other hand, "tanshukuB" is set to "x" and the actual connection destination is not acquired. The URL is determined to be an appropriate URL for the condition that expansion is not required and the actual connection destination is not acquired. By setting the presence/absence of deployment, only URLs that need to be determined as to whether they are appropriate or not can be acquired as connection destinations, making it possible to efficiently determine URLs.

FIG. 3 is an explanatory diagram illustrating an example of an e-mail containing development conditions.
URL information is described in the text of the e-mail, and "scriptA" is included as a preconfigured expansion condition in the URL information. In this case, the determination unit 18 acquires the actual connection destination URL (http://malicious.com) for the URL information determined as the redirect destination, and determines whether or not the connection destination URL is appropriate. In this way, the expansion conditions for redirecting from the URL of the access destination are stored in advance, and whether or not the URL information redirects is checked based on the extracted URL information and the expansion conditions. Then, by acquiring the actual connection destination URL for the URL information determined to be redirected, and determining whether or not the connection destination URL is appropriate, it is possible to accurately detect camouflaged mail.

FIG. 4 is a flow chart showing an example of the processing procedure of the information processing method according to this embodiment.

The URL information extractor 15 extracts URL information from the received e-mail (S10).

The collation unit 17 collates whether or not the URL information redirects based on the extracted URL information and expansion conditions (S11). Specifically, the collating unit 17 collates whether or not the extracted URL information includes the expansion conditions stored in the expansion condition storage unit 16, and if the extracted URL information contains the expansion conditions, the URL information shall be redirected (S11: YES).

The determination unit 18 acquires the actual connection destination URL for the URL information determined to be redirected, and determines whether or not the connection destination URL is appropriate (S12, S13). When determining that the e-mail is appropriate, the determining unit 18 transfers the e-mail to the client terminal 20 (S13: YES15).

On the other hand, if the determining unit 18 determines that the e-mail is not appropriate, the URL information included in the e-mail is considered to be harmful and the disguised e-mail is quarantined (S13: NO, S14). Note that, when the e-mail is quarantined as a fake mail, the determination unit 18 may notify the client terminal 20 (the terminal corresponding to the destination set in the e-mail) of the quarantine. Further, when the information processing apparatus 10 judges whether or not it is a camouflaged mail using a plurality of judgment criteria such as sender information such as the sender's domain and IP address, the judgment unit 18 determines whether the connection destination URL is determined to be inappropriate, it may be determined whether or not it is a fake mail based on a plurality of criteria such as this determination result and sender information.

In this way, when judging disguise of an e-mail based on whether or not to redirect it as in the past, there is a risk that false positives may increase in judging e-mail disguise. By judging whether or not it is appropriate, it is possible to accurately detect fake mail even if the link destination is fake, and reduce false positives in judging fake mail.

According to the information processing apparatus of each of the embodiments described above, when the user accesses, the expansion conditions for redirecting from the URL of the access destination are stored in advance, and the URL information is displayed based on the extracted URL information and the expansion conditions. If the link destination is disguised by checking whether or not to redirect, acquiring the actual connection destination URL for the URL information determined to be redirected, and determining whether or not the connection destination URL is appropriate However, it is possible to accurately detect fake mail.

It should be noted that the program executed by the information processing apparatus 10 is provided by being preliminarily incorporated in a hard disk constituted by a ROM or the like. Alternatively, the program may be stored in a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD, flexible disk, etc. as a file in an installable format or an executable format. may Also, the program executed by the information processing apparatus 10 may be stored in a computer connected to a network such as the Internet, downloaded via the network, and provided.

While several embodiments of the invention have been described, these embodiments have been presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and modifications can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the scope of the invention described in the claims and equivalents thereof.

DESCRIPTION OF SYMBOLS 10... Information processing apparatus, 11... Internal network, 12... Communication part, 13... External name resolution apparatus, 14... Transmission/reception part, 15... URL information extraction part, 16... Expansion condition storage part, 17... Verification part, 18... Judgment Part 19... deployment condition delivery server, 20... client terminal.

Claims (4)

An information processing device that relays an e-mail sent to a client terminal,
a URL information extraction unit that receives the e-mail and extracts URL information included in the e-mail;
a deployment condition storage unit for pre-storing deployment conditions including a script for redirecting from an access destination URL when a user accesses;
a collation unit that collates whether or not the URL information redirects based on the extracted URL information and the expansion condition;
a determination unit that acquires an actual connection destination URL for the URL information determined to be redirected and determines whether or not the connection destination URL is appropriate;
The deployment conditions are distributed from a distribution server at regular intervals,
The expansion condition storage unit sets whether or not to expand and acquire the connection destination URL in association with each of the expansion conditions, and sets whether or not to expand and acquire the connection destination URL. For the expansion condition that is not set , set it to be obtained by expanding the connection destination URL,
When the extracted URL is expanded based on the expansion condition, the determination unit acquires information by expanding URL information, and compares and expands with the expansion condition to obtain an actual connection destination URL. to determine whether the connection destination URL is appropriate,
The information processing apparatus according to the above-mentioned. The deployment condition storage unit stores in advance a list of domains of shortened URLs to be redirected from the URL of the access destination,
The matching unit determines whether or not to redirect by matching the domain of the URL of the access destination included in the extracted URL information with the saved domain.
The information processing apparatus according to claim 1, characterized by: An information processing method for relaying an e-mail sent to a client terminal,
receiving the e-mail and extracting URL information contained in the e-mail;
a step of pre-saving deployment conditions including a script for redirecting from an access destination URL when a user accesses;
determining whether the URL information redirects based on the extracted URL information and the expansion condition;
obtaining an actual connection destination URL for the URL information determined to be redirected, and determining whether or not the connection destination URL is appropriate;
The deployment conditions are distributed from a distribution server at regular intervals,
Regarding the expansion condition for which setting is made as to whether or not to expand and acquire the connection destination URL in association with each of the expansion conditions, and whether or not to expand and acquire the connection destination URL is not set is set to the one to be acquired by expanding the connection destination URL,
When the extracted URL is expanded based on the expansion condition, the information is acquired by expanding the URL information, and the collation and expansion with the expansion condition are repeated until the actual connection destination URL is acquired. determining whether the connection destination URL is appropriate;
An information processing method characterized by: the computer,
A function of receiving an e-mail and extracting URL information contained in the e-mail;
A function that saves deployment conditions in advance, including a script that redirects from the URL of the access destination when the user accesses.
a function of determining whether or not the URL information redirects based on the extracted URL information and the expansion condition;
obtaining an actual connection destination URL for the URL information determined to be redirected, and determining whether or not the connection destination URL is appropriate;
The deployment conditions are distributed from a distribution server at regular intervals,
Regarding the expansion condition for which setting is made as to whether or not to expand and acquire the connection destination URL in association with each of the expansion conditions, and whether or not to expand and acquire the connection destination URL is not set is set to the one to be acquired by expanding the connection destination URL,
When the extracted URL is expanded based on the expansion condition, the information is acquired by expanding the URL information, and the collation and expansion with the expansion condition are repeated until the actual connection destination URL is acquired. determining whether the connection destination URL is appropriate;
The information processing program according to the description.

Images