| 摘要 |
<P>PROBLEM TO BE SOLVED: To provide a mass mail detection device which operates at a high speed but requires no preliminary creation of a rule and no learning. <P>SOLUTION: An electronic mail collecting means 51 analyzes an electronic mail distribution protocol flowing on a network and extracts an electronic mail body from an electronic mail traffic flowing on the network. Then, a feature quantity converting means 52 computes several hash values from the electronic mail body, and the hash values are made to be the feature quantity of the electronic mail. Finally, a mass mail detection means 53 compares a past electronic mail that it stores with a new electronic mail that it receives and determines the degree of the similarity between the mails according to a specific reference. If the similarity exists, the mass mail detection means 53 determines the electronic mails to be candidates for a mass mail (a similar mail) and further determines a certain number or more of similar mails to be a mass mail. <P>COPYRIGHT: (C)2005,JPO&NCIPI |
