Patent ID: 8677490

Claim:
A method of distinguishing an abnormal e-mail, comprising the steps of: decoding, through the use of a computer processor, received e-mail data; analyzing the decoded e-mail data and classifying a header of the analyzed e-email data according to header fields of the header in the email data; determining whether each of the header fields is normal or abnormal; assigning one of a first value indicating a normal header field and a second value indicating an abnormal header field to the each of the header fields, according to the determination results; applying a logical inference rule to the header fields given the one of the first value and the second value, the logical inference rule being a set of conditional operations that determine the e-mail data as normal or abnormal based on the first value or the second value given to the each of the header fields; and determining that the e-mail data is normal or abnormal based on a result of the applying.