CN100589453C - An anti-spam processing device and method - Google Patents

Abstract

The invention discloses an anti-spam processing device and method. Wherein, the device includes a mail receiving/delivery unit, a general mail control unit, an anti-spam processing unit and a mail database, and the mail database pre-saves spam templates and legitimate mail templates; the mail receiving/delivery unit receives the mail receiving/sending After the request, the mail to be received/sent is sent to the anti-spam processing unit; the anti-spam processing unit compares the mail with the spam template and the legal mail template respectively, and then marks the type of the mail according to the comparison result, and sends it to the spam processing unit. To the general mail control unit for processing control, or back to the mail receiving/delivery unit. The device and method of the present invention can identify and filter junk emails based on dynamically generated email templates when receiving/sending emails, thereby achieving a better anti-spam effect.

Description

An anti-spam processing device and method

technical field

The invention relates to electronic mail (E-mail) processing technology, in particular to an anti-spam processing device and method.

Background technique

At present, spam is rampant on the Internet, causing great troubles to many network users. In order to solve the above problems, network service providers are studying anti-spam methods in order to better filter out spam on the network.

The method of existing anti-spam mainly contains following several: 1) filter spam based on the key character string of rule; 2) adopt statistical algorithm to classify and identify spam, such as Bayesian algorithm etc.; Intercepting spam; 4) Control methods such as flow limitation on sending behavior. The above anti-spam processing methods can be used alone or in combination, and are suitable for application on mail servers and/or mail processing devices at individual client terminals. FIG. 1 shows the structure of an existing mail processing device, including a mail receiving/delivery unit 11 and a general mail control unit 12 .

The general mail control unit 12 is used for encoding/decoding and storing mails, and displaying mail contents to users and the like. The control unit further includes: a legitimate mail processing module and a junk mail processing module. The legal email processing module is responsible for subsequent processing of emails with legal email identifiers, such as storing the emails in the inbox or sending them out, etc.; the spam email processing module is responsible for subsequent processing of emails with spam email identifiers, such as Put the email in the trash, do not send or restrict sending the email, etc.

The mail receiving/delivery unit 11 receives instructions from the general mail control unit 12, and receives/sends new mails between mail servers and/or individual clients according to existing mail transfer protocols.

Through practical application, it is found that the above-mentioned anti-spam method is only a passive response to spam, and spammers can easily adopt corresponding countermeasures to interfere with these anti-spam technologies.

For example, for verification methods such as message digest algorithm (MD5, Message-Digest algorithm 5), spammers introduce a small amount of randomly changing content when sending spam, so that the spam is not strictly the same.

For statistical methods such as Bayesian, spammers insert a large number of scrambled words/characters into the email, thereby disturbing the feature ratio used for spam identification.

For technologies such as black and white lists and sending address filtering, spammers change the sender/sending address in order to send similar emails through different server IPs.

For the language correlation method, the spammers change the language and character set of the email body, so that technologies such as Chinese word segmentation cannot effectively filter out spam.

For flow control methods, spammers slow down the frequency of sending spam, or control the number of emails sent by the same account, so that spam cannot be identified.

It can be seen from the above description that almost all commonly used anti-spam technologies have been cracked by spammers, that is, the update frequency of anti-spam technology is far behind that of spam sending technology, which makes the network unable to provide satisfactory Anti-spam effect.

Contents of the invention

In view of this, the main purpose of the present invention is to provide an anti-spam processing device, so that the mail processing device can identify and filter spam based on the mail template when receiving/sending mail, so as to achieve a better anti-spam effect.

Another object of the present invention is to provide an anti-spam processing method, which utilizes mail templates to identify and filter spam, and further generates and adjusts mail templates by actively extracting mail features.

In order to achieve the above object, the technical solution of the present invention is specifically realized in the following way:

An anti-spam processing device, including a mail receiving/delivery unit and a general mail control unit; the mail processing device also includes: an anti-spam processing unit and a mail database;

The mail database includes a legal mailing list database, a spam template database and a sample database of all mails, the legal mailing list database is used to preserve legal mail templates, and the spam template database is used to preserve spam templates;

After the mail receiving/delivery unit receives the mail receiving/sending request, it sends the mail to be received/sent to the anti-spam processing unit and saves it in the sample library of all mails;

The anti-spam processing unit obtains the legal mail template from the legal mailing list library and compares it with the mail to be received/sent. If there is a similar mail to the mail to be received/sent in the legitimate mail template, it will mark the mail to be received/sent as a legal mail logo;

Otherwise, obtain the spam template from the spam template library and compare it with the mail to be received/sent, if there is a similar mail to the mail to be received/sent in the spam template, then mark the spam logo on the mail to be received/sent;

Otherwise, look for similar emails of the emails to be received/sent in the entire email sample library, and extract the email templates of the emails to be received/sent according to the Alignment comparison algorithm when the number of similar emails exceeds a predetermined value, and set the email template for all emails according to the preset information. Mark the mail to be received/sent with a spam mark or a legitimate mail mark, and save the mail template of the mail to be received/sent to the corresponding mail database according to the type mark;

The anti-spam processing unit sends the mail to be received/sent marked with type identification to the general mail control unit for processing control, or returns to the mail receiving/delivery unit.

The anti-spam processing unit includes: a garbage judgment module and an email template extraction module;

After receiving the mails to be received/sent, the junk judgment module sends query requests to the legitimate mailing list database and the spam template database respectively to determine the mail type of the mails, and to determine the mail type of the mails to be received/sent. Send a template extraction instruction to the email template extraction module when the number of emails exceeds a predetermined value;

After the mail template extraction module receives the above instruction, it uses the Alignment comparison algorithm to extract the mail template, and saves it in the mail database of the corresponding type.

The mail processing device also includes: a maintenance module for all mail databases, a maintenance module for a mailing list database, and a maintenance module for a garbage template database;

The operations performed on the sample database of all emails, the database of legal mailing lists and the template database of spam are carried out through the maintenance module of the database of all emails, the maintenance module of the mailing list database and the maintenance module of the spam template database respectively.

The mail processing device also includes: an error feedback processing module, which is used to send a modification request to the anti-spam processing unit according to user feedback information; The module sends a modification notice to modify the corresponding data records in the legal mailing list library and/or spam template library;

Alternatively, the error feedback processing module directly sends a modification notice to the mailing list database maintenance module and/or spam template database maintenance module to modify the corresponding data records in the legal mailing list database and/or spam template database.

The mail processing device is set on the personal client side, and the general mail control unit sends a modification notice to the mail list database maintenance module and/or the spam template database maintenance module according to the user request, and revises the legitimate mail list database and/or the spam template database The corresponding data record in .

When the mail receiving/delivery unit receives the mail, the anti-spam processing unit determines the type of the mail, and adds the corresponding type identification to the general mail control unit;

The general mail control unit saves the mail in the corresponding position and displays it to the user according to the type identification, if it is a legal mail identification, it is stored in the inbox, if it is a spam identification, it is stored in the trash bin.

The mail processing device is set on a mail server.

A processing method for anti-spam, applied in a mail processing device comprising a mail receiving/delivery unit, a general mail control unit, an anti-spam processing unit and a mail database, the mail database including a legal mail list library for storing legal mail templates , a spam template storehouse for storing spam templates and a whole mail sample storehouse for storing unprocessed mail samples, the method comprises the following steps:

a. When the mail receiving/delivery unit receives/sends mails, it sends the mails to be received/sent to the anti-spam processing unit and stores them in the sample library of all mails;

b. The anti-spam processing unit compares the legitimate mail templates in the legitimate mailing list library with the mails to be received/sent one by one according to the comparison strategy, and judges whether there are similar mails to be received/sent, and if it exists, it is said to be received /Send the email with a legal email logo, otherwise perform step c;

c. The anti-spam processing unit compares the spam templates in the spam template library with the mails to be received/sent one by one according to the comparison strategy, and judges whether there are similar mails to be received/sent, and if it exists, it is the mail to be received /Send mail with a spam mark, otherwise execute step d;

d. The anti-spam processing unit searches for the similar mails of the mails to be received/sent stored in the entire mail sample database, and judges whether the number of similar mails exceeds a predetermined value, and if it exceeds, extracts the mails to be received/sent and other mails according to the Alignment comparison algorithm Generate a new mail template with the same content of the similar mail, and determine the type of the mail to be received/sent according to the preset information, and mark the corresponding type logo, and save the mail template to the corresponding mail according to the determined mail type in the database;

e. The anti-spam processing unit sends the mail to be received/sent with the type identification to the general mail control unit for processing and control, or returns it to the mail receiving/delivery unit.

In step b or c, the anti-spam processing unit obtains the comparison result according to the Alignment comparison algorithm.

In step d, the anti-spam processing unit determines the email type according to the black and white lists.

The comparison strategy includes: comparing email contents, or comparing email formats, or comparing communication instruction sequences for sending emails, or using any combination of the above three methods.

The method for judging whether there are similar emails to be received/sent in step b or step c is specifically: setting a similarity threshold in advance, and judging whether the comparison results of the one-by-one comparisons exceed the corresponding similarity threshold, and if so, then Similar mail for incoming/sent mail, otherwise not.

It can be seen from the above-mentioned technical scheme that this anti-spam processing device of the present invention adds an anti-spam processing unit to the existing mail processing device, and compares the mail to be received/sent with the template stored in the mail database in advance , according to existing information to distinguish spam emails from legitimate emails, and after determining the email type, extract the email features, save them in the email database, and use them as a new email template for comparison in the subsequent process, so that the email database can be dynamically updated, Therefore, the reliability of the mail processing device for identifying spam is improved, the flexibility of the device for anti-spam is enhanced, and a better anti-spam effect is achieved. Wherein, the mail processing device may refer to a mail server or a mail program set in a personal client terminal.

In addition, the anti-spam processing method of the present invention generates spam templates and legal email templates respectively by extracting the characteristics of sending behavior, sending content and structure of a large number of emails, and maintains the dynamic adjustment of the above-mentioned email templates, and then uses the Alignment comparison algorithm Compare the mail to be received/sent with the above mail template, and distinguish and filter out spam by judging the similarity between the mail and the mail template, so this method has a considerable degree of feasibility and can improve the accuracy of spam identification Spend.

Based on the above anti-spam technology, the present invention can better intercept spam information and ensure that the normal communication of mail system users will not be disturbed by spam mails. Furthermore, the mail system can use the above method to set spam warning and processing strategies, such as providing anti-spam services of different granularities for VIP paid users and ordinary free users.

Description of drawings

Fig. 1 is the composition structure of mail processing device in the prior art;

Fig. 2 is the schematic diagram that utilizes Alignment comparison algorithm to carry out character string comparison in a preferred embodiment of the present invention;

Fig. 3 is the composition structure of anti-spam processing device among the present invention;

FIG. 4 is a specific flow of anti-garbage processing in the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

The anti-spam processing device and method of the present invention can actively search for the regularity of mail in sending behavior, sending content and structure, etc., and introduce Alignment technology in the mail system to extract spam templates and/or legal mail templates as a spam discrimination mail standard.

The Alignment technology is a method applied in the field of bioinformatics, and is widely used to search for identical character strings in DNA sequences to reveal whether a certain sequence appears in large numbers in DNA databases. Among them, the characters in the DNA sequence refer to biological characters such as ATCG, and other characters such as spaces, newlines, special symbols, and non-English letters will be ignored in the field of bioinformatics. When using the Alignment technology to compare two input strings, it is allowed to perform operations such as deletion/insertion on the input strings, so that the two strings can be aligned and then compared, so that the maximum possible matching string between the two can be found.

In order to make the above-mentioned Alignment technology applicable to the mail system, the processing object of the Alignment technology is expanded in the present invention to cover all ASCII characters, special characters (such as carriage return, line feed and blank characters), and Chinese characters (character 127 ~256), etc., so that the Alignment technology has the ability to process any Chinese and English character strings. Figure 2 shows a schematic diagram of Alignment technology for string comparison. The upper and lower lines are the input strings that need to be compared, and '-' means inserting a space; the middle line is the comparison result, where '|' means match, and '.' means no match. After obtaining the comparison result, you can further judge whether the two input strings are similar according to the set standard. For example, if there are 25 character strings in total, if there are more than 13 '|' in the comparison result, then judge the two input strings The strings are similar.

It can be seen from Figure 2 that the Alignment technology can display the same content in two strings, so in the E-mail environment, specific Alignment comparison algorithms such as Fasta and Blast can be used to extract spam templates hidden in a large number of emails And/or legitimate email templates, such as XML text of a certain web page and structure, or article title templates, etc., make the anti-spam technology more targeted and improve the accuracy of spam interception. Still taking Figure 2 as an example, after comparing the two input strings, a new template can be generated by taking the same content.

In order to obtain spam templates and/or legitimate email templates, it is necessary to set up an email database to save a large number of E-mails as comparison objects, and form a large number of comparison results as references after a certain period of time. At the initial stage of realization of the method, the set mail databases such as the sample database of all mails, the database of legitimate mailing lists and the database of spam templates are all empty. Thereafter, when the mail processing apparatus receives/sends mail, it stores the mail as a sample in the entire mail sample library.

When the number of email samples in the entire email sample library reaches a certain number, the email processing device starts to work, and uses the Alignment comparison algorithm to compare the subsequent received new emails with the email samples in the entire email sample library, and judge the email according to the degree of similarity type. To improve efficiency, you can select only mail samples that are similar in size to the mail for comparison.

What Fig. 3 shows is the composition structure of anti-spam processing device in the present invention, and this mail processing device comprises: mail receiving/delivery unit 31, common mail control unit 32, anti-spam processing unit 33, whole mail sample storehouse 34, legal mail List library 35 and spam template library 36.

The working principle of the mail receiving/delivery unit 31 and the general mail control unit 32 is the same as that of the prior art, and will not be repeated here.

The anti-spam processing unit 33 includes: a spam determination module 331 and an email template extraction module 332 .

What preserved in the described whole mail sample storehouse 34 is unprocessed mail sample; Every piece of data records preserved in the legal mail list storehouse 35 is a legal mail template, and each legal mail template is all passed by more than one legal mail. After the comparison, the same content is extracted and generated; the spam template library 36 stores a spam template, and the generation method of this template is similar to that of a legitimate email template, and will not be repeated here.

In order to avoid direct operations on mail databases such as the whole mail sample library 34, the legal mail list library 35 and the spam template library 36, corresponding maintenance modules can be set for each database, which are respectively: the overall mail library maintenance module 341, the mailing list Library maintenance module 351 and garbage template library maintenance module 361. In this way, the operation instructions for each database can be issued through the corresponding maintenance module, and the operations include obtaining data records in the mail database, or adding, deleting and modifying data records therein.

After the mail receiving/delivery unit 31 receives the mail receiving/sending request, the mails to be received/sent are sent to the junk judging module 331 for processing, and the mails to be received/sent are stored in the whole mail database by the overall mail library maintenance module 341 simultaneously. Sample library34.

Garbage judging module 331 after receiving above-mentioned new mail, by all mail storehouse maintenance module 341, mail list storehouse maintenance module 351 and rubbish template storehouse maintenance module 361, to all mail sample storehouse 34, legal mail list storehouse 35 and spam template storehouse respectively The library 36 issues a query request, and judges the mail type of the new mail according to the data records in the above-mentioned database. Then, the junk judging module 331 marks the mail as legal/junk mail, and sends it to the general mail control unit 32 for processing and control, or returns it to the mail receiving/delivery unit 31 .

In addition, the email template extracting module 332 will extract new email templates according to the judgment result of the garbage judging module 331 and send them to the legitimate email list library 35 or the junk email template library 36. If the new email is a legitimate email, then a new email template will be obtained. Legal email templates are also the same for spam, so the anti-spam device of the present invention can dynamically generate and adjust its own email templates to ensure that the anti-spam technology it provides is not easy to be cracked.

The error feedback processing module 37 is responsible for adjusting the records in the corresponding database according to the feedback information of the user/administrator, such as an indication of an email misjudgment. Wherein, the error feedback processing module 37 can send the adjustment record request to the garbage judging module 331, and then the garbage judging module 331 completes the record adjustment of the corresponding database; or, the error feedback processing module 37 directly sends the adjustment record request to the mailing list library maintenance Module 351 and/or Garbage Template Library Maintenance Module 361 to complete the record adjustment of the corresponding database.

In addition, if the mail processing device of the present invention is set on a personal client, the general mail control unit 32 can also send adjustments directly to the mail list maintenance module 351 and/or spam template database maintenance module 361 according to the user's request. Record requests to operate on records in the corresponding database.

Based on the above-mentioned anti-spam processing device, the processing flow of the anti-spam technology of the present invention is shown in Figure 4, specifically comprising the following steps:

Step 401, after the mail processing device generates a new mail to be received/sent, it saves the mail in the sample database of all mails, and sends the mail to the anti-spam processing unit for type determination.

Step 402, after the garbage judging module in the anti-spam processing unit receives the above-mentioned mail, it sends a query request to the mailing list database maintenance module, and judges whether the mail is a legal mail through the data record of the legal mailing list database, and if so, execute the step 409, otherwise go to step 403.

Each data record stored in the legal mailing list database is a legal mail template, and these legal mail templates are generated by extracting the same content in the mail after comparing the legal mails through the Alignment comparison algorithm. The junk judging module compares the original content of the to-be-received/sent mail with the legal mail template one by one according to the Alignment comparison algorithm. Among them, the original content of the mail to be received/sent is in the form of alphabetic text, so the Alignment comparison algorithm can process it as a character string.

When making a specific comparison, you can set a comparison strategy based on the characteristics of E-mail, such as: comparing the similarity of E-mail content (including the header); comparing the similarity of E-mail format; or, analyzing the sending of spam During the behavior, compare the similarity of the communication command sequence for sending E-mail, etc.

If you want to compare E-mail formats, convert them into format sequences according to the order of appearance, and then compare the format sequences as strings. Under normal circumstances, only the three characters TAB (\t), carriage return (\r), and newline (\n) are regarded as format characters, so a possible format sequence is "\t\r\n\r\ n\r\n". In fact, the format characters constituting the E-mail format can be set as required, for example, punctuation marks can also be set as format characters. Similarly, Email content and/or communication instruction sequence can also use a similar method to obtain the comparison result.

For different comparison contents, the mail system can set different similarity thresholds, such as 95% similarity threshold for email headers, 80% similarity threshold for email text, 98% similarity threshold for attachments such as pictures, etc. Only when the comparison result exceeds the set similarity threshold can it be determined that the two are similar. The above similarity threshold can be adjusted and modified according to the user's feedback, which will not be repeated here.

In addition, the comparison results of different parts can also be calculated according to the specified rules to calculate a comprehensive similarity index, which can be used as a standard for identifying legitimate/spam emails. For example, if the header similarity of two input emails is >95%, the email body similarity is >80%, and both contain the same picture attachment, then it is determined that the two input emails are similar.

Through the above process, the garbage judging module can easily know whether the email is legitimate.

Step 403 , the spam determination module sends a query request to the spam template library maintenance module, and judges whether the email is spam according to the data records of the spam template library, and if so, executes step 404 , otherwise executes step 405 .

In this step, the judging process of spam emails is similar to that of legitimate emails, and will not be repeated here.

Step 404, the spam judging module marks the email as spam, gives a high-risk spam indicator, and sends it to the general mail control unit, and then executes step 410.

The high-risk spam indicators include: similarity of spam emails, number of emails covered by spam email templates, and the like. If the number of covered emails is 10,000, it indicates that the spam template is extracted based on 10,000 spam emails.

Step 405, the junk judging module sends a query request to the all mail database maintenance module, searches for similar mails of the mail in the mail samples stored in the whole mail sample database, and if the number of similar mails exceeds the preset threshold value T, then execute the step 406, otherwise directly execute step 407.

Step 406, the spam determination module sends a template extraction instruction to the email template extraction module. After the email template extraction module receives the above instructions, it selects at least one email sample similar to the email to be received/sent from the entire email sample library, and uses the Alignment comparison algorithm to compare the email with the email sample to generate a new email template.

Step 407, the garbage judging module judges the mail type according to the auxiliary information provided by itself, if it is a spam, then notify the mail template extraction module to save the new mail template in the spam template library, and perform step 408; if it is a legitimate mail, Then save the new mail template into the legitimate mailing list library, and execute step 409 .

The auxiliary information refers to black and white lists, etc. For example, if a certain mail is delivered by a trusted address, it will be listed on the white list, and the garbage determination module will receive the same mail as the sending address in the follow-up process. It will be judged as legitimate mail. Spam information can also be set in the same way, which will not be repeated here.

Step 408, the spam judging module marks the mail as spam, gives a medium spam indicator, and sends it to the general mail control unit, and then executes step 410.

Step 409, the spam judging module marks the email as a legitimate email, gives an indicator of the legitimate email, and sends it to the general email control unit.

Step 410, the general mail control unit executes subsequent processing on the mail according to the type identification, which will not be repeated here.

For the mail carrying the spam mark, the mail processing device will refuse to send or limit the sending, and keep sending normally for judging as legal mail.

The above-mentioned anti-spam processing process can be triggered when receiving/sending emails, thereby increasing the anti-spam processing strength when sending and receiving emails. For the two cases of receiving and sending mail, the mail processing device can treat them differently when performing type determination. For example, for received emails, it is necessary to query the entire email sample library; but it is not necessary to perform the above process when sending emails. For another example, when the mail processing device is installed on the mail server, a large-scale mail database is used for comparison when receiving mail, while sending mail only needs to compare a small range of mail templates.

In addition, the above-mentioned mail processing device can be installed on the mail server and the personal client side at the same time, so that the entire mail system has a stronger anti-spam capability. When an individual client sends an email to the mail server, it will perform an email scan to determine the type of the email according to the data records in its own email database; after the email server receives the email, it can perform another type determination. And extract new mail templates according to the situation. In practical applications, the anti-spam processing process of the mail system is not limited to this, and the mail scanning process can be triggered on any desired mail processing device, which will not be repeated here.

As can be seen from the above-mentioned embodiments, this anti-spam processing device and method of the present invention compares the mail to be received/sent with the template stored in the mail database in advance, and distinguishes spam and legitimate mail according to existing information , and extract the features of the email after determining the email type, and use it as a new email template in the subsequent process, so as to achieve a better anti-spam effect.

Claims (12)

1, a kind of processing unit of anti-rubbish mail comprises mail reception/delivery unit and general mail control unit; It is characterized in that this mail treatment device also comprises: anti-trash processing unit and mail database;

Described mail database comprises legitimate mail tabulation storehouse, spam ATL and all mail sample storehouses, and described legitimate mail tabulation storehouse is used to preserve the legitimate mail template, and described spam ATL is used to preserve the spam template;

Mail reception/delivery unit gets the mail after the reception/transmission request, and the mail that receives waiting/send is delivered to anti-trash processing unit, and is kept in all mail samples storehouse;

Anti-trash processing unit obtains the legitimate mail template and waits that the mail that receives/send compares from legitimate mail tabulation storehouse, if there is the similar mail wait the mail that receives/sends in the legitimate mail template, the mail that then receives for waiting/send is stamped legitimate mail and is identified;

Otherwise, obtain the spam template and wait that the mail that receives/sends compares from the spam ATL, if there is the similar mail wait the mail that receives/send in the spam template, the mail that then receives for waiting/send is stamped spam and is identified;

Otherwise, in all mail sample storehouses, search the similar mail of waiting the mail that receives/send, when surpassing predetermined value, similar number of mail extracts the mail template of waiting the mail that receives/send according to the Alignment comparison algorithm, and according to the information that sets in advance is that the described mail that receives/send of waiting is stamped spam sign or legitimate mail sign, and the mail template of the mail that receives/send according to waiting of will extracting of type identification is saved in the mail database of correspondence;

Anti-trash processing unit will be stamped the mail that receives/send of waiting of type identification and deliver to general mail control unit and carry out processing controls, or return to mail reception/delivery unit.

2, device according to claim 1 is characterized in that, described anti-trash processing unit comprises: rubbish determination module and mail template extraction module;

After the rubbish determination module receives the described mail of waiting to receive/send, issue query requests to legitimate mail tabulation storehouse and spam ATL respectively, with the email type of definite described mail, and when surpassing predetermined value, the similar number of mail of the mail of waiting to receive/send sends the template extraction instruction to mail template extraction module;

After mail template extraction module receives above-mentioned instruction, utilize the Alignment comparison algorithm to extract the mail template, be saved in the mail database of corresponding types.

3, device according to claim 1 and 2 is characterized in that, this mail treatment device also comprises: all mail storehouses maintenance module, mail tabulation storehouse maintenance module and rubbish ATL maintenance module;

Then the operation that all mail samples storehouse, legitimate mail tabulation storehouse and spam ATL are carried out is undertaken by all mails storehouse maintenance module, mail tabulation storehouse maintenance module and rubbish ATL maintenance module respectively.

4, device according to claim 3 is characterized in that, this mail treatment device also comprises: the error feedback processing module is used for sending the request of modification according to field feedback to anti-trash processing unit; After anti-trash processing unit receives above-mentioned request, send amendment advice, revise the corresponding data record in legitimate mail tabulation storehouse and/or the spam ATL to mail tabulation storehouse maintenance module and/or rubbish ATL maintenance module;

Perhaps, the error feedback processing module is directly sent amendment advice to mail tabulation storehouse maintenance module and/or rubbish ATL maintenance module, revises the corresponding data record in legitimate mail tabulation storehouse and/or the spam ATL.

5, device according to claim 3, it is characterized in that, described mail treatment device is arranged on personal user's end, then general mail control unit is asked according to the user, send amendment advice to mail tabulation storehouse maintenance module and/or rubbish ATL maintenance module, revise the corresponding data record in legitimate mail tabulation storehouse and/or the spam ATL.

6, device according to claim 5 is characterized in that, when mail reception/delivery unit received mail, described anti-trash processing unit carried out type decision to this mail, and adds the type identification of going up correspondence and deliver to general mail control unit;

General mail control unit is kept at correspondence position with this mail and is shown to the user according to described type identification, if for legitimate mail sign then be kept at inbox, if identify for spam then be kept at dustbin.

7, device according to claim 3 is characterized in that, described mail treatment device is arranged on mail server.

8, a kind of processing method of anti-rubbish mail, be applied to comprise in the mail treatment device of mail reception/delivery unit, general mail control unit, anti-trash processing unit and mail database, it is characterized in that, described mail database comprises the legitimate mail tabulation storehouse of preserving the legitimate mail template, the spam ATL of preserving the spam template and all mail samples storehouse of preserving undressed mail sample, and this method may further comprise the steps:

A, mail reception/delivery unit are when reception/transmission mail, and the mail that receives waiting/send is delivered to anti-trash processing unit and is kept in all mail samples storehouse;

B, anti-trash processing unit according to comparison strategy with legitimate mail tabulate in the storehouse the legitimate mail template with treat that reception/transmission mail compares one by one, and judge whether to exist the similar mail of waiting to receive/send mail, if exist then stamp legitimate mail and identify for the described receptions/transmission mail for the treatment of, otherwise execution in step c;

C, anti-trash processing unit according to comparison strategy with the spam template in the spam ATL with treat that reception/transmission mail compares one by one, and judge whether to exist the similar mail of waiting to receive/send mail, if exist then stamp spam and identify for the described receptions/transmission mail for the treatment of, otherwise execution in step d;

D, anti-trash processing unit are searched the described similar mail of preserving in all mail samples storehouse of waiting to receive/send mail, and judge whether similar number of mail surpasses predetermined value, if surpass then extract the new mail template of identical content generation of waiting to receive/sends mail and its similar mail according to the Alignment comparison algorithm, and determine the described type of waiting to receive/send mail according to the information of setting in advance, and stamp corresponding type identification, according to the email type of determining, described mail template is saved in the corresponding mail database;

E, anti-trash processing unit will be stamped the reception/transmission mail for the treatment of of type identification and deliver to general mail control unit and carry out processing controls, or return to mail reception/delivery unit.

9, method according to claim 8 is characterized in that, among step b or the c, described anti-trash processing unit obtains comparative result according to the Alignment comparison algorithm.

10, method according to claim 8 is characterized in that, in the steps d, anti-trash processing unit is determined email type according to black and white lists.

11, method according to claim 8 is characterized in that, described comparison strategy comprises: compare Mail Contents, or compare mail format, or relatively send the communication instruction sequence of mail, or adopt the combination in any of above-mentioned three kinds of modes.

12, method according to claim 8, it is characterized in that, step b or step c be described to judge whether to exist the method for the similar mail of waiting to receive/send mail to be specially: set in advance similarity threshold, and judge whether the described comparative result that compares one by one surpasses corresponding similarity threshold, if surpass then receive/send the similar mail of mail for waiting, otherwise be not.

Images