E-mail filtering system and method

• US 20050188036A1
• Filed: 01/21/2005
• Published: 08/25/2005
• Est. Priority Date: 01/21/2004
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Yasuda, Masato
• Application Number:
  US11/038,520
• Publication Number:
  US 20050188036A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

An e-mail filtering system determines whether a received e-mail is an unsolicited e-mail or a possible unsolicited e-mail. If the received e-mail is an unsolicited e-mail, a URL contained in the received e-mail is registered in a memory. If the received e-mail is a possible unsolicited e-mail, a search is made through the memory for a registered URL corresponding to a URL contained in the e-mail. If the corresponding registered URL is detected, the possible unsolicited e-mail is identified as an unsolicited e-mail. In response to receipt of an e-mail, its source IP address or a URL contained in it is used to identify it as a possible unsolicited e-mail and a count value is incremented, which is reset to zero if the time following receipt of a possible unsolicited e-mail has lapsed a predetermined interval. The possible unsolicited e-mail is identified as an unsolicited e-mail when the count value exceeds a threshold.

Claims

1. An e-mail filtering system comprising:

a first store for maintaining registered URLs;

decision mechanism for determining whether a received e-mail is an unsolicited e-mail or a possible unsolicited e-mail; and

registration mechanism for making a registration of a URL contained in the received e-mail into said first store if the received e-mail is determined to be an unsolicited e-mail,

said decision mechanism determining whether the received e-mail contains a URL registered in said first store if the received e-mail is determined to be a possible unsolicited e-mail and identifying the received e-mail as an unsolicited e-mail if the received e-mail is determined to contain said registered URL.

2. The e-mail filtering system of claim 1, wherein said decision mechanism identifies a received e-mail as a possible unsolicited e-mail by using the source IP address of the e-mail, increments a count value in response to each of received e-mails identified as a possible unsolicited e-mail, resets said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval, and changes said possible unsolicited e-mail to said unsolicited e-mail if said count value is higher than a threshold value.

3. The e-mail filtering system of claim 1, wherein said decision mechanism identifies a received e-mail as a possible unsolicited e-mail by using a URL contained in the text of the e-mail, increments a count value in response to each of received e-mails identified as a possible unsolicited e-mail, resets said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval, and identifies said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

4. The e-mail filtering system of claim 1, 2 or 3, further comprising a second store for maintaining a whitelist of URLs, and wherein said registration mechanism makes a search through said whitelist for an URL which corresponds to the URL detected in the text of said unsolicited e-mail and makes no registration of the detected URL in said first store if the detected URL corresponds to the URL of the whitelist.

5. The e-mail filtering system of claim 1, 2 or 3, further comprising a second store for maintaining candidate URLs, and wherein said registration mechanism makes a registration of the detected URL in said second store as one of said candidate URLs, and wherein said second store is accessible from an external source which is configured to select a candidate URL from said second store and set the selected candidate URL into said first store as one of the registered URLs.

6. The e-mail filtering system of claim 1, further comprises restriction mechanism for imposing a restriction said unsolicited e-mail.

7. The e-mail filtering system of any of claims 1, further comprising a second store, wherein said registered URLs are maintained as a blacklist of URLs in said second store, said third store being arranged to be accessible from an external source.

8. The e-mail filtering system of claim 1, 2 or 3, wherein said first store further maintains a plurality of registered spam words, and wherein said decision mechanism makes a search through said first store for a registered spam word corresponding to a word contained in said possible unsolicited e-mail if said count value is lower than said threshold value, and identifies the possible unsolicited e-mail as an unsolicited e-mail if said corresponding registered spam word is detected in said first store.

9. An e-mail filtering system comprising:

processing means for identifying, as a possible unsolicited e-mail, a received e-mail by using one of the source IP address of the e-mail and a URL contained in the text of the e-mail, incrementing a count value in response to receipt of said possible unsolicited e-mail, resetting said count value to zero if the time following a receipt of said possible unsolicited e-mail has lapsed a predetermined interval, and identifying the possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

10. The e-mail filtering system of claim 9, further comprising a cache table having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval,

wherein said processing means is configured to:

make a search through said cache table for an entry corresponding to a received e-mail by using the source IP address of the received e-mail as a search key,

if no corresponding entry is detected in said cache table, create an entry in said cache table by setting said source IP address and a predetermined count value in the created entry, and

if a corresponding entry is detected, increment the count value of the corresponding entry by a predetermined amount.

11. The e-mail filtering system of claim 9, further comprising a cache table having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval, and

wherein said processing means is configured to:

make a search through said cache table for an entry corresponding to a received e-mail by using a URL contained in the e-mail as a search key,

if no corresponding entry is detected in said cache table, create an entry in said cache table by setting said Linking URL and a predetermined count value in the created entry, and

if a corresponding entry is detected in said cache table, increment the count value of the corresponding entry by a predetermined amount.

12. The e-mail filtering system of claim 9, further comprising a first store for maintaining registered URLs, wherein said processing means is configured to:

identify a received e-mail as a possible unsolicited e-mail by the source IP address of the e-mail,

if said count value is higher than said threshold value, make a registration of a URL contained in the possible unsolicited e-mail into said first store and identify the possible unsolicited e-mail as an unsolicited e-mail,

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a URL registered in said first store, and

if said possible unsolicited e-mail is determined to contain the registered URL, identify the possible unsolicited e-mail as an unsolicited e-mail.

13. The e-mail filtering system of claim 9, further comprising a first store for maintaining registered spam words and registered URLs,

wherein said processing means is configured to:

identify a received e-mail as a possible unsolicited e-mail by the source IP address of the received e-mail,

if said count value is higher than said threshold value, make a registration of a URL contained in said possible unsolicited e-mail into said first store and identify said possible unsolicited e-mail as an unsolicited e-mail,

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store,

if said possible unsolicited e-mail is determined to contain the registered URL, identify said possible unsolicited e-mail as an unsolicited e-mail, and

if said possible unsolicited e-mail is determined not to contain said registered URL but contain the registered spam word, make a registration of a URL contained in the possible unsolicited e-mail into said first store, and identify said possible unsolicited e-mail as an unsolicited e-mail.

14. The e-mail filtering system of claim 9, further comprising a first store for maintaining registered URLs, wherein said processing means is configured to:

detect a URL contained in the received e-mail and identify the received e-mail as a possible unsolicited e-mail by the detected URL,

if said count value is higher than said threshold value, make a registration of the detected URL into said first store and identify the possible unsolicited e-mail as an unsolicited e-mail,

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a URL registered in said first store, and

if said possible unsolicited e-mail is determined to contain the registered URL, identify the possible unsolicited e-mail as an unsolicited e-mail.

15. The e-mail filtering system of claim 9, further comprising a first store for maintaining registered spam words and registered URLs,

wherein said processing means is configured to:

detect a URL contained in the received e-mail and identify the received e-mail as a possible unsolicited e-mail by the detected URL,

if said count value is higher than said threshold value, make a registration of the detected URL into said first store and identify the possible unsolicited e-mail as an unsolicited e-mail,

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store,

if said possible unsolicited e-mail is determined to contain the registered URL, identify the possible unsolicited e-mail as an unsolicited e-mail, and

if said possible unsolicited e-mail is determined not to contain said registered URL but contain said registered spam word, make a registration of said detected URL in said first store, and identify the possible unsolicited e-mail as an unsolicited e-mail.

16. The e-mail filtering system of any of claims 12 to 15, further comprising a second store for maintaining a whitelist of non-spam URLs,

wherein said processing means is configured to:

make a search through said second store for a non-spam URL corresponding to a URL contained in said possible unsolicited e-mail, and

if said corresponding non-spam URL is detected in said second store, inhibit said registration of said URL in said first store.

17. The e-mail filtering system of any of claims 12 to 15, further comprising a second store for maintaining candidate URLs, wherein the URLs registered in said first store are URLs selected from a plurality of candidate URLs, and wherein said processing means is configured to make a registration of a URL contained said possible unsolicited e-mail in said second store as a candidate URL, further comprising means for accessing said second store for manually selecting a candidate URL and storing the selected candidate URL into said first store as a registered URL.

18. The e-mail filtering system of any of claims 12 to 15, wherein said processing means is configured to impose restriction on the unsolicited e-mail.

19. The e-mail filtering system of any of claims 12 to 15, further comprising a second store for maintaining registered URLs in a blacklist of spam sources, said second store being arranged so that the blacklist in said second store is accessible from an external source.

20. A method of filtering e-mails, comprising the steps of:

a) determining whether a received e-mail is an unsolicited e-mail or a possible unsolicited e-mail;

b) if the received e-mail is determined to be an unsolicited e-mail, making a registration of a URL contained in the unsolicited e-mail into a first store;

c) if the received e-mail is determined to be a possible unsolicited e-mail, determining whether the possible unsolicited e-mail contains a URL registered in said first store; and

d) if the possible unsolicited e-mail is determined to contain the registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

21. The method of claim 20, wherein step (a) comprises the steps of:

identifying a received e-mail as a possible unsolicited e-mail by using the source IP address of the e-mail;

incrementing a count value in response to each of received e-mails identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval; and

identifying said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

22. The method of claim 20, wherein step (a) comprises the steps of:

identifying a received e-mail as a possible unsolicited e-mail by using a URL contained in the received e-mail,

incrementing a count value in response to each of received e-mails identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval; and

identifying said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

23. The method of claim 20, 21 or 22, further comprising the steps of:

maintaining a whitelist of URLs;

determining whether a received e-mail contains a URL maintained in said whitelist; and

inhibiting said registration of the URL in said first store if the received e-mail is determined to contain said URL maintained in said whitelist.

24. The method of claim 20, 21 or 22, further comprising the steps of:

making a registration of the detected URL in a second store as one of a plurality of candidate URLs; and

allowing an external source to select one of said candidate URLs from aid second store and set the selected candidate URL into said first store as one of the registered URLs.

25. The method of claim 20, 21 or 22, further comprises the step of imposing a restriction said unsolicited e-mail.

26. The method of claim 20, 21 or 22, further comprising the steps of storing said registered URLs as a blacklist of URLs, and allowing said blacklist to be accessed from an external source.

27. A method of filtering e-mails, comprising the steps of:

identifying, as a possible unsolicited e-mail, a received e-mail by using one of the source IP address of the e-mail and a URL contained in the text of the e-mail;

incrementing a count value in response to each of received e-mails each being identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of an e-mail identified as a possible unsolicited e-mail has lapsed a predetermined interval; and

identifying the possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

28. The method of claim 27, wherein a cache table is provided having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval, further comprising the steps of:

making a search through said cache table for an entry corresponding to a received e-mail by using the source IP address of the received e-mail as a search key;

if no corresponding entry is detected in said cache table, creating an entry in said cache table by setting said source IP address and a predetermined count value in the created entry; and

if a corresponding entry is detected, incrementing the count value of the corresponding entry by a predetermined amount.

29. The method of claim 27, wherein a cache table is provided having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval, further comprising the steps of:

making a search through said cache table for an entry corresponding to a received e-mail by using a linking URL contained in the text of the e-mail as a search key;

if no corresponding entry is detected in said cache table, creating an entry in said cache table by setting said linking URL and a predetermined count value in the created entry; and

if a corresponding entry is detected in said cache table, incrementing the count value of the corresponding entry by a predetermined amount.

30. The method of claim 27, wherein a first store is provided for maintaining registered URLs, further comprising the steps of:

a) identifying a received e-mail as a possible unsolicited e-mail by the source IP address of the e-mail;

b) if said count value is higher than said threshold value, making a registration of a URL contained in the possible unsolicited e-mail into said first store and identifying said possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a URL registered in said first store; and

d) if said possible unsolicited e-mail is determined to contain the registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

31. The method of claim 27, wherein a first store is provided for maintaining registered spam words and registered URLs, further comprising the steps of:

a) identifying a received e-mail as a possible unsolicited e-mail by the source IP address of the received e-mail;

b) if said count value is higher than said threshold value, making a registration of a URL contained in said possible unsolicited e-mail into said first store and identifying said possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store;

d) if said possible unsolicited e-mail is determined not to contain said URL but contain said registered spam word, making a registration of a URL contained in the possible unsolicited e-mail in said first store; and

identifying said possible unsolicited e-mail as an unsolicited e-mail; and

e) if said possible unsolicited e-mail is determined to contain said registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

32. The method of claim 27, wherein a first store is provided for maintaining registered URLs, further comprising the steps of:

a) detecting a URL in a received e-mail and identifying the received e-mail as a possible unsolicited e-mail by the detected URL;

b) if said count value is higher than said threshold value, make a registration of the detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a URL registered in said first store; and

d) if said possible unsolicited e-mail is determined to contain said registered URL, identifying the possible unsolicited e-mail as an unsolicited e-mail.

33. The method of claim 27, wherein a first store is provided for maintaining registered spam words and registered URLs, further comprising the steps of:

a) detecting a URL in a received e-mail, and identifying the received e-mail as a possible unsolicited e-mail by the detected URL;

b) if said count value is higher than said threshold value, making a registration of the detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store;

d) if said possible unsolicited e-mail is determined not to contain said registered URL but contain said registered spam word, making a registration of said detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail; and

e) if the possible unsolicited e-mail is determined to contain said registered URL, identifying the possible unsolicited e-mail as an unsolicited e-mail.

34. The method of any of claims 30 to 33, wherein a second store is provided for maintaining a whitelist of non-spam URLs, further comprising the steps of:

determining whether said possible unsolicited e-mail contains a URL maintained in said whitelist; and

if said possible unsolicited e-mail is determined to contain said URL maintained in said whitelist, inhibiting said registration of the URL in said first store.

35. The method of any of claims 30 to 33, wherein a second store is provided for maintaining candidate URLs, and wherein the URLs registered in said first store are URLs selected from said candidate URLs, wherein step (b) comprises the steps of:

making a registration of the detected linking URL in said second store as a candidate URL; and

selecting a candidate URL from said maintained candidate URLs and storing the selected candidate URL into said first store as a registered URL.

36. The method of any of claims 30 to 33, further comprising the step of imposing restriction on the unsolicited e-mail.

37. The method of any of claims 30 to 33, wherein a second store is provided for maintaining registered URLs in a blacklist of spam sources, further comprising the step of accessing the blacklist in said second store from an external source.

38. A computer-readable storage medium containing a program for filtering e-mails, said program comprising the steps of:

a) determining whether a received e-mail is an unsolicited e-mail or a possible unsolicited e-mail;

b) if the received e-mail is determined to be an unsolicited e-mail, making a registration of a URL contained in the unsolicited e-mail into a first store;

c) if the received e-mail is determined to be a possible unsolicited e-mail, determining whether the possible unsolicited e-mail contains a URL registered in said first store; and

d) if the possible unsolicited e-mail is determined to contain the registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

39. The computer-readable storage medium of claim 38, wherein step (a) comprises the steps of:

identifying a received e-mail as a possible unsolicited e-mail by using the source IP address of the e-mail;

incrementing a count value in response to each of received e-mails identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval; and

identifying said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

40. The computer-readable storage medium of claim 38, wherein step (a) comprises the steps of:

identifying a received e-mail as a possible unsolicited e-mail by using a URL contained in the received e-mail;

incrementing a count value in response to each of received e-mails identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval; and

identifying said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

41. The computer-readable storage medium of claim 38, 39 or 40, further comprising the steps of:

maintaining a whitelist of URLs;

determining whether a received e-mail contains a URL maintained in said whitelist; and

inhibiting said registration of the URL in said first store if the received e-mail is determined to contain said URL maintained in said whitelist.

42. The computer-readable storage medium of claim 38, 39 or 40, further comprising the steps of:

making a registration of the detected URL in a second store as one of a plurality of candidate URLs; and

allowing an external source to select one of said candidate URLs from aid second store and set the selected candidate URL into said first store as one of the registered URLs.

43. The computer-readable storage medium of claim 38, 39 or 40, further comprises the step of imposing a restriction on said unsolicited e-mail.

44. The computer-readable storage medium of claim 38, 39 or 40, further comprising the steps of storing said registered URLs as a blacklist of URLs, and allowing said blacklist to be accessed from an external source.

45. A computer-readable storage medium containing a program for filtering e-mails, said program comprising the steps of:

identifying, as a possible unsolicited e-mail, a received e-mail by using one of the source IP address of the e-mail and a URL contained in the text of the e-mail;

incrementing a count value in response to each of received e-mails each being identified as a possible unsolicited e-mail;

resetting said count value to zero if the time following a receipt of an e-mail identified as a possible unsolicited e-mail has lapsed a predetermined interval; and

identifying the possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

46. The computer-readable storage medium of claim 45, wherein a cache table is provided having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval, further comprising the steps of:

making a search through said cache table for an entry corresponding to a received e-mail by using the source IP address of the received e-mail as a search key;

if no corresponding entry is detected in said cache table, creating an entry in said cache table by setting said source IP address and a predetermined count value in the created entry; and

if a corresponding entry is detected, incrementing the count value of the corresponding entry by a predetermined amount.

47. The computer-readable storage medium of claim 45, wherein a cache table is provided having a plurality of entries, each of the entries being removed from the cache table when the time after the entry is created has lapsed said predetermined interval, further comprising the steps of:

making a search through said cache table for an entry corresponding to a received e-mail by using a linking URL contained in the text of the e-mail as a search key;

if no corresponding entry is detected in said cache table, creating an entry in said cache table by setting said linking URL and a predetermined count value in the created entry; and

if a corresponding entry is detected in said cache table, incrementing the count value of the corresponding entry by a predetermined amount.

48. The computer-readable storage medium of claim 45, wherein a first store is provided for maintaining registered URLs, further comprising the steps of:

a) identifying a received e-mail as a possible unsolicited e-mail by the source IP address of the e-mail;

b) if said count value is higher than said threshold value, making a registration of a URL contained in the possible unsolicited e-mail into said first store and identifying said possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a URL registered in said first store; and

d) if said possible unsolicited e-mail is determined to contain the registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

49. The computer-readable storage medium of claim 45, wherein a first store is provided for maintaining registered spam words and registered URLs, further comprising the steps of:

a) identifying a received e-mail as a possible unsolicited e-mail by the source IP address of the received e-mail;

b) if said count value is higher than said threshold value, making a registration of a URL contained in said possible unsolicited e-mail into said first store and identifying said possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store;

d) if said possible unsolicited e-mail is determined not to contain said URL but contain said registered spam word, making a registration of a URL contained in the possible unsolicited e-mail in said first store; and

identifying said possible unsolicited e-mail as an unsolicited e-mail; and

e) if said possible unsolicited e-mail is determined to contain said registered URL, identifying said possible unsolicited e-mail as an unsolicited e-mail.

50. The computer-readable storage medium of claim 45, wherein a first store is provided for maintaining registered URLs, further comprising the steps of:

a) detecting a URL in a received e-mail and identifying the received e-mail as a possible unsolicited e-mail by the detected URL;

b) if said count value is higher than said threshold value, making a registration of the detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a URL registered in said first store; and

d) if said possible unsolicited e-mail is determined to contain said registered URL, identifying the possible unsolicited e-mail as an unsolicited e-mail.

51. The computer-readable storage medium of claim 45, wherein a first store is provided for maintaining registered spam words and registered URLs, further comprising the steps of:

a) detecting a URL in a received e-mail, and identifying the received e-mail as a possible unsolicited e-mail by the detected URL;

b) if said count value is higher than said threshold value, making a registration of the detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail;

c) if said count value is lower than said threshold value, determining whether said possible unsolicited e-mail contains a spam word and a URL which are registered in said first store;

d) if said possible unsolicited e-mail is determined not to contain said registered URL but contain said registered spam word, making a registration of said detected URL in said first store, and identifying the possible unsolicited e-mail as an unsolicited e-mail; and

e) if the possible unsolicited e-mail is determined to contain said registered URL, identifying the possible unsolicited e-mail as an unsolicited e-mail.

52. The computer-readable storage medium of any of claims 48 to 51, wherein a second store is provided for maintaining a whitelist of non-spam URLs, further comprising the steps of:

determining whether said possible unsolicited e-mail contains a URL maintained in said whitelist; and

if said possible unsolicited e-mail is determined to contain said URL maintained in said whitelist, inhibiting said registration of the URL in said first store.

53. The computer-readable storage medium of any of claims 48 to 51, wherein a second store is provided for maintaining candidate URLs, and wherein the URLs registered in said first store are URLs selected from said candidate URLs, wherein step (b) comprises the steps of:

making a registration of the detected linking URL in said second store as a candidate URL; and

selecting a candidate URL from said maintained candidate URLs and storing the selected candidate URL into said first store as a registered URL.

54. The computer-readable storage medium of any of claims 48 to 51, further comprising the step of imposing restriction on the unsolicited e-mail.

55. The computer-readable storage medium of any of claims 48 to 51, wherein a second store is provided for maintaining registered URLs in a blacklist of spam sources, further comprising the step of accessing the blacklist in said second store from an external source.

56. A mobile terminal wirelessly connected to a mobile communication network, comprising:

a store for maintaining registered URLs;

decision mechanism for determining whether an e-mail received from said network is an unsolicited e-mail or a possible unsolicited e-mail; and

registration mechanism for making a search through the text of the received e-mail for a URL linking to a Web site if the received e-mail is determined as an unsolicited e-mail and making a registration of the detected URL in said store,

said decision mechanism making a search through the text of the possible unsolicited e-mail for a URL corresponding to a URL registered in said store and identifying said possible unsolicited e-mail as an unsolicited e-mail if said corresponding URL is detected.

57. The mobile terminal of claim 56, wherein said decision mechanism identifies a received e-mail as a possible unsolicited e-mail by using the source IP address of the e-mail, increments a count value in response to each of received e-mails identified as a possible unsolicited e-mail, resets said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval, and identifies said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

58. The mobile terminal of claim 56, wherein said decision mechanism identifies a received e-mail as a possible unsolicited e-mail by using a URL contained in the text of the e-mail, increments a count value in response to each of received e-mails identified as a possible unsolicited e-mail, resets said count value to zero if the time following a receipt of the possible unsolicited e-mail has lapsed a predetermined interval, and identifies said possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

59. A mobile terminal wirelessly connected to a mobile communication network, comprising:

processing means for identifying, as a possible unsolicited e-mail, an e-mail received from said network by using one of the source IP address of the e-mail and a URL contained in the text of the e-mail, incrementing a count value in response to receipt of said possible unsolicited e-mail, resetting said count value to zero if the time following a receipt of said possible unsolicited e-mail has lapsed a predetermined interval, and identifying the possible unsolicited e-mail as an unsolicited e-mail if said count value is higher than a threshold value.

60. The mobile terminal of claim 59, further comprising a store for maintaining registered URLs, wherein said processing means is configured to:

identify a received e-mail as a possible unsolicited e-mail by the source IP address of the e-mail,

if said count value is lower than said threshold value, make a registration of a URL contained in said possible unsolicited e-mail into said store and identify said possible unsolicited e-mail as an unsolicited e-mail,

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a URL registered in said store, and

if the possible unsolicited e-mail is determined to contain said registered URL, identify said possible unsolicited e-mail as an unsolicited e-mail.

61. The mobile terminal of claim 59, further comprising a store for maintaining registered URLs;

wherein said processing means is configured to;

make a search through the text of a received e-mail for detecting a URL linking to a Web site, and identify the received e-mail as a possible unsolicited e-mail by the detected URL,

if said count value is higher than said threshold value, make a registration of a URL contained in said possible unsolicited e-mail into said store, and identify the possible unsolicited e-mail as an unsolicited e-mail;

if said count value is lower than said threshold value, determine whether said possible unsolicited e-mail contains a URL registered in said store; and

if said possible unsolicited e-mail is determined to contain said registered URL, identify the possible unsolicited e-mail as an unsolicited e-mail.