JP6730692B2 - Information processing apparatus, information processing method, and information processing program - Google Patents

Description

Embodiments of the present invention relate to an information processing device, an information processing method, and an information processing program.

The problem is so-called "spoofing" emails, in which the sender of the email is spoofed and the email is disguised as if it were an appropriate email and sent. In particular, a malicious third party sends an e-mail with a more sophisticated disguise of the sender to a specific corporation or organization, and the user's terminal is infected with malware via the link destination information etc. described in the mail. It is necessary to take measures against targeted e-mail attacks that steal data such as personal information by infecting e.g.

Conventionally, in order to deal with a forged electronic mail, an electronic mail addressed to a user is stored in advance, and the electronic mail is a forged mail based on the mail address set in this electronic mail. A technique of using a mail server for determining whether or not it is disclosed.

JP, 2012-78922, A

By the way, as is widely used for sending e-mail newsletters of companies, e-mails are sent from a server different from the mail server of the company by entrusting the company to send e-mails to other companies. There are cases where In this case, the email address of the actual sender may be different from the email address corresponding to the company, and as in the conventional case, it is determined whether the email is forged by checking the email address of the sender. According to the method, there is a possibility that even a proper email may be mistakenly determined to be a forgery.

The present invention has been made in consideration of such circumstances, and an object of the present invention is to provide an information processing apparatus, an information processing method, and an information processing program capable of accurately filtering forged mail.

An information processing apparatus according to an exemplary embodiment of the present invention includes a mail information extraction unit that extracts mail information including sender and link information of a received electronic mail, a domain of a mail address corresponding to the sender, and the link destination. A collation data storage that stores in advance a combination of a determination unit that determines whether the e-mail is appropriate by comparing information domains, a domain of each organization's email address, and an FQDN of the organization corresponding to the domain. The determination unit includes a combination of the domain of the header From of the received email and the FQDN of the link destination URL that is the actual access destination, which is extracted from the link destination information. It is characterized in that the electronic mail is collated with a storage unit to judge whether the electronic mail is appropriate or not.

According to the embodiments of the present invention, an information processing device, an information processing method, and an information processing program capable of filtering forged mail with high accuracy are provided.

The block diagram which shows an example of a structure of the electronic mail system to which the information processing apparatus which concerns on 1st Embodiment is applied. Explanatory drawing explaining the method of the camouflage determination of this embodiment, when the display URL displayed in the email body differs from the link destination URL which is the actual access destination. Explanatory drawing explaining the method of the forgery determination of this embodiment, when making it access to the link destination URL used as an actual access destination via the keyword displayed on the email body. Explanatory drawing explaining the method of the camouflage determination of this embodiment, when making it access to the link destination URL used as an actual access destination via the image incorporated in the email. Explanatory drawing explaining the method of the camouflage determination of this embodiment, when making it access to the link destination URL described including the prohibition extension. 6 is a flowchart showing an example of a processing procedure of the information processing method according to the present embodiment. The block diagram which shows an example of a structure of the electronic mail system to which the information processing apparatus which concerns on 2nd Embodiment is applied. (A) A table showing an example of the correspondence relationship between the sender's email address domain and the organization's FQDN, and (B) The correspondence relationship between the sender's email address domain and the organization's shortened URL. A table showing an example.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.
FIG. 1 is a configuration diagram showing an example of the configuration of an electronic mail system to which the information processing apparatus 10 according to the first embodiment is applied.

The information processing device 10 is a server that receives an electronic mail from an external terminal (not shown) via the external mail server and sends the received electronic mail to the internal terminal 20. The information processing device 10 may be provided in, for example, an internal network 11 that is restricted from being connected to the Internet, and is provided at a boundary (DMZ: DeMilitarized Zone) between the internal network 11 and an external network that can be arbitrarily connected to the Internet. May be.

The internal terminal 20 is a client terminal that receives an electronic mail from the information processing device 10. Although an example in which the number of internal terminals 20 is three is shown here, the number and arrangement of internal terminals 20 are not limited to those shown in FIG.

The communication unit 12 is a relay device that transfers the electronic mail transmitted from the external terminal to the information processing device 10. The communication unit 12 may be provided at the boundary connecting the internal network 11 and the external network, or may be provided in the external network. An example of the communication unit 12 is an MTA (Message Transfer Agent).

The external name resolution device 13 is a server that holds determination information for identifying whether or not the sender of an electronic mail is appropriate, and is, for example, a DNS (Domain Name System) server. An example of the determination information is a combination of the source domain and the IP address. When receiving the e-mail, the information processing device 10 inquires of the external name resolution device 13 via the communication unit 12 whether the sender of the received e-mail matches the discrimination information of the external name resolution device 13. Whether or not the sender of the electronic mail is appropriate may be determined by collating the above.

The information processing device 10 according to the first embodiment includes a transmission/reception unit 14, a mail information extraction unit 15, a determination unit 16, and a storage unit 17.

The function of each unit forming the information processing apparatus 10 may be realized by executing a predetermined program code using a processor, and is not limited to such software processing, and for example, an ASIC or the like is used. The hardware processing may be realized, or the software processing and the hardware processing may be combined.

The transmission/reception unit 14 executes reception control of the electronic mail transferred and received from the communication unit 12 and transmission control of the electronic mail transmitted from the internal terminal 20.

The mail information extraction unit 15 extracts mail information including the sender and link destination information of the received electronic mail. The extracted sender information includes the sender address (envelope From) described in the mail envelope, the sender address (header From) described in the mail header, and the sender IP address described in the header. Is included. In addition, the link destination information includes all information about the link destination acquired from the mail body, the attached file attached to the electronic mail, the attached file macro, and the like. Note that the link destination information in the attached file is, for example, the URL described in the file, or a script (for example, a macro) that guides access to an external URL when the file is activated, when the file is linked. Means a URL or the like.

The determination unit 16 determines whether the email is appropriate by comparing the domain of the transmission source of the received email with the domain of the link destination information.

Specifically, the determination unit 16 compares the domain of the header From extracted from the electronic mail with the domain of the link destination URL that is the actual access destination of the user in the link destination information. If both domains match, the link destination URL included in the received electronic mail is harmless and is determined to be an appropriate mail. On the other hand, if they do not match, the link destination URL included in the received e-mail is harmful and is determined as a forged mail. A specific determination method will be described later. Here, the harmful URL means a URL that, when accessed by the user, guides the internal terminal 20 to download a malicious file or connect to a website.

In addition, when the determination unit 16 compares the domain of the header From and the domain of the access destination URL, when the domain of the header From matches the parent domain (root domain) excluding the sub domain in the access destination URL. In addition, the link destination URL included in the received electronic mail is harmless and may be determined to be an appropriate mail.

Further, the determination unit 16 stores in advance a domain of a private email address (hereinafter, abbreviated as private domain) such as a free email domain or a domain under the jurisdiction of a provider, and the determination unit 16 If the domain of the header From of the received e-mail matches the pre-stored private domain, the linked URL included in the received e-mail is considered to be harmful and it is determined as a forged e-mail. May be.

Further, the determination unit 16 compares the domains of the envelope From and the header From corresponding to the sender of the extracted email, and when both domains do not match, determines the domain of the header From and the domain of the link destination URL. It may be configured to make a comparison and determination. If the domain of the envelope From and the domain of the header From corresponding to the sender match, the link destination URL included in the email is harmless, it is determined as an appropriate email, and the domain of the header From and the domain of the link destination URL are determined. The comparison judgment with may not be executed.

Further, the determination unit 16 inquires of the external name resolution device 13 to check whether the transmission source of the received email matches the determination information of the external name resolution device 13, and the transmission source of the email is The configuration may be such that, after being determined to be appropriate, the domain of the header From and the domain of the link destination URL are compared and determined. Alternatively, in the storage unit 17, an appropriate combination of the source domain and the IP address is stored in advance, and the domain and the source IP address of the envelope From of the received e-mail are compared with the stored combination data. , And the domain of the header From and the domain of the link destination URL may be compared and determined.

If the determination unit 16 determines that the link destination URL included in the electronic mail is harmless and is appropriate, the internal terminal 20 (the terminal corresponding to the destination set in the electronic mail) is transmitted via the transmission/reception unit 14. ) Is transferred to. On the other hand, the link URL included in the electronic mail may be harmful and may be quarantined without being sent to the internal terminal 20, and may be stored in the storage unit 17, for example, if the email is determined to be a forged email.

The same forgery determination processing as described above is executed for the link destination URL associated with the attachment file attached to the e-mail. In addition, in the camouflage judgment process, if the attachment file attached to the e-mail is stored in a hierarchically structured folder, the e-mail is judged as the camouflaged mail suspected of being camouflaged. You may.

Next, a specific example of a processing method for determining whether or not the e-mail is appropriate based on the domain of the header From extracted from the e-mail and the domain of the link destination URL that is the actual access destination of the user I will give you an explanation. Note that the electronic mails shown in FIGS. 2 to 5 will be examined when the link destination URL included in the electronic mail is harmless.

FIG. 2 illustrates a method of determining impersonation according to the present embodiment when a link anchor is set in an email and the display URL displayed in the email body differs from the link destination URL that is the actual access destination by the user. FIG.

Here, the link anchor is the URL that is the link destination in the body of the email in the html email, and when the user clicks it, the URL associated with this URL (the link destination URL that is the actual access destination) Means connecting a user's terminal to.

In the example of FIG. 2, the domain of the envelope From of the e-mail does not match the domain of the header From, and the URL "http://abc.com" is displayed in the body of the e-mail, and the URL is associated with this URL. The URL actually linked to is "http://abc.com/xx".

Even if the link destination URL included in the email is harmful and is appropriate, for example, in order to simplify the display of the email text, the URL displayed in the email text is different from the URL that is the actual access destination. There are cases. In addition, since the e-mail newsletter sent by a company may use the delivery e-mail service of another company, the domain of the envelope From which indicates the actual sender of the e-mail becomes the domain of the delivery service, and the header From of the domain. It may be a corporate domain.

In the normal disguise determination method, if the URL displayed in the email body differs from the URL that is the actual access destination, the link destination URL included in the email is determined to be a malicious disguise email. As shown in the figure, there is a risk of false detection even for an appropriate email that has no suspicion of forgery.

If the linked URL included in the e-mail is a proper e-mail, for example, if the sender of the e-mail wants to direct the e-mail to the company's URL, the e-mail header From will contain the e-mail address using the company's domain. Also, since the URL domain of the company is described in the URL in the body of the e-mail, the domain of the e-mail address matches the domain of the link destination URL actually accessed by the user.

In the present embodiment, by utilizing this property, when the domain of the header From extracted from the e-mail and the domain of the link destination URL that is the actual access destination of the user match, the link destination included in the email. The URL is considered harmless and is an appropriate email. In the example of FIG. 2, the domain of the header From and the domain of the link destination URL are the same in “abc.com”. On the other hand, if the domains do not match, the link destination URL included in the e-mail is determined to be harmful spoofed e-mail. By doing so, it is possible to reduce false detection in the determination of the forged email.

FIG. 3 is a diagram for explaining the method of determining forgery according to the present embodiment when a link keyword is set in an electronic mail and the linked URL is accessed via the keyword displayed in the body of the electronic mail.

Here, the link keyword is displayed in the body of the email in the html email, and when the user clicks the keyword, the link keyword is connected to the URL associated with the keyword (link destination URL that is the actual access destination). Means the way.

In the example of FIG. 3, the domain of the envelope From of the e-mail does not match the domain of the header From, and the link keyword is displayed in the body of the e-mail.

In the normal disguise determination method, a prohibited word is set in advance, and when the prohibited word is set as a link keyword in the email body, it is determined that the link destination URL included in the email is a malicious forged email. .. However, even if the link destination URL is a harmless proper email, the link destination URL may be accessed via a link keyword, and as shown in FIG. It may be detected.

In the present embodiment, not only the camouflage determination is made based on the presence or absence of the link keyword, but also the domain of the header From extracted from the e-mail and the domain of the link destination URL that is the actual access destination of the user match or not. It is determined whether the linked URL included in the electronic mail is harmful or not. By doing so, it is possible to reduce false detection in the determination of the forged email.

FIG. 4 is a diagram for explaining the method of determining forgery according to the present embodiment when an image link is set in an electronic mail and the linked URL is accessed via an image incorporated in the mail.

Here, the image link is associated with the image when the image is displayed in the mail body of the html mail and the user clicks on the portion where the image is set (the link destination that is the actual access destination). URL).

In the example of FIG. 4, the domain of the envelope From of the electronic mail and the domain of the header From do not match, and an image link is set in the mail body.

Since it is difficult to filter camouflaged emails, there is a tendency to visually disguise characters by visualizing them, so in the usual camouflage check, if the image link is set and described, the link destination URL included in the email will be Judge as a fake email that is harmful. However, even if the link destination URL included in the e-mail is an appropriate harmless mail, the link destination URL may be accessed via the image link, and there is a risk of false detection.

In the present embodiment, not only the camouflage determination is made based on the presence or absence of the image link, but also the domain of the header From extracted from the e-mail and the domain of the link destination URL that is the actual access destination of the user match. It is determined whether the linked URL included in the electronic mail is harmful or not. As a result, it is possible to reduce erroneous detection in determining a forged email.

FIG. 5 is a diagram for explaining a method of determining forgery according to the present embodiment when accessing a link destination URL that includes a prohibited extension. Here, the prohibited extension is the extension of the link file described in the e-mail, which may cause malware to be downloaded or executed when the user accesses it. Means "dangerous" extension. Examples of prohibited extensions are exe and zip, which are set in advance by the administrator of the information processing device 10.

In a normal impersonation determination method, a prohibited extension for prohibiting access is set in advance, and when the prohibited extension is set in the link destination URL, the link destination URL included in the email is harmful. Judge as forged email. However, even a proper email that is not disguised may access the link destination URL that includes the prohibited extension, which may result in erroneous detection.

In the present embodiment, not only the camouflage determination is made based on the presence or absence of the link destination URL including the prohibited extension, but also the domain of the header From extracted from the email and the domain of the link destination URL that is the actual access destination by the user. It is determined whether or not the link destination URL included in the electronic mail is harmful based on whether or not and are matched. As a result, it is possible to reduce erroneous detection in determining a forged email.

FIG. 6 is a flowchart showing an example of the processing procedure of the information processing method according to the present embodiment (see FIG. 1 as appropriate).

The mail information extraction unit 15 extracts mail information including the sender and link destination information of the received electronic mail (S10).

When the domain of the link destination URL that is the access destination of the actual user matches the domain of the header From, the determination unit 16 determines that the link destination URL included in the email is an appropriate mail that is harmless, and the S13 (S11: YES). On the other hand, if the domain of the link destination URL does not match the domain of the header From, the link destination URL included in the electronic mail is quarantined as a malicious forged email (S11: NO, S12). Note that the determination unit 16 may notify the internal terminal 20 (the terminal corresponding to the destination set in the e-mail) that the content has been quarantined if it is quarantined as a forged email.

Furthermore, when the domain of the link destination URL matches the domain of the header From, the determination unit 16 determines whether the domain of the header From matches the private domain (S13). If the domain of the header From matches the private domain, the sender is quarantined as a forged forged email (S13: YES, S12).

On the other hand, if the domain of the header From does not match the private domain, it is determined that the sender is a proper email that has not been forged, and the email is transferred to the internal terminal 20 (S13: NO, S14). ..

As described above, in the first embodiment, it is possible to determine whether the link destination URL included in the email is harmful by comparing the domain of the transmission source of the received email with the domain of the link destination information. In addition, it is possible to reduce false detection in the determination of the forged mail, and to filter the forged mail with high accuracy.

If the sender of the e-mail is not necessarily a corporation and a private domain is used, even if the domain of the header From and the domain of the link destination URL match, it may not be concluded that the URL is safe. is there. For this reason, when the domain of the header From matches the private domain, the link destination URL of the e-mail is determined to be a forged mail because it may be harmful. This makes it possible to more accurately determine whether or not the email is forged.

(Second embodiment)
FIG. 7 is a diagram showing an example of the configuration of an electronic mail system to which the information processing device 10 according to the second embodiment is applied. Note that, in FIG. 7, parts having the same configurations or functions as those of the first embodiment (FIG. 1) are denoted by the same reference numerals, and overlapping description will be omitted.

In the information processing apparatus 10 according to the second embodiment, collation data that stores in advance a combination of the domain of the mail address of each organization (corporation, organization, etc.) and the FQDN (Fully Qulified Domain Name) of the organization corresponding to the domain. The storage unit 18 is further provided. Note that FQDN means a description format specified without omitting all host names such as DNS and domain names.

The determination unit 16 compares the combination of the domain of the header From of the received e-mail and the FQDN of the link destination URL that is the actual access destination with the data of the collation data storage unit 18 to determine whether the e-mail is forged. judge. Specifically, if the combination of the domain of the header From of the received e-mail and the FQDN of the link destination URL that is the actual access destination matches the combination stored in the collation data storage unit 18, the The link URL included in the email is determined to be a proper email that is harmless.

FIG. 8A is a table showing an example of the correspondence relationship between the domain of an email address whose validity is confirmed as the email address of the organization and the FQDN of the organization corresponding to this domain. As shown in FIG. 8A, the domain of the mail address is registered in advance in association with each FQDN of the organization. For example, for ABC company, the domain of the mail address is associated with the FQDN of this ABC company. It has been saved.

The FQDN of a company URL is increasingly using a parent domain different from the domain of the mail address corresponding to the company. The combination of the domain of each organization's email address and the FQDN of the organization corresponding to the domain is registered in the collation data storage unit 18, and the forgery determination is performed based on this registration data, so that an appropriate email can be easily and accurately generated. Therefore, it is possible to reduce erroneous detection in the determination of forged email.

Furthermore, the collation data storage unit 18 may store in advance the combination of the domain of the mail address of each organization and the shortened URL of the organization corresponding to the domain. The shortened URL is a shortened URL of a long character string and is used to connect to the original long URL by using redirect. Redirection means to go through another server without directly connecting to the server where the content is stored.

In this case, the determination unit 16 compares the combination of the domain of the header From of the received e-mail and the link destination URL that is the actual access destination with the data stored in the collation data storage unit 18 and includes it in the e-mail. It is determined whether or not the linked URL provided is harmful. Specifically, when the combination of the domain of the header From of the received e-mail and the link destination URL that is the actual access destination matches the combination stored in the data of the collation data storage unit 18, it is suspected of being camouflaged. It is determined to be an appropriate email without

FIG. 8B is a table showing an example of a correspondence relationship between a domain of an email address whose validity is confirmed as an email address of an organization and a shortened URL held by an organization corresponding to this domain. As shown in FIG. 8B, the domain of the mail address is registered in advance in association with each shortened URL of the organization. For example, for ABC company, the domain of the mail address and the shortened URL of this ABC company are associated with each other. Have been saved.

When the forgery determination is made based on whether the shortened URL is written in the shortened URL or in the email, false detection may increase in the email forgery determination, but the combination of the sender domain and the shortened URL is saved in advance. In addition, by determining the forgery based on the combination of the sender domain and the shortened URL, it is possible to easily determine an appropriate email and reduce false detection in the forgery email determination.

By combining the camouflage determination in the second embodiment and the camouflage determination shown in the first embodiment, false detection in the camouflaged mail determination can be reduced, and the camouflaged mail can be filtered more accurately.

According to the information processing apparatus of each embodiment described above, is the e-mail disguised based on the domain of the header From extracted from the e-mail and the domain of the link destination URL that is the actual access destination of the user? By determining whether or not it is possible to reduce erroneous detection in the determination of the forged email, and it is possible to accurately filter the forged email.

The program executed by the information processing device 10 is provided by being pre-installed in a hard disk composed of a ROM or the like. Alternatively, the program is provided as an installable or executable file stored in a computer-readable storage medium such as a CD-ROM, a CD-R, a memory card, a DVD, and a flexible disk. May be. The program executed by the information processing device 10 may be stored in a computer connected to a network such as the Internet and may be provided by being downloaded via the network.

Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the scope of equivalents thereof.

10... Information processing device, 11... Internal network, 12... Communication unit, 13... External name resolution device, 14... Send/receive unit, 15... Mail information extraction unit, 16... Judgment unit, 17... Storage unit, 18... Collation data storage Department, 20... Internal terminal.

Claims (6)

A mail information extraction unit that extracts mail information including the sender and link destination information of the received electronic mail, and the electronic mail is obtained by comparing the domain of the mail address corresponding to the sender and the domain of the link destination information. The determination unit includes a determination unit that determines whether or not it is appropriate, a domain of the email address of each organization, and a collation data storage unit that stores in advance a combination of the FQDN of the organization corresponding to the domain . The combination of the domain of the header From of the received e-mail and the FQDN of the link destination URL, which is the actual access destination, extracted from the link destination information is collated with the collation data storage unit to make the e-mail appropriate. An information processing apparatus, characterized by determining whether or not it is . If the domain of the header From and the domain of the link destination URL that is the actual access destination that is extracted from the link destination information match, the link destination URL included in the e-mail is harmless. The information processing apparatus according to claim 1, wherein the information processing apparatus determines that the email is appropriate. The determination unit further includes a collation data storage unit that stores in advance a combination of the domain of the email address of each organization and the shortened URL of the organization corresponding to the domain, and the determination unit includes the domain of the header From of the received email. And a link destination URL that is an actual access destination and is extracted from the link destination information is collated with the collation data storage unit to determine whether or not the e-mail is appropriate. The information processing device according to claim 1. The e-mail is obtained by comparing the domain of the e-mail address corresponding to the sender and the domain of the link destination information with a mail information extraction unit that extracts mail information including the sender and link destination information of the received e-mail. a determination section for determining appropriate or not, includes a domain organization each email address, and verification data storage unit which previously stored the combination of the shortening URL of tissue corresponding to the domain, wherein the determination unit , The combination of the domain of the header From of the received e-mail and the link destination URL that is the actual access destination extracted from the link destination information is collated with the collation data storage unit to determine whether the e-mail is appropriate. An information processing apparatus, characterized by determining whether or not . The step of extracting mail information including the sender and link information of the received email, and comparing the domain of the mail address corresponding to the sender with the domain of the link information to determine whether the email is appropriate or not. And a step of pre-storing a combination of the domain of the mail address of each organization and the FQDN of the organization corresponding to the domain in the collation data storage unit, the header From of the received e-mail From Of the domain and the FQDN of the link destination URL that is the actual access destination, which is extracted from the link destination information, is collated with the collation data storage unit to determine whether the email is appropriate or not. An information processing method characterized by: A function of extracting mail information including sender and link information of the received electronic mail in a computer, comparing the domain of the mail address corresponding to the sender with the domain of the link information, and the email is appropriate. determining whether or not function, and the domain organization each email address, the ability to pre-stored in the combined verification data storage unit of the FQDN of the organization corresponding to the domain, a, the e-mail received The combination of the domain of the header From and the FQDN of the link destination URL that is the actual access destination extracted from the link destination information is collated with the collation data storage unit to determine whether the email is appropriate or not. the information processing program, wherein a.

Images