JP6984114B2 - E-mail monitoring device, terminal device, e-mail monitoring method, and e-mail monitoring program - Google Patents

Description

The present invention relates to a technique for monitoring unauthorized operation due to unauthorized e-mail.

In recent years, cyber attacks using malicious (malicious) emails have increased rapidly. Therefore, there are increasing expectations for technology to protect against cyber attacks by monitoring malicious email.

As a technique related to such a technique, Patent Document 1 discloses an e-mail device that suppresses the transmission of an unauthorized e-mail due to a computer virus. This device determines whether the e-mail scheduled to be sent is malicious e-mail due to a computer virus. This device makes the above-mentioned determination by displaying the contents of the e-mail on the display device and requesting the user to authenticate the person and confirm whether or not the e-mail is intended to be transmitted. If the device receives a response to the effect that the user is who he or she is, or receives a response to the effect that the email is intended to be sent by the user, the device determines that the email is not fraudulent. And send the e-mail.

Further, Patent Document 2 discloses an e-mail system for determining infection of a computer virus without causing a burden on a small-sized mail terminal having poor computer processing capacity. In this system, a mail server and a mail terminal are connected via a wireless communication network, and the mail terminal is configured as a small mail terminal of a mobile phone or a mobile information terminal. When an e-mail arrives at this mail server via the Internet communication network, the mail server determines whether or not the e-mail is infected with a virus. This mail server adds the determination result regarding virus infection in the header of the e-mail as all or part of the inspection information. The mail terminal detects the presence or absence of virus infection based on the inspection information, and if the e-mail is infected with a virus, the buzzer, vibration, etc. are different from when the normal e-mail is received, so that the user is infected with the virus. Notify.

Further, Patent Document 3 discloses a virus inspection system including a mail server and an inspection computer. This inspection computer executes the email attachments forwarded from the mail server. This system invades the I (Input) / O (Output) port that connects the inspection computer and the peripheral devices provided in the personal computer by detecting the presence or absence of access by executing the attached file. To inspect.

International Publication No. 2004-55681 Japanese Unexamined Patent Publication No. 2005-237023 Japanese Unexamined Patent Publication No. 2003-169096

In a general e-mail system, for example, a mail analysis device having a sandbox can be used to detect malicious e-mail. A sandbox is an isolated environment constructed as a virtual environment, for example, in order to analyze whether or not the e-mail to be investigated contains malicious information. Is a protected area (software execution environment) that does not affect the system. In the technology for detecting malicious e-mail using this sandbox, after accessing the URL (Uniform Resource Locator) contained in the e-mail in the sandbox, or attached to the e-mail. Analyze whether or not an illegal operation has occurred, such as after executing the file.

When an unauthorized e-mail is detected by the mail analysis device in this way, for example, it is possible to grasp the destination (e-mail address) of the e-mail, but the e-mail may be received or may be received in the future. It is not generally done until the terminal device is specified. If a terminal device that has received or may receive fraudulent e-mail can be identified, it is possible to efficiently monitor the occurrence of fraudulent operation by giving instructions to the terminal device to monitor the fraudulent operation. Can be done. Therefore, in the e-mail system, it is a challenge to identify the terminal device that has received or may receive malicious e-mail in the future, and to give an instruction to monitor the unauthorized operation to the specified terminal device. be. Patent Documents 1 to 3 do not refer to this subject. A main object of the present invention is to provide an e-mail monitoring device or the like that solves this problem.

The e-mail monitoring device according to one aspect of the present invention has received or received the e-mail and the e-mail based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation. A generation means for generating terminal specific information associated with a terminal device that may be received in the future, and the occurrence of the illegal operation in the terminal specific information in response to an external instruction associated with the e-mail. The terminal device provided with the monitoring means for monitoring is provided with an instruction means for instructing the terminal device to monitor the occurrence of the unauthorized operation.

From another point of view to achieve the above object, the e-mail monitoring method according to one aspect of the present invention is an analysis result showing that the e-mail contains fraudulent information that may cause fraudulent operation by the e-mail monitoring device. Based on the above, the terminal specific information that associates the e-mail with the terminal device that has received or may receive the e-mail is generated, and in the terminal specific information, the e-mail is associated with the e-mail. The terminal device is instructed to monitor the occurrence of the fraudulent operation, and the terminal device monitors the occurrence of the fraudulent operation in response to the instruction from the e-mail monitoring device.

Further, from the further viewpoint of achieving the above object, the e-mail monitoring program according to one aspect of the present invention is based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation. A generation process that generates terminal-specific information that associates the e-mail with a terminal device that has received or may receive the e-mail, and an external device associated with the e-mail in the terminal-specific information. A program for causing a computer to execute an instruction process for instructing a terminal device having a configuration for monitoring the occurrence of an illegal operation in response to an instruction from the user to monitor the occurrence of the illegal operation. be.

Further, the present invention can also be realized by a computer-readable, non-volatile recording medium in which such an e-mail monitoring program (computer program) is stored.

The invention of the present application makes it possible to efficiently and reliably monitor the occurrence of fraudulent operation due to receiving fraudulent e-mail.

It is a block diagram which shows the structure of the e-mail monitoring system 1 which concerns on 1st Embodiment of this invention. It is a figure which illustrates the structure of the terminal specific information 130 which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation of the e-mail monitoring system 1 which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the e-mail monitoring apparatus 50 which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the information processing apparatus 900 which can execute the e-mail monitoring apparatus which concerns on each embodiment of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

<First Embodiment>
FIG. 1 is a block diagram conceptually showing the configuration of the e-mail monitoring system 1 according to the first embodiment of the present invention. The e-mail monitoring system 1 is broadly divided into an e-mail monitoring device 10, a terminal device 20, a mail server device 30, and a mail analysis device 40. These devices are communicably connected. Although FIG. 1 shows one terminal device 20 for convenience of explanation, the e-mail monitoring system 1 may have a plurality of terminal devices 20. Further, although FIG. 1 shows one e-mail 31 for convenience of explanation, the e-mail monitoring system 1 processes a large number of e-mails 31. In the e-mail monitoring system 1, the e-mail monitoring device 10 instructs the terminal device 20 that has received the fraudulent e-mail 31 to monitor the fraudulent operation, and the terminal device 20 responds to the instruction to perform fraudulent operation. Monitor the occurrence of operations.

The mail server device 30 delivers the e-mail 31 to the terminal device 20 when the user having the destination e-mail address included in the e-mail 31 accesses the mail server device 30 by using the terminal device 20. At this time, the mail server device 30 and the terminal device 20 use a communication protocol for e-mail such as IMAP (Internet Message Access Protocol) or POP (Post Office Protocol). The mail server device 30 stores the access history (login history) from the terminal device 20 as the access history 32 in a storage device (not shown) such as a built-in electronic memory or magnetic disk.

The access history 32 is information in which, for example, the e-mail address of the destination included in the e-mail 31 and the identifier that can identify the terminal device 20 are associated with each other. As an identifier that can identify the terminal device 20, for example, an IP (Internet Protocol) address or the like can be used.

The mail analysis device 40 is an information processing device in which a sandbox is constructed in order to analyze whether or not fraudulent information is contained in the e-mail (sample (subject)) to be investigated. The mail analysis device 40 obtains the e-mail 31 from the mail server device 30 and analyzes whether or not the obtained e-mail 31 contains fraudulent information. More specifically, the mail analysis device 40 malfunctions after accessing the URL included in the e-mail 31, or after executing the file (attached file) attached to the e-mail 31. Analyze whether or not is occurring.

The mail analysis device 40 transmits the analysis result 41 to the e-mail monitoring device 10. The analysis result 41 includes, for example, an e-mail address of a destination included in the e-mail 31, and a sample index (indicator). However, the sample index is an index indicating fraudulent information contained in the e-mail 31, and is, for example, a URL that causes fraudulent operation by access, an identifier that can identify an attached file that causes fraudulent operation by execution, or the like. Is. As an identifier that can identify this attached file, for example, there is an MD5 (Message Digest Algorithm 5) hash value of the attached file.

The e-mail monitoring device 10 according to the present embodiment includes a generation unit 11, an instruction unit 12, and a terminal specific information storage unit 13.

The generation unit 11 generates the terminal specific information 130 based on the analysis result 41 received from the mail analysis device 40 and the access history 32 stored in the mail server device. The terminal specific information 130 is information that associates an e-mail 31 including fraudulent information with a terminal device 20 that may have received or may receive the e-mail 31 in the future.

FIG. 2 is a diagram conceptually illustrating the configuration of the terminal specific information 130 according to the present embodiment. As illustrated in FIG. 2, the terminal specific information 130 is included in the e-mail 31 and the IP address of the terminal device 20 that may have received or may receive the e-mail 31 containing the malicious information in the future. The destination e-mail address and the sample index included in the e-mail 31 are related information.

The terminal identification information 130 illustrated in FIG. 2 is, for example, an e-mail in which the terminal device 20 having an IP address of "IP address 0001" includes an invalid attached file A and the destination e-mail address is "e-mail address 000001". It indicates that 31 may have been received. In the terminal identification information 130 illustrated in FIG. 2, one IP address is associated with the e-mail address of one destination, but when a user uses a plurality of terminal devices 20, one destination is used. Multiple IP addresses may be associated with your email address.

The generation unit 11 shown in FIG. 1 stores the generated terminal specific information 130 in the terminal specific information storage unit 13. The terminal specific information storage unit 13 is a storage device such as a magnetic disk or an electronic memory.

The instruction unit 12 refers to the terminal specific information 130 stored in the terminal specific information storage unit 13, and monitors the occurrence of unauthorized operation for the terminal device 20 whose IP address is registered in the terminal specific information 130. To instruct. At this time, the instruction unit 12 notifies the terminal device 20 of the sample index associated with the terminal device 20 in the terminal identification information 130.

The terminal device 20 according to the present embodiment shown in FIG. 1 is an information processing device such as a personal computer. The terminal device 20 uses a communication protocol such as IMAP or POP to be authenticated by the user's mail address, connect to the mail server device 30, and receive the e-mail 31 from the mail server device 30. The terminal device 20 has a function of performing predetermined processing on a file attached to an e-mail 31 and accessing an access address such as a URL in a communication network included in the e-mail in response to an operation input by the user. Be prepared. The terminal device 20 includes an operation log generation unit 21, a monitoring unit 22, and an operation log storage unit 23.

The operation log generation unit 21 monitors the operation of the terminal device 20 and stores the monitoring result as the operation log 230 in the operation log storage unit 23. The operation log storage unit 23 is, for example, a storage device such as a magnetic disk or an electronic memory. The operation log generation unit 21 monitors, for example, the following operations performed by the terminal device 20.
-File access: operation time, access file name, MD5 hash value of access file,
-Process startup and termination: operating time, executable file name, MD5 hash value of the executable file, information about the parent process that called the process,
-HTTP (HyperText Transfer Protocol) communication: Operation time, URL of communication destination.

The monitoring unit 22 monitors the occurrence of unauthorized operation in the terminal device 20 based on the sample index notified from the instruction unit 12 in response to the instruction from the instruction unit 12 in the e-mail monitoring device 10. The monitoring unit 22 confirms the operation log 230 stored in the operation log storage unit 23, and also confirms the monitoring result (operation log) added as the operation log 230 by the operation log generation unit 21.

For example, when the monitoring unit 22 is notified of the "attached file A" illustrated in FIG. 2 as a sample index, the monitoring unit 22 monitors a predetermined process for the "attached file A" performed in the terminal device 20. For example, when the "attached file A" is an executable file (for example, a file having an extension of "exe" or the like), the monitoring unit 22 determines that the "attached file A" is executed in the terminal device 20. Detect the occurrence of fraudulent operation. Alternatively, when the "attached file A" is a file in a compressed format (for example, a file having an extension of "zip" or the like), the monitoring unit 22 decompresses the "attached file A" (the compressed state is released). After that, when the terminal device 20 performs a predetermined process for the file included in the "attached file A", the occurrence of an illegal operation is detected.

For example, when the monitoring unit 22 is notified of the "access destination URL 001" illustrated in FIG. 2 as a sample index, the monitoring unit 22 monitors an unauthorized operation triggered by an access to the "access destination URL 001" performed in the terminal device 20. do. In this case, the monitoring unit 22 causes an illegal operation, for example, when a suspicious process is started in the terminal device 20 by accessing the "access destination URL 001" or a suspicious communication occurs. Detect.

When the monitoring unit 22 detects the occurrence of an unauthorized operation in the terminal device 20, the monitoring unit 22 may display that the unauthorized operation has occurred on the monitor (not shown) included in the terminal device 20, or the terminal device (not shown) of the system administrator. The occurrence of an illegal operation may be notified to (not shown) or the like.

Next, the operation (processing) of the e-mail monitoring system 1 according to the present embodiment will be described in detail with reference to the flowchart of FIG.

The e-mail monitoring device 10 receives an analysis result 41 indicating that the e-mail 31 contains fraudulent information from the mail analysis device 40 (step S101). The generation unit 11 in the e-mail monitoring device 10 obtains terminal identification information 130 that associates the e-mail 31 with the terminal device 20 based on the access history 32 from the terminal device 20 to the mail server device 30 and the analysis result 41. It is generated and the terminal specific information 130 is stored in the terminal specific information storage unit 13 (step 102).

In the terminal identification information 130, the instruction unit 12 in the e-mail monitoring device 10 instructs the terminal device 20 associated with the e-mail 31 to monitor the unauthorized operation by the sample index indicated by the analysis result 41 (step). 103). The terminal device 20 monitors the occurrence of an unauthorized operation by referring to the operation log 230 in response to an instruction from the instruction unit 12 in the e-mail monitoring device 10 (step S104), and completes the entire process.

The e-mail monitoring system 1 according to the present embodiment can efficiently and reliably monitor the occurrence of fraudulent operations due to receiving fraudulent e-mails. The reason is that in the e-mail monitoring system 1, the e-mail monitoring device 10 instructs the terminal device 20 that may have received the fraudulent e-mail 31 to monitor the fraudulent operation. This is because the terminal device 20 monitors the occurrence of unauthorized operation in response to an instruction from the e-mail monitoring device 10.

The effects realized by the e-mail monitoring system 1 according to the present embodiment will be described in detail below.

When an unauthorized e-mail is detected by a mail analysis device, for example, it is possible to know the destination (e-mail address) of the e-mail, but a terminal device that has received or may receive the e-mail in the future. Until it is specified, it is not generally done. If a terminal device that has received or may receive fraudulent e-mail can be identified, it is possible to efficiently monitor the occurrence of fraudulent operation by giving instructions to the terminal device to monitor the fraudulent operation. Can be done. Therefore, in the e-mail system, it is a challenge to identify the terminal device that has received or may receive the malicious e-mail in the future, and to give an instruction to monitor the unauthorized operation to the specified terminal device. be.

In response to such a problem, in the e-mail monitoring device 10 according to the present embodiment, the generation unit 11 is based on the analysis result 41 indicating that the e-mail 31 contains fraudulent information that may cause fraudulent operation. The terminal specific information 130 that associates the e-mail 31 with the terminal device 20 that has received or may receive the e-mail 31 is generated. The instruction unit 12 causes an unauthorized operation with respect to the terminal device 20 provided with a monitoring unit 22 that monitors the occurrence of an unauthorized operation in response to an external instruction associated with the e-mail 31 in the terminal identification information 130. Instruct to monitor. Then, in the terminal device 20, when the monitoring unit 22 detects that the e-mail 31 has been received or may be received in the future by the e-mail monitoring device 10, the monitoring unit 22 responds to the instruction by the e-mail monitoring device 10. And monitor the occurrence of fraudulent operations. That is, in the e-mail monitoring system 1 according to the present embodiment, only the terminal device 20 that has received or may receive the malicious e-mail 31 detected by the mail analysis device 40 is the e-mail monitoring device 10. In response to the instruction, the occurrence of fraudulent operation caused by the fraudulent information contained in the e-mail 31 is monitored. As a result, the e-mail monitoring system 1 according to the present embodiment can efficiently and reliably monitor the occurrence of fraudulent operation due to receiving fraudulent e-mail.

Further, when the IP address of the terminal device 20 according to the present embodiment is assigned by, for example, DHCP (Dynamic Host Configuration Protocol), the IP address of the terminal device 20 changes fluidly. In this case, the generation unit 11 can use a MAC (Media Access Control) address instead of the IP address as an identifier that can identify the terminal device 20 when generating the terminal identification information 130. In this case, the generation unit 11 generates the terminal specific information 130 by analyzing the operation log of the DHCP server device. Then, in this case, the instruction unit 12 instructs the terminal device 20 whose MAC address is registered in the terminal identification information 130 to monitor the occurrence of unauthorized operation.

Further, the e-mail monitoring device 10 according to the present embodiment may manage the e-mail 31 by an e-mail identifier that can uniquely identify the e-mail 31. In this case, the generation unit 11 obtains, for example, a mail identifier (for example, a message ID (Message-ID), which indicates “Identifier”) that can uniquely identify the e-mail 31 from the analysis result 41 by the mail analysis device 40. Extract. For example, when the terminal device 20 may receive the e-mail 31 from the mail server device 30 by SMTP, POP, or the like, the generation unit 11 obtains the terminal identification information 130 in which the mail identifier and the terminal device 20 are associated with each other. Generate. Then, the instruction unit 12 instructs the terminal device 20 associated with the mail identifier in the terminal identification information 130 to monitor the occurrence of an unauthorized operation. As a result, the e-mail monitoring system 1 according to the present embodiment can more efficiently and reliably monitor the occurrence of fraudulent operations due to receiving fraudulent e-mails.

Further, the instruction unit 12 according to the present embodiment can use the file identification information that can identify the malicious file attached to the e-mail 31 or the illegal URL (access address in the communication network) included in the e-mail 31. Notify the terminal device 20. Then, the monitoring unit 22 in the terminal device 20 monitors that a predetermined process (operation) for the notified file occurs and that a predetermined process triggered by the access to the notified URL occurs. .. The predetermined process described above also includes a complex process. As a result, the e-mail monitoring system 1 according to the present embodiment can more efficiently and reliably monitor the occurrence of fraudulent operations due to receiving fraudulent e-mails.

<Second embodiment>
FIG. 4 is a block diagram conceptually showing the configuration of the e-mail monitoring device 50 according to the second embodiment of the present invention. The e-mail monitoring device 50 includes a generation unit 51 and an instruction unit 52.

The generation unit 51 may have received or may receive the e-mail 71 and the e-mail 71 based on the analysis result indicating that the e-mail 71 contains the fraudulent information 710 that may cause a fraudulent operation. The terminal specific information 510 associated with a certain terminal device 60 is generated.

The instruction unit 52 refers to the terminal device 60 provided with the monitoring unit 61, which is associated with the e-mail 71 and monitors the occurrence of an unauthorized operation in response to an external instruction, in the terminal identification information 510. Instruct to monitor the outbreak.

The e-mail monitoring device 50 according to the present embodiment can efficiently and reliably monitor the occurrence of fraudulent operation due to receiving fraudulent e-mail, because the e-mail monitoring device 50 can be used. This is because the terminal device 60 provided with the monitoring unit 61 for monitoring the occurrence of the fraudulent operation, which has received or may receive the fraudulent e-mail 71, is instructed to monitor the fraudulent operation.

<Hardware configuration example>
In each of the above-described embodiments, each part of the e-mail monitoring device shown in FIGS. 1 and 4 can be realized by a dedicated HW (HardWale) (electronic circuit). Further, in FIGS. 1 and 4, at least the following configuration can be regarded as a function (processing) unit (software module) of a software program.
-Generating units 11 and 51,
・ Indicators 12 and 52,
However, the division of each part shown in these drawings is a configuration for convenience of explanation, and various configurations can be assumed at the time of mounting. An example of the hardware environment in this case will be described with reference to FIG.

FIG. 5 is a diagram illustrating an example of a configuration of an information processing device 900 (computer) capable of executing an e-mail monitoring device according to each embodiment of the present invention. That is, FIG. 5 is a configuration of a computer (information processing device) capable of realizing the e-mail monitoring device shown in FIGS. 1 and 4, and is a hardware environment capable of realizing each function in the above-described embodiment. Represents.

The information processing apparatus 900 shown in FIG. 5 includes the following as components.
-CPU (Central_Processing_Unit) 901,
-ROM (Read_Only_Memory) 902,
-RAM (Random_Access_Memory) 903,
-Hard disk (storage device) 904,
-Communication interface 905 with an external device,
・ Bus 906 (communication line),
A reader / writer 908 that can read / write data stored in a recording medium 907 such as a CD-ROM (Compact_Disc_Read_Only_Memory),
-I / O interface 909.

That is, the information processing apparatus 900 including the above components is a general computer to which these components are connected via the bus 906. The information processing apparatus 900 may include a plurality of CPUs 901 or may include a CPU 901 configured by a multi-core processor.

The present invention described by taking the above-described embodiment as an example supplies the information processing apparatus 900 shown in FIG. 5 with a computer program capable of realizing the following functions. The function is the above-mentioned configuration in the block configuration diagram (FIGS. 1 and 4) referred to in the description of the embodiment, or the function of the flowchart (FIG. 3). The present invention is subsequently achieved by reading, interpreting, and executing the computer program in the CPU 901 of the hardware. Further, the computer program supplied in the apparatus may be stored in a readable / writable volatile memory (RAM 903) or a non-volatile storage device such as ROM 902 or a hard disk 904.

Further, in the above case, as a method of supplying a computer program into the hardware, a general procedure can be adopted at present. As the procedure, for example, there are a method of installing in the apparatus via various recording media 907 such as a CD-ROM, a method of downloading from the outside via a communication line such as the Internet, and the like. In such a case, the present invention can be regarded as being composed of a code constituting the computer program or a recording medium 907 in which the code is stored.

The invention of the present application has been described above by taking the above-described embodiment as a model example. However, the invention of the present application is not limited to the above-described embodiment. That is, the invention of the present application can apply various aspects that can be understood by those skilled in the art within the scope of the invention of the present application.

In addition, a part or all of each of the above-mentioned embodiments may be described as the following appendix. However, the present invention exemplified by each of the above-described embodiments is not limited to the following. That is,
(Appendix 1)
Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. A generation method for generating terminal-specific information, and
In the terminal specific information, monitoring the occurrence of the fraudulent operation with respect to the terminal device provided with a monitoring means for monitoring the occurrence of the fraudulent operation in response to an external instruction associated with the e-mail. And the instruction means to instruct
E-mail monitoring device equipped with.
(Appendix 2)
The generation means generates the terminal specific information based on the history of access by the terminal device to the mail server device that delivers the e-mail to the terminal device.
The e-mail monitoring device according to Appendix 1.
(Appendix 3)
The generation means generates the terminal specific information that associates the e-mail with the IP address or MAC address assigned to the terminal device.
The instruction means instructs the terminal device specified by the IP address or the MAC address to monitor the occurrence of the unauthorized operation.
The e-mail monitoring device according to Appendix 1 or 2.
(Appendix 4)
The generation means generates the terminal specific information that associates the terminal device with the destination email address or message ID included in the e-mail.
The instruction means instructs the terminal device associated with the destination e-mail address or message ID to monitor the occurrence of the unauthorized operation.
The e-mail monitoring device according to any one of Supplementary note 1 to 3.
(Appendix 5)
The generation means includes the file attached to the e-mail or the e-mail containing an access address in a communication network included in the e-mail as the malicious information, and the terminal-specific information for associating the terminal device with the e-mail. To generate,
The e-mail monitoring device according to any one of Supplementary note 1 to 4.
(Appendix 6)
The generation means generates the terminal identification information including a hash value that can identify the file attached to the e-mail.
The e-mail monitoring device according to Appendix 5.
(Appendix 7)
The instruction means notifies the terminal device of file identification information that can identify a file attached to the e-mail or the access address included in the e-mail.
The e-mail monitoring device according to Appendix 5 or 6.
(Appendix 8)
Instructions from the e-mail monitoring device when the e-mail monitoring device detects that an e-mail containing malicious information that may cause fraudulent operation has been received or may be received in the future. A terminal device provided with a monitoring means for monitoring the occurrence of the fraudulent operation according to the above.
(Appendix 9)
The monitoring means generates a predetermined process for a file attached to the e-mail, and a predetermined process triggered by an access to an access address in a communication network included in the e-mail. To monitor,
The terminal device according to Appendix 8.
(Appendix 10)
The monitoring means converts the compressed file attached to the e-mail into the compressed file after the executable file attached to the e-mail is executed and the compressed state of the compressed file attached to the e-mail is released. Monitor that processing has been performed on the contained files,
The terminal device according to Appendix 9.
(Appendix 11)
The monitoring means monitors the activation of a suspicious process and the occurrence of suspicious communication contained in the e-mail, triggered by the access to the access address.
The terminal device according to Appendix 9 or 10.
(Appendix 12)
Further equipped with an operation log storage means for storing the operation log of the own device,
The monitoring means monitors the occurrence of the illegal operation by checking the operation log stored in the operation log storage means or the operation log newly stored in the operation log storage means.
The terminal device according to any one of Supplementary Provisions 8 to 11.
(Appendix 13)
It has an e-mail monitoring device and a terminal device,
The e-mail monitoring device is
Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. A generation method for generating terminal-specific information, and
In the terminal specific information, an instruction means for instructing the terminal device associated with the e-mail to monitor the occurrence of the unauthorized operation, and
Equipped with
The terminal device is
A monitoring means for monitoring the occurrence of the fraudulent operation in response to an instruction from the e-mail monitoring device is provided.
Email monitoring system.
(Appendix 14)
By email monitoring device
Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. Generate device specific information,
In the terminal specific information, the terminal device associated with the e-mail is instructed to monitor the occurrence of the fraudulent operation.
By the terminal device
In response to instructions from the e-mail monitoring device, the occurrence of the fraudulent operation is monitored.
Email monitoring method.
(Appendix 15)
Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. Generation processing to generate terminal specific information and
In the terminal specific information, monitoring the occurrence of the fraudulent operation is performed for the terminal device having a configuration for monitoring the occurrence of the fraudulent operation in response to an external instruction associated with the e-mail. Instruction processing to instruct and
An email monitoring program for running your computer.

1 E-mail monitoring system 10 E-mail monitoring device 11 Generation unit 12 Instruction unit 13 Terminal specific information storage unit 130 Terminal specific information 20 Terminal equipment 21 Operation log generation unit 22 Monitoring unit 23 Operation log storage unit 230 Operation log 30 Mail server device 31 E-mail 32 Access history 40 E-mail analysis device 41 Analysis result 50 E-mail monitoring device 51 Generation unit 510 Terminal specific information 52 Instruction unit 60 Terminal device 61 Monitoring unit 71 E-mail 710 Invalid information 900 Information processing device 901 CPU
902 ROM
903 RAM
904 Hard disk (storage device)
905 Communication interface 906 Bus 907 Recording medium 908 Reader / writer 909 Input / output interface

Claims (10)

Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. A generation method for generating terminal-specific information, and
In the terminal specific information, an operation related to an operation performed by the terminal device with respect to the terminal device provided with a monitoring means for monitoring the occurrence of the unauthorized operation in response to an external instruction associated with the e-mail. An instruction means for instructing to monitor the occurrence of the above-mentioned illegal operation by referring to the log, and
E-mail monitoring device equipped with. The generation means generates the terminal specific information based on the history of access by the terminal device to the mail server device that delivers the e-mail to the terminal device.
The e-mail monitoring device according to claim 1. The generation means generates the terminal specific information that associates the e-mail with the IP address or MAC address assigned to the terminal device.
The e-mail monitoring device according to claim 1 or 2, wherein the instruction means instructs the terminal device specified by the IP address or the MAC address to monitor the occurrence of the fraudulent operation. The generation means generates the terminal specific information that associates the terminal device with the destination email address or message ID included in the e-mail.
The instruction means instructs the terminal device associated with the destination e-mail address or message ID to monitor the occurrence of the unauthorized operation.
The e-mail monitoring device according to any one of claims 1 to 3. The generation means includes the file attached to the e-mail or the e-mail containing an access address in a communication network included in the e-mail as the malicious information, and the terminal-specific information for associating the terminal device with the e-mail. To generate,
The e-mail monitoring device according to any one of claims 1 to 4. The instruction means notifies the terminal device of file identification information that can identify a file attached to the e-mail or the access address included in the e-mail.
The e-mail monitoring device according to claim 5. When the e-mail monitoring device detects that an e-mail containing malicious information that may cause a fraudulent operation has been received or may be received in the future, the e-mail monitoring device is used. A terminal device including a monitoring means for monitoring the occurrence of the abnormal operation by referring to an operation log related to an operation performed by the terminal device in response to an instruction. The monitoring means generates a predetermined process for a file attached to the e-mail, and a predetermined process triggered by an access to an access address in a communication network included in the e-mail. To monitor,
The terminal device according to claim 7. By email monitoring device
Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. Generate device specific information,
In the terminal specific information, the terminal device associated with the e-mail is instructed to monitor the occurrence of the unauthorized operation by referring to the operation log related to the operation performed by the terminal device.
By the terminal device
In response to an instruction from the e-mail monitoring device, the occurrence of the fraudulent operation is monitored by referring to the operation log regarding the operation performed by the terminal device.
Email monitoring method. Based on the analysis result indicating that the e-mail contains fraudulent information that may cause fraudulent operation, the e-mail is associated with the terminal device that has received or may receive the e-mail in the future. Generation processing to generate terminal specific information and
In the terminal specific information, an operation log relating to an operation performed by the terminal device with respect to the terminal device having a configuration for monitoring the occurrence of the unauthorized operation in response to an external instruction associated with the e-mail. And the instruction processing instructing to monitor the occurrence of the above-mentioned illegal operation by referring to
E-mail monitoring program for causing a computer to execute the.

Images