| 摘要 |
PROBLEM TO BE SOLVED: To provide a mass mail detection device which operates at a high speed but requires no preliminary creation of a rule and no learning. SOLUTION: An electronic mail collecting means 51 analyzes an electronic mail distribution protocol flowing on a network and extracts an electronic mail body from an electronic mail traffic flowing on the network. Then, a feature quantity conversion means 52 computes several hash values from a preprocessed electronic mail body according to specifications when the electric mail is displayed to a recipient, and the hash values are made to be the feature quantity of the electronic mail. Finally, a mass mail detection means 53 compares a past electronic mail that it stores with a new electronic mail that it receives and determines the degree of the similarity between the mails according to a specific reference. If the similarity exists, the mass mail detection means 53 determines the electronic mails to be candidates for a mass mail (a similar mail) and determines a certain number or more of similar mails to be a mass mail. COPYRIGHT: (C)2009,JPO&INPIT
|
