MISREPRESENTATION MAIL DETECTION DEVICE, CYBER ATTACK DETECTION SYSTEM, COMPUTER PROGRAM AND MISREPRESENTATION MAIL DETECTION METHOD

摘要

PROBLEM TO BE SOLVED: To provide a misrepresentation mail detection device capable of determining misrepresentation mail misrepresenting an internal domain while learning an exclusion domain which can be excluded as a non-unjust domain.SOLUTION: The misrepresentation mail detection device includes: a creator domain acquisition part 23 for acquiring a creator domain 248b to which a creator described in the creator field of electronic mail is belonging; a sender domain acquisition part 241 for, when the creator domain 248b acquired by the creator domain acquisition part 23 is an internal domain, acquiring a sender domain to which the sender of the electronic mail is belonging; an internal creation counting part 242 for counting the number of internal creation mail whose creator domain 248b is the internal domain among one or more electronic mail whose sender domain is the same as that of mail to be determined; and a misrepresentation determination part 28 for, when the number of internal creation mail counted by the internal creation counting part 242 is smaller than an exclusion determination value 2422, determining that there is possibility that the mail to be determined is misrepresentation mail misrepresenting the creator.