# US 11,444,901 B2 · Device, method, and computer readable medium for identifying fraudulent email using function terms > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,901 B2 - Document ID: US11444901B2 - Status: Granted - Kind: B2 - Application number: 17/060,773 - Filed: 2020-10-01 - Published: 2021-01-21 - Granted: 2022-09-13 - Earliest claimed: 2018-05-22 - Assignees: Mitsubishi Electric Corporation - Applicants: Mitsubishi Electric Corporation - Inventors: Takumi Yamamoto; Hiroki Nishikawa; Kiyoto Kawauchi - Web page: https://patentgrep.com/patent/US11444901B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 13/00: Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units (interface circuits for specific input/output devices G06F3/00 {; multiprogram control therefor G06F9/46}; multiprocessor systems G06F15/16 ) - G06F 18/2132: based on discrimination criteria, e.g. discriminant analysis - G06F 18/22: Matching criteria, e.g. proximity measures - G06F 18/23: Clustering techniques - G06N 20/00: Machine learning - H04L 51/212: using filtering or selective blocking - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A fraudulent email decision device (10) is provided with a consistency analysis unit (24). The consistency analysis unit (24) identifies an intention of a subject email by, for example, a method of, with respect to a newly received incoming email as a subject email, extracting a function term, being a word expressing a reason the subject email was sent, from a body of the subject email. The consistency analysis unit (24) decides whether or not the subject email is a fraudulent email, from a relationship between another incoming email received in the past from the same sender as the sender of the subject email, and the identified intention of the subject email. ## Claims ### Claim 1 A fraudulent email decision device comprising: processing circuitry configured to, with respect to a newly received incoming email as a subject email, identify an intention of the subject email from a body of the subject email by extracting one or more words from the body of the subject email, calculating for each extracted word a similarity between the extracted word and one or more function terms registered in advance, a function word expressing a reason a subject email was sent, and identifying the intention expressed by the function term similar to the extracted word, as the intention of the subject email; and decide whether or not the subject email is a fraudulent email, from a relationship among the subject email, another incoming email received from a same sender as a sender of the subject email, and the identified intention of the subject email. ### Claim 2 (depends on 1) The fraudulent email decision device according to claim 1, wherein the processing circuitry calculates an evaluation value, by which the body of the subject email corresponds to each function term, based on a discrimination tool obtained from a past incoming email by machine learning, extracts a function term whose calculated evaluation value is equal to a threshold or more, and identifies an intention expressed by the extracted function term, as the intention of the subject email. ### Claim 3 (depends on 1) The fraudulent email decision device according to claim 1, wherein the processing circuitry decides whether or not the subject email is a fraudulent email, from a condition that matches with the identified intention, the subject email, and said another incoming email. ### Claim 4 (depends on 3) The fraudulent email decision device according to claim 3, wherein the processing circuitry decides whether or not a topic of the subject email is included in said another incoming email, and decides whether or not the subject email is a fraudulent email, from a condition that matches with an email type indicating that the subject email is a topic matching email or a topic non-matching email, and that matches with the identified intention, the topic matching email being a subject email whose topic is decided as being included in said another incoming email, the topic non-matching email being a subject email whose topic is decided as not being included in said another incoming email. ### Claim 5 (depends on 4) The fraudulent email decision device according to claim 4, wherein the email type indicates whether or not there is another incoming email received from the same sender as the sender of the subject email, and in a case where there is another incoming email received from the same sender as the sender of the subject email, indicates that the subject email is the topic matching email or the topic non-matching email. ### Claim 6 (depends on 5) The fraudulent email decision device according to claim 5, wherein, in a case where there is no other incoming email received from the same sender as the sender of the subject email, the email type indicates that the subject email is a contact-card-existing email or a related-field email, the contact-card-existing email being a subject email whose sender has been registered in a contact card management system which manages a contact card, the related-field email being a subject email whose information identified from an email address of the sender of the subject email is related to a recipient of the subject email. ### Claim 7 (depends on 1) The fraudulent email decision device according to claim 1, wherein the processing circuitry decides that the subject email is a fraudulent email in a case where a destination of the body of the subject email does not include a name of a recipient of the subject email. ### Claim 8 (depends on 1) The fraudulent email decision device according to claim 1, wherein the processing circuitry decides that the subject email is a fraudulent email in a case where a sender of the subject email does not state his or her name in the body of the subject email. ### Claim 9 A fraudulent email decision method comprising: with respect to a newly received incoming email as a subject email, identifying an intention of the subject email from a body of the subject email by extracting one or more words from the body of the subject email, calculating for each extracted word a similarity between the extracted word and one or more function terms registered in advance, a function word expressing a reason a subject email was sent, and identifying the intention expressed by the function term similar to the extracted word, as the intention of the subject email; and deciding whether or not the subject email is a fraudulent email, from a relationship among the subject email, another incoming email received from a same sender as the sender of the subject email, and an identified intention of the subject email. ### Claim 10 A non-transitory computer readable medium recorded with a fraudulent email decision program which causes a computer to execute: an intention identification process of, with respect to a newly received incoming email as a subject email, identifying an intention of the subject email from a body of the subject email by extracting one or more words from the body of the subject email, calculating for each extracted word a similarity between the extracted word and one or more function terms registered in advance, a function word expressing a reason a subject email was sent, and identifying the intention expressed by the function term similar to the extracted word, as the intention of the subject email; and an email decision process of deciding whether or not the subject email is a fraudulent email, from a relationship among the subject email, another incoming email received from a same sender as the sender of the subject email, and an intention, identified by the intention identification process, of the subject email.