Mass mail detection system and mail server

• US 20050188032A1
• Filed: 01/12/2005
• Published: 08/25/2005
• Est. Priority Date: 01/14/2004
• Status: Active Grant

• Current Assignee: KDDI Corporation, Kenichi Yoshida
• Original Assignee: KDDI Corporation, Kenichi Yoshida
• Inventors: Yoshida, Kenichi, Yamazaki, Katsuyuki, Honma, Teruaki, Fujikawa, Hiromitsu, Nakashima, Akihiro
• Granted Patent: US 7,853,654 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention is to provide a mass mail detection device that eliminates the need for preparation of rules or learning in advance and operates at a high speed. Electronic mail collecting means analyzes the electronic mail delivery protocol that flows on the network, and extracts an electronic mail main text from the electronic mail traffic that flows on the network. Next, characteristic quantity conversion means calculates a number of hash values from the electronic mail main text, as the characteristic quantity of the mail. Finally, mass mail detection means compares the newly received electronic mail with the stored past electronic mails, and determines the similarity in accordance with a specific standard. If determined as being similar, the new mail is determined as a candidate for a mass mail (similar mails), and a prescribed number or more of similar mails are determined as a mass mail.

Claims

1. A mass mail detection system comprising:

electronic mail collecting means for collecting an electronic mail as an object of delivery;

characteristic quantity conversion means for converting the collected electronic mail into a characteristic quantity; and

mass mail detection means for detecting a mass mail by using the converted characteristic quantity,

wherein the characteristic quantity conversion means extracts partial letter series from a main text of the electronic mail, and uses a set of values calculated from the partial letter series as the characteristic quantity, and

the mass mail detection means determines the similarity of electronic mails based on the characteristic quantities and determines the similar electronic mails as a mass mail when a prescribed number or more of the similar electronic mails are detected.

2. The mass mail detection system of claim 1, wherein the mass mail detection means has means for preferentially storing electronic mails that are frequently delivered as electronic mails to be stored in a storage region.

3. The mass mail detection system of claim 2, wherein the mass mail detection means uses a managed map cache system as the means for preferentially storing electronic mails that are frequently delivered.

4. The mass mail detection system of claim 3, wherein the managed map cache system includes a characteristic quantity database and a pointer to the characteristic quantity database, and

a similarity between a new electronic mail and an already registered electronic mail is determined by making an access to the characteristic quantity database using the pointer and making a comparison with a characteristic value of the electronic mail already registered in the characteristic quantity database.

5. The mass mail detection system of claim 3 or 4, wherein the managed map cache system includes a characteristic quantity database and a pointer to the characteristic quantity database,

the characteristic quantity database registers the number of similar mails, the number of received references referred to by the pointer, and hash values of electronic mails, and

when a similar mail is received, the number of similar mails in the already registered similar mail is increased by one, and the number of received references increases in accordance with the number of coincident hash values in the similar electronic mail and the already registered similar mail.

6. The mass mail detection system of claim 2, wherein the mass mail detection means uses an LRU system as the means for preferentially storing electronic mails that are frequently delivered.

7. The mass mail detection system of claim 1, wherein the characteristic quantity conversion means performs preprocessing of an electronic mail in accordance with a mode by which the electronic mail is displayed to a receiver.

8. The mass mail detection system of claim 7, wherein the characteristic quantity conversion means gives priority to letters that are displayed in an initial part of the electronic mail when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

9. The mass mail detection system of claim 7, wherein similar letters are dealt with as identical letters when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

10. The mass mail detection system of claim 7, wherein the preprocessing includes an HTML processing when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

11. The mass mail detection system of claim 7, wherein the preprocessing includes an MIME processing when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

12. The mass mail detection system of claim 7, wherein a two-byte letter and a one-byte letter are dealt with as the similar letters when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

13. The mass mail detection system of claim 7, wherein a large-case letter and a small-case letter are dealt with as the similar letters when the characteristic quantity conversion means performs preprocessing of the electronic mail in accordance with the mode by which the electronic mail is displayed to the receiver.

14. A mail server provided with the mass mail detection system of any one of claims 1 to 4 and 6 to 13.

15. A mail server provided with the mass mail detection system of claim 5.