relay device

Abstract

This device provides a relay system that accurately assesses a user's ability to deal with attack emails under desired email reception conditions. [Solution] The relay device 10 includes a relay circuit 13 that relays user terminals 20 connected to it via LAN to the communication network via a communication line L, and a control circuit 15 that monitors and controls data communication between the user terminals 20 and the communication network via the relay circuit 13. The control circuit 15 includes a mail monitoring unit 15A that monitors received mail received by the target user terminal of the training target user from the mail server 30 on the communication network, and a training control unit 15B that, in response to the detection of received mail to the target user terminal by the mail monitoring unit 15A, acquires the content of the received mail, generates training mail content addressed to the training target user that mimics a resent mail in response to the received mail, and instructs the training device 31 on the communication network to send the training mail using the training mail content.

Description

Technical Field

[0001] The present invention relates to security countermeasure technology for training a user to correctly handle attack emails based on training emails that mimic malicious attack emails.

Background Art

[0002] In recent years, the damage caused by malicious malware that uses emails as an infection route has been increasing rapidly. For example, according to "Emotet", which infects just by clicking on and opening an attached file in a targeted attack email, not only the email data registered on the user terminal but also important personal information including authentication information such as IDs and passwords is said to be leaked. Therefore, if such malware infection occurs, new attack emails are generated based on the leaked email data and the infection spreads to other users, access to the internal network is made based on the leaked authentication information and confidential information is stolen, or it leads to extremely large damage such as being infected with a malicious program typified by "Ransomware" that demands a ransom. Therefore, it is important to correctly handle attack emails, and users are required to master correct handling from day to day. <00000?1>

[0003] Conventionally, as a technique for grasping the user's correct handling ability for such attack emails, Patent Document 1 proposes a training device for training correct handling of attack emails that generates training emails that mimic malicious attack emails based on a preset template, transmits them to a user to be trained via a mail server, and detects that the user has received the training email on the user terminal and opened the attached file attached to the training email. Thereby, the user's correct handling ability for attack emails can be grasped, and it can be reflected in efforts to enhance the user's security awareness and in improving the security literacy of the entire organization to which the user belongs.

Prior Art Documents

Patent Documents

[0004] [Patent Document 1] Japanese Patent Publication No. 2013-149063 [Overview of the Initiative] [Problems that the invention aims to solve]

[0005] A user's response to an attack email varies depending on the circumstances under which they received it. In particular, security awareness regarding opening attachments is relatively high when the email arrives unexpectedly, but decreases when it arrives at a predictable time, leading to a tendency to carelessly open attachments. For example, if a user receives a resent email after already receiving an email, their security awareness regarding opening attachments in the resent email decreases because the resentment is predictable. Therefore, understanding a user's ability to respond to resent emails is crucial.

[0006] According to the conventional technology mentioned above, while it is possible to arbitrarily adjust the date, time, and number of training emails sent, there was a problem in that it was not possible to send a training email that mimicked a resend email to the target user at the moment the target user received the email. Furthermore, when generating training emails based on pre-registered template data, as in the conventional technology mentioned above, it is not possible to reflect the content of the emails received by the target user, resulting in the inability to generate highly credible training emails and a decrease in the quality of the training itself.

[0007] This invention aims to solve these problems and provide a security measure that can accurately assess a user's ability to deal with malicious attack emails that mimic resent emails. [Means for solving the problem]

[0008] To achieve this objective, the relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to monitor received mail received by the target user terminal of the training target user from a mail server on the communication network, and a training control unit configured to acquire the content of the received mail in response to the detection of received mail to the target user terminal by the mail monitoring unit, generate training mail content addressed to the training target user that mimics a resent mail for the received mail based on the obtained received mail content, and instruct a training device on the communication network to send a training mail using the training mail content.

[0009] Furthermore, another relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to monitor received mail received by the target user terminal of the training target user from a mail server on the communication network, and a training control unit configured to acquire the content of the received mail in response to the detection of received mail to the target user terminal by the mail monitoring unit, generate a training mail addressed to the training target user that mimics a resent mail for the received mail, based on the obtained received mail content, and send it to the mail server. [Effects of the Invention]

[0010] According to the present invention, it becomes possible to accurately grasp a user's ability to deal with malicious attack emails that mimic resent emails. [Brief explanation of the drawing]

[0011] [Figure 1]Figure 1 is a block diagram showing the configuration of a relay device according to the first embodiment. [Figure 2] Figure 2 is an explanatory diagram showing an example of setting up implementation details data. [Figure 3] Figure 3 is a sequence diagram showing the operation of the relay device according to the first embodiment. [Figure 4] Figure 4 is an explanatory diagram showing an example of the content of a received email. [Figure 5] Figure 5 is an explanatory diagram showing an example of training email content. [Figure 6] Figure 6 is a sequence diagram showing the operation of the relay device according to the second embodiment. [Modes for carrying out the invention]

[0012] Next, embodiments of the present invention will be described with reference to the drawings.

[0013] [First Embodiment] First, with reference to the block diagram in Figure 1, the relay device 10 according to the first embodiment of the present invention will be described.

[0014] This relay device 10 consists of relay devices such as a UTM (Unified Threat Management) device and a gateway, and is configured to relay user terminals 20 such as PCs and smartphones, which are connected to it via a LAN (Local Area Network), to a higher-level communication network NW such as the Internet.

[0015] [Principle of the present invention] A user's response to a targeted attack email containing malware attachments varies depending on the circumstances under which they received the email. In particular, security awareness regarding opening attachments is relatively high when the email arrives unexpectedly, but decreases when it arrives at a predictable time, leading to a tendency to carelessly open attachments. For example, if a user receives a resent email after already receiving an original email, their security awareness regarding opening attachments in the resent email decreases because the resentment is anticipated. Therefore, understanding a user's ability to respond to resent emails is crucial.

[0016] Here, the relay device 10 is configured to monitor and control data communication, including email exchanges, between the user terminal 20 connected to it via the LAN and the communication network NW. When the user terminal 20 sends an email reception request to the mail server 30, the relay device 10 can acquire the content of the received email included in the email reception response sent back from the mail server 30 in response to that email reception request.

[0017] The present invention focuses on the configuration for monitoring and controlling emails that is originally provided in such a relay device 10, and monitors the exchange of emails between the target user terminal 20 of the training user and the mail server 30, and in response to the detection of received emails received by the target user terminal 20 from the mail server 30, it acquires the content of the received email, and uses the training email generated based on the obtained received email content to understand the training user's ability to respond to resent emails.

[0018] As a result, it is possible to transmit a training email that mimics a resend email to the email in accordance with the timing when the training target user receives the email, and further, it is possible to generate a highly reliable training email that reflects the content of the received email received by the training target user. Therefore, it becomes possible to accurately grasp the user's coping ability against an illegal attack email that mimics a resend email.

[0019] [Detailed Configuration of Relay Device] Next, referring to the block diagram of FIG. 1 described above, the detailed configuration of the relay device 10 according to the present embodiment will be described.

[0020] The relay device 10 according to the present embodiment includes a network I / F 11, a LAN I / F 12, a relay circuit 13, a memory circuit 14, and a control circuit 15 as main circuit configurations.

[0021] [Network I / F] The network I / F 11 is connected to the communication network NW via the communication line L and is configured to perform data communication with the communication network NW based on an instruction from the control circuit 15.

[0022] [LAN I / F] The LAN I / F 12 is connected to the LAN and is configured to perform data communication with the LAN based on an instruction from the control circuit 15.

[0023] [Relay Circuit] It is connected to the network I / F 11 and the LAN I / F 12 and is configured to relay and connect data communication between the network I / F 11 and the LAN I / F 12 in response to an instruction from the control circuit 15.

[0024] [Memory Circuit] The memory circuit 14 is generally composed of a storage device such as a semiconductor memory or a hard disk, and is configured to store processing data and a program 14P used in the training email control process executed by the control circuit 15.

[0025] The main processing data stored in the memory circuit 14 is the execution content data 14A.

[0026] [Implementation details data] Implementation content data 14A is data used to set the content of the training to be actually conducted using training emails, and is pre-set in the memory circuit 14 by the training administrator. Note that the data set in implementation content data 14A is not limited to the data described below, and other data used to create training emails, such as personal information such as the affiliation of the training target users, may also be set in implementation content data 14A.

[0027] In the example settings shown in Figure 2, the username of the user to be trained is set to "Saxa Taro," and the email address of the user to be trained is set to "saxa.taro@saxa.jp." As a result, training is conducted on a user named "Saxa Taro," the content of an incoming email addressed to "saxa.taro@saxa.jp" is retrieved, and a training email simulating a resent email is generated based on that content, with "saxa.taro@saxa.jp" set as the recipient email address.

[0028] Furthermore, in the example settings shown in Figure 2, the timing for sending the training email is set to "15 minutes after the received email," meaning the training email will be sent 15 minutes after the date and time the received email was received by the training target user. Note that "15 minutes" is just an example; any typical time required for a resent email to arrive after the received email should be used. For the date and time of the received email, the date and time when the relay device 10 detected the received email, or the reception timestamp written in the header of the received email, should be used.

[0029] [program] Program 14P is a program that, in cooperation with the CPU of the control circuit 15, realizes various processing units for executing training email control processing in the control circuit 15. This program 14P is read from an external device or recording medium (neither of which are shown) and stored in the memory circuit 14 in advance.

[0030] [control circuit] The control circuit 15 has a CPU and its peripheral circuits, and is configured to execute training email control processing by having the CPU and the program 14P of the memory circuit 14 cooperate to realize various processing units.

[0031] The main processing units implemented in the control circuit 15 are the email monitoring unit 15A and the training control unit 15B.

[0032] [Email Monitoring Department] The email monitoring unit 15A monitors data communication between the user terminal 20 and the communication network NW via the relay circuit 13, and is configured to detect received emails from the email server 30 that the target user terminal 20 has received, based on the implementation data 14A of the storage circuit 14. Specifically, for example, received emails can be detected from the email reception response sent back from the email server 30 in response to an email reception request sent from the target user terminal 20.

[0033] [Training Control Unit] The training control unit 15B is configured to, when the email monitoring unit 15A detects an incoming email received by the target user terminal 20, acquire the content of the incoming email, generate training email content for a training email that mimics a resent email in response to the incoming email, and instruct the training device 31 on the communication network NW to send the training email using the training email content.

[0034] Furthermore, when the training control unit 15B instructs the training device 31 to send a training email, it is configured to determine and instruct the date and time of sending the training email based on the transmission timing set in the implementation data 14A of the memory circuit 14. In this case, for example, according to the example in Figure 2 mentioned above, the date and time of sending the training email is determined to be 15 minutes after the date and time when the received email was detected.

[0035] [Operation of the first embodiment] Next, the operation of the relay device 10 according to the first embodiment will be described with reference to the sequence diagram in Figure 3. In the following description, the case in which the contents shown in Figure 2 above are pre-set in the implementation data 14A of the memory circuit 14 will be explained as an example.

[0036] First, in the control circuit 15 of the relay device 10, the training control unit 15B sets the implementation data 14A in response to instructions from the user terminal 20 used by the training administrator, which are received via LANI / F12 (step 100), and the email monitoring unit 15A starts monitoring the received emails received by the training target users based on the implementation data 14A (step 101).

[0037] After monitoring begins, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 102), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0038] In response, when the mail server 30 sends back a mail reception response addressed to the training target user (step 103), the mail monitoring unit 15A temporarily receives this mail reception response from the relay circuit 13 and detects the received mail received by the target user terminal 20 (step 104). The training control unit 15B obtains the content of the received mail from the received mail detected by the mail monitoring unit 15A (step 105), and relays the received mail response to the target user terminal 20 connected to the LAN via the relay circuit 13 and LANI / F 12 (step 106).

[0039] Next, the training control unit 15B generates training email content that mimics a resent email in response to a received email, based on the acquired email content (step 110). Comparing the received email content shown in Figure 4 with the training email content shown in Figure 5, the "Subject" field of the training email, which indicates the subject, has "Resend" added, which is used in resend emails. Also, the "Date" field of the training email, which indicates the sending date and time, is set to a date and time 15 minutes after "2024 / 07 / 22 09:00" in the received email. Furthermore, the "Message-Id" of the received email, which indicates the identifier, is written in the "In-Reply-To" and "References" fields of the training email, which indicates the source. In addition, the email body of the training email contains content disguised as a resend email, and the training email has an attachment containing a program that notifies the recipient when the email is opened.

[0040] After this, the training control unit 15B determines the date and time to send the training email based on the transmission timing set in the implementation content data 14A (step 111), instructs the training device 31 on the communication network NW to send a training email using the contents of the training email via the network I / F 11 (step 112), and the email monitoring unit 15A terminates email monitoring (step 113).

[0041] In this case, the training control unit 15B determines the date and time for sending the training email to be 15 minutes after the date and time when the received email was detected, as in the example shown in Figure 2 above. The content of the training email to be instructed to the training device 31 is not limited to the configuration shown in Figure 5 above, but may also be instructed using a list that shows the contents of each column.

[0042] The training device 31 generates a training email addressed to the email address of the training target user based on the training email content included in the training email transmission instruction from the relay device 10, and sends it to the mail server 30 at the training email transmission date and time (step 114).

[0043] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 120), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0044] In response, if the mail server 30 returns an incoming mail (step 121), the control circuit 15 relays and forwards it to the target user terminal 20 via the network interface 11, relay circuit 13, and LAN interface 12.

[0045] As a result, the training email is relayed to the target user terminal 20 and viewed by the training user. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and a notification of malware infection is sent to the training device 31 on the communication network NW, and this is collected as training results. At this time, a training email mimicking a resent email to the training user is sent back to the training user at the same time the training user receives the email. In addition, a highly credible training email reflecting the content of the email received by the training user is sent.

[0046] [Effects of the First Embodiment] As described above, in this embodiment, the relay device 10 monitors the incoming emails received by the target user terminal 20 of the training target user from the mail server 30, and in response to detection, obtains the content of the incoming email, generates training email content addressed to the training target user that mimics a resent email in response to the incoming email, and instructs the training device 31 on the communication network NW to send the training email using the training email content.

[0047] This allows the system to send a training email to a trainee user at the exact moment they receive an email, mimicking a resent email. Furthermore, it can send a highly credible training email that reflects the content of the email the trainee user received. Therefore, it becomes possible to accurately assess a user's ability to deal with malicious attack emails that mimic resent emails.

[0048] [Second Embodiment] Next, a relay device 10 according to a second embodiment of the present invention will be described. In the first embodiment described above, the case in which the transmission of training emails and the collection of training results are performed by an existing training device 31 on a communication network NW was described as an example. In this embodiment, the case in which the configuration of the training device 31 is implemented in the control circuit 15 of the relay device 10 will be described as an example.

[0049] The configuration of the relay device 10 according to this embodiment is almost the same as the block diagram shown in Figure 1 above, but some of the configurations of the training control unit 15B of the control circuit 15 are different.

[0050] [Training Control Unit] The training control unit 15B is configured to obtain the content of a received email when the email monitoring unit 15A detects that an email has been received by the target user terminal 20, generate a training email that mimics a resent email in response to the received email based on the obtained content, and send the training email to the mail server 30 on the communication network NW. At this time, the training control unit 15B is configured to determine the date and time of sending the training email based on the transmission timing set in the implementation data 14A of the memory circuit 14, and to send the training email to the mail server 30 according to that date and time.

[0051] For example, according to the example in Figure 2 mentioned above, the date and time 15 minutes after the date and time the received email was detected is determined as the date and time the training email was sent.

[0052] Furthermore, the training control unit 15B is configured to collect training results related to the target user terminal 20 and store them in the memory circuit 14 if it is notified that malware attached to a training email has been activated and the target user terminal 20 has been infected with malware.

[0053] [Operation of the second embodiment] Next, with reference to the sequence diagram in Figure 6, the operation of the relay device 10 according to the second embodiment will be described. In the following description, the case in which the contents shown in Figure 2 above are pre-set in the implementation data 14A of the memory circuit 14, and a training email addressed to the training target user is sent from the relay device 10 will be described as an example. Steps 100 to 106 in Figure 3 are the same in this embodiment as well, and a detailed explanation will be omitted here.

[0054] The training control unit 15B generates a training email that mimics a resent email to the received email, based on the content of the received email of the target user obtained in step 105 of Figure 3 (step 200). In this case, the content of the training email is the same as the example in Figure 5.

[0055] After this, the training control unit 15B determines the date and time to send the training email based on the transmission timing set in the implementation data 14A (step 201), sends the training email to the mail server 30 on the communication network NW via the network I / F 11 (step 202), and the mail monitoring unit 15A terminates mail monitoring (step 203).

[0056] In this case, the training control unit 15B determines the date and time of sending the training email to be 15 minutes after the date and time when the received email was detected, as in the example shown in Figure 2 above.

[0057] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 120), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0058] In response, if the mail server 30 returns an incoming mail (step 121), the control circuit 15 relays and forwards it to the target user terminal 20 via the network interface 11, relay circuit 13, and LAN interface 12.

[0059] As a result, the training email is relayed to the target user terminal 20 and viewed by the training user. Therefore, if the monitored user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the relay device 10 is notified of the malware infection, which is then collected as training results. At this time, a training email mimicking a resent email to the training user is sent to the training user at the same time the training user receives the email. In addition, a highly credible training email reflecting the content of the email received by the training user is sent.

[0060] [Effects of the second embodiment] Thus, in this embodiment, the relay device 10 is configured to acquire the content of the received email in response to the detection of the received email by the target user terminal 20, and based on the obtained content of the received email, generate a training email addressed to the training target user that mimics a resent email in response to the received email, and send it to the mail server 30.

[0061] Therefore, the relay device 10 alone can accurately grasp the user's ability to deal with malicious attack emails that mimic resent emails, and the required configuration can be simplified.

[0062] [Expansion of the embodiment] Although the present invention has been described above with reference to embodiments, the present invention is not limited to the above embodiments. Various modifications to the configuration and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art. Furthermore, each embodiment can be arbitrarily combined and implemented without contradiction. [Explanation of Symbols]

[0063] 10...Relay device, 11...Network interface, 12...LAN interface, 13...Relay circuit, 14...Memory circuit, 14A...Implementation data, 14P...Program, 15...Control circuit, 15A...Email monitoring unit, 15B...Training control unit, 20...User terminal, 20...Target user terminal, 30...Email server, 31...Training device, LAN...Local network, L...Communication line, NW...Communication network.

Claims

1. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit configured to monitor incoming mail received from a mail server on the communication network by the target user terminal of the training user, A training control unit is configured to, upon detection of an incoming email to the target user terminal by the email monitoring unit, acquire the content of the received email, generate training email content addressed to the target user, which mimics a resent email in response to the received email, based on the obtained content, and instruct a training device on the communication network to send a training email using the training email content. A relay device characterized by being equipped with the following features.

2. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit configured to monitor incoming mail received from a mail server on the communication network by the target user terminal of the training user, A training control unit is configured to, upon detection of an incoming email to the target user terminal by the email monitoring unit, acquire the content of the received email, generate a training email addressed to the target user that mimics a resent email in response to the received email, and send it to the email server, based on the obtained content of the received email. A relay device characterized by being equipped with the following features.

Images