Unauthorized email determination device, unauthorized email determination method and unauthorized email determination program

Abstract

This unauthorized email determination device (10) is provided with a consistency analysis unit (24). The consistency analysis unit (24) identifies the intention of a newly received, target email witha method involving extracting function words, which are words that show the reason that the target email was sent, from the body of the target email. The consistency analysis unit (24) determines whether or not the target email is an unauthorized email on the basis of the relation between the identified intention of the target email, and other emails received in the past from the same sender as the target email.

Description

technical field [0001] The invention relates to a technology for detecting targeted attack emails. Background technique [0002] Targeted attacks such as Advanced Persistent Threat (Advanced Persistent Threat) are mostly targeted attack emails that use improper emails as intrusion means for attacks. [0003] In targeted attack emails, cleverly crafted sentences are used using information related to attack targets such as organizations and people. In a targeted attack email, an attempt is made to open a malicious file attached to the email, or to access a malicious Web site indicated by a URL (Uniform Resource Locator: Uniform Resource Locator) described in the text. [0004] There is known prior art for statically or dynamically parsing the maliciousness of content with respect to attachments and URLs. For example, techniques are known to detect malware by confirming whether an attachment to a check object matches a pattern of known malware. In addition, there are techniq...

AI Technical Summary

Problems solved by technology

However, in this technique, it is impossible to detect impersonation emails that maliciously use the accounts of legitimate users

Images