relay device

Abstract

This device provides a relay system that accurately assesses users' ability to deal with malicious attack emails disguised as reply emails. [Solution] A relay device 10 that monitors and controls data communication, including email exchanges, between user terminals 20 connected to it via LAN and the communication network NW monitors outgoing emails sent from the target user terminal 20 of the training target user to the mail server 30, and in response to detection, obtains the content of the outgoing email, generates training email content addressed to the training target user that mimics a reply email to the outgoing email based on the obtained outgoing email content, and uses the training email generated based on the training email content to understand the training user's ability to respond to reply emails.

Description

Technical Field

[0001] The present invention relates to a security countermeasure technology for training a user to correctly handle attack emails based on training emails that mimic malicious attack emails.

Background Art

[0002] In recent years, the damage caused by malicious malware that uses email as an infection route has been increasing rapidly. For example, according to "Emotet", which infects just by clicking and opening an attached file in a targeted attack email, not only the email data registered on the user terminal but also important personal information including authentication information such as IDs and passwords is said to be leaked. Therefore, if such malware infection occurs, new attack emails are generated based on the leaked email data and the infection spreads to other users, access is made to the internal network based on the leaked authentication information and confidential information is stolen, or it leads to extremely large damage such as being infected with a malicious program typified by "Ransomware" that demands a ransom. Therefore, it is important to correctly handle attack emails, and it is required that users master correct handling from day to day.

[0003] Conventionally, as a technology for grasping the user's correct handling ability for such attack emails, Patent Document 1 proposes a training device that trains correct handling of attack emails to generate training emails that mimic malicious attack emails based on a preset template, transmits them to a user to be trained via a mail server, and detects that the user has received the training emails on the user terminal and opened the attached files attached to the training emails. Thereby, the user's correct handling ability for attack emails can be grasped, and it can be reflected in efforts to enhance the user's security awareness and in improving the security literacy of the entire organization to which the user belongs.

Prior Art Documents

Patent Documents

[0004] [Patent Document 1] Japanese Patent Publication No. 2013-149063 [Overview of the project] [Problems that the invention aims to solve]

[0005] A user's response to an attack email varies depending on the circumstances under which they received it. In particular, when an email arrives unexpectedly, security awareness regarding opening attachments is relatively high. However, when an email arrives at a predictable time, security awareness decreases, and users tend to carelessly open attachments. For example, if a user sends an email and then receives a reply, the reply is predictable, so security awareness regarding opening attachments in the reply email decreases. Therefore, understanding a user's ability to respond to replies to emails they have sent is crucial.

[0006] According to the conventional technology mentioned above, while it is possible to arbitrarily adjust the date, time, and number of training emails sent, there was a problem in that it was not possible to send a training email that mimicked a reply email to an email sent by the target user at the time the email was sent. Furthermore, when training emails are generated based on pre-registered template data, as in the conventional technology mentioned above, it is not possible to reflect the content of emails sent by the target user, resulting in the inability to generate highly credible training emails and a decrease in the quality of the training itself.

[0007] This invention aims to solve these problems and provide a security measure that can accurately grasp a user's ability to deal with malicious attack emails that mimic reply emails. [Means for solving the problem]

[0008] To achieve this objective, the relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to monitor outgoing emails sent from the target user terminal of the training target user to a mail server on the communication network, and a training control unit configured to acquire the content of the outgoing email in response to the detection of outgoing emails from the target user terminal by the mail monitoring unit, generate training email content addressed to the training target user that mimics a reply email to the outgoing email based on the obtained outgoing email content, and instruct a training device on the communication network to send a training email using the training email content.

[0009] Furthermore, another relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to monitor outgoing emails sent from the target user terminal of the training target user to a mail server on the communication network, and a training control unit configured to acquire the content of the outgoing email in response to the detection of outgoing emails from the target user terminal by the mail monitoring unit, generate a training email addressed to the training target user that mimics a reply email to the outgoing email based on the obtained outgoing email content, and send it to the mail server. [Effects of the Invention]

[0010] According to the present invention, it becomes possible to accurately grasp a user's ability to deal with malicious attack emails that mimic reply emails. [Brief explanation of the drawing]

[0011] [Figure 1]Figure 1 is a block diagram showing the configuration of a relay device according to the first embodiment. [Figure 2] Figure 2 is an explanatory diagram showing an example of setting up implementation details data. [Figure 3] Figure 3 is a sequence diagram showing the operation of the relay device according to the first embodiment. [Figure 4] Figure 4 is an explanatory diagram showing an example of the content of an outgoing email. [Figure 5] Figure 5 is an explanatory diagram showing an example of training email content. [Figure 6] Figure 6 is a sequence diagram showing the operation of the relay device according to the second embodiment. [Modes for carrying out the invention]

[0012] Next, embodiments of the present invention will be described with reference to the drawings.

[0013] [First Embodiment] First, with reference to the block diagram in Figure 1, the relay device 10 according to the first embodiment of the present invention will be described.

[0014] This relay device 10 consists of relay devices such as a UTM (Unified Threat Management) device and a gateway, and is configured to relay user terminals 20 such as PCs and smartphones, which are connected to it via a LAN (Local Area Network), to a higher-level communication network NW such as the Internet.

[0015] [Principle of the present invention] A user's response to a targeted attack email containing malware attachments varies depending on the circumstances under which they received the email. In particular, security awareness regarding opening attachments is relatively high when the email arrives unexpectedly, but decreases when it arrives at a predictable time, leading to a tendency to carelessly open attachments. For example, if a user sends an email and then receives a reply, the reply is predictable, thus lowering their security awareness regarding opening attachments in the reply. Therefore, understanding a user's ability to respond to replies to emails they have sent is crucial.

[0016] Here, the relay device 10 is configured to monitor and control data communication, including email exchanges, between the user terminal 20 connected to it via the LAN and the communication network NW. When the user terminal 20 sends an email sending request to the mail server 30, the relay device 10 can acquire the content of the sent email included in the email sending response sent back from the mail server 30 in response to that email sending request.

[0017] The present invention focuses on the configuration for monitoring and controlling emails that is originally provided in such a relay device 10, and monitors the exchange of emails between the target user terminal 20 of the target user and the mail server 30, and in response to the detection of outgoing emails sent from the target user terminal 20 to the mail server 30, it acquires the content of the outgoing email, and uses the training email generated based on the obtained outgoing email content to understand the training user's ability to respond to reply emails.

[0018] As a result, in accordance with the timing when an email is sent from the user to be trained, a training email imitating a reply email to that email can be replied, and furthermore, a highly reliable training email reflecting the content of the sent email sent from the user to be trained can be generated. Therefore, it becomes possible to accurately grasp the user's coping ability with respect to an unauthorized attack email imitating a reply email.

[0019] [Detailed Configuration of Relay Device] Next, referring to the block diagram of FIG. 1 described above, the detailed configuration of the relay device 10 according to the present embodiment will be described.

[0020] The relay device 10 according to the present embodiment includes, as main circuit configurations, a network I / F 11, a LAN I / F 12, a relay circuit 13, a memory circuit 14, and a control circuit 15.

[0021] [Network I / F] The network I / F 11 is connected to the communication network NW via the communication line L and is configured to perform data communication with the communication network NW based on an instruction from the control circuit 15.

[0022] [LAN I / F] The LAN I / F 12 is connected to the LAN and is configured to perform data communication with the LAN based on an instruction from the control circuit 15.

[0023] [Relay Circuit] It is connected to the network I / F 11 and the LAN I / F 12 and is configured to relay and connect the data communication between the network I / F 11 and the LAN I / F 12 in response to an instruction from the control circuit 15.

[0024] [Memory Circuit] The memory circuit 14 is generally composed of a storage device such as a semiconductor memory or a hard disk, and is configured to store processing data and a program 14P used in the training email control process executed by the control circuit 15.

[0025] The main processing data stored in the memory circuit 14 is the execution content data 14A.

[0026] [Implementation details data] Implementation content data 14A is data used to set the content of the training to be actually conducted using training emails, and is pre-set in the memory circuit 14 by the training administrator. Note that the data set in implementation content data 14A is not limited to the data described below, and other data used to create training emails, such as personal information such as the affiliation of the training target users, may also be set in implementation content data 14A.

[0027] In the example settings shown in Figure 2, the username of the user to be trained is set to "Saxa Taro," and the email address of the user to be trained is set to "saxa.taro@saxa.jp." As a result, training is conducted on a user named "Saxa Taro," the content of an outgoing email sent from the email address "saxa.taro@saxa.jp" is retrieved, and a training email simulating a reply email is generated based on that content, with "saxa.taro@saxa.jp" set as the recipient email address.

[0028] Furthermore, in the example settings shown in Figure 2, the timing for sending the training email is set to "15 minutes after the outgoing email," meaning the training email will be sent 15 minutes after the sending time of the outgoing email sent by the training target user. Note that "15 minutes later" is just an example; you can use the general time it takes for a reply email to arrive after an outgoing email has been sent. For the sending time of the outgoing email, you can use the time the relay device 10 detects the outgoing email or the transmission timestamp written in the header of the outgoing email.

[0029] [program] Program 14P is a program that, in cooperation with the CPU of the control circuit 15, realizes various processing units for executing training email control processing in the control circuit 15. This program 14P is read from an external device or recording medium (neither of which are shown) and stored in the memory circuit 14 in advance.

[0030] [control circuit] The control circuit 15 has a CPU and its peripheral circuits, and is configured to execute training email control processing by having the CPU and the program 14P of the memory circuit 14 cooperate to realize various processing units.

[0031] The main processing units implemented in the control circuit 15 are the email monitoring unit 15A and the training control unit 15B.

[0032] [Email Monitoring Department] The email monitoring unit 15A monitors data communication between the user terminal 20 and the communication network NW via the relay circuit 13, and is configured to detect outgoing emails sent from the target user terminal 20 to the email server 30 based on the implementation data 14A of the storage circuit 14. Specifically, for example, outgoing emails can be detected from the email sending response sent back from the email server 30 in response to an email sending request sent from the target user terminal 20.

[0033] [Training Control Unit] The training control unit 15B is configured to, when the email monitoring unit 15A detects an outgoing email sent from the target user terminal 20, acquire the content of the outgoing email, generate training email content that mimics a reply email to the outgoing email based on the obtained content, and instruct the training device 31 on the communication network NW to send a training email using that training email content.

[0034] Furthermore, when the training control unit 15B instructs the training device 31 to send a training email, it is configured to determine and instruct the date and time of sending the training email based on the transmission timing set in the implementation data 14A of the memory circuit 14. In this case, for example, according to the example in Figure 2 mentioned above, the date and time of sending the training email is determined to be 15 minutes after the date and time when the sent email was detected.

[0035] [Operation of the first embodiment] Next, the operation of the relay device 10 according to the first embodiment will be described with reference to the sequence diagram in Figure 3. In the following description, the case in which the contents shown in Figure 2 above are pre-set in the implementation data 14A of the memory circuit 14 will be explained as an example.

[0036] First, in the control circuit 15 of the relay device 10, the training control unit 15B sets the implementation data 14A in response to instructions from the user terminal 20 used by the training administrator, which are received via LANI / F12 (step 100), and the email monitoring unit 15A starts monitoring outgoing emails sent by the training target users based on the implementation data 14A (step 101).

[0037] After monitoring begins, if a mail sending request is sent from the target user terminal 20 to the mail server 30 (step 102), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0038] In response, when the mail server 30 sends a response to the training target user for sending an email (step 103), the mail monitoring unit 15A takes this response from the relay circuit 13 and detects the sent email sent from the target user terminal 20 (step 104). The training control unit 15B obtains the content of the sent email from the sent email detected by the mail monitoring unit 15A (step 105) and relays the response to the sent email to the target user terminal 20 connected to the LAN via the relay circuit 13 and LANI / F 12 (step 106).

[0039] Next, the training control unit 15B generates training email content that mimics a reply email to an outgoing email, based on the acquired email content (step 110).

[0040] Comparing the sent email content shown in Figure 4 with the training email content shown in Figure 5, the email addresses in the "From" and "To" fields, which indicate the sender and recipient, have been swapped. The "Subject" field of the training email, which indicates the subject, now includes "Re:", which is used in reply emails. In addition, the "Date" field of the training email, which indicates the sending date and time, is set to a date and time 15 minutes after "2024 / 07 / 22 09:00" in the sent email. Furthermore, the "Message-Id" of the sent email, which indicates the identifier, is written in the "In-Reply-To" and "References" fields of the training email, which indicates the source. The body of the training email contains content disguised as a reply email, and the training email has an attachment containing a program that notifies the recipient when the email has been opened.

[0041] After this, the training control unit 15B determines the date and time to send the training email based on the transmission timing set in the implementation content data 14A (step 111), instructs the training device 31 on the communication network NW to send a training email using the contents of the training email via the network I / F 11 (step 112), and the email monitoring unit 15A terminates email monitoring (step 113).

[0042] In this case, the training control unit 15B determines the date and time of sending the training email to be 15 minutes after the date and time when the sent email was detected, as the example in Figure 2 described above. The content of the training email to be instructed to the training device 31 is not limited to the configuration shown in Figure 5 described above, and may also be instructed using a list showing the contents of each column.

[0043] The training device 31 generates a training email addressed to the email address of the training target user based on the training email content included in the training email transmission instruction from the relay device 10, and sends it to the mail server 30 at the training email transmission date and time (step 114).

[0044] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 120), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0045] In response, if the mail server 30 returns an incoming mail (step 121), the control circuit 15 relays and forwards it to the target user terminal 20 via the network interface 11, relay circuit 13, and LAN interface 12.

[0046] As a result, the training email is relayed to the target user terminal 20 and viewed by the training user. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and a notification of malware infection is sent to the training device 31 on the communication network NW, and this is collected as training results. At this time, a training email mimicking a reply to the email sent by the training user is sent back to the training user at the same time the email was sent. In addition, a highly credible training email reflecting the content of the email sent by the training user is sent back.

[0047] [Effects of the First Embodiment] In this embodiment, the relay device 10 monitors outgoing emails sent from the target user terminal 20 of the training target user to the mail server 30, and upon detection, obtains the content of the outgoing email. Based on the obtained content of the outgoing email, it generates training email content addressed to the training target user, which mimics a reply email to the outgoing email, and instructs the training device 31 on the communication network NW to send a training email using the training email content.

[0048] This allows the system to send a training email to a trainee user at the same time the user sends an email, mimicking a reply to that email. Furthermore, it can send a highly credible training email that reflects the content of the email sent by the trainee user. Therefore, it becomes possible to accurately assess a user's ability to deal with malicious attack emails that mimic replies.

[0049] [Second Embodiment] Next, a relay device 10 according to a second embodiment of the present invention will be described. In the first embodiment described above, the case in which the transmission of training emails and the collection of training results are performed by an existing training device 31 on a communication network NW was described as an example. In this embodiment, the case in which the configuration of the training device 31 is implemented in the control circuit 15 of the relay device 10 will be described as an example.

[0050] The configuration of the relay device 10 according to this embodiment is almost the same as the block diagram shown in Figure 1 above, but some of the configurations of the training control unit 15B of the control circuit 15 are different.

[0051] [Training Control Unit] The training control unit 15B is configured to, when the email monitoring unit 15A detects an outgoing email sent from the target user terminal 20, acquire the content of the outgoing email, generate a training email that mimics a reply email to the outgoing email based on the obtained content, and send the training email to the mail server 30 on the communication network NW. At this time, the training control unit 15B is configured to determine the date and time of sending the training email based on the transmission timing set in the implementation data 14A of the memory circuit 14, and to send the training email to the mail server 30 according to that date and time.

[0052] For example, according to the example in Figure 2 mentioned above, the date and time 15 minutes after the date and time the outgoing email was detected is determined as the date and time the training email was sent.

[0053] Furthermore, the training control unit 15B is configured to collect training results related to the target user terminal 20 and store them in the memory circuit 14 if it is notified that malware attached to a training email has been activated and the target user terminal 20 has been infected with malware.

[0054] [Operation of the second embodiment] Next, with reference to the sequence diagram in Figure 6, the operation of the relay device 10 according to the second embodiment will be described. In the following description, the case in which the contents shown in Figure 2 above are pre-set in the implementation data 14A of the memory circuit 14, and a training email addressed to the training target user is sent from the relay device 10 will be described as an example. Steps 100 to 106 in Figure 3 are the same in this embodiment as well, and a detailed explanation will be omitted here.

[0055] The training control unit 15B generates a training email that mimics a reply email to an email sent by a user being trained, based on the content of the email sent by the user being trained, which was obtained in step 105 of Figure 3 (step 200). In this case, the content of the training email is the same as the example in Figure 5.

[0056] After this, the training control unit 15B determines the date and time to send the training email based on the transmission timing set in the implementation data 14A (step 201), sends the training email to the mail server 30 on the communication network NW via the network I / F 11 (step 202), and the mail monitoring unit 15A terminates mail monitoring (step 203).

[0057] In this case, the training control unit 15B determines the date and time of sending the training email to be 15 minutes after the date and time when the sent email was detected, as the date and time of sending the training email, in the example shown in Figure 2 above.

[0058] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 120), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0059] In response, if the mail server 30 returns an incoming mail (step 121), the control circuit 15 relays and forwards it to the target user terminal 20 via the network interface 11, relay circuit 13, and LAN interface 12.

[0060] As a result, the training email is relayed to the target user terminal 20 and viewed by the training user. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the relay device 10 is notified of the malware infection, which is then collected as a training result. At this time, a training email mimicking a reply to the email sent by the training user is sent back to the training user at the same time the email was sent. In addition, a highly credible training email reflecting the content of the email sent by the training user is sent back.

[0061] [Effects of the second embodiment] Thus, in this embodiment, the relay device 10 is configured to detect outgoing emails from the target user terminal 20, acquire the content of the outgoing email, and based on the acquired content, generate a training email addressed to the training target user, which mimics a reply email to the outgoing email, and send it to the mail server 30.

[0062] Therefore, the relay device 10 alone can accurately grasp the user's ability to deal with malicious attack emails that mimic reply emails, and the required configuration can be simplified.

[0063] [Expansion of the embodiment] Although the present invention has been described above with reference to embodiments, the present invention is not limited to the above embodiments. Various modifications to the configuration and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art. Furthermore, each embodiment can be arbitrarily combined and implemented without contradiction. [Explanation of Symbols]

[0064] 10...Relay device, 11...Network interface, 12...LAN interface, 13...Relay circuit, 14...Memory circuit, 14A...Implementation data, 14P...Program, 15...Control circuit, 15A...Email monitoring unit, 15B...Training control unit, 20...User terminal, 20...Target user terminal, 30...Email server, 31...Training device, LAN...Local network, L...Communication line, NW...Communication network.

Claims

1. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit configured to monitor outgoing emails sent from the target user terminal of a training user to the mail server on the communication network, A training control unit is configured to, upon detection of an outgoing email from the target user terminal by the email monitoring unit, acquire the content of the outgoing email, generate a training email addressed to the target user that mimics a reply email to the outgoing email based on the obtained content of the outgoing email, and instruct a training device on the communication network to send a training email using the training email content. A relay device characterized by being equipped with the following features.

2. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit configured to monitor outgoing emails sent from the target user terminal of a training user to the mail server on the communication network, A training control unit is configured to detect outgoing emails from the target user terminal in the email monitoring unit, acquire the content of the outgoing email, generate a training email addressed to the target user that mimics a reply email to the outgoing email, and send it to the email server based on the obtained content of the outgoing email. A relay device characterized by being equipped with the following features.

Images