JP2019036032A - Information processing device, information processing method and program - Google Patents

Abstract

To improve the accuracy of a spam list.
An information processing apparatus receives a block including one or more spam reports generated by an external apparatus that receives a spam report on communication data; and a reception unit previously received by the reception unit Based on the block chain formed by each block, verify the validity of the block received this time by the receiving unit, and if the block is valid, communicate with the verifying unit that adds the block to the block chain And a determination unit that determines whether or not the communication data is spam based on the block chain when the data is received.
[Selection] Figure 4

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  2. Description of the Related Art Conventionally, a filtering technique for preventing spam sent unilaterally for the purpose of advertising or the like by e-mail or the like is known (see, for example, Patent Document 1). In this filtering technology, for example, one or more keywords included in spam, the IP address of a spam transmission source, or an email address are registered in a black list, and received emails are automatically converted based on the black list. It is classified into a predetermined folder such as a junk mail folder, or reception is refused.

JP 2003-242090 A

  However, in the prior art, a spam list is created based on a relatively small number of samples by, for example, a specific business provider that provides services such as e-mail. There is a problem that may not be enough.

  Therefore, an object of one aspect is to provide a technique that can further improve the accuracy of a spam list.

  In one proposal, a receiving unit that receives a block including one or more spam reports generated by an external device that receives a spam report on communication data, and each block previously received by the receiving unit is formed. Based on the block chain, the validity of the block received this time by the receiving unit is verified, and if the block is valid, the verification unit that adds the block to the block chain and the communication data are received. An information processing apparatus is provided that includes a determination unit that determines whether the communication data is spam based on the block chain.

  According to one aspect, the accuracy of the spam list can be further improved.

It is a figure which shows the structural example of the communication system which concerns on embodiment. It is a figure which shows the hardware structural example of the terminal which concerns on embodiment. It is a figure which shows an example of a function structure of the communication system which concerns on 1st Embodiment. It is a sequence diagram which shows an example of a process of the communication system which concerns on 1st Embodiment. It is a figure explaining an example of a block chain. It is a figure explaining an example of a definition file. It is a flowchart which shows an example of a filtering process. It is a flowchart which shows an example of a block creation process. It is a flowchart which shows an example of a block verification process. It is a figure which shows an example of the functional block diagram of the communication system which concerns on 2nd Embodiment. It is a sequence diagram which shows an example of a process of the communication system which concerns on 2nd Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<System configuration>
FIG. 1 is a diagram illustrating a configuration example of a communication system 1 according to the embodiment. In FIG. 1, the communication system 1 includes terminals 10-1, 10-2,... (Hereinafter referred to simply as “terminal 10” when there is no need to distinguish each), and a monitoring terminal 20-1. , 20-2,... (In the following, when there is no need to distinguish between them, they are simply referred to as “monitoring terminal 20”), servers 30-1, 30-2,. Are simply referred to as “server 30”).

  The terminal 10, the monitoring terminal 20, and the server 30 are connected in a communicable state via a network 50 such as the Internet, a mobile phone network, a wireless LAN (Local Area Network), or a LAN. Further, the terminal 10 and each monitoring terminal 20 and between each monitoring terminal 20 are connected by, for example, a P2P (Peer-to-peer) network.

  The terminal 10 is, for example, an information processing apparatus (computer) such as a desktop PC (Personal Computer), a notebook PC, a tablet PC, or a smartphone. When the user determines that the mail received from the server 30 is spam, the terminal 10 transmits a spam report indicating that the mail is spam to the monitoring terminal 20 by the user's operation. Further, the terminal 10 receives a spam list from the monitoring terminal 20, and filters mails received from the server 30 based on the list.

  The monitoring terminal 20 is an information processing apparatus such as a desktop PC (Personal Computer) or a terminal having dedicated hardware for mining. Based on the spam report from each terminal 10, the monitoring terminal 20 creates a list of spam and transmits the created list to each terminal 10.

  The server 30 is an information processing device for the server, and transfers messages addressed to the terminal 10 by e-mail, SMS (Short Message Service), voice message by VoIP (Voice over IP), SNS (Social Networking Service), etc. To do. Hereinafter, a case where the server 30 transfers mail will be described as an example.

<Hardware configuration>
FIG. 2 is a diagram illustrating a hardware configuration example of the terminal 10 according to the embodiment. The terminal 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, a display device 106, an input device 107, and the like that are mutually connected by a bus B.

  A program for realizing processing in the terminal 10 is provided by the recording medium 101. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 realizes functions related to the terminal 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network. The display device 106 is a display that displays a GUI (Graphical User Interface) or the like by a program. The input device 107 receives input of various operation instructions.

  An example of the recording medium 101 is a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory. An example of the auxiliary storage device 102 is an HDD (Hard Disk Drive) or a flash memory. Both the recording medium 101 and the auxiliary storage device 102 correspond to computer-readable recording media.

  The hardware configuration of the monitoring terminal 20 and the server 30 may be the same as the hardware configuration example of the terminal 10 illustrated in FIG.

[First Embodiment]
<Functional configuration>
Next, the functional configuration of the communication system 1 according to the first embodiment will be described with reference to FIG. FIG. 3 is a diagram illustrating an example of a functional configuration of the communication system 1 according to the first embodiment.

≪Terminal≫
The terminal 10 has a storage unit 11. The storage unit 11 is realized using, for example, the auxiliary storage device 102 or the like. The storage unit 11 stores data such as the block chain 500 and the definition file 600. The block chain 500 stores each block including report data related to spam in association with the order in which the blocks are generated. The definition file 600 stores, for each mail, a user ID that is reported as spam, a user ID that is reported as not spam, and the like. The definition file 600 is updated based on the updated block chain 500, for example, when the block chain 500 is updated. Thereby, when a mail or the like is received, a spam score for the mail can be calculated relatively quickly.

  In addition, the terminal 10 includes a reception unit 12, a reception unit 13, a verification unit 14, a determination unit 15, a processing unit 16, a display unit 17, and a communication unit 18. Each of these units is realized by processing that one or more programs installed in the terminal 10 cause the CPU 104 of the terminal 10 to execute.

  The reception unit 12 receives a spam report operation from a user.

  The receiving unit 13 receives a block including a spam report from the monitoring terminal 20.

  The verification unit 14 verifies the validity of the block received by the reception unit 13. For example, the verification unit 14 verifies whether or not the nonce included in the block is correct based on a predetermined algorithm. In addition, the verification unit 14 verifies whether the hash value of the previous block included in the block matches the hash value of the latest block in the block chain 500. In addition, the verification unit 14 verifies whether each report included in the block and other reports included in the block chain 500 and the block are not reports to the same mail by the same user.

  Further, the verification unit 14 adds the block that has been successfully verified to the block chain 500 and causes the storage unit 11 to store the block.

  The determination unit 15 determines whether the received mail is spam based on the block chain 500.

  The processing unit 16 performs received mail filtering processing based on the determination result by the determination unit 15.

  The display unit 17 displays the mail that has been filtered by the processing unit 16 on the screen.

  The communication unit 18 communicates with the monitoring terminal 20 and the server 30. The communication unit 18 transmits a spam report to the monitoring terminal 20. In addition, the communication unit 18 receives mail (an example of “communication data”) from the server 30.

≪Monitoring terminal≫
The monitoring terminal 20 has a storage unit 21. The storage unit 21 is realized using, for example, an auxiliary storage device. The storage unit 21 stores data such as the block chain 500.

  The monitoring terminal 20 includes a reception unit 22, a generation unit 23, a transmission unit 24, a verification unit 25, and a communication unit 26. Each of these units is realized by processing that one or more programs installed in the monitoring terminal 20 cause the CPU of the monitoring terminal 20 to execute.

  The receiving unit 22 receives a spam report from the terminal 10.

  The generation unit 23 generates a block including a report of spam received by the reception unit 22.

  The transmission unit 24 broadcasts (broadcasts) the block generated by the generation unit 23 to each terminal 10 and each other monitoring terminal 20.

  The verification unit 25 verifies the validity of the block received from the other monitoring terminal 20. The verification unit 25 adds the block that has been successfully verified to the block chain 500 and causes the storage unit 21 to store the block.

  The communication unit 26 communicates with the terminal 10 and each other monitoring terminal 20.

<Processing>
Next, processing of the communication system 1 according to the first embodiment will be described with reference to FIG. FIG. 4 is a sequence diagram illustrating an example of processing of the communication system 1 according to the first embodiment.

  In step S <b> 1, the communication unit 18 of the terminal 10 receives mail from the server 30.

  Subsequently, the determination unit 15 and the processing unit 16 of the terminal 10 filter the received mail based on the block chain 500 (step S2).

  FIG. 5 is a diagram for explaining an example of the block chain 500. The block chain 500 is a database that stores data by sequentially generating data units called blocks and connecting them like chains. As shown in FIG. 5, each block 501A, 501B,... Included in the block chain 500 is a proof based on the hash values 502A, 502B,. Nonce 503A, 503B for proof of work (POW), reports 504A-1, 504A-2, ..., 504B- 1... (In the following, when there is no need to distinguish between them, they are simply referred to as “report 504”).

  Each report 504 includes, for example, a report type, a mail ID, a report source user ID, and the like. The report type is information indicating whether it is a spam report or a non-spam report. Here, the spam report is a report when it is determined as spam by the user, and the non-spam report is a report when it is determined by the user that it is not spam.

  The mail ID is identification information of the mail to be reported. The email ID is, for example, one or more keywords, subject, body, URL (Uniform Resource Locator) contained in the email to be reported, the IP address of the spam sender, and the email address of the spam sender. Etc. may be at least one. The mail ID may be extracted by the terminal 10 or may be extracted by a selection operation of the user of the terminal 10.

  The report source user ID is identification information of the user who made the report, and may be, for example, the mail address of the user.

  FIG. 6 is a diagram for explaining an example of the definition file 600. The terminal 10 generates a definition file 600 as shown in FIG.

  The definition file 600 stores an agreed user ID and a negative user ID in association with the mail ID. The mail ID is a mail ID included in each report described above. The consent user ID is one or more report source user IDs that have made a spam report for the mail related to the mail ID. The negative user ID is zero or one or more reporter user IDs who have made a non-spam report for the mail related to the mail ID.

  The processing unit 16 of the terminal 10 uses the definition file 600 generated based on the block chain 500 to determine whether each mail is spam or the like, and distributes it to a spam folder or assigns a predetermined name to a subject. A predetermined filtering process such as inserting a warning message is performed.

  Subsequently, the display unit 17 of the terminal 10 displays the filtered mail on the screen (step S3). Here, the mail is browsed by the user, and it is determined whether or not it is spam.

  Subsequently, the receiving unit 12 of the terminal 10 receives a spam report or non-spam report operation from the user (step S4).

  Subsequently, the communication unit 18 of the terminal 10 transmits a report corresponding to the operation to the user to each of the monitoring terminals 20-1, 20-2,... (Step S5-1, Step S5-2).

  Subsequently, the generation unit 23 of one monitoring terminal 20-1 among the monitoring terminals 20 completes block generation before the other monitoring terminals 20 (step S6). Here, it is assumed that the monitoring terminal 20-1 has completed the block generation earliest.

  In order to complete the block generation, the nonce calculation needs to be completed. Therefore, the generation unit 23 of each monitoring terminal 20 sequentially generates nonce candidates and searches for a nonce that satisfies a predetermined condition. And the monitoring terminal 20 which discovered nonce first completes the production | generation of a block, and may obtain a predetermined | prescribed reward from each terminal 10, for example.

  Subsequently, the transmission unit 24 of the monitoring terminal 20-1 that first completes the block generation transmits the generated block to each terminal 10 and the other monitoring terminals 20-2,. S7-1, 7-2). Here, for example, when the monitoring terminal 20-1 has not received the block from another monitoring terminal 20 at the time when the monitoring terminal 20-1 has completed the generation of the block, the transmission unit 24 of the monitoring terminal 20-1 It is determined that the generation is completed first, and the block is transmitted by broadcasting or the like.

  Subsequently, the verification unit 14 of each terminal 10 and the verification units 25 of the monitoring terminals 20-2,... Other than the monitoring terminal 20-1 that first completed the block generation verify the validity of the received block. (Steps S8-1 and 8-2).

  Subsequently, the verification unit 14 of each terminal 10 and the verification unit 25 of each monitoring terminal 20 add the block to the block chain 500 when the verification of the correctness is successful (steps S9-1, 9-2, 9-3).

  Subsequently, the generation unit 23 of each monitoring terminal 20 starts generation of the next block to be added to the block chain 500 next to the block (steps S10-1 and 10-2). Here, the POW process for the next block is started. In addition, each monitoring terminal 20 may adjust the difficulty of the process which calculates (calculates) a nonce so that the process of POW is completed in about predetermined time (for example, 10 minutes) on average, for example. In this case, a spam report or a non-spam report at the predetermined time interval is added to the block chain 500 approximately at the predetermined time interval.

  Here, each monitoring terminal 20 may adjust the difficulty level of the nonce calculation process by adjusting the number of zeros that should follow the hash value of the immediately preceding block in the block chain 500, for example.

<Modification of POW difficulty level adjustment>
The generation unit 23 of each monitoring terminal 20 may add blocks to the block chain 500 approximately every predetermined number of reports, instead of adding blocks to the block chain 500 approximately every predetermined time interval. In this case, for example, the generation unit 23 of each monitoring terminal 20 completes the POW process in about the time expected to receive a predetermined number (for example, 10) of reports from each terminal 10 based on the history of reports. As described above, the difficulty level of the process of calculating the nonce (an example of “calculation for generating a block”) may be adjusted. For example, if it took 1 hour before 10 reports were collected before, the time when the next block is added is adjusted to be 1 hour later. Also, for example, if it took only 1 minute before 10 reports gathered before, the time when the next block is added is adjusted to be 1 minute later.

  Thereby, for example, when spam is expanded at a stretch, the time from when a spam report is made until the spam report can be used for filtering can be shortened by increasing the timing at which the block is added. In addition, when the amount of spam is relatively low, the processing load on the block chain 500 by the terminal 10 can be reduced by delaying the timing at which blocks are added.

≪Filtering process≫
Next, the filtering process by the terminal 10 in step S2 of FIG. 4 will be described with reference to FIG. FIG. 7 is a flowchart illustrating an example of the filtering process.

  In step S <b> 101, the determination unit 15 obtains a score corresponding to the received mail calculated based on the block chain 500.

  Subsequently, the determination unit 15 determines whether or not the acquired score is larger than the first threshold (step S102).

  If the score is greater than the first threshold (YES in step S102), the determination unit 15 determines that the received mail is spam (step S103).

  Subsequently, the processing unit 16 displays the received mail on the display unit 17 as spam (step S104), and ends the process. Here, for example, the display unit 17 may display a message such as “E-mail was treated as spam. If you still want to see it, please click here” and a button. In this case, the display unit 17 may display the mail when the user presses the button.

  If the score is not greater than the first threshold (NO in step S102), the determination unit 15 determines whether the score is greater than the second threshold (step S105). Here, the second threshold is a value smaller than the first threshold.

  When the score is larger than the second threshold (YES in step S105), the determination unit 15 determines that the received mail is temporary spam (step S106).

  Subsequently, the processing unit 16 causes the display unit 17 to display the received mail as temporary spam (step S107), and ends the processing. Here, for example, the processing unit 16 may insert a message such as “(Spam Warning)” into the subject of the mail.

  If the score is not greater than the second threshold (NO in step S105), the determination unit 15 determines that the received mail is a normal mail (step S108).

  Subsequently, the processing unit 16 displays the received mail as a normal mail on the display unit 17 (step S109), and ends the process.

  In step S104 and step S107, the processing unit 16 may cause the display unit 17 to display a message corresponding to the generation order or generation time of each block including each report for the received mail. In this case, for example, in the block chain 500, when the spam report for the received mail includes a predetermined threshold value or more within a predetermined time, the processing unit 16 sends a message such as “Looks like recently generated spam”. It may be added to the subject. Accordingly, for example, since it is new spam, it is possible to notify the user that the user should be wary of an adverse effect when browsing the spam mail.

  Further, for example, in the block chain 500, when the frequency of spam reports for received mails has increased more than a predetermined threshold in recent years compared to the previous one, the processing unit 16 determines that “recently treated as spam. It may be added to the subject line. As a result, for example, when a company's e-mail magazine or advertising e-mail has been reported as spam recently due to a decline in the quality of information or privileges included in the e-mail. The user can be notified of this.

≪Block generation process≫
Next, the block creation processing by the monitoring terminal 20 in step S6 of FIG. 4 will be described with reference to FIG. FIG. 8 is a flowchart illustrating an example of a block creation process.

  First, the generation unit 23 calculates the hash value of the immediately preceding block in the block chain 500 (step S201).

  Subsequently, the generation unit 23 acquires each report received by the communication unit 26 after the immediately preceding block is generated (step S202).

  Subsequently, the generation unit 23 excludes reports on the same mail by the same user (step S203). Here, the generation unit 23, in a block already included in the block chain 500 or a block being generated, already includes a report for one mail by one user, the corresponding one by the one user When another report for one mail is received, the other report is discarded.

  That is, when the generation unit 23 includes a report for one mail by one user in a block and adds the block to the block chain 500, a plurality of reports for the one mail by the one user are included in the block chain 500. Do not include the report in the block. Thereby, when the same user reports a plurality of times for the same mail, the second and subsequent reports are discarded.

  Subsequently, the generation unit 23 excludes non-spam reports that make the number of non-spam reports for one mail larger than the number of spam reports for the one mail among the non-spam reports included in each report. (Step S204). As a result, the difference between the number of spam reports for one mail and the number of non-spam reports in the block chain 500 or each report is prevented from becoming a negative value.

  Subsequently, the generation unit 23 sequentially generates nonce candidates and searches for a nonce that satisfies a predetermined condition (step S205).

  Subsequently, the generation unit 23 generates a block including the nonce, the calculated hash value, and each report that is not excluded in step S203 and step S204 (step S206).

≪Block verification process≫
Next, block verification processing by the terminal 10 and the monitoring terminal 20 in step S8 of FIG. 4 will be described with reference to FIG. FIG. 9 is a flowchart illustrating an example of the block verification process. Hereinafter, the processing of the verification unit 14 of the terminal 10 will be described as an example, but the processing of the verification unit 25 of the monitoring terminal 20 may be the same as the processing of FIG. 9 described below.

  In step S301, the verification unit 14 determines whether the received block includes a report for the same mail by the same user. Here, in the case where the block already included in the block chain 500 or the block received this time includes a report for one mail by one user, the verification unit 14 When another report for the one mail by the one user is included, the block received this time is discarded.

  That is, when the verification unit 14 adds the received block to the block chain 500, if a plurality of reports for one mail by one user are included in the block chain 500, the verification unit 14 determines that the block is an illegal block. , Discard the block. Thereby, for example, a block that the same user reports a plurality of times for the same mail generated by a malicious minor operating the monitoring terminal 20 is discarded.

  When the received block includes a report for the same mail by the same user (YES in step S301), the verification unit 14 discards the block (step S302) and ends the process. Thereby, an illegal block is not added to the block chain 500. In this case, in the next and subsequent block generation, if a monitoring terminal 20 other than the monitoring terminal 20 that has transmitted the illegal block first calculates a nonce, a new valid block is added to the block chain 500. .

  When the received block does not include a report for the same mail by the same user (NO in step S301), the verification unit 14 sets the number of non-spam reports for one mail in the received block. It is determined whether or not non-spam reports are included that are larger than the number of spam reports for (step S303).

  When the received block includes a non-spam report that makes the number of non-spam reports for one mail larger than the number of spam reports for the one mail (YES in step S303), the process in step S302 is performed. move on.

  When the received block does not include a non-spam report that increases the number of non-spam reports for one mail more than the number of spam reports for the one mail (NO in step S303), the verification unit 14 The received block is added to the block chain 500 (step S304).

  Subsequently, the verification unit 14 updates the definition file 600 based on the block chain 500, calculates a score corresponding to the received mail based on the updated definition file 600 (step S305), and ends the process. In addition, the verification part 25 of the monitoring terminal 20 does not need to perform about the process of step S305.

≪Score calculation≫
(Calculation method 1)
In step S305 of FIG. 9, the verification unit 14 may calculate the mail score S related to each mail ID by the following equation.

S = A / (A + N) (1)
Here, A is the total number of consenting user IDs for the mail related to each mail ID (number of consenters) in the definition file shown in FIG. 6, and N is the total number of negative user IDs for the mail related to each mail ID ( Negative number).

(Calculation method 2)
The verification unit 14 may calculate the mail score S related to each mail ID by the following procedure.

  First, the mail group M1 in which the value of A / (A + N) is equal to or less than a predetermined threshold value α is extracted from the definition file 600.

  Subsequently, a mail group M2 in which the value of A / (A + N) is equal to or greater than a predetermined threshold value β (> α) is extracted from the definition file 600.

  Subsequently, for each reporter ID, a value obtained by adding the number of non-spam reports in the mail group M1 and the number of spam reports in the mail group M2 is calculated as the number of correctly reported cases.

Subsequently, a value obtained by dividing the number of correctly reported reports for each reporter by the total number of reports for each reporter is defined as a contribution degree k _i for each reporter.

  Subsequently, the mail score S relating to each mail ID may be calculated by the following equation.

S = Σc _i / (Σc _i + Σd _i ) (2)
Here, Σc _i is a value obtained by summing up the contribution degree k _i of the reporter who reported the spam for all the users with respect to the mail related to each mail ID. Further, Σd _i is a value obtained by summing up the contributions k _i of the reporter who made the non-spam report for all the users with respect to the mail related to each mail ID. As a result, it is possible to calculate a score more reflecting the report of the user who is estimated to have made a correct report.

(Calculation method 3)
The verification unit 14 adds a weight to each report included in each block of the block chain 500 according to the generation order or generation time of each block, and calculates a score based on each report to which the weight is added. May be.
In this case, for example, if the information on the generation time is included in each block, the verification unit 14 uses the information on the generation time. If the information on the generation time is not included in each block, the verification unit 14 generates each block. The order (order of each block in the block chain 500) may be used. And the verification part 14 may calculate a score by above-mentioned Formula (1) etc., after multiplying the number of consent user ID with the weighting coefficient of a larger value, so that a generation order or generation time is new.

  As a result, e-mail magazines, advertisement e-mails, etc. that were previously reported as spam by users in the past have been improved in the quality of benefits and information included in such e-mails. Therefore, when it is relatively frequently reported that it is non-spam recently, it can be treated as non-spam relatively early.

[Second Embodiment]
Next, a second embodiment will be described. In the first embodiment, the example in which the terminal 10 stores the block chain 500 and performs the filtering process based on the block chain 500 has been described. In the second embodiment, an example in which the server 30 performs storage processing of the block chain 500 and filtering processing based on the block chain 500 will be described. According to the second embodiment, in addition to the effect of the first embodiment, the processing load on each terminal 10 can be reduced.

  Note that the second embodiment is the same as the first embodiment except for a part thereof, and thus description thereof will be omitted as appropriate. Below, description is abbreviate | omitted about the part which is common in 1st Embodiment, and only a different part is demonstrated. Note that the contents described in the second embodiment can also be applied to the first embodiment.

<Functional configuration>
Next, a functional configuration of the communication system 1 according to the second embodiment will be described with reference to FIG. FIG. 10 is a diagram illustrating an example of a functional block diagram of the communication system 1 according to the second embodiment.

≪Terminal≫
The terminal 10 according to the second embodiment includes a reception unit 12, a display unit 17, and a communication unit 18.

<< Server >>
The server 30 according to the second embodiment includes a storage unit 31. The storage unit 31 is realized using, for example, an auxiliary storage device. The storage unit 31 stores data such as the block chain 500 and the definition file 600.

  In addition, the server 30 according to the second embodiment includes a reception unit 32, a verification unit 33, a determination unit 34, a processing unit 35, and a communication unit 36. Each of these units is realized by processing that one or more programs installed in the server 30 cause the CPU of the server 30 to execute.

  The receiving unit 32 receives a block including a report of spam from the monitoring terminal 20.

  The verification unit 33 verifies the validity of the block received by the reception unit 32. The verification unit 33 adds the block that has been successfully verified to the block chain 500 and causes the storage unit 31 to store the block.

  The determining unit 34 determines whether the received mail is spam based on the block chain 500.

  The processing unit 35 performs received mail filtering processing based on the determination result by the determination unit 34.

<Processing>
Next, processing of the communication system 1 according to the second embodiment will be described with reference to FIG. FIG. 11 is a sequence diagram illustrating an example of processing of the communication system 1 according to the second embodiment.

  In step S <b> 51, the communication unit 36 of the server 30 receives a mail from another server 30 or the terminal 10.

  Subsequently, the determination unit 34 and the processing unit 35 of the server 30 filter the received mail based on the block chain 500 (step S52).

  Subsequently, the communication unit 36 of the server 30 transmits the filtered mail to the terminal 10 (step S53). Here, for example, a message corresponding to the score is added to the subject or the like in the filtered mail.

  Subsequently, the display unit 17 of the terminal 10 displays the filtered mail on the screen (step S54). Here, the mail is browsed by the user, and it is determined whether or not it is spam.

  Subsequently, the receiving unit 12 of the terminal 10 receives a spam report or non-spam report operation from the user (step S55).

  Subsequently, the communication unit 18 of the terminal 10 transmits a report corresponding to the operation to the user to each of the monitoring terminals 20-1, 20-2,... (Step S56-1, Step S56-2).

  Subsequently, the generation unit 23 of one monitoring terminal 20-1 among the monitoring terminals 20 completes the block generation before the other monitoring terminals 20 (step S57).

  Subsequently, the transmission unit 24 of the monitoring terminal 20-1 that first completed the generation of the block transmits the generated block to each terminal 10 and the other monitoring terminals 20-2,... (Step S58). -1, 58-2).

  Subsequently, the verification unit 14 of each terminal 10 and the verification units 25 of the monitoring terminals 20-2,... Other than the monitoring terminal 20-1 that first completed the block generation verify the validity of the received block. (Steps S59-1, 59-2).

  Subsequently, the verification unit 14 of each terminal 10 and the verification unit 25 of each monitoring terminal 20 add the block to the block chain 500 when the verification of the correctness is successful (steps S60-1, 60-2, 60-3).

  Subsequently, the generation unit 23 of each monitoring terminal 20 starts generation of the next block to be added to the block chain 500 next to the block (steps S61-1, 61-2).

  Conventionally, a spam list is created by, for example, a company analyzing mail, and there is a problem that it takes a relatively long time from the start of spam distribution to the start of provision of the list. . When a list generated by a specific company is used, there is a possibility that specific spam is evaluated as not spam.

  According to the above-described embodiment, it is determined whether the received communication data is spam based on the list generated by the block chain. Thereby, the fairness of spam determination is ensured and the accuracy of the spam list can be further improved.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

  For example, each functional unit of the terminal 10, the monitoring terminal 20, and the server 30 may be realized by cloud computing including, for example, one or more computers. Moreover, it is good also as a structure which has at least one part of each function of the terminal 10 in the monitoring terminal 20 or the server 30. FIG.

  The terminal 10, the monitoring terminal 20, and the server 30 are examples of an “information processing apparatus”. The monitoring terminal 20 is an example of an “external device”.

Regarding the above description, the following items are further disclosed.
(Appendix 1)
A receiver for receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on a block chain formed by each block previously received by the receiving unit, the validity of the block received this time by the receiving unit is verified, and if the block is valid, the block is A verification unit to be added to the chain;
When receiving communication data, based on the block chain, a determination unit that determines whether the communication data is spam,
An information processing apparatus.
(Appendix 2)
If the report included in the block received this time by the receiving unit and the report included in the block chain are reports for the same communication data by the same reporter, the verification unit may illegally delete the block. Judge that there is
The information processing apparatus according to attachment 1.
(Appendix 3)
The determination unit adds a weight having a larger value to a relatively new block to each report included in each block of the block chain, and receives the report based on each report to which the weight is added. Determine if the communication data is spam,
The information processing apparatus according to appendix 1 or 2.
(Appendix 4)
When the received communication data is determined to be spam by the determination unit, the display unit displays a message corresponding to the generation time of each block including a report for the communication data.
The information processing apparatus according to any one of appendices 1 to 3.
(Appendix 5)
Information processing device
Receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on the block chain formed by each previously received block, verify the validity of the block received this time,
If the block is valid, add the block to the blockchain,
When receiving communication data, based on the block chain, determine whether the communication data is spam,
An information processing method for executing processing.
(Appendix 6)
On the computer,
Receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on the block chain formed by each previously received block, verify the validity of the block received this time,
If the block is valid, add the block to the blockchain,
When receiving communication data, based on the block chain, determine whether the communication data is spam,
A program that executes processing.
(Appendix 7)
A receiver for receiving reports of spam related to communication data;
Calculate the time interval at which the number of spam reports received by the receiving unit is equal to or greater than a threshold, and the degree of difficulty of calculation for generating a block including one or more spam reports received by the receiving unit, Adjusting the calculation to be completed at the time interval, and generating the block;
A transmission unit for transmitting the generated block;
An information processing apparatus.
(Appendix 8)
Information processing device
Receive spam reports on communication data,
Calculating the time interval at which the number of spam reports received by the receiver is equal to or greater than a threshold,
Adjusting the difficulty of calculation to generate a block including one or more spam reports received by the receiver so that the calculation is completed at the time interval;
Generate the block,
Sending the generated block,
An information processing method for executing processing.
(Appendix 9)
On the computer,
Receive spam reports on communication data,
Calculating the time interval at which the number of spam reports received by the receiver is equal to or greater than a threshold,
Adjusting the difficulty of calculation to generate a block including one or more spam reports received by the receiver so that the calculation is completed at the time interval;
Generate the block,
Sending the generated block,
A program that executes processing.

DESCRIPTION OF SYMBOLS 1 Communication system 10 Terminal 11 Storage part 12 Reception part 13 Reception part 14 Verification part 15 Determination part 15 Determination part 16 Processing part 17 Display part 18 Communication part 20 Monitoring terminal 21 Storage part 22 Reception part 23 Generation part 24 Transmission part 25 Verification part 26 Communication part 30 Server 31 Storage Unit 32 Reception Unit 33 Verification Unit 34 Determination Unit 35 Processing Unit 36 Communication Unit 500 Block Chain 600 Definition File

Claims (9)

A receiver for receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on a block chain formed by each block previously received by the receiving unit, the validity of the block received this time by the receiving unit is verified, and if the block is valid, the block is A verification unit to be added to the chain;
When receiving communication data, based on the block chain, a determination unit that determines whether the communication data is spam,
An information processing apparatus. If the report included in the block received this time by the receiving unit and the report included in the block chain are reports for the same communication data by the same reporter, the verification unit may illegally delete the block. Judge that there is
The information processing apparatus according to claim 1. The determination unit adds a weight having a larger value to a relatively new block to each report included in each block of the block chain, and receives the report based on each report to which the weight is added. Determine if the communication data is spam,
The information processing apparatus according to claim 1 or 2. When the received communication data is determined to be spam by the determination unit, the display unit displays a message corresponding to the generation time of each block including a report for the communication data.
The information processing apparatus according to any one of claims 1 to 3. Information processing device
Receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on the block chain formed by each previously received block, verify the validity of the block received this time,
If the block is valid, add the block to the blockchain,
When receiving communication data, based on the block chain, determine whether the communication data is spam,
An information processing method for executing processing. On the computer,
Receiving a block containing one or more spam reports generated by an external device that receives spam reports on communication data;
Based on the block chain formed by each previously received block, verify the validity of the block received this time,
If the block is valid, add the block to the blockchain,
When receiving communication data, based on the block chain, determine whether the communication data is spam,
A program that executes processing. A receiver for receiving reports of spam related to communication data;
Calculate the time interval at which the number of spam reports received by the receiving unit is equal to or greater than a threshold, and the degree of difficulty of calculation for generating a block including one or more spam reports received by the receiving unit, Adjusting the calculation to be completed at the time interval, and generating the block;
A transmission unit for transmitting the generated block;
An information processing apparatus. Information processing device
Receive spam reports on communication data,
Calculate the time interval during which the number of received spam reports is greater than or equal to the threshold,
Adjusting the computational difficulty to generate a block containing one or more received spam reports so that the computation is completed in the time interval;
Generate the block,
Sending the generated block,
An information processing method for executing processing. On the computer,
Receive spam reports on communication data,
Calculate the time interval during which the number of received spam reports is greater than or equal to the threshold,
Adjusting the computational difficulty to generate a block containing one or more received spam reports so that the computation is completed in the time interval;
Generate the block,
Sending the generated block,
A program that executes processing.

Images