Mass mail detection system and mail server

• US 7,853,654 B2
• Filed: 01/12/2005
• Issued: 12/14/2010
• Est. Priority Date: 01/14/2004
• Status: Expired due to Fees

• Current Assignee: KDDI Corporation, Kenichi Yoshida
• Original Assignee: KDDI Corporation, Kenichi Yoshida
• Inventors: Yoshida, Kenichi, Yamazaki, Katsuyuki, Honma, Teruaki, Fujikawa, Hiromitsu, Nakashima, Akihiro
• Primary Examiner(s): Najjar; Saleh
• Assistant Examiner(s): Kim; Edward J
• Application Number:
  US11/033,111
• Publication Number:
  US 20050188032A1
• Time in Patent Office: 2,162 Days
• Field of Search: 709/206, 709/207, 707687-704, 707705-788
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

The present invention is to provide a mass mail detection device that eliminates the need for preparation of rules or learning in advance and operates at a high speed. Electronic mail collecting means analyzes the electronic mail delivery protocol that flows on the network, and extracts an electronic mail main text from the electronic mail traffic that flows on the network. Next, characteristic quantity conversion means calculates a number of hash values from the electronic mail main text, as the characteristic quantity of the mail. Finally, mass mail detection means compares the newly received electronic mail with the stored past electronic mails, and determines the similarity in accordance with a specific standard. If determined as being similar, the new mail is determined as a candidate for a mass mail (similar mails), and a prescribed number or more of similar mails are determined as a mass mail.

Claims

1. A mass mail detection system comprising:

electronic mail collecting means for collecting an electronic mail as an object of delivery;

characteristic quantity conversion means for converting the collected electronic mail into a characteristic quantity; and

mass mail detection means for detecting a mass mail by using the converted characteristic quantity,

wherein the characteristic quantity conversion means extracts a partial letter series from a main text of the electronic mail, and uses a set of values calculated from the partial letter series as the characteristic quantity, and

wherein the mass mail detection means uses a managed map cache system including a characteristic quantity database and a pointer to the characteristic quantity database as a means for storing electronic mails that are frequently delivered, the characteristic quantity database storing a registered electronic mail and an indicator associated with the registered electronic mail, the indicator indicating a number of newly received electronic mails that have been determined to be similar to the registered electronic mail,

wherein the mass mail detection means determines that a newly received electronic mail and the registered electronic mail stored in the characteristic quantity database are similar by making an access to the characteristic quantity database using a pointer corresponding to a characteristic quantity of the newly received electronic mail and making a comparison between the characteristic quantity of the newly received electronic mail and a characteristic quantity of the electronic mail registered in the characteristic quantity database, and

wherein when the mass mail detection means determines that the newly received electronic mail is similar to the electronic mail registered in the characteristic quantity database based on the comparison between the characteristic quantity of the newly received electronic mail and the characteristic quantity of the electronic mail registered in the characteristic quantity database, the mass mail detection means increases the indicator of the number of newly received electronic mails that are similar to the electronic mail registered in the characteristic quantity database by one and stores the indicator in the characteristic quantity database, and the mass mail detection means determines that the newly received electronic mail is the mass mail when the indicator indicates that the number of newly received electronic mails that are similar to the electronic mail registered in the characteristic quantity database is at least a prescribed number.

2. The mass mail detection system of claim 1, wherein

the characteristic quantity database registers a number of electronic mails received that are similar to the electronic mail already stored in the characteristic quantity database, a number of received references referred to by the pointer, and hash values of electronic mails, and

when the electronic mail that is similar to the electronic mail already stored in the characteristic quantity database is received, the number of received references increases in accordance with a number of coincident hash values in the received electronic mail that is similar to the electronic mail already stored in the characteristic quantity database and the electronic mail already stored in the characteristic quantity database.

3. The mass mail detection system of claim 1, wherein the characteristic quantity conversion means performs preprocessing of an electronic mail.

4. The mass mail detection system of claim 3, wherein the characteristic quantity conversion means selects letters that are displayed in a beginning part of a terminal of the receiver when the characteristic quantity conversion means performs preprocessing of the electronic mail.

5. The mass mail detection system of claim 3, wherein similar letters are dealt with as identical letters when the characteristic quantity conversion means performs preprocessing of the electronic mail.

6. The mass mail detection system of claim 3, wherein the preprocessing includes an HTML processing when the characteristic quantity conversion means performs preprocessing of the electronic mail.

7. The mass mail detection system of claim 3, wherein the preprocessing includes an MIME processing when the characteristic quantity conversion means performs preprocessing of the electronic mail.

8. The mass mail detection system of claim 3, wherein a two-byte letter and a one-byte letter are dealt with as the similar letters when the characteristic quantity conversion means performs preprocessing of the electronic mail.

9. The mass mail detection system of claim 3, wherein a large-case letter and a small-case letter are dealt with as the similar letters when the characteristic quantity conversion means performs preprocessing of the electronic mail.

10. The mass mail detection system of any one of claims 1 and 3 to 9, wherein the mass mail detection system is provided as part of a mail server.

11. The mass mail detection system of claim 2, wherein the mass mail detection system is provided as part of a mail server.