JP6721874B2 - Communication system, communication method and program - Google Patents

Description

The present invention relates to communication systems. The present invention particularly relates to control of access to a resource indicated by a URL (Uniform Resource Locator), and particularly to control of access to a URL included in a mail.

2. Description of the Related Art In recent years, damage has been frequently caused by targeted attacks that steal information or the like by targeting specific opponents such as specific organizations and specific individuals. In particular, targeted attacks using email have become a problem.

As a technique to counter targeted attacks, when accessing a website on an external network represented by the Internet from an internal network such as a so-called in-house LAN (Local Area Network), a web proxy server is used. Some have access. This will improve access efficiency and limit access to sites containing threats.

Generally, in a web proxy server, an operator individually sets URLs to which access should be restricted, thereby restricting access. Alternatively, since there is a service on the Internet that provides an access restriction list that lists URLs that have been determined to have a threat in advance, access restriction may be performed by referring to such an external access restriction list.

According to this kind of web proxy server, access to the URL is permitted unless the operator sets it as the URL to be restricted. The same applies when referring to an external access restriction list. Therefore, the method using the web proxy server described above cannot counter the targeted attack using the new threat URL.

As another countermeasure technology, first, it is judged whether there is a threat in the URL included in the mail, and depending on the judgment result, additional processing regarding the mail is performed and the mail is delivered to the destination, or the mail is sent. There is something to discard. Here, the adding process is a process of updating the contents of the mail, sending a warning message instead of the mail, or with the mail.

In this type of mail delivery device, first, the presence/absence of a threat is determined for the URL, and then the mail is delivered to the destination mail client according to the determination result. Therefore, the mail cannot be delivered to the destination until the determination of the URL is completed. Therefore, mail delivery may be delayed.

There is a so-called behavior detection method as a method for detecting a threat of a URL and determining whether or not the URL has a threat. The behavior detection method can determine the presence or absence of a threat with high accuracy, but the determination requires a long time. For this reason, if the behavior detection method is adopted as the threat detection method of the above-described mail delivery device, a delay in mail delivery is particularly likely to occur.

A technique for countering a targeted attack is described in Patent Document 1. According to the document, a virtual machine built on a secure proxy server runs a web browser, and the web browser accesses the URL included in the mail. If there is no problem in accessing the virtual machine with the browser, access the URL from the user terminal.

In the method of Patent Document 1, the user terminal can avoid the influence even if there is a threat in the URL by indirectly accessing the target URL via the virtual machine.

JP, 2013-246474, A

According to Patent Document 1, it is when an attempt is made to access the URL from the user terminal that the determination of whether or not the URL is a threat is started. According to Patent Document 1, even if there is a threat in the URL, the effect remains on the virtual machine, and the user terminal is not affected. However, it is unknown whether there is a threat unless you try to access the URL once.

In addition, “a pattern of address information of an access destination in which access is not permitted” (claim 2 of the same document) or “a pattern of address information of access destination in which the access is permitted” (claim 3 of the same document) is stored in advance. Is listed. However, the document does not mention how to determine whether a URL has a threat. Therefore, when a URL with a threat is accessed from the user terminal via a virtual machine, an operation that actually causes the threat (for example, download a file containing a virus from the web page of that URL and allow execution) The user terminal does not know if there is a threat to the URL unless you perform the following operation. Therefore, even though it is via the virtual machine and has no direct effect on the user terminal, access to the URL continues to be permitted.

The present invention has been made in view of such circumstances, and the problem to be solved by the present invention is to achieve both threat detection of URLs included in emails and email delivery without delay. Communication system, communication method, and program. In particular, it is to provide a communication system, a communication method, and a program that preventively restrict access to a URL included in an email.

In order to solve the above-mentioned problem, the present invention, as one aspect thereof, is a pre-detection threat list update processing means for temporarily adding a resource on a network specified by an identifier included in a received message to a target of access restriction. And a mail storage processing unit that stores the message in a mail storage server so that the user can receive it, a threat detection unit that determines whether or not there is a threat to the resource , and an access restriction if the determination result is no threat. There is provided a communication system including:

Further, as another aspect of the present invention, the pre-detection threat list update processing means temporarily adds a resource on the network identified by the identifier included in the received message to a target of access restriction and stores the mail. When the processing unit stores the message in the mail storage server so that the user can receive it, the threat detecting unit determines whether or not the resource has a threat , and the access limiting unit determines that the determination result is no threat, release the access restriction, to provide a communication method.

As another aspect of the present invention, a pre-detection threat list update processing unit that temporarily adds a resource on a network specified by an identifier included in a received message to a target of access restriction, and a user-received threat list update processing unit. A mail storage processing unit that stores the message in a mail storage server as much as possible, a threat detection unit that determines whether or not there is a threat to the resource , and an access restriction unit that releases the access restriction when the result of the determination is no threat. To provide a program for operating a computer.

In addition, as another aspect of the present invention, a pre-detection threat list update processing unit that temporarily adds a resource on a network, which is specified by an identifier included in a received message, to a target of access restriction, and a user A mail storage processing unit that stores the message in a mail storage server in a receivable manner, a threat detection unit that performs a threat detection determination that determines whether the resource has a threat, and the identifier that is specified by the identifier If the threat detection determination for the identifier is in progress at the time of requesting access to the resource, or if the threat detection determination for the identifier is completed and it is determined that there is a threat, the access request And an output unit for transmitting a warning message to the requesting source.

Further, as another aspect of the present invention, the pre-detection threat list update processing means temporarily adds a resource on the network, which is identified by an identifier included in the received message, to a target of access restriction, and sends a mail. The storage processing means stores the message in a mail storage server so that the user can receive it, the threat detection means performs threat detection determination to determine whether or not the resource has a threat , and the output means to output the message to the user. When there is a request for access to the resource specified by the identifier, if the threat detection determination for the identifier is in progress, or if the threat detection determination for the identifier is completed and the determination result is threat If a determination already, to the request source of the access request, that sends a warning message, to provide a communication method.

According to the present invention, it is possible to provide a communication system, a communication method, and a program capable of achieving both threat detection of a URL included in an email and mail delivery without delay. In particular, it is possible to provide a communication system, a communication method, and a program that preventively restrict access to a URL included in an email.

It is a block diagram of the access control system 100 which is a 1st embodiment of the present invention. 3 is a block diagram for further explaining a mail delivery server 1, a web proxy server 3, and a threat detection device 8 of the access restriction system 100. FIG. 6 is a flowchart for explaining operations of the mail delivery server 1, the threat detection device 8, and the list storage device 7 in the access restriction system 100. 7 is a table for explaining a threat URL list 7A1 that is an example of the threat URL list 7A in the access restriction system 100. 6 is a flowchart for explaining operations of the web proxy server 3, the mail display device 6, and the list storage device 7 in the access restriction system 100. It is a block diagram of the access control system 200 which is the 2nd Embodiment of this invention. 7 is a table for explaining a threat URL list 7A2 that is an example of the threat URL list 7A in the access restriction system 200. 7 is a flowchart for explaining operations of the mail delivery server 1, the threat detection device 8, the threat detection device 9, and the list storage device 7 in the access restriction system 200.

(First embodiment)
The access restriction system 100 according to the first embodiment of the present invention will be described. Referring to FIG. 1, an access restriction system 100 includes a mail delivery server 1, a mail storage server 2, a web proxy server 3, an internal network 4, an external network 5, an email display device 6, a list storage device 7, and a threat detection device. Equipped with 8.

Each of the mail delivery server 1, the mail storage server 2, the web proxy server 3, the mail display device 6, the list storage device 7, and the threat detection device 8 has one or more CPUs (Central Processing Unit) and LAN (Local Area Network). A computer provided with a network interface device such as a card. The list storage device 7 may be a storage device including a network interface device, or may be a storage device of any one of the mail delivery server 1, the mail storage server 2, the web proxy server 3, the mail display device 6, and the threat detection device 8. The device area may be assigned as the list storage device 7.

The mail delivery server 1 has a function of receiving a mail received from the external network 5 via the internal network 4. Further, the mail delivery server 1 has a function of scanning the content of the received mail. Further, the mail delivery server 1 has a function of updating the threat URL (Uniform Resource Locator) list 7A stored in the list storage device 7 according to the result of scanning, and transfers the received mail to the mail storage server 2. Have a function.

The mail delivery server 1 will be further described with reference to FIG. The mail delivery server 1 includes a mail reception processing unit 11, a mail URL extraction unit 12, a mail URL notification unit 13, and a mail storage processing unit 14.

The mail reception processing unit 11 receives a mail according to the SMTP (Simple Mail Transfer Protocol). The received mail and the command information of the SMTP protocol used at that time (contents of the MAIL FROM command and RCPT TO command) are temporarily stored in the mail delivery server 1 and referred to in the subsequent processing.

The mail URL extracting unit 12 scans the content of the mail. Also, the URL is extracted from the mail data including the mail body. Generally, the content of the mail is described according to the format defined by the rules such as RFC (Request For Comments)822. In order to extract the URL from the mail, the mail URL extraction unit 12 analyzes this format. Then, the mail URL extracting unit 12 finds the URL character string based on the format of the predetermined URL character string. The format of the URL string is specified in RFC3986 etc.

The mail URL notification unit 13 sends the URL output by the mail URL extraction unit 12 to the threat detection device 8. After the sending process is completed, the mail URL notification unit 13 transitions to the process in the mail storage processing unit 14.

The mail storage processing unit 14 transfers the mail processed by the mail reception processing unit 11, the mail URL extraction unit 12, and the mail URL notification unit 13 to the mail storage server 2.

The mail storage server 2 responds to a request from the mail display device 6 which is the destination of the mail, the contents of the mail addressed to the mail display device 6 (or the user of the mail display device 6), and a list of the mails. To send. Further, in preparation for this transfer, a storage device for storing the mail received from the mail storage processing unit 14 is provided.

The in-house network 4 has a plurality of mail display devices 6. In addition, a terminal (not shown) that executes a web browser may exist in the in-house network 4. The mail display device and the web browser terminal specify a URL and request a resource from the web proxy server 3. The URL is a character string for identifying the resource on the network 5 outside the organization. The web proxy server 3 has a function of acquiring a resource such as a web page from the URL specified in the request. Further, it has a function of transferring the acquired resource to the mail display device 6 or the web browser which is the request source.

The web proxy server 3 will be further described with reference to FIG. The web proxy server 3 restricts access to the resource specified by the URL described in the threat URL list 7A. Targets of access restriction by the web proxy server 3 are various clients of the in-house network 4 represented by the mail display device 6. The threat detection device 8 is not subject to the access restriction by the web proxy server 3. The web proxy server 3 includes a request receiving unit 31, a request analyzing unit 32, and a request issuing unit 33.

The request receiving unit 31 receives a request from the mail display device 6 or the web browser, and passes the data necessary for the migration process to the request analysis unit 32. The request from the mail display device 6 or the web browser is a request issued according to a protocol such as so-called HTTP (Hypertext Transport Protocol) or HTTPS (Hypertext Transport Protocol Secure).

The request analysis unit 32 receives the URL from the request reception unit 31. The request analysis unit 32 determines whether the URL is included in the threat URL list 7A. When the URL is included in the threat URL list 7A, the request analysis unit 32 returns an error response to the mail display device 6 or the web browser that is the request source of the URL. On the other hand, when the URL is not included in the threat URL list 7A, the request analysis unit 32 passes necessary data including the URL to the request issuing unit 33.

The request issuing unit 33 acquires the resource indicated by the URL received from the request analyzing unit 32 via the internal network 4 and the external network 5. Further, the request issuing unit 33 transfers the acquired resource to the mail display device 6 or the web browser which is the request source.

The in-house network 4 is a data communication network that interconnects the mail delivery server 1, the mail storage server 2, the web proxy server 3, the mail display device 6, the list storage device 7, and the threat detection device 8. The internal network 4 is connected to the external network 5. Access from the intra-organization network 4 to the non-organization network 5 is controlled so that it can be accessed only from a specific server or request source.

The external network 5 is a data communication network outside the internal network 4, and is, for example, the Internet.

The mail display device 6 is a mail client that can display a web page. Here, the mail display device 6 operates especially as a terminal which is a destination of the mail. Normally, a plurality of mail display devices 6 are connected to the in-house network 4, but any mail display device 6 operates in the same manner in the present invention. Therefore, in FIG. 1, only one mail display device 6 is shown in the in-house network 4.

The mail display device 6 is an information processing device including a display device such as a liquid crystal display device and a CRT (Cathode Ray Tube). The type of hardware of the information processing device that operates as the mail display device 6 does not matter. For example, the mail display device 6 may be a desktop computer, laptop computer, workstation, tablet, smartphone, or the like.

The mail display device 6 may operate a dedicated mail client program on these hardware, or may operate a web browser to operate as a mail client for web mail. When operating a dedicated mail client program, the mail client program itself may have a function of displaying a web page. Alternatively, the mail client program may display a web page by calling a web browser program different from the mail client program.

The mail display device 6 has a function of acquiring information from the mail storage server 2 and displaying a mail list or mail contents. Further, the mail display device 6 has a function of issuing a request to the web proxy server 3 and displaying the content thereof according to the operation of the operator for the displayed mail. For example, when the URL is described in the displayed mail and the operator clicks the URL with a pointing device such as a mouse, the mail display device 6 sends the resource indicated by the URL to the web proxy server. Request.

The list storage device 7 is a storage device that stores the threat URL list 7A. The threat URL list 7A is a list of URLs included in the received email. The URL is an identifier that can uniquely identify a resource on the network. The URL included in the threat URL list 7A does not record the entire identifier, but records a part of the front part based on the operation design, and only the computer host name part, for example, matches whether or not the front part matches. It may be a method of determining whether or not. The list storage device 7 may be a storage device having a network interface for connecting to the in-house network 4, such as a so-called NAS (Network Attached Storage). Alternatively, a partial area of the storage device of the mail delivery server 1, the mail storage server 2, and the web proxy server 3 may be used as the list storage device 7.

The method for storing the threat URL list 7A in the list storage device 7 is not particularly limited. For example, it may be stored as a simple text file, or may be stored using a database server such as RDBMS (Relational Database Management System).

The threat URL list 7A is a list of URLs that may be attacked by accessing and is sometimes called a black list. In the present embodiment, the threat detection device 8 generates and updates the threat URL list 7A. Further, the web proxy server 3 refers to the threat URL list 7A.

The threat detection device 8 is a device that determines whether the input URL is a threat and updates the threat URL list 7A according to the determination result. The threat detection device 8 includes a pre-detection threat list update processing unit 81, a threat detection unit 82, and a post-detection threat list update processing unit 83.

The pre-detection threat list update processing unit 81 adds the URL notified from the email URL notification unit 13 to the threat URL list 7A of the list storage device 7. It is preferable that the URL is added to the threat URL list 7A before the threat detection unit 82 determines the URL, and at the latest, before the determination is completed. Further, the pre-detection threat list update processing unit 81 passes the notified URL to the threat detection unit 82.

The threat detection unit 82 performs a process (threat detection) of determining whether the resource specified by the URL received from the pre-detection threat list update processing unit 81 actually has a threat. There are various threat detection processing methods, and any method may be used. In particular, a method with high detection accuracy even if the required time is long is suitable. When no threat is detected in the URL as a result of threat detection, the threat detection unit 82 notifies the post-detection threat list update processing unit 83 of that fact.

A behavior detection method is suitable as a threat detection method of the threat detection unit 82. The behavior detection method is also called a behavior method, a dynamic heuristic method, or the like. In the behavior detection method, a virtual execution environment is prepared and the URL to be judged is accessed to check if any abnormal behavior is caused. In this case, the threat detection unit 82 is configured to include a device that virtualizes the mail display device 6. By accessing the URL to be determined by this virtualization device and observing the behavior of the virtualization device thereafter, it is determined whether or not to take an abnormal action.

The post-detection threat list update processing unit 83 updates the threat URL list 7A in the list storage device 7 according to the result of threat detection by the threat detection unit 82. When the threat detection unit 82 determines that the URL has no threat as a result of threat detection, the post-detection threat list update processing unit 83 accesses the list storage device 7 and deletes the URL from the threat URL list 7A.

Next, the operation of the access restriction system 100 will be described with reference to FIG. 3 centering on the mail delivery server 1 and the threat detection device 8 shown in FIG.

The mail M arrives at the internal network 4 from the external network 5. Here, the URL is described in the mail M, and its value is URL_X. Further, the destination of the mail M is the operator of the mail display device 6.

The mail reception processing unit 11 of the mail delivery device 1 receives the mail M and temporarily stores the data of the mail M inside the mail delivery device 1 (step S1). Next, the mail URL extraction unit 12 extracts URL_X from the mail M (step S2). Next, the email URL notification unit 13 passes URL_X to the pre-detection threat list update processing unit 81 and the email storage processing unit 14 of the threat detection device 8 (step S3).

The pre-detection threat list update processing unit 81 of the threat detection device 8 adds URL_X to the threat URL list 7A (step S4). After that, the web proxy server 3 prohibits access to the URL_X by the mail display device 6, the browser terminal, and the like in the in-house network 4, based on the threat list URL list 7A to which the URL_X is added. That is, the web proxy server 3 starts the access restriction to the URL_X. FIG. 4 shows the threat URL list 7A1 as an example of the threat URL list 7A. The threat URL list 7A1 is a table having columns for storing item numbers, URLs, and registration dates in order from the left.

Further, the pre-detection threat list update processing unit 81 notifies the threat detection unit 82 of URL_X. Upon receiving the notification, the threat detection unit 82 starts the threat detection process for the URL_X (step S5). In other words, almost at the same time that the web proxy server 3 starts the access restriction to the URL_X, the threat detecting unit 82 starts the threat detecting process for the URL_X.

Although access control to URL_X is being executed at this point, it is undecided whether URL_X is actually a threat. In the present invention, the access restriction to the URL is started without waiting for the threat detection result of the URL extracted from the mail, and the access restriction is released after the result of no threat is obtained.

When the threat detection unit 82 completes the URL_X threat detection process and obtains a determination result that there is no threat, the threat detection unit 82 notifies the post-detection threat list update processing unit 83 (step S6). Upon receiving this notification, the post-detection threat list update processing unit 83 accesses the list storage device 7 and deletes URL_X from the threat URL list 7A. On the other hand, if the result of the threat detection processing indicates that there is a threat, nothing is done.

Returning to step S3, the mail storage processing unit 14 notified of the URL_X from the mail URL notification unit 13 transfers the mail M temporarily stored in step S1 to the mail storage server 2 (step S7).

Next, operations of the mail display device 6 and the web proxy server 3 after the mail storage server 2 stores the mail M will be described. In FIG. 5, steps S11, S12, and S16 are operations of the mail display device 6. Further, steps S13, S14, S15, and S17 are operations of the web proxy server 3.

The operator of the mail display device 6 receives and displays the mail M from the mail storage server 2 at an arbitrary timing (step S11). At this time, the mail display device 6 requests the mail storage server 2 to transfer the mail M addressed to the mail display device 6 or the operator of the mail display device 6, and the mail storage server 2 receives the mail storage server 2. 2 transfers the mail M to the mail display device 6 in response to this request.

The operator clicks the URL_X described in the mail M with a pointing device such as a mouse, and tries to acquire the resource on the network 5 outside the organization indicated by the URL_X, that is, the external information. At this time, the mail display device 6 transmits an access request to the URL_X to the request receiving unit 31 (step S12).

The request receiving unit 31 extracts URL_X from the access request, and passes the extracted URL_X to the request analysis unit 32 of the web proxy server 3. The request analysis unit 32 determines whether the URL_X is included in the threat URL list 7A (steps S13 and S14).

First, the case where URL_X is not registered in the threat URL list 7A will be described. This is a case in which URL_X is once registered in the threat URL list 7A in step S4 described above, but thereafter it is determined that there is no threat in threat detection in step S5, and URL_X is deleted from the threat URL list 7A in step S6. is there.

In this case, the request analysis unit 32 passes the data necessary for accessing the URL_X to the request issuing unit 33. The request issuing unit 33 acquires the resource indicated by URL_X via the internal network 4 and the external network 5 (step S15). The request issuing unit 33 transfers the acquired external information to the mail display device 6 that is the request source of the access request. The mail display device 6 displays the transferred external information (step S16).

Next, a case where URL_X is registered in the threat URL list 7A will be described. In this case, after the URL_X is registered in the threat URL list 7A in step S4 described above, it is determined that there is a threat in the threat detection in step S5, and it is not deleted from the threat URL list 7A in step S6. Is. Alternatively, it is a case where the threat detection in step S5 is not yet completed.

In this case, the request analysis unit 32 returns an acquisition error in response to the access request from the mail display device 6 (step S17). In this case, the mail display device 6 displays an acquisition error to the operator and does not display the external information indicated by URL_X.

In the present embodiment, the access restriction in the mail display device 6 in which the addressee of the mail M is the operator has been described. All the web browser terminals in the in-house network 4 access the web pages in the in-house network 5 via the web proxy server 3. Therefore, the operation after step S12 is the same even in a web browser terminal or the like other than the mail display device 6.

As described above, in the present embodiment, after the URL is extracted from the mail using the mail URL extracting unit 12 (step S2), the determination of the URL is started using the threat detection device 8 (step S5). Then, before or after, the mail is stored in the mail storage server 2 (step S7). In other words, when the mail including the URL arrives at the in-house network 4, the web proxy server 3 starts the access restriction to the URL regardless of whether the URL is actually a threat. On the other hand, by forwarding the mail to the mail storage server 2, the delivery process of the mail is advanced. Further, the threat detection device 8 starts the threat detection of the URL in parallel. After the threat detection is completed and it is confirmed that there is no threat, the access restriction to the URL is released.

Therefore, according to the present embodiment, while avoiding the delay of mail delivery due to the execution of threat detection, access to URLs that may be threatened is proactively restricted, and URLs for which safety has been confirmed are Since access is permitted, both convenience and safety can be achieved.

(Second embodiment)
FIG. 6 shows an access restriction system 200 according to the second embodiment of the present invention. The access restriction system 200 is obtained by adding another threat detecting device 9 to the access restriction system 100 shown in FIG. In this regard, the parts of FIG. 6 corresponding to FIG. 2 are given the same reference numerals as in FIG. That is, the access restriction system 200 includes the mail delivery server 1, the mail storage server 2, the web proxy server 3, the in-organization network 4, the non-organization network 5, the mail display device 6, the list storage device 7, and the two threat detection devices 8. , 9 are provided. Here, the threat detection devices 8 and 9 are also referred to as the first and second threat detection devices in order.

The second threat detection device 9 is a computer including one or a plurality of CPUs and a network interface device such as a LAN card, like the first threat detection device 8. As shown in FIG. 6, the threat detection devices 8 and 9 are connected to the mail delivery server 1 and the list storage device 7 in parallel with each other. Similar to the first threat detection device 8, the second threat detection device 9 is a device that determines whether or not the input URL is a threat and updates the threat URL list 7A according to the determination result. .. Although not shown in FIG. 6, the second threat detection apparatus 9 is also the same as the first threat detection apparatus 8 in the pre-detection threat list update processing unit 91, the threat detection unit 92, and the post-detection threat list update processing. The unit 93 is provided. The operation of each functional block is similar to that of the corresponding functional block of the threat detection device 8. However, the threat detection method of the threat detection unit 92 is different from that of the threat detection unit 82 of the threat detection device 8. Any threat detection method may be used, but it is preferable that the detection principle, accuracy, and required time are different.

Further, in the access restriction system 200, the structure of the table stored in the list storage device 7 is different. In this system, the list storage device 7 stores a table having a structure such as the threat URL list 7A2 shown in FIG. The threat URL list 7A2 differs from the threat URL list 7A1 in that it stores the number of times judged to be safe in addition to the item number, URL, registration date and time.

Further, in the access restriction system 100 of FIG. 2, when the threat detecting unit 82 determines that a URL has no threat, the post-detection threat list update processing unit 82 deletes the URL from the threat URL list 7A.

On the other hand, in the present system, in each of the first and second threat detection devices 8 and 9, it is independently determined whether a certain URL has a threat. The number of times the first and second threat detection devices 8 and 9 determine that there is no threat is recorded in the threat URL list. When the number of recorded times reaches 2, it is determined that the URL has no threat, and the URL is deleted from the threat URL list.

The operation of the access restriction system 200 will be described with reference to FIG. Steps S21 and S22 are the same as steps S1 and S2 described above, respectively.

In step S3, the mail URL notification unit 13 notifies the pre-detection threat list update processing unit 81 of the URL. On the other hand, in step S23, the email URL notification unit 13 notifies the pre-detection threat list update processing unit 81 and the pre-detection threat list update processing unit 91 of the URL.

The first threat detection device 8 operates as follows. When the URL is registered in the threat URL list 7A2, the pre-detection threat list update processing unit 81 stores zero in the "number of times determined to be safe" column on the same line as the URL (step S24A). Next, the threat detection unit 82 determines whether or not there is a threat with respect to the URL (step S25A). Next, the post-detection threat list update processing unit 83 updates the threat URL list 7A2 in accordance with the determination result of the threat detection unit 82 and the “number of times the URL has been determined to be safe” (step S26A). If the determination result is threat, the post-detection threat list update processing unit 83 does nothing. If the determination result is that there is no threat, the post-detection threat list update processing unit 83 adds 1 to the value in the “number of times determined to be safe” column of the URL. Then, when the value after addition is 2, the line of the URL is deleted from the threat URL list 7A2.

Steps S24B, S25B, and S26B that are operations of the second threat detection apparatus 9 are the same as the operations of steps S24A, S25A, and S26A of the first threat detection apparatus 8 described above, which are the pre-detection threat list update processing unit 81 and threat detection The unit 82 and the post-detection threat list update processing unit 83 are replaced with the pre-detection threat list update processing unit 91, the threat detection unit 92, and the post-detection threat list update processing unit 93, respectively. However, as described above, the threat detection unit 82 and the threat detection unit 92 have different threat detection methods.

According to the present embodiment, in addition to the effects of the first embodiment described above, access restriction is released only for URLs that are confirmed to have no threat by a plurality of threat detection methods, so that safety is further enhanced. You can

(Transformation)
The present invention is not limited to the above-described first and second embodiments, and various modifications are possible.

For example, the access restriction systems 100 and 200 are configured by combining a plurality of node devices in the in-house network 4. However, the present invention is not limited to this. For convenience of explanation, the mail delivery server 1, the mail storage server 2, the web proxy server 3, the mail display device 6, the list storage device 7, and the threat detection devices 8 and 9 have been described as separate devices. Those skilled in the art will understand that it is possible to construct a single device by appropriately combining these.

Further, the access restriction system 200 has been described as including the two threat detecting devices 8 and 9, but may include three or more threat detecting devices. It is preferable that the three or more threat detection devices detect threats according to different threat detection methods, but at least two types of threat detection methods are included, in other words, threat detection methods different from each other may be included. ..

Further, in the above-described embodiment, as a method of restricting access, access to the URL determined to have a threat is prohibited. Instead of prohibiting access, or in addition to prohibiting access, the web proxy server 3 may display a warning message on the mail display device 6 in response to an access request to a URL determined to have a threat.

Further, in the above-described embodiment, the behavior detection method has been described as an example of the threat detection method used when the threats are detected by the threat detection units 82 and 92, but the present invention is not limited to this. .. A threat detection method that has high detection accuracy but takes a long processing time because it includes complicated arithmetic processing is suitable as a threat detection method performed by the threat detection units 82 and 92 regardless of the method. Further, the threat detecting units 82 and 92 may detect threats by interlocking with a system or a device external to the communication system of the present invention. In this case, processing time is generated by an external system or device, but according to the present invention, mail delivery delay due to this type of processing time does not occur.

Further, although the threat detection devices 8 and 9 are provided in the internal network 4 in the above-described embodiment, they may be provided in the external network 5. In particular, in the second embodiment, both threat detection devices 8 and 9 are provided in the in-organization network 4, but one may be provided in the in-organization network 4 and the other may be provided in the extra-organization network 5. Good. For example, it is conceivable to provide the first threat detection device 8 in the in-house network 4 of the company and use the threat detection service provided by another company on the Internet as the second threat detection device 9.

Further, in the second embodiment, two threat detection devices are provided, but three or more threat detection devices may be provided. In this case, only the URLs that all threat detection devices determine to have no threat may be deleted from the threat URL list. Alternatively, while at least one of the plurality of threat detection devices determines that the URL has a threat, the URL is listed in the threat URL list, and the web proxy server 3 restricts access to the URL. Good. Alternatively, for example, when two of the three threat detecting devices determine that the URL is not threatened, the URL may be deleted from the threat URL list and the access restriction to the URL by the web proxy server 3 may be released. Good.

Further, although the above embodiment has been described as limiting the access to the URL included in the mail, it will be apparent to those skilled in the art that the present invention can be applied to so-called instant messages instead of mail. .. Therefore, in the present application, texts, images, moving images, etc., such as mails, instant messages, etc., which are transmitted to the designated destination via the data communication network are collectively referred to as a message.

Further, although the resource specified by the URL has been described in the above embodiment, the present invention is not limited to this, and may be an identifier that can specify a resource on the network, such as an IP address. If so, the present invention can be similarly applied.

The whole or part of the exemplary embodiments disclosed above can be described as, but not limited to, the following supplementary notes.

(Appendix 1)
Pre-detection threat list update processing means for temporarily adding a resource on the network identified by the identifier included in the received message to the target of access restriction,
Mail storage processing means for storing the message in a mail storage server so that the user can receive the message;
Threat detection means for determining whether the resource has a threat,
If the judgment result is no threat, access restriction means for canceling access restriction,
A communication system including.

(Appendix 2)
When there is an access request based on the identifier while the access restriction unit is restricting access to the resource specified by the identifier, the access restriction unit warns the request source of the access request. The communication system according to Appendix 1, which transmits a message.

(Appendix 3)
The communication system according to appendix 1 or 2, wherein the access restriction unit continues access restriction when the determination result indicates threat.

(Appendix 4)
The pre-detection threat list update processing means temporarily adds the resource on the network identified by the identifier included in the received message to the target of access restriction,
The mail storage processing means stores the message in the mail storage server so that the user can receive it,
The threat detecting means determines whether or not the resource has a threat ,
Access restriction means is, if the result of the determination is no threat, you release the access restriction,
Communication method.

(Appendix 5)
If there is an access request based on the identifier while the access restriction unit is restricting access to the resource specified by the identifier, the access restriction unit warns the request source of the access request. The communication method according to attachment 4, which transmits a message.

(Appendix 6)
The communication method according to appendix 4 or appendix 5, wherein the access restriction unit continues access restriction when the determination result indicates threat.

(Appendix 7)
Pre-detection threat list update processing means for temporarily adding a resource on the network identified by the identifier included in the received message to the target of access restriction,
Mail storage processing means for storing the message in a mail storage server so that the user can receive the message;
Threat detection means for determining whether the resource has a threat,
A program that causes a computer to function as an access restriction unit that releases access restrictions when the result of the determination is no threat.

(Appendix 8)
When there is an access request based on the identifier while the access restriction unit is restricting access to the resource specified by the identifier, the access restriction unit warns the request source of the access request. The program according to appendix 7, which sends a message.

(Appendix 9)
The program according to appendix 7 or 8, wherein the access restriction unit continues the access restriction when the determination result indicates threat.

(Appendix 10)
Pre-detection threat list update processing means for temporarily adding resources on the network, which are identified by the identifier included in the received message, to the access control target,
A mail storage processing means for storing a message in the mail storage server so that the user can receive it;
A threat detection unit for performing a threat detection determination, which determines whether the resource has a threat,
When there is a request for access to the resource specified by the identifier, if the threat detection determination for the identifier is in progress, or if the threat detection determination for the identifier is completed and the determination result is a threat If it is determined that there is, output means for transmitting a warning message to the request source of the access request,
A communication system including.

(Appendix 11 )
The pre-detection threat list update processing means temporarily adds the resource on the network identified by the identifier included in the received message to the access restriction target,
The mail storage processing means stores the message in the mail storage server so that the user can receive it,
The threat detecting means determines whether or not the resource has a threat, performs a threat detection determination ,
When the output unit has a request for access to the resource specified by the identifier, the threat detection determination for the identifier is being executed, or the threat detection determination for the identifier is completed, and If the determination result is Yes threat determination already, to the request source of the access request, that sends a warning message,
Communication method.

1 Mail Delivery Server 2 Mail Storage Server 3 Web Proxy Server 4 Internal Network 5 External Network 6 Mail Display Device 7 List Storage Device 7A, 7A1, 7A2 Threat URL List 8, 9 Threat Detection Device 11 Mail Reception Processing Unit 12 Mail URL Extraction unit 13 Mail URL notification unit 14 Mail storage processing unit 31 Request reception unit 32 Request analysis unit 33 Request issuing unit 100, 200 Access restriction system

Claims (9)

Pre-detection threat list update processing means for temporarily adding a resource on the network identified by the identifier included in the received message to the target of access restriction,
Mail storage processing means for storing the message in a mail storage server so that the user can receive the message;
Threat detection means for determining whether the resource has a threat,
If the judgment result is no threat, access restriction means for canceling access restriction,
A communication system including. When there is an access request based on the identifier while the access restriction unit is restricting access to the resource specified by the identifier, the access restriction unit warns the request source of the access request. The communication system according to claim 1, which transmits a message. The communication system according to claim 1, wherein the access restriction unit continues the access restriction when the determination result indicates threat. The pre-detection threat list update processing means temporarily adds the resource on the network identified by the identifier included in the received message to the target of access restriction,
The mail storage processing means stores the message in the mail storage server so that the user can receive it,
The threat detecting means determines whether or not the resource has a threat ,
Access restriction means is, if the result of the determination is no threat, you release the access restriction,
Communication method. If there is an access request based on the identifier while the access restriction unit is restricting access to the resource specified by the identifier, the access restriction unit warns the request source of the access request. The communication method according to claim 4, wherein the message is transmitted. The communication method according to claim 4, wherein the access restriction unit continues the access restriction when the determination result indicates a threat. Pre-detection threat list update processing means for temporarily adding a resource on the network identified by the identifier included in the received message to the target of access restriction,
A mail storage processing means for storing the message in a mail storage server so that the user can receive it;
Threat detection means for determining whether or not the resource has a threat,
A program that causes a computer to function as an access restriction unit that releases access restrictions when the result of the determination is no threat. Pre-detection threat list update processing means for temporarily adding resources on the network, which are identified by the identifier included in the received message, to the access control target,
Mail storage processing means for storing the message in a mail storage server so that the user can receive the message;
A threat detection unit for performing a threat detection determination, which determines whether the resource has a threat,
When there is a request for access to the resource specified by the identifier, the threat detection determination for the identifier is being executed, or the threat detection determination for the identifier has been completed and it has been determined that there is a threat. In the case of, output means for transmitting a warning message to the request source of the access request,
A communication system including. The pre-detection threat list update processing means temporarily adds the resource on the network identified by the identifier included in the received message to the access restriction target,
The mail storage processing means stores the message in the mail storage server so that the user can receive it,
The threat detecting means determines whether or not the resource has a threat, performs a threat detection determination ,
When the output unit makes a request for access to the resource specified by the identifier, the threat detection determination for the identifier is being executed, or the threat detection determination for the identifier is completed, and the threat If there a determination already, to the request source of the access request, that sends a warning message,
Communication method.

Images