Device, method, and computer readable medium for identifying fraudulent email using function terms

A fraudulent email decision device (10) is provided with a consistency analysis unit (24). The consistency analysis unit (24) identifies an intention of a subject email by, for example, a method of, with respect to a newly received incoming email as a subject email, extracting a function term, being a word expressing a reason the subject email was sent, from a body of the subject email. The consistency analysis unit (24) decides whether or not the subject email is a fraudulent email, from a relationship between another incoming email received in the past from the same sender as the sender of the subject email, and the identified intention of the subject email.

TECHNICAL FIELD

The present invention relates to a technique of detecting a targeted-attack email.

BACKGROUND ART

Most of targeted attacks such as Advanced Persistent Threat are targeted-attack emails which are fraudulent emails utilized as an invasion trick of an attack.

A targeted-attack email employs sentences skillfully crafted with using information concerning a target of attack such as an organization and a person. The targeted-attack email entices to open a malicious file attached to the email or to visit a malicious website indicated by a Uniform Resource Locator (URL) written in a body of the email.

Regarding an attachment and a URL, existing techniques are known which statically or dynamically analyze a degree of malignancy of the content. For example, there is a technique that confirms whether an inspection-subject attachment matches with a pattern of known malware, thereby detecting malware. There is also a technique that utilizes a feature of behavior a file shows during execution, thereby detecting malware. There is also a technique that prepares a blacklist of URLs indicating malicious websites, thereby preventing a user from visiting a dangerous web site. There is also malware detection software that incorporates these techniques.

However, the more sophisticated the attacker is, the more likely the attacker confirms in advance whether an attachment and a URL will be detected by malware detection software, before executing the attack. Therefore, it is difficult to properly detect unknown malware and a new malicious URLs.

There is also a technique that detects an attack based on unnaturalness of header information of an email. This technique decides whether or not an email is a fraudulent email, based on information such as an authentication result of a sender's sending domain, a sending route, employed email software, and a country through which the email was sent. However, this technique cannot detect a spoofed email that uses a legitimate user's account.

Non-Patent Literature 1 describes a technique of detecting a spoofed email.

In the technique described in Non-Patent Literature 1, emails sent out by a sender of an email are analyzed at a lexical level, a syntactic level, and a structural level, and a profile representing an individuality of the emails is created. The lexical level involves a number of words, a number of characters per word, a number of characters in the whole text, a number of characters per line, a number of lines, a number of sentences, a frequency of an individual character in the text, a frequency of a character used for sentence termination, and so on. The syntactic level involves a number of adjectives, a number of adverbs, a number of coordinate conjunctions, a number of past participles, and so on. The structural level involves information such as signature, address, and phone number, that identifies the author; the format of the greeting; how a sentence begins; how a sentence is terminated; and so on. How a sentence begins involves a number of capital letters, a number of lowercase letters, and so on. How a sentence is terminated involves a number of sentences that use a space to punctuate the sentences, a number of sentences that use a dot to punctuate the sentences, a number of sentences that use a punctuation mark other than a dot to punctuate the sentences, a number of sentences that use a space after the sentences are terminated, and so on.

In the technique described in Non-Patent Literature 1, a profile of the sender is created from the emails received from the sender in the past. When a newly received email does not match with the profile, it is determined as a spoofed email.

CITATION LIST

Non-Patent Literature 1: Sevtap Duman, Kubra Kalkan Cakmakciy, Manuel Egelez, William Robertson and Engin Kirda: “EmailProfiler: Spearphishing Filtering with Header and Stylometric Features of Emails”, Computer Software and Applications Conference (COMPSAC), 2016 IEEE 40th Annual

SUMMARY OF INVENTION

Technical Problem

However, even using the technique described in Non-Patent Literature 1, it is not possible to detect spoofing in a case where an attacker is exactly imitating writing habits of a person to impersonate, and a case where a past email is appropriated unchanged.

An objective of the present invention is to make it possible to properly detect a targeted-attack email.

Solution to Problem

A fraudulent email decision device of the present invention includes:

an intention identification unit, with respect to a newly received incoming email as a subject email, to identify an intention of the subject email from a body of the subject email; and

an email decision unit to decide whether or not the subject email is a fraudulent email, from a relationship between another incoming email received from a same sender as a sender of the subject email and an intention, identified by the intention identification unit, of the subject email.

Advantageous Effects of Invention

In the present invention, whether or not a subject email is a fraudulent email is decided from a relationship between an intention of the subject email and another incoming email received from the same sender as the sender of the subject email. This makes it possible to properly detect a targeted-attack email.

DESCRIPTION OF EMBODIMENTS

A configuration of a fraudulent email decision device10according to Embodiment 1 will be described with referring toFIG. 1.

The fraudulent email decision device10is a computer.

The fraudulent email decision device10is provided with hardware devices which are a processor11, a memory12, a storage13, and a communication interface14. The processor11is connected to the other hardware devices via signal lines and controls these other hardware devices.

The processor11is an Integrated Circuit (IC) that performs processing. Specific examples of the processor11are a Central Processing Unit (CPU), a Digital Signal Processor (DSP), and a Graphics Processing Unit (GPU).

The memory12is a storage device that stores data temporarily. Specific examples of the memory12are a Static Random-Access Memory (SRAM) and a Dynamic Random-Access Memory (DRAM).

The storage13is a storage device that stores data. A specific example of the storage13is a Hard Disk Drive (HDD). Alternatively, the storage13may be a portable recording medium such as a Secure Digital (SD; registered trademark) memory card, a CompactFlash (registered trademark; CF), a NAND flash, a flexible disk, an optical disk, a compact disk, a blu-ray (registered trademark) disk, and a Digital Versatile Disk (DVD).

The communication interface14is an interface to communicate with an external device. Specific examples of the communication interface14are an Ethernet (registered trademark) port, a Universal Serial Bus (USB) port, and a High-Definition Multimedia Interface (HDMI; registered trademark) port.

The fraudulent email decision device10is provided with an initial filter unit21, an unknownness analysis unit22, a knownness analysis unit23, and a consistency analysis unit24, as function constituent elements. Functions of the individual function constituent elements of the fraudulent email decision device10are implemented by software.

A program that implements the functions of the individual function elements of the fraudulent email decision device10is stored in the storage13. This program is read into the memory12by the processor11and executed by the processor11. Thus, the functions of the individual function constituent elements of the fraudulent email decision device10are implemented.

A configuration of the initial filter unit21according to Embodiment 1 will be described with referring toFIG. 2.

The initial filter unit21is provided with a sender extraction unit211, a blacklist decision unit212, a content decision unit213, and a difference decision unit214, as function constituent elements. The initial filter unit21uses a blacklist216stored in the storage13.

A configuration of the unknownness analysis unit22according to Embodiment 1 will be described with referring toFIG. 3.

The unknownness analysis unit22is provided with a destination decision unit221, an identity decision unit222, a contact card decision unit223, and an open information decision unit224, as function constituent elements. The unknownness analysis unit22uses person-name dictionary data225, fixed-form sentence data226, and a recipient profile227which are stored in the storage13. The unknownness analysis unit22also uses a contact card management system30connected via the communication interface14.

A configuration of the knownness analysis unit23according to Embodiment 1 will be described with referring toFIG. 4.

The knownness analysis unit23is provided with a personal identification decision unit231and a topic decision unit232as function constituent elements. The topic decision unit232is provided with a profile generation unit233and a matching decision unit234. The knownness analysis unit23uses a sender profile235stored in the storage13.

A configuration of the consistency analysis unit24according to Embodiment 1 will be described with referring toFIG. 5.

The consistency analysis unit24is provided with an intention identification unit241, a rule application unit242, and an email decision unit243, as function constituent elements. The consistency analysis unit24uses a consistency decision rule244stored in the storage13.

InFIG. 1, only one processor11is illustrated. However, there may be a plurality of processors11. The plurality of processors11may cooperate with each other to execute the program that implements the individual functions.

Operations of the fraudulent email decision device10according to Embodiment 1 will be described with referring toFIGS. 6 to 16.

The operations of the fraudulent email decision device10according to Embodiment 1 correspond to a fraudulent email decision method according to Embodiment 1. The operations of the fraudulent email decision device10according to Embodiment 1 also correspond to a processing of a fraudulent email decision program according to Embodiment 1.

Also, an overall processing of the fraudulent email decision device10according to Embodiment 1 will be described with referring toFIGS. 1 and 6.

The initial filter unit21, with respect to a newly received incoming email as an analysis-target subject email, confirms whether an apparently fraudulent feature is included in the subject email. If an apparently fraudulent feature is included, the initial filter unit21excludes the subject email from processes of step S2and beyond, as a fraudulent email.

The initial filter unit21decides whether a sender of the subject email is an unknown sender with whom no email transaction was made in the past, or a known sender with whom email transaction was made in the past.

If the sender of the subject email is an unknown sender, the initial filter unit21advances the processing to step S3. On the other hand, if the sender of the subject email is a known sender, the initial filter unit21advances the processing to step S4.

The unknownness analysis unit22decides whether or not the subject email is an email that has a feature unsuitable for an email from a party to exchange emails with for the first time. If the subject email is an email that has an unsuitable feature, the unknownness analysis unit22excludes the subject email from the process of step S5, as being a fraudulent email.

The knownness analysis unit23decides whether or not a topic of the subject email is a topic that has been discussed in the past with the sender of the subject email.

The consistency analysis unit24analyzes consistency of the email transaction from a relationship between the subject email and an email received in the past from the sender of the subject email. If the email transaction includes contradiction, the consistency analysis unit24decides that the subject email is a fraudulent email.

A processing of the initial filter unit21according to Embodiment 1 will be described with referring toFIGS. 2 and 7.

The processing of the initial filter unit21corresponds to processes of step S1and step S2ofFIG. 6. Specifically, processes of step S11to step S14correspond to a process of step S1ofFIG. 6. A process of step S15corresponds to a process of step S2ofFIG. 6.

The sender extraction unit211extracts information on the sender of the subject email. Specifically, the sender extraction unit211extracts information of “From” field and information of “Received” field from header information of the subject email, as information on the sender and information on a server through which the subject email was sent.

The blacklist decision unit212decides whether or not at least either one of the sender and the server through which the subject email was sent, the sender and the server being extracted in step S11, is included in the blacklist216. The blacklist216is created beforehand. The blacklist216may be added each time a sender who is sending a fraudulent email is found.

If at least either one of the sender and the server through which the subject email was sent is included in the blacklist216, the blacklist decision unit212decides that the subject email is a fraudulent email, and ends the processing. On the other hand, if the sender and the server through which the subject email was sent is not included in the blacklist216, the blacklist decision unit212advances the processing to step S13.

The content decision unit213decides whether at least either one of an attachment and a URL is included in the subject email.

If none of an attachment and a URL is included, the content decision unit213decides that the subject email is not a fraudulent email, and ends the processing. On the other hand, if at least either one of an attachment and a URL is included, the content decision unit213advances the processing to step S14.

The difference decision unit214, with respect to one of the attachment and the URL that is decided in step S13as being included, as a subject, decides whether or not a content of the subject matches with a content of a body of the email. Specifically, if an attachment is the subject, the difference decision unit214decides whether or not the content of the attachment matches with the content of the body. On the other hand, if an URL is the subject, the difference decision unit214decides whether or not the content of a Web site indicated by the URL matches with the content of the body. To decide whether or not the content matches with the content of the body, it is possible to employ a technique described in a literature by Hiroki NISHIKAWA, Takumi YAMAMOTO, Kiyoto KAWAUCHI, “Detection method what suspicious email is based on email context”, Computer Security Symposium2017,1B3-3.

If there is no consistency, the difference decision unit214decides that the subject email is a fraudulent email, and ends the processing. On the other hand, if there is consistency, the difference decision unit214advances the processing to step S15.

A knownness decision unit215decides whether or not the sender of the subject email is included among the senders of the past incoming emails, thereby deciding whether the sender of the subject email is an unknown sender or a known sender.

Specifically, the knownness decision unit215searches for the sender of the subject email from sender email addresses or sender names in “From” fields of all the past emails stored in the storage13. The past emails may be stored in the storage13or may be stored in an external storage device connected via the communication interface14. If the sender of the subject email is not found, the knownness decision unit215decides that the sender of the subject email is an unknown sender, and advances the processing to step S3ofFIG. 6. On the contrary, if the sender of the subject email is found, the knownness decision unit215decides that the sender of the subject email is a known sender, and advances the processing to step S4ofFIG. 6.

A processing of the unknownness analysis unit22according to Embodiment 1 will be described with referring toFIGS. 3 and 8.

The processing of the unknownness analysis unit22corresponds to the process of step S3ofFIG. 6.

The destination decision unit221decides whether or not the destination of the body of the subject email includes the name of the recipient of the subject email. Specifically, when the subject email is an English email, the destination decision unit221decides whether or not a description of the destination such as “Dear Mr. Suzuki” at the beginning of the body includes the name of the recipient. The destination decision unit221refers to the fixed-form sentence data226indicating typical description styles of a destination and so on, to identify description of the destination. Assume that the name of the recipient is stored in advance in the memory12or the like.

If the name of the recipient is not included, the destination decision unit221decides that the subject email is a fraudulent email, and ends the processing. On the other hand, if the name of the recipient is included, the destination decision unit221advances the processing to step S22. There is a case where the subject email contains a plurality of destinations as in a case where the subject email is addressed to a mailing list. Hence, fixed-form sentences such as “dear all”, “dear folks”, and “dear person who may concern” are registered in advance. In this case, the subject email is not decided as a fraudulent email even if the destinations do not include the name of the recipient.

The identity decision unit222decides whether or not the sender of the subject email states his or her name in the body. Specifically, the identity decision unit222searches the body for a name other than the name of the recipient. In this case, the identity decision unit222refers to the person-name dictionary data225to search the body for the name other than the name of the recipient. Also, the identity decision unit222may refer to the fixed-form sentence data226to search the body for a typical description style that is employed when the sender states his or her name by saying, for example, “My name is XX”, “I'm XX”, and signature, thereby finding a name not listed in the person-name dictionary data225.

If the sender does not state his or her name in the body, the identity decision unit222decides that the subject email is a fraudulent email, and ends the processing. On the other hand, if the sender states his or her name in the body, the identity decision unit222advances the processing to step S23.

The contact card decision unit223decides whether or not the recipient has exchanged contact cards with the sender of the subject email. Specifically, if the name of the sender of the subject email is registered in the contact card management system30connected via the communication interface14, the contact card decision unit223decides that the recipient has exchanged contact cards with the sender. The contact card management system30is an external system that manages contact cards. The contact card decision unit223may decide whether or not someone of an organization the recipient belongs to, not the recipient, has exchanged contact cards with the sender.

If contact cards have been exchanged, the contact card decision unit223decides that the subject email is a contact-card-existing email, and advances the processing to step S5ofFIG. 6. On the other hand, if exchange of contact cards has not been made, the contact card decision unit223advances the processing to step S24.

The open information decision unit224decides whether or not open information concerning the sender of the subject email includes a content related to the recipient.

Specifically, the open information decision unit224utilizes an Open Source Intelligence (OSINT) tool to collect open information concerning the sender of the subject email. The open information decision unit224decides whether or not the open information includes a content related to the recipient, based on whether or not the collected open information includes the information registered in the recipient profile227. In the recipient profile227, words concerning matters such as business, project, and hobby of the recipient are registered in advance in the form of a list.

According to a specific example, with respect to a Web page collected by OSINT, the open information decision unit224uses a keyword extraction technique such as Term Frequency-Inverse Document Frequency (TF-IDF) to extract a keyword of the page. Then, the open information decision unit224uses a word similarity calculating technique such as Word2Vec, to calculate a similarity between the keyword and a word in the profile. If a first reference number or more of pairs whose calculated similarity is equal to a first threshold or more are included, the open information decision unit224decides that the collected open information includes the information registered in the recipient profile227, and concludes that the content of the open information is related to the recipient. On the other hand, if the first reference number or more of pairs whose calculated similarity is equal to the first threshold or more are not included, the open information decision unit224decides that the collected open information does not include the information registered in the recipient profile227, and concludes that the content of the open information is not related to the recipient.

When the content of the open information is related to the recipient, the open information decision unit224decides that the subject email is a related-field email, and advances the processing to step S5ofFIG. 6. On the other hand, when the content of the open information is not related to the recipient, the open information decision unit224decides that the subject email is a fraudulent email, and ends the processing.

A processing of the knownness analysis unit23according to Embodiment 1 will be described with referring toFIGS. 4 and 9.

The processing of the knownness analysis unit23corresponds to the process of step S4ofFIG. 6.

The personal identification decision unit231decides from the style of the body of the subject email whether or not the body is written by the sender in person. Specifically, the personal identification decision unit231uses the technique described in Non-Patent Literature 1 and so on to decide whether or not the body is written by the sender in person.

If the body is not written by the sender in person, the personal identification decision unit231decides that the subject email is a fraudulent email, and ends the processing. On the other hand, if the body is written by the sender in person, the personal identification decision unit231advances the processing to step S32.

The topic decision unit232decides whether or not the topic of the subject email is included in another incoming email received from the same sender as the sender of the subject email. In other words, the topic decision unit232decides whether or not the topic of the subject email is a topic that has been discussed in the past between the recipient and the sender.

If the topic of the subject email is included in another incoming email, the topic decision unit232decides that the subject email is a topic matching email, and advances the processing to step S5ofFIG. 6. On the other hand, if the topic of the subject email is not included in another incoming email, the topic decision unit232decides that the subject email is a topic non-matching email, and advances the processing to step S5ofFIG. 6.

The topic decision process (step S32ofFIG. 9) according to Embodiment 1 will be described in detail with referring toFIGS. 4, 10, and 11. The topic decision process includes a processing of the profile generation unit233and a processing of the matching decision unit234.

First, a processing of the profile generation unit233according to Embodiment 1 will be described with referring toFIGS. 4 and 10.

The profile generation unit233extracts the bodies from all the past incoming emails.

The profile generation unit233extracts features from the bodies of the individual incoming emails extracted in step S41. The features may include a topic selection probability that uses Latent Dirichlet Allocation (LDA) and a keyword based on TF-IDF.

The profile generation unit233clusters the past incoming emails into a plurality of clusters according to the features extracted in step S42. The profile generation unit233may use, as a clustering algorithm, an existing technique such as KMEANS and Density-based spatial clustering of applications with noise (DBSCAN).

The profile generation unit233, with respect to the incoming emails clustered into the plurality of clusters in step S43, as learning data, assigns discriminators of the clusters which the incoming emails belong to, to the learning data as labels of the incoming emails.

The profile generation unit233performs supervised learning based on the learning data labelled in step S44. As a supervised learning algorithm, an existing scheme such as SVM and random forest may be employed. Hence, a discrimination tool that discriminates which cluster the incoming email is classified as is generated.

Processes of step S46to step S49are executed on the sender of each incoming email as a subject.

The profile generation unit233extracts the bodies from, among all the past incoming emails, incoming emails that are sent by the sender of the subject.

The profile generation unit233extracts features from the bodies of the individual incoming emails extracted in step S46, by the same method as that of step S42.

The profile generation unit233, with respect to the individual incoming emails from which extraction has been done in step S46, as a subject, classifies the subject incoming emails, based on the discrimination tool generated in step S45and the features extracted from the subject incoming emails in step S47. Then, the profile generation unit233assigns to the subject incoming emails the discriminators of the clusters which the subject incoming emails are classified into, as labels.

The profile generation unit233writes a list of labels assigned to the individual incoming emails from which extraction has been done in step S46, to the sender profile235as a profile of the subject sender.

A processing of the matching decision unit234according to Embodiment 1 will be described with referring toFIGS. 4 and 11.

(Step S51: Sender Extraction Process) The matching decision unit234extracts information on the sender of the subject email. The information on the sender is extracted by the same method as that of step S11ofFIG. 7. Note that the subject email will be denoted by M0. Also, a sender indicated by the extracted information on the sender will be denoted by P. That is, the sender of the subject email M0will be denoted by P.

The matching decision unit234reads out a profile of the sender P from the sender profile235.

The matching decision unit234identifies, among all the past incoming emails, incoming emails about the sender P. The matching decision unit234extracts X of incoming emails from among the incoming emails about the identified P, in the order from the most recent one received, where X is an integer of 1 or more. The extracted X of incoming emails will be denoted by M1, . . . , MX in the order from the most recent one received.

The matching decision unit234extracts a body from the subject email M0and bodies from the extracted X of incoming emails M1, . . . , MX.

The matching decision unit234extracts features from the bodies of the incoming emails M0, . . . , MX by the same method as that of step S42ofFIG. 10.

The matching decision unit234classifies the subject email M0and the incoming emails M1, . . . , MX, and assigns discriminators to the subject email M0and the incoming emails M1, . . . , MX, as labels, in the same manner as in step S48ofFIG. 10. Note that the label assigned to the subject email M0will be denoted by C0, and the labels assigned to the incoming emails M1, . . . , MX will be respectively denoted by C1, . . . , CX.

The matching decision unit234decides whether or not the label C0assigned to the subject email M0in step S55is included in the profile about the sender P which is read out in step S52.

If the label C0is not included in the profile, the matching decision unit234decides that the subject email is a topic non-matching email, and advances the processing to step S5ofFIG. 6. On the other hand, if the label C0is included on the profile, the matching decision unit234advances the processing to step S57.

The matching decision unit234decides whether or not the label C0assigned to the subject email M0in step S55is included among the labels C1, . . . , CX assigned respectively to the incoming emails M1, . . . , MX in step S55.

If the label C0is not included among the labels C1, . . . , CX, the matching decision unit234decides that the subject email is a topic non-matching email, and advances the processing to step S5ofFIG. 6. On the other hand, if the label C0is included among the labels C1, . . . , CX, the matching decision unit234decides that the subject email is a topic matching email, and advances the processing to step S5ofFIG. 6.

A processing of the consistency analysis unit24according to Embodiment 1 will be described with referring toFIGS. 5 and 12.

As a result of execution of the processing of the initial filter unit21, unknownness analysis unit22, and knownness analysis unit23, the subject emails have been classified into fraudulent emails, non-fraudulent emails, contact-card-existing emails, related-field emails, topic matching emails, and topic non-matching emails. When a subject email is classified as an email type of the contact-card-existing email, an email type of the related-field email, an email type of the topic matching email, or an email type of the topic non-matching email, the consistency analysis unit24decides whether or not the subject email is fraudulent.

The intention identification unit241identifies an intention of the subject email from the body of the subject email. The intention of the subject email is the reason the subject email was sent, which is, for example, forward, resend, forgot to attach, update, or answer. In Embodiment 1, the intention identification unit241extracts, from the body of the subject email, a word similar to a function term registered in advance, and identifies the intention expressed by the function term similar to the extracted word, as the intention of the subject email.

The rule application unit242reads out a rule corresponding to the intention identified in step S61and the email type of the subject email, from the consistency decision rule244. Rules are registered in the consistency decision rule244in advance. Rules can be added as necessary to the consistency decision rule244in the form of plug-in or the like. The rules indicate conditions for deciding the subject email as a fraudulent email. As described above, the email type is one of the contact-card-existing email, the related-field email, the topic matching email, and the topic non-matching email.

The email decision unit243decides whether or not the subject email is a fraudulent email, from a relationship between the intention of the subject email identified in step S61and another incoming email received from the same sender as the sender of the subject email.

Specifically, the email decision unit243decides whether or not the subject email is a fraudulent email, from the condition indicated by the rule read out in step S62, and another incoming email received from the same sender as the sender of the subject email.

A processing of the intention identification unit241according to Embodiment 1 will be described in detail with referring toFIGS. 5 and 13.

The processing of the intention identification unit241corresponds to step S61ofFIG. 12.

The intention identification unit241extracts the body from the subject email.

The intention identification unit241extracts a word from the body extracted in step S71. For example, the intention identification unit241performs morphological analysis on the body and extracts as a word some parts of speech such as a noun and a verb.

The intention identification unit241, with respect to each word extracted in step S72as a subject, calculates a similarity of the subject word with each function term. To calculate the similarity, a technique such as Word2Vec, which calculates a similarity of a word is used. The function terms are words each expressing the reason a subject email was sent, which are, for example, forward, resend, forgot to attach, update, and answer. The function terms are registered in advance. The function terms can be added as necessary as plug-in or the like.

The intention identification unit241decides whether or not a second reference number or more of words each with a similarity calculated in step S73that is equal to a second threshold or more are included.

If the second reference number or more of words each with a similarity that is equal to the second threshold or more are not included, the intention identification unit241decides that the subject email is not a fraudulent email, and ends the processing. On the other hand, if the second reference number or more of words each with a similarity that is equal to the second threshold or more are included, the intention identification unit241generates a list of function terms each determined as having a similarity that is equal to the second threshold or more with the word, and advances the processing to step S62ofFIG. 12.

Processes of the rule application unit242and email decision unit243according to Embodiment 1 will be described in detail with referring toFIGS. 5 and 14.

The processes of the rule application unit242and email decision unit243correspond to processes of step S62and step S63ofFIG. 12.

The rule application unit242decides whether or not all the function terms in the list generated in step S74are selected.

If all the function terms are selected, the rule application unit242decides that the subject email is not a fraudulent email, and ends the processing. On the other hand, if there is an unselected function term, the rule application unit242advances the processing to step S82.

The rule application unit242selects one unselected function term from the list.

The rule application unit242reads out a rule corresponding to the function term selected in step S82and the email type of the subject email, from the consistency decision rule244.

The email decision unit243decides whether or not the subject email is a fraudulent email, from the condition indicated by the rule read out in step S83and another incoming email received from the same sender as the sender of the subject email. In this connection, if the subject email or another incoming email satisfies the condition indicated by the rule, the email decision unit243decides that the subject email is a fraudulent email. On the other hand, if the subject email and another incoming email do not satisfy the condition indicated by the rule, the email decision unit243decides that the subject email is not a fraudulent email.

Examples of the rules registered in the consistency decision rule244will be described with referring toFIGS. 15 and 16.

FIG. 15illustrates seven rules of rule 1 to rule 7.FIG. 16illustrates rules applied per function terms and email type.FIG. 16illustrates rules for email types which are the contact-card-existing email and the related-field email. Rules are set likewise for email types which are the topic matching email and the topic non-matching email.

For example, when a contact-card-existing email includes a word related to a function term “resend”, rule 1 is applied.

Rule 1 is a rule that decides a subject email as a fraudulent email if a body of the subject email includes a function term. The process of step S84ofFIG. 14is executed only when the body of the subject email includes a function term. Hence, when rule 1 is applied, the subject email is always decided as a fraudulent email. This is because it is unnatural if an email is suddenly “resent” from a person with whom no regular transaction is made.

For example, when a contact-card-existing email includes a word related to a function term “forward”, rule 2 is applied.

According to rule 2, the email decision unit243extracts a topic and a keyword from the body of the subject email, a content of an attachment, and a content of the URL, and decides whether or not the topic matches with a topic of an email exchanged with the sender in the past. Whether a topic matches or not is decided by a method that is the same as the processing of the matching decision unit234. If the topic does not match, the subject email is decided as a fraudulent email. This is because it is unnatural if information on a non-related topic is suddenly sent from a person with whom no regular email transaction is made.

For example, if a related-field email includes a word concerning the function term “resend”, rule 3 or rule 4 is applied.

According to rule 3, the email decision unit243decides whether or not an email with the same content has been sent from the same sender immediately previously. If such an email has not been sent, the related-field email is decided as a fraudulent email. This is because it is unnatural if an email having the same content has not been sent in the past prior to an email notifying resend. Decision of whether an email has the same content or not can be done by deciding that an email includes sentences of the same content if its similarity is equal to a threshold or more, utilizing an existing technique such as Doc2Vec.

According to rule 4, the email decision unit243decides whether or not the same email being sent from the same sender immediately previously has the same attachment. If the same email has a different attachment, the email decision unit243decides that the related-field email is a fraudulent email. This is because it is unnatural if an email is sending a different attachment in spite of being a resent email.

For example, when a related-field email includes a word concerning a function term “forget to attach”, rule 3 or rule 5 is applied.

According to rule 5, the email decision unit243decides whether or not the same email being sent from the same sender immediately previously has the same attachment. If the same attachment is attached, the email decision unit243decides that the related-field email is a fraudulent email. This is because it is unnatural if an attachment is attached despite that it should have been forgotten to be attached.

As described above, the fraudulent email decision device10according to Embodiment 1 decides whether or not a subject email is a fraudulent email, from a relationship between an intention of the subject email and another incoming email received from the same sender as the sender of the subject email. This makes it possible to properly detect a targeted-attack email.

In particular, also in a case where the writing habits of a person to impersonate are exactly imitated and in a case where a past email is appropriated unchanged, a fraudulent email can be detected according to a condition such as non-matching of a topic of the incoming email and a contradiction in the transaction. Therefore, it is possible to prevent malware contamination by a sophisticated attack attempted via an email.

In particular, the fraudulent email decision device10according to Embodiment 1 decides whether a subject email is a fraudulent email, based on a function term indicating an intention of the subject email and a condition according to a mail type. As a result, a targeted attack email can be detected more properly.

In Embodiment 1, the individual constituent elements are implemented by software. However, according to Modification 1, the individual constituent elements may be implemented by hardware. Modification 1 will be described regarding its difference from Embodiment 1.

A configuration of a fraudulent email decision device10according to Modification 1 will be described with referring toFIG. 17.

In a case where individual function constituent elements are implemented by hardware, the fraudulent email decision device10is provided with an electronic circuit15, in place of a processor11, a memory12, and a storage13. The electronic circuit15is a dedicated circuit that implements functions of the individual constituent elements and functions of the memory12and storage13.

The electronic circuit15is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a Gate Array (GA), an Application Specific Integrated Circuit (ASIC), or a Field-Programmable Gate Array (FPGA).

The function constituent elements may be implemented by one electronic circuit15. Alternatively, the function constituent elements may be implemented by a plurality of electronic circuits15through distribution.

According to Modification 2, some of the function constituent elements may be implemented by hardware, and the remaining function constituent elements may be implemented by software.

The processor11, the memory12, the storage13, and the electronic circuit15are referred to as processing circuitry. That is, functions of the individual function constituent elements are implemented by processing circuitry.

An intention of a subject email is identified from the entire body of the subject email. This is where Embodiment 2 is different from Embodiment 1. In Embodiment 2, this difference will be described, and description on the same matters will be omitted.

A configuration of a consistency analysis unit24according to Embodiment 2 will be described with referring toFIG. 18.

The consistency analysis unit24is different from the configuration illustrated inFIG. 5in that an intention identification unit241is provided with an intention learning unit245, an intention estimation unit246, and a learning email247.

Operations of the fraudulent email decision device10according to Embodiment 2 will be described with referring toFIGS. 19 and 20.

The operations of the fraudulent email decision device10according to Embodiment 2 correspond to a fraudulent email decision method according to Embodiment 2. The operations of the fraudulent email decision device10according to Embodiment 2 also correspond to a fraudulent email decision program according to Embodiment 2.

A processing of the intention learning unit245according to Embodiment 2 will be described with referring toFIG. 19.

The intention learning unit245extracts all paragraphs from email data included in the learning email247. Data of bodies of a plurality of emails in which labels indicating function terms are attached to each paragraph are registered in the learning email247.

The intention learning unit245extracts features from each paragraph extracted in step S91, by the same method as that of step S42ofFIG. 10.

The intention learning unit245performs supervised learning based on the features extracted from each paragraph in step S92and the labels attached to each paragraph, in the same manner as in step S45ofFIG. 10. Here, a discrimination tool that discriminates which label a feature corresponds to is generated. In other words, a discrimination tool that discriminates which function term a feature corresponds to is generated.

A processing of the intention estimation unit246according to Embodiment 2 will be described with referring toFIG. 20.

The intention estimation unit246extracts the body from the subject email.

The intention estimation unit246extracts paragraphs from the body extracted in step S101.

The intention estimation unit246extracts features from each paragraph extracted in step S102, by the same method as that of step S42ofFIG. 10.

The intention estimation unit246, with respect to each paragraph as a subject, calculates a discrimination score, by which a subject paragraph corresponds to each function term, based on the discrimination tool generated in step S93and the features extracted from the subject paragraph in step S103.

The intention estimation unit246decides whether or not a function term whose discrimination score calculated in step S104is equal to a third threshold or more is included.

If a function term whose discrimination score is equal to the third threshold or more is included, a list of function terms whose discrimination scores are equal to the third threshold or more is generated. On the other hand, if a function term whose discrimination score is equal to the third threshold or more is not included, the subject email is decided as not being a fraudulent email, and the processing is ended.

It is not just that a list of function terms which each paragraph is discriminated as corresponding to is generated, but a list of function terms whose discrimination scores are equal to the third threshold or more is generated. As a result, a list of only function terms which the paragraph may correspond to by a possibility of a certain level or more is generated.

In Embodiment 1, the intention identification unit241identifies an intention of a subject email by extracting a word that is similar to a function term registered in advance. In this case, if a word similar to the function term is unintentionally used in the body, an intention will be detected erroneously.

In contrast to this, the fraudulent email decision device10according to Embodiment 2 identifies an intention from the whole body of the email. Therefore, even if a word similar to the function term is unintentionally used in the body, the intention can be identified properly.

REFERENCE SIGNS LIST