CN101060421A - A garbage mail processing system and garbage mail sorting method - Google Patents

Abstract

The present invention relates to a spam processing system, which includes a spam filter module and a virus analyzer module arranged in the mail server SMTP, and also includes: (1) a mailbox monitor module, which is used to monitor the operation behavior of the mailbox and analyze the mail (2) a trust degree database that records mail trust degree values by mail addresses; and (3) a trust degree evaluation module, which calls the trust degree value of the current mail stored in the credit degree database and compares it with a predetermined reference trust degree value Sorting the current mail; the mailbox filter module modifies the trust value of the mail stored in the trust database according to the processing results of the filter module, the virus analyzer module, and the trust evaluation module, so as to reduce the number of being sorted as garbage Mail trust value of mail, increase the trust value of mail sorted as normal mail. The application of the system of the invention can improve the effect of processing and sorting mails, and enhance the prevention of malicious visits.

Description

A spam processing system and method for sorting spam

technical field

The invention relates to the processing technology in electronic information transmission, in particular to the processing and sorting of junk mails and the effective prevention of malicious visitors.

technical background

With the advent of the network information society, spam has been bothering the administrators of mailbox servers and the majority of users. In order to eliminate the increasing amount of spam, the manager of the mailbox server has designed a whitelist and blacklist audit system, which blacklists the email addresses and domain names that are at fault, and puts absolutely trustworthy email addresses and domain names into the whitelist, so that they can be processed quickly mail. The existing white and black list technologies are too absolute and cannot effectively solve the situation of dynamic changes in black and white lists. If a spam sender uses a stolen mailbox (whitelist mailbox) to send spam, or the machine of a whitelist user is abnormal (poisoned or Trojan horse), then the whitelist and blacklist will bring serious negative effects. The generation of member addresses of the existing white and black lists is too artificial, and it cannot solve the problem of automatic generation and addition at any time.

In the prior art, a spam filtering system or a virus analysis system is also installed in the STMP of the mailbox server, which can effectively intercept various illegal keywords and suspicious codes, but cannot make an absolutely reliable analysis of the passed emails. conclusion. The existing mail filtering system is too scattered (blacklist, whitelist, spam filter, and virus filter operate independently), and it is impossible to produce a dynamic comprehensive evaluation of the current reliability of the target object, and it is impossible to evaluate the object based on the comprehensive impact of time , to judge. That is, the judgment of the comprehensive impact of time cannot be reflected in the existing mail filtering system.

Existing filters only use the content or structure distinguishing features of normal emails and spam emails to filter. If the characteristics of the recipient's attitude toward normal mail and spam can be used to affect the filtering judgment process, the performance of the entire filtering system can be greatly improved. But the existing mail filtering system does not have this ability.

Contents of the invention

The purpose of the present invention is to solve the problem that the generation of black and white lists in the existing spam processing is basically done manually, and cannot adapt to the dynamic changes of black and white lists, and the temporary dynamic random characteristics of spam, resulting in malicious senders being arrested. The effective interception of the blacklist cannot last long.

In order to solve the above problems, the invention provides a spam processing system, the system includes a spam filter module and a virus analyzer module arranged in the mail server SMTP, it is characterized in that: it also includes:

(1) Mailbox monitor module, used to monitor the operation behavior of mailboxes and sort mails;

(2) a trust degree database that records mail trust degree values according to mail addresses; and

(3) degree of trust evaluation module, this module transfers the degree of trust value of the current mail stored in the credit degree database and the predetermined reference degree of trust value to compare and sort out the current mail;

The mailbox filter module modifies the trust value of the mail stored in the trust database according to the processing results of the filter module, the virus analyzer module, and the trust evaluation module, and reduces the trust degree of the mail sorted as spam value, increases the confidence value of messages that are sorted as clean.

Preferably, the evaluation method of the trust evaluation module is an absolute trust evaluation or a relative trust evaluation.

Preferably, in the initial state, the trust value stored in the trust database is low.

Preferably, domain-level trust relationship data is stored in the trust database;

The adjudication scope of the email monitor module is the domain where the email address is located, that is, the email monitor module collects the email address forwarded to the current email, and modifies the trust degree data of the email address forwarded to the current email according to the sorting result of the current email.

In the present invention, the mail trust degree judgment system in the junk mail processing system refers to the evaluation mechanism of personal credit in the society for reference, and establishes a set of comprehensive evaluation mechanism to the mail source address and domain, except including the existing junk mail filtering engine, In addition to the impact of the anti-virus engine on the evaluation of source addresses and domains, it also has an original mailbox monitoring system that is influenced by the comprehensive impact of joining time and the recipient's attitude towards normal emails and spam emails. Judgment Two levels of trust judgment are made on emails to achieve an email trust database formed by the accumulation of time and history. In fact, it is a dynamic database containing automatically generated black and white lists. Among the above systems, spam filtering system, virus analysis system, and mailbox monitoring system are all judges of trust. Every judgment will have an impact on the mail trust database, which will be continuously updated, and has a significant supporting role in accurately blocking spam.

The present invention also provides a kind of method of sorting spam, the system that this method applies comprises through blacklist, white list examination module, spam filter module, virus analyzer module, it is characterized in that: this method comprises steps:

(1) According to the address of the mail, find out the trust value of the corresponding source address from the trust degree database and compare it with the set range, if it is greater than the maximum value of the set range, it is judged as a normal mail, and the mail is checked into the normal mailbox; The judgment below the minimum value of the set range is spam, and the mail is checked into the junk mailbox; the step (2) is carried out between the maximum and minimum values of the set range;

(2) After the garbage filter module and the virus analyzer module are further sorted and processed, during the two filtering and sorting processes, if any one filter is unqualified, the mail will be judged as spam, and it will be sorted into the junk mailbox. Perform step (3) if the filtering is qualified for the second time;

(3) Compare the trust degree value corresponding to the source address in the trust degree database with the average value of the maximum and minimum values in the set range, and the mails greater than the average value are judged as normal mails, and the mails are sorted into normal mailboxes, and those less than The mail with the average value is judged as spam, and the mail is checked into the junk mailbox;

(4) According to the results of mail processing, the trust value corresponding to the mail source address in the trust database is revised, the trust value corresponding to the normal mail address is increased, and the trust value corresponding to the spam address is reduced.

Preferably, for each judgment result made in the sorting process, the trust value corresponding to the mail source address in the trust database is revised.

Preferably, after the server receives the email, it first checks the records in the credit database to determine whether it is a first-time visitor, if not, then proceed to step (1) for processing, if so, first assign a low e-mail address corresponding to the first-time visitor email address in the supporting database trust value, and then turn to step (1) for processing.

Preferably, the step of revising the trust value corresponding to the mail source address in the trust database further includes:

According to the increase or decrease of the trust value corresponding to the source address of the current mail, the obtained trust value of other mail addresses forwarding the current mail is increased or decreased.

The positive effect of the present invention is to form an effective evaluation system for the overall trust degree of the target object in the mail server, to evaluate the reliability of the received mail with the trust degree of the mail, in fact, with the trust degree of the sender, which can be used in In the existing mail identification system, the filter interception rate can be effectively improved and the misjudgment rate can be reduced. The more important significance is that the evaluation system replaces the absolute black and white lists with dynamic credit changes, which has a higher adaptive ability, can adapt to the dynamically changing email environment, and can solve the problem of automatic black and white lists. The system can reflect the influence of the cumulative effect of historical time. The cumulative effect of historical time will make the trust of the target object tend to be able to correctly express whether it is reliable, so it can distinguish emails more accurately, and the principle of human beings is more suitable for filtering Spam with dynamic sender characteristics. In this e-mail trust degree judgment system, it is more scientific and effective than the existing system to comprehensively add the influence of people's different emotional processing attitude characteristics on normal e-mails and spam e-mails. The cumulative effect on the domain under long-term application and the application of the delivery principle help to quickly form a trust relationship network of security target objects at the system level, making it more difficult for spam initiators to infiltrate.

Description of drawings

Fig. 1 is an illustration of mail judgment according to the mailbox trust value in the supporting database.

Fig. 2 is a schematic diagram of implementing trust evaluation and mail judgment in the spam processing system.

Fig. 3 is a schematic diagram of sorting spam according to the present invention.

Figure 4 is an example of a monitor module extended to domain-level monitoring.

In the figure, 1 Absolute Trust Judgment, 2 Spam Filter Module, 3 Virus Filter Module, 4 Mail Monitor Module, 5 Relative Trust Judgment, 6 Trust Degree Database, 7 Normal Mailbox, 8 Junk Mailbox, A9 User, B10 User , C11 user, 12 receiving system.

Detailed ways

How to achieve the object of the present invention will be further described below in conjunction with the accompanying drawings.

In order to state the content of the invention more concisely and clearly, special terms are firstly introduced.

Email trustworthiness: it is used to represent the trustworthiness of the target (for the email system, the target is the sender or sending domain). The lower the email trust value, the more unreliable the target is, on the contrary, the higher the trust value, the more reliable it is. In this mail trust degree judgment system, reliable means that the more reliable the possible probability of a normal mail is, the higher the probability that it is a normal mail, and vice versa, the lower the probability that it is a normal mail. In the email trust system, the principle of human beings is evil is based on the fact that spam senders have a low degree of trust and often change addresses.

Trust judge: In the trust judgment system, the trust judge acts as a judge and can judge all actions. The determination of the behavior will produce a judgment result, which directly affects the change of the trust value of the target.

Trust Judgment: A judgment made by the trust judge on whether the behavior of the target object violates the credit will produce three effects on the target object: legal or illegal, and undeterminable, which correspond to three types of results: increase in credit, sharp decline in credit, and unchanged credit Credit value change results. After the long-term cumulative effect of trust judgments, the trust degree of the object's mail tends to be able to correctly express whether it is reliable.

Trust Judgment: An evaluation and judgment made by the trust degree judgment system based on the trust degree of the current target object whether a certain email behavior is reliable, divided into two types: absolute trust judgment and relative trust judgment.

Absolute Trust Judgment: Based on the trust degree of the target object, make an absolute judgment on the nature of a certain behavior, and produce three results: reliable, unreliable, and undetermined. Its characteristic is that only when the trust degree is very obviously close to the minimum or maximum value, and it is already obvious whether the performance is reliable, can a reliable or unreliable judgment result be made, while the rest are all judged as undetermined.

Relative trust judgment: It is based on the trust degree of the target object to predict the reliability of a certain behavior, and produce two prediction results: possibly reliable and possibly unreliable. Its characteristic is that as long as one of the two probabilities of reliability and unreliability is greater than the other, the one with the higher probability will be recognized and a relative prediction will be made.

See Figure 1. In Fig. 1, a is the minimum value of the preset trust degree, c is the maximum value of the preset trust degree, and b is the middle value of the preset trust degree. In the judgment of absolute confidence, if it is less than a, it will be judged as absolutely unreliable, if it is greater than c, it will be judged as absolutely reliable, and if it is between a-c, it will be judged as undetermined. In the judgment of relative confidence, the judgment between a-b is probably unreliable, and the judgment between b-c is probably reliable.

The core of the present invention lies in: combining trust evaluation, mail judgment and system-level expansion to establish a comprehensive evaluation mechanism for mail source addresses and domains. In addition to the influence of source address and domain evaluation, it also has the original comprehensive influence of joining time, the influence of recipients' attitude towards normal emails and spam emails, and judges emails at two levels: absolute trust judgment and relative trust judgment. Splitting to achieve better adaptive classification results than existing ones.

The present invention involves in the spam processing system: a spam filter module 2, a virus filter module 3, a mail monitor module 4, a specially set trust degree database 6 and a mail receiving system 12 of the prior art.

Fig. 2 is a schematic diagram of implementing trust evaluation and mail judgment in the spam processing system. Wherein, the spam filter module 2, the virus mail filter module 3, and the mail monitor module 4 judge whether the mail is credible or not, and store the trust degree data in the trust degree database 6. In the initial state, trust degree is low.

The spam filter module 2 determines whether the mail is spam by the spam filtering engine, thereby rewarding (increasing credit) and punishing (reducing credit) the mail source address and domain;

The virus mail filter module 3 judges whether the mail contains suspicious codes through the virus filtering engine, so as to reward and punish the source address and domain of the mail.

The mail monitor module 4 is based on the mailbox owner's processing behavior characteristics of two different mails, normal mail and junk mail. The specific implementation can summarize a rule set in the form of a mailbox operation behavior rule set, so as to determine the source address of the mail, The domain rewards and punishes. For example: emails in a normal mailbox will be deleted within a few seconds of opening, or even deleted without being opened, indicating that there is a tendency to dislike it, so the sender will be punished; opening more than a certain amount or If there is a reply or forwarding operation, it means that there is a tendency to like and pay attention to it, so a reward ruling will be issued to the sender; if the email in the trash box is opened beyond a certain point or is transferred to a normal mailbox, it means that there is like and concern about it Tendency, a reward ruling will be issued to the sender; sending an email indicates a friendly tendency to the recipient, and a reward ruling will be generated for it.

In conjunction with Fig. 2 and Fig. 3, among the present invention, the sorting method to spam comprises:

(1) After the mail receiving system 12 receives the mail, it transfers the trust degree value of the corresponding source address from the trust degree database 6 according to the address of the mail, and carries out absolute trust judgment. Taking Fig. 1 as an example, if it is greater than the preset c value, judged to be a normal email, sent directly to the normal mailbox 7, that is, the target address mailbox, if it is less than the preset a value, it will be sent directly to the junk mailbox 8, and c can be set to 75%-95 of 2b according to the specific situation % size, the larger the maximum value is set, the higher the trustworthiness. The set minimum value can be set to 5%-25% of 2b according to the specific situation. The smaller the set minimum value, the lower the trust degree. If the trust value of the address corresponding to the email is between a and c, proceed to step (2).

(2) Send the mails with the trust value between a and c to the spam filter module 2 and the virus filter module 3 for virus filtering, if any filter is unqualified, the mail is sent to the spam mailbox 8; If both layers of filtration pass, proceed to step (3).

(3) Call out the trust value of the corresponding source address in the supporting database 6 again, and make a relative trust judgment. Still taking Figure 1 as an example, the judgment greater than the b value is normal mail, and it is sent to the normal mailbox 7, that is, the target Mailbox, if the value is less than b, it is judged as spam and sent to spam mailbox 8.

(4) After the mail is sorted into different mailboxes, the mailbox monitor module 4 will modify its trust degree value according to the processing result of the mail, and update the trust degree database 6 .

The trust relationship email system shown in Figure 3 provides support for email judgment at two levels: absolute trust judgment 1 and relative trust judgment 5 . Absolute Trust Judgment 1, which plays the qualitative role of the highest priority, classifies, judges and diverts mail behaviors according to the degree of trust. Because the judgment conditions are very harsh, it has very high accuracy and can be used to replace the existing black and white list technology. And it solves the problem of automatic generation of black and white lists, and the problem of dynamic adaptive changes. Relative trust judgment 5, which occurs when the filters cannot judge it as spam, is the lowest priority. At this time, a possibility prediction is made based on the trust degree to form the final judgment. The two-tier trust judgment is designed based on the idea that if it is obvious that it is reliable, an absolute judgment will be made immediately, and if it is not obvious, a predictive evaluation will be made at the end. In absolute trust judgment 1, it can achieve a very ideal absolute good or bad classification effect, while in relative trust judgment 5, it is the last means to improve the filtering rate.

Each judgment result made in the sorting process is supported by the management software, and the trust value of the corresponding address in the trust database 6 is rewarded or punitively modified;

The modification of the trust database 6 is determined by the processing and operation methods of normal emails and spam emails by the owner of the receiving mailbox. Specifically, the standardized mode of mailbox operation behavior can be summarized into a rule set to determine the source address of the email. , or the trust degree database of the recipient address makes a judgment on the corresponding trust degree modification; automatically generates a dynamic black and white list, that is, it is listed in the absolutely trustworthy range or the absolutely untrustworthy range.

In Figure 4, the solid line indicates the sending direction of the mail, the dotted line indicates the direction of trust degree action, and the trust degree of the end point increases for the starting point.

In conjunction with Fig. 4, the monitoring scope of the mail monitor module 4 is extended to the transmission of mails, and the mails transmitted from a certain user A9 to a certain user B10 are forwarded to a certain user C11 through a certain user B10, and then the monitoring system makes a decision to a certain user A9 Determine the trust degree reward for the trust of a user C11, and modify the corresponding trust value of the supporting database, so as to form a stable mutual trust relationship network structure between safe target email addresses.

As shown in Fig. 4, the correction to the trust degree database 6 is based on the judgment made by the mailbox monitor system to reward the source address trust degree according to the operation of forwarding normal mail, thereby forming a mutual trust relationship filter between security target objects. net. This is the system-level extension, which extends to the entire mail system based on the trust relationship, and is extended from point to surface. The expansion is as follows: 1. By accumulating the functions of all trust judgments to the domain of the target, a domain-level trust relationship can be formed and extended to system-level applications; 2. In order to strengthen the generation and function of trust relationships, the following assertion is made, a The object of trust, the object of its trust may also be reliable. Apply it to the trust relationship system, and define the trust degree of the action object to have a transitive relationship: a certain user A9 sends a letter to a certain user B10 (the trust degree of a certain user B10 in a certain user A9 increases), and a certain user B10 sends a letter to a certain user C11 (the trust degree of a certain user C11 in a certain user B10 increases), then this transfer relationship will lead to the same effect of a certain user A9 sending a letter to a certain user C11 (the trust degree of a certain user C11 in a certain user A9 increases), the magnitude of the effect It is proportional to the trust degree of the intermediate object (a certain user B10). This transfer relationship is an irreversible one-way transfer, and the mail system acts as a trust arbiter to reward a user A9 with a degree of trust for a user C11. Through the transfer function, it can intensify the change speed of the trust degree of each role of trust. The purpose is to form a stable mutual trust relationship network structure community among the existing security target objects, so that the spam initiator as an outsider, more difficult to penetrate.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications made within the spirit and principles of the present invention, equivalent substitutions and improvements, etc., should be included in the protection of the present invention. within range.

Claims (8)

1. spam treatment system, this system comprises twit filter module, the virus analysis device module that is arranged among the mail server SMTP, it is characterized in that: also comprise:

(1) mailbox monitor module is used to monitor the mailbox operation behavior, to mail-sorting;

(2) record the degree of belief database that mail is trusted number of degrees value by addresses of items of mail; And

(3) degree of belief is passed judgment on module, and the degree of belief value of the current mail of storing in this module invokes credit rating database and predetermined reference degree of belief numeric ratio are than the current mail of go-on-go;

The mailbox filter module is according to filter module, virus analysis device module, and degree of belief is passed judgment on the result of module to mail, revise the degree of belief numerical value of this mail of storing in the degree of belief database, reduction is the mail degree of belief value of spam by go-on-go, and raising by go-on-go is the mail degree of belief value of normal email.

2. a kind of spam treatment system according to claim 1 is characterized in that: the mode that described degree of belief is passed judgment on the module judge is that utmost good faith is judged or relative trust is judged.

3. a kind of spam treatment system according to claim 1 is characterized in that:

Under the initial condition, the degree of belief value of storing in the degree of belief database is low.

4. a kind of spam treatment system of stating according to claim 1,2 or 3 is characterized in that:

Store the degree of belief relation data of territory level in the degree of belief database;

The ruling scope of mail monitor module is the territory at email address place, and promptly the mail monitor module is collected the addresses of items of mail of transmitting current mail, and according to the degree of belief data of the go-on-go results modification of current mail being transmitted the addresses of items of mail of current mail.

5. the method for a go-on-go spam, the system that this method is used comprise that it is characterized in that: the method comprising the steps of through black, white list auditing module, twit filter module, virus analysis device module:

(1) the degree of belief numerical value of finding out corresponding source address by the address of mail from the degree of belief database is compared with setting range, greater than the normal email that is judged to be more than the setting range maximum, mail-sorting is gone into normal mailbox; Less than the spam that is judged to be below the setting range minimum value, mail-sorting is gone into the rubbish mailbox; Drop on and carry out step (2) between the maximin of setting range;

(2) do further go-on-go processing through spam filters module and virus analysis device module, filter in the go-on-go processing procedure at twice, anyly once filter defectively, then mail is judged to be spam, go-on-go is to the rubbish mailbox, and twice filtration is all qualified carries out step (3);

(3) the degree of belief numerical value of corresponding source address in the degree of belief database and the mean value of setting range maximin are compared, mail greater than this mean value is judged to be normal email, mail-sorting is gone into normal mailbox, mail less than this mean value is judged to be spam, and mail-sorting is gone into the rubbish mailbox;

(4) by result to mail treatment, the degree of belief value of source of email address correspondence in the revision degree of belief database, the degree of belief value of increase normal email address correspondence, the degree of belief value of minimizing spam address correspondence.

6. the method for go-on-go spam according to claim 5 is characterized in that: to the result of determination of being made in the go-on-go process each time, all revise the degree of belief value of source of email address correspondence in the degree of belief database.

7. according to the method for claim 5 or 6 described go-on-go spams, it is characterized in that:

After server receives mail, at first check record in the credit rating database, take a decision as to whether and visit the user for the first time, handle if not then change step (1) over to, if then elder generation's correspondence in supporting database is visited email address for the first time and given a degree of belief numerical value on the low side, change step (1) again over to and handle.

8. according to the method for claim 5 or 6 described go-on-go spams, it is characterized in that: the step of the degree of belief value of source of email address correspondence also comprises in the revision degree of belief database:

Foundation increases and decreases the degree of belief value of other addresses of items of mail of the current mail of forwarding that obtains to the increase and decrease of the degree of belief value of current source of email address correspondence.

Images