relay device

Abstract

To accurately understand a user's ability to deal with attack emails under the desired email receiving conditions. [Solution] In the relay device 10, in response to an email reception request from the target user terminal 20 of the training target user, the number of received emails sent back from the mail server 30 along with a training email that mimics a malicious attack email is obtained as the email reception status. This email reception status is compared with the pre-set training execution conditions. If the email reception status matches the training execution conditions, all received emails, including the training email, are relayed to the target user terminal 20. If the email reception status does not match the training execution conditions, all received emails other than the training email are relayed to the target user terminal 20.

Description

Technical Field

[0001] The present invention relates to a security countermeasure technology for training a user to correctly handle attack emails based on training emails imitating malicious attack emails.

Background Art

[0002] In recent years, the damage caused by malicious malware using emails as an infection route has been increasing rapidly. For example, according to "Emotet", which infects just by clicking and opening an attached file in a targeted attack email, it is said that not only the email data registered on the user terminal but also important personal information including authentication information such as IDs and passwords will be leaked. Therefore, if such malware infection occurs, new attack emails will be generated based on the leaked email data and the infection will spread to other users, access to the internal network will be made based on the leaked authentication information and confidential information will be stolen, or it will lead to extremely large damage such as being infected with malicious programs represented by "Ransomware" that demands ransom. Therefore, it is important to correctly handle attack emails, and users are required to master correct handling from day to day.

[0003] Conventionally, as a technology for grasping the user's correct handling ability for such attack emails, Patent Document 1 proposes a training device for training correct handling of attack emails, which generates a training email imitating a malicious attack email based on a preset template, transmits it to a user to be trained via a mail server, and detects that the user has received the training email on the user terminal and opened the attached file attached to the training email. Thereby, the user's correct handling ability for attack emails can be grasped, and it can be reflected in efforts to enhance the user's security awareness and improvement of the security literacy of the entire organization to which the user belongs.

Prior Art Documents

Patent Documents

[0004] [Patent Document 1] Japanese Patent Publication No. 2013-149063 [Overview of the Initiative] [Problems that the invention aims to solve]

[0005] When users actually receive an attack email, their response will vary depending on the circumstances under which they receive it. For example, if they receive a small number of emails, their security awareness regarding opening attachments is relatively high, but if they receive a large number of emails, their security awareness decreases, and they tend to open attachments carelessly. Therefore, the timing of sending training emails will affect users' ability to respond.

[0006] According to the conventional technology described above, while it is possible to arbitrarily adjust the date, time, and number of training emails sent, it is not possible to determine the timing of sending training emails based on the circumstances under which the target users receive the training emails. As a result, variations in users' response capabilities arise due to changes in their email reception status, and there is a problem in that it is not possible to accurately grasp the response capabilities of users.

[0007] This invention aims to solve these problems and provide a security measure that can accurately grasp a user's ability to deal with attack emails under desired email reception conditions. [Means for solving the problem]

[0008] To achieve this objective, the relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to acquire the number of received emails as mail reception status of emails returned from a mail server on the communication network to the target user terminal in response to an email reception request from the target user terminal of the training target user, and a training control unit configured to, if the received emails returned from the mail server to the target user terminal include training emails that mimic malicious attack emails, compare the mail reception status with preset training execution conditions, relay forward all of the received emails, including the training emails, to the target user terminal if the mail reception status matches the training execution conditions, and relay forward all of the received emails, including the training emails, to the target user terminal if the mail reception status does not match the training execution conditions.

[0009] Furthermore, in one example of the configuration of the relay device according to the present invention, the training control unit is configured to instruct the training device on the communication network to send the training email addressed to the training target user, based on pre-set implementation content data.

[0010] Furthermore, in one example of the configuration of the relay device according to the present invention, the training control unit is configured to generate the training email addressed to the training target user based on pre-set implementation content data and send it to the mail server. [Effects of the Invention]

[0011] According to the present invention, it becomes possible to accurately grasp a user's ability to deal with attack emails under desired email reception conditions. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 is a block diagram showing the configuration of a relay device according to the first embodiment. [Figure 2] Figure 2 is an explanatory diagram showing an example of setting condition pattern data. [Figure 3] Figure 3 is an explanatory diagram showing an example of setting transfer pattern data. [Figure 4] Figure 4 is an explanatory diagram showing an example of setting up implementation details data. [Figure 5] Figure 5 is a sequence diagram showing the operation of the relay device according to the first embodiment. [Figure 6] Figure 6 is a sequence diagram showing the operation of the relay device according to the second embodiment. [Modes for carrying out the invention]

[0013] Next, embodiments of the present invention will be described with reference to the drawings.

[0014] [First Embodiment] First, with reference to the block diagram in Figure 1, the relay device 10 according to the first embodiment of the present invention will be described.

[0015] This relay device 10 consists of relay devices such as a UTM (Unified Threat Management) device and a gateway, and is configured to relay user terminals 20 such as PCs and smartphones, which are connected to it via a LAN (Local Area Network), to a higher-level communication network NW such as the Internet.

[0016] [Principle of the present invention] The actions taken by a user in response to a targeted attack email with an attached file containing malware vary depending on the situation in which the user receives the attack email. For example, when receiving emails collectively from the mail server 30 on the communication network NW, if the number of received emails is small, the user's security awareness regarding opening attached files is relatively high. However, if the number of received emails is large, the security awareness decreases, and there is a tendency to carelessly open the attached file. This is thought to be because the processing burden on the user increases or decreases depending on the timing of sending training emails, and the coping ability changes accordingly.

[0017] Here, the relay device 10 is originally configured to monitor and control data communication including email exchanges between the user terminal 20 connected under it via the LAN and the communication network NW. When the user terminal 20 receives emails collectively from the mail server 30, the relay device 10 can obtain the email content and the number of received emails. Also, since the training email is relayed and transferred from the mail server 30 to the target user terminal 20 of the training target user via the relay device 10, the relay device 10 can obtain the email reception status of the training target user at the time of receiving the training email.

[0018] The present invention focuses on the configuration related to the monitoring and control of data communication originally provided in such a relay device 10 and the fact that the training email from the mail server 30 is relayed and transferred to the target user terminal 20 by the relay device 10. In the relay device 10, in response to a mail reception request from the target user terminal 20, the number of received emails returned together with a training email imitating an illegal attack email from the mail server 30 is obtained as the mail reception status, and this mail reception status is compared with the pre-set training execution conditions. When the mail reception status matches the training execution conditions, all the received emails including the training email are relayed and transferred to the target user terminal 20. When the mail reception status does not match the training execution conditions, all the emails other than the training email among the received emails are relayed and transferred to the target user terminal 20.

[0019] As a result, when the mail reception status of the target user terminal 20 when the training mail is returned from the mail server 30 matches the preset conditions, the training mail is relayed and transferred to the target user terminal 20 only. Therefore, if the response content to the training mail of the monitored user is inappropriate thereafter, the malware of the attached file attached as in the prior art is activated, and it is notified that the training device 31 on the communication network NW has been infected with malware. On the other hand, when the mail reception status of the target user terminal 20 does not match the conditions, the training mail is not relayed and transferred to the user and is discarded. Also, the returned training mail may be saved, and the training mail may be relayed and transferred to the user at the timing when the mail reception status of the target user terminal matches the conditions.

[0020] Therefore, when the mail reception status of the monitored user is different from the desired mail reception status, training is not performed on the training target user, and training is performed on the training target user only when the mail reception status is the desired one. Therefore, it is possible to accurately grasp the user's response ability to the attack mail in the desired mail reception status.

[0021] [Detailed Configuration of Relay Device] Next, referring to the block diagram of FIG. 1 described above, the detailed configuration of the relay device 10 according to the present embodiment will be described.

[0022] The relay device 10 according to the present embodiment includes, as main circuit configurations, a network I / F 11, a LAN I / F 12, a relay circuit 13, a memory circuit 14, and a control circuit 15.

[0023] [Network I / F] The network I / F 11 is connected to the communication network NW via the communication line L, and is configured to perform data communication with the communication network NW based on an instruction from the control circuit 15.

[0024] [LAN I / F] LANI / F12 is connected to the LAN and is configured to communicate data with user terminals 20 connected to the LAN based on instructions from the control circuit 15.

[0025] [Relay Circuit] It is connected to the network interface 11 and LAN interface 12, and is configured to relay data communication between the network interface 11 and LAN interface 12 in response to instructions from the control circuit 15.

[0026] [Memory circuit] The memory circuit 14 consists of a storage device such as a semiconductor memory or a hard disk, and is configured to store processing data and program 14P used in the training email control processing executed by the control circuit 15.

[0027] The main processing data stored in the memory circuit 14 includes pattern data 14A and execution content data 14B.

[0028] [Pattern data] Pattern data 14A is pattern data used to select training content in order to understand the training target user's ability to respond correctly to attack emails, and is pre-set in the memory circuit 14 by the training administrator.

[0029] The main patterns set in pattern data 14A are conditional pattern data and transfer pattern data.

[0030] The condition pattern data is compared in the control circuit 15 with the number of emails received in a batch when the training email is received, and is used to determine whether or not the training email needs to be relayed to the target user terminal 20 of the target user, i.e., whether or not the training should be conducted. This makes it possible to identify the email reception status of the target user when conducting the training.

[0031] The forwarding pattern data is used in the control circuit 15 to determine the order in which the training emails are forwarded when the emails received in a batch are relayed to the target user terminal 20. When multiple emails are received at once, the user's processing load tends to increase or decrease, and their security awareness tends to decline, as the number of emails to be viewed at once increases, similar to the number of emails received. By adjusting this forwarding pattern data, it becomes possible to understand the user's ability to deal with attack emails in more detail and accurately.

[0032] Figure 2 shows three condition patterns JA, JB, and JC as examples of setting condition pattern data from pattern data 14A. For example, condition pattern JA is set to the condition that the number of received emails is less than 3, condition pattern JB is set to the condition that the number of received emails is 3 or more but less than 10, and condition pattern JC is set to the condition that the number of received emails is 10 or more.

[0033] Figure 3 shows three example forwarding patterns HA, HB, and HC, which represent the forwarding pattern data within the pattern data 14A. For example, forwarding pattern HA has the starting position of the emails to be forwarded in a batch, forwarding pattern HB has the middle position of the emails to be forwarded in a batch, and forwarding pattern HC has the ending position of the emails to be forwarded in a batch.

[0034] Generally, when multiple emails are returned together from mail server 30, they are often returned in chronological order, starting with the oldest timestamp indicating the arrival time at mail server 30. In this case, for forwarding pattern HA, a timestamp that is a predetermined time older than the oldest timestamp among the multiple emails should be generated and set as the training email. For forwarding pattern HB, a timestamp midway between the oldest and newest timestamps among the multiple emails should be generated and set as the training email, and for forwarding pattern HC, a timestamp that is a predetermined time newer than the latest timestamp among the multiple emails should be generated and set as the training email.

[0035] [Implementation details data] The implementation content data 14B is data used to set the content of the training to be actually conducted using training emails, and is pre-set in the memory circuit 14 by the training administrator. Note that the data set in the implementation content data 14B is not limited to the data described below, and other data used to create training emails, such as personal information such as the affiliation of the training target users, may also be set in the implementation content data 14B.

[0036] In the example of the implementation data settings in Figure 4, the username of the user to be trained is set to "Saxa Taro," and the email address of the user to be trained is set to "saxa.taro@saxa.jp." As a result, training will be conducted on the user named "Saxa Taro," and training emails will be sent to the email address "saxa.taro@saxa.jp."

[0037] Furthermore, in the example of the implementation data settings in Figure 4, the pattern "JA" from Figure 2 is set as the training implementation condition, and the pattern "HC" from Figure 3 is set as the training email forwarding location. In addition, "2024 / 07 / 22 10:00" is set as the sending date and time of the training email sent from the training device 31.

[0038] As a result, training is conducted only if the number of received emails in the bundle returned from the mail server 30 along with the training email is less than 3. The training email is relayed from the relay device 10 to the target user terminal 20 of the target user. Additionally, the training email is relayed from the relay device 10 to the target user terminal 20 at the end of the bundle returned email. Furthermore, the training email is sent from the training device 31 to the mail server 30 at "2024 / 07 / 22 10:00".

[0039] [program] Program 14P is a program that, in cooperation with the CPU of the control circuit 15, realizes various processing units for executing training email control processing in the control circuit 15. This program 14P is read from an external device or recording medium (neither of which are shown) and stored in the memory circuit 14 in advance.

[0040] [control circuit] The control circuit 15 has a CPU and its peripheral circuits, and is configured to execute training email control processing by having the CPU and the program 14P of the memory circuit 14 cooperate to realize various processing units.

[0041] The main processing units implemented in the control circuit 15 are the email monitoring unit 15A and the training control unit 15B.

[0042] [Email Monitoring Department] The email monitoring unit 15A is configured to monitor data communication between the user terminal 20 and the communication network NW via the relay circuit 13 based on the implementation data 14B, and to acquire the number of emails received from the email server 30 to the user terminal 20 in response to an email reception request from the user terminal 20 as the email reception status, and to record it in the storage circuit 14.

[0043] [Training Control Unit] The training control unit 15B is configured to, if it detects that the incoming emails returned from the mail server 30 to the target user terminal 20 include training emails that mimic malicious attack emails, compare the email reception status for those emails obtained by the mail monitoring unit 15A with the training execution conditions of the pre-configured execution content data 14B. If the email reception status matches the training execution conditions, it relays all incoming emails, including the training emails, to the target user terminal 20. If the email reception status does not match the training execution conditions, it relays all incoming emails other than the training emails to the target user terminal 20.

[0044] Furthermore, the training control unit 15B is configured to instruct the training device 31 to send a training email containing each item of the implementation details data 14B via the network interface 11, communication line L, and communication network NW. In this case, the training control unit 15B should instruct the training device 31 to send the training email in advance so that it arrives in time for the training email transmission date and time of the implementation details data 14B.

[0045] Furthermore, when the training control unit 15B relays multiple emails together with the training email to the target user terminal 20 of the target user, it is configured to adjust the forwarding position of the training email based on the forwarding pattern data of the implementation content data 14B.

[0046] [Operation of the first embodiment] Next, the operation of the relay device 10 according to the first embodiment will be described with reference to the sequence diagram in Figure 5. In the following description, the case in which the contents shown in Figure 4 above are pre-set in the implementation data 14B of the memory circuit 14 will be explained as an example.

[0047] First, in the control circuit 15 of the relay device 10, the training control unit 15B sets the implementation content data 14B in response to instructions from the user terminal 20 used by the training administrator, which are received via LANI / F12 (step 100), and the email monitoring unit 15A starts training using training emails to the training target users based on the implementation content data 14B (step 101).

[0048] After the training begins, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 102), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0049] In response, when the mail server 30 sends back an incoming mail addressed to the training target user (step 103), the mail monitoring unit 15A temporarily receives this mail reception response from the relay circuit 13, obtains the number of received mails included in the mail reception response as the mail reception status, and records it in the storage circuit 14 (step 104).

[0050] Furthermore, the control circuit 15 relays and forwards all of these received emails to the target user terminal 20 connected to the LAN via the network interface 11, relay circuit 13, and LAN interface 12 (step 105).

[0051] After this, the training control unit 15B confirms that the timing for sending the training email instruction to the training device 31 has arrived (step 110), and processing related to the training email is started in accordance with the arrival of the sending timing.

[0052] First, the training control unit 15B sends a training email transmission instruction, including each item of the implementation content data 14B, to the training device 31 on the communication network NW via the network I / F 11 (step 111). Based on the contents of the training email transmission instruction from the relay device 10, the training device 31 generates a training email addressed to the email address of the training target user and sends it to the mail server 30 at the training email transmission date and time (step 112). From this point onward, whenever a mail reception request is sent from the target user terminal 20 to the mail server 30, the mail reception response will always include the training email.

[0053] Furthermore, the training email sending date and time set in the implementation details data 14B may be determined by the training control unit 15B based on the progression of the training target user's email reception status, which has been acquired in advance and recorded in the memory circuit 14. Generally, email reception status changes with a certain degree of periodicity on a weekly or monthly basis. Therefore, for example, when applying "JC" as a training implementation condition, the training control unit 15B can predict the date and time when the number of received emails will be 10 or more based on the progression of the email reception status, and then determine the training email sending date and time so that the training target user can receive the email from the mail server 30 at that predicted date and time. In addition, the timing of sending the training email sending instruction in the training control unit 15B should be determined to be in time for the training email sending date and time when the training device 31 sends the training email.

[0054] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 120), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0055] In response, if the mail server 30 returns an incoming email (step 121), the mail monitoring unit 15A temporarily retrieves the incoming email from the relay circuit 13 and obtains the number of received emails as the mail reception status (step 122).

[0056] Next, the training control unit 15B, recognizing that training emails are included among these received emails, compares the email reception status for these received emails obtained by the email monitoring unit 15A with the pre-set training execution conditions (step 123). If the email reception status does not match the training execution conditions (step 123: NO), the training control unit 15B relays all emails other than training emails from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 124), returns to step 110 described above, and waits until the next transmission timing arrives.

[0057] Therefore, in step 121, if two received emails, including the training email, are returned, and the email reception status does not meet the training conditions, in step 124, the one received email other than the training email will be relayed to the target user terminal 20.

[0058] On the other hand, in step 123, if the email reception status matches the training execution conditions (step 123: YES), the training control unit 15B relays all of these received emails, including the training emails, from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 130). At this time, if transfer pattern data is set in the execution content data 14B, the training control unit 15B adjusts the order of the training emails in these received emails based on the set transfer pattern, and then relays them to the target user terminal 20.

[0059] Therefore, in step 121, if two received emails, including the training email, are returned, and the email reception status meets the training conditions, then in step 130, the two received emails, including the training email, will be relayed to the target user terminal 20.

[0060] After this, the training control unit 15B notifies the training device 31 from the network interface 11 of the training process details, such as the date and time of relaying the training email to the target user terminal 20 and the email reception status (step 131), and then completes the series of training sessions for the target user using the training email (step 132).

[0061] As a result, when the training email is returned from the mail server 30, the training email is relayed to the target user terminal 20 only if the email reception status of the target user terminal 20 matches the pre-set conditions. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the training device 31 on the communication network NW is notified of the malware infection, which is then collected as a training result. On the other hand, if the email reception status of the target user terminal 20 does not match the conditions, the training email is not relayed to the target user terminal 20 and is discarded.

[0062] [Effects of the First Embodiment] As described above, in this embodiment, the relay device 10 acquires the number of received emails as the email reception status, which are sent back from the mail server 30 along with training emails that mimic malicious attack emails, in response to an email reception request from the target user terminal 20 of the target user. This email reception status is then compared with pre-set training execution conditions. If the email reception status matches the training execution conditions, all received emails, including the training emails, are relayed to the target user terminal 20. If the email reception status does not match the training execution conditions, all received emails other than the training emails are relayed to the target user terminal 20.

[0063] Therefore, if the email reception status of the monitored user differs from the desired email reception status, training will not be performed on the trained user. Training will only be performed on the trained user if the email reception status is as desired, making it possible to accurately grasp the user's ability to deal with attack emails under the desired email reception status.

[0064] [Second Embodiment] Next, a relay device 10 according to a second embodiment of the present invention will be described. In the first embodiment described above, the case in which the transmission of training emails and the collection of training results are performed by an existing training device 31 on a communication network NW was described as an example. In this embodiment, the case in which the configuration of the training device 31 is implemented in the control circuit 15 of the relay device 10 will be described as an example.

[0065] The configuration of the relay device 10 according to this embodiment is almost the same as the block diagram shown in Figure 1 above, but some of the configurations of the training control unit 15B of the control circuit 15 are different.

[0066] [Training Control Unit] The training control unit 15B is configured to generate training emails based on each item in the implementation details data 14B and send them to the mail server 30 via the communication line L and communication network NW from the network I / F 11. In this case, the training control unit 15B only needs to send the training emails in advance so that they arrive in time for the training email transmission date and time specified in the implementation details data 14B.

[0067] Furthermore, the training control unit 15B is configured to collect training results related to the target user terminal 20 and store them in the memory circuit 14 if it is notified that malware attached to a training email has been activated and the target user terminal 20 has been infected with malware.

[0068] [Operation of the second embodiment] Next, with reference to the sequence diagram in Figure 6, the operation of the relay device 10 according to the second embodiment will be described. In the following, the description will be based on the case where the contents shown in Figure 4 above are pre-set in the implementation data 14B of the memory circuit 14, and a training email addressed to the training target user is sent from the relay device 10. Steps 100 to 105 in Figure 5 are the same in this embodiment as well, and a detailed explanation will be omitted here.

[0069] The training control unit 15B confirms the timing for sending the training email (step 200), and in response to the timing, generates a training email addressed to the training target user's email address based on the content of the training email sending instruction and the template email data registered in the memory circuit 14, and sends it to the mail server 30 from the network interface 11 (step 201). From this point onward, whenever a mail reception request is sent from the training target user's terminal 20 to the mail server 30, the mail reception response will always include the training email. The timing for sending the training email in the training control unit 15B should be determined at the same time as the training email sending date and time.

[0070] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 210), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0071] When a received email is returned from the mail server 30 in response to an email reception request (step 211), the control circuit 15 temporarily retrieves the received email from the relay circuit 13, and the email monitoring unit 15A obtains the number of received emails as the email reception status (step 212).

[0072] Next, the training control unit 15B, recognizing that training emails are included among these received emails, compares the email reception status for these received emails obtained by the email monitoring unit 15A with the pre-set training execution conditions (step 213). If the email reception status does not match the training execution conditions (step 213: NO), the training control unit 15B relays all emails other than training emails from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 214), returns to step 200 described above, and waits until the next transmission timing arrives.

[0073] Therefore, in step 211, if two received emails, including the training email, are returned, and the email reception status does not meet the training conditions, in step 214, the one received email other than the training email will be relayed to the target user terminal 20.

[0074] On the other hand, in step 213, if the email reception status matches the training execution conditions (step 213: YES), the training control unit 15B relays all of these received emails, including the training emails, from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 220). At this time, if transfer pattern data is set in the execution content data 14B, the training control unit 15B adjusts the order of the training emails in these received emails based on the set transfer pattern, and then relays them to the target user terminal 20.

[0075] Therefore, in step 211, if two received emails, including the training email, are returned, and the email reception status matches the training conditions, then in step 220, the two received emails, including the training email, will be relayed to the target user terminal 20.

[0076] After this, the training control unit 15B saves training processing details, such as the date and time of relaying the training email to the target user terminal 20 and the email reception status, to the memory circuit 14 (step 221), and ends the series of training sessions for the target user using the training email (step 222).

[0077] As a result, when the training email is returned from the mail server 30, the training email is relayed to the target user terminal 20 only if the email reception status of the target user terminal 20 matches the pre-set conditions. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the relay device 10 is notified that it has been infected with malware. On the other hand, if the email reception status of the target user terminal 20 does not match the conditions, the training email is not relayed to the target user terminal 20 and is discarded.

[0078] [Effects of the second embodiment] Thus, in this embodiment, the relay device 10 is configured to generate a training email addressed to the training target user based on pre-configured implementation data 14B and send it to the mail server 30.

[0079] Therefore, the relay device 10 alone can determine the user's ability to properly respond to attack emails, and the required configuration can be simplified.

[0080] [Expansion of the embodiment] Although the present invention has been described above with reference to embodiments, the present invention is not limited to the above embodiments. Various modifications to the configuration and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art. Furthermore, each embodiment can be arbitrarily combined and implemented without contradiction. [Explanation of Symbols]

[0081] 10...Relay device, 11...Network interface, 12...LAN interface, 13...Relay circuit, 14...Memory circuit, 14A...Pattern data, 14B...Implementation data, 14P...Program, 15...Control circuit, 15A...Email monitoring unit, 15B...Training control unit, 20...User terminal, 20...Target user terminal, 30...Email server, 31...Training device, LAN...Local network, L...Communication line, NW...Communication network.

Claims

1. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit configured to acquire the number of received emails as mail reception status, which are sent back to the target user terminal from the mail server on the communication network in response to a mail reception request from the target user terminal of the training target user, A training control unit is configured to, if the received email sent back from the mail server to the target user terminal contains a training email that mimics a malicious attack email, compare the email reception status of the received email with a pre-configured training execution condition, and if the email reception status matches the training execution condition, relay forward all of the received emails, including the training email, to the target user terminal; and if the email reception status does not match the training execution condition, relay forward all of the received emails other than the training email to the target user terminal. A relay device characterized by being equipped with the following features.

2. The training control unit is configured to instruct the training device on the communication network to send the training email addressed to the training target user, based on pre-configured implementation data. The relay device according to claim 1.

3. The training control unit is configured to generate the training email addressed to the training target user and send it to the mail server based on pre-configured implementation data. The relay device according to claim 1.

Images