MAIL CHECK METHOD, MAIL CHECK DEVICE, AND MAIL CHECK PROGRAM

PROBLEM TO BE SOLVED: To provide a mail check method, a mail check device, and a mail check program which efficiently detect a targeted threat mail candidate.SOLUTION: The mail check method which detects an alarming mail candidate from target mails to be received newly comprises a feature information data base (a DB, hereafter) generation process and a detection process. The feature information DB generation process extracts, from plural authorized received mails, plural pieces of feature information contained in the mail headers of the received mails to generate a feature information DB. If similarity between first pieces of feature information contained in the mail header of the reception target mail and second pieces of feature information of the plural received mails having the same address as that of the reception target mail, which are referred from the feature information DB, is smaller than a reference similarity, the detection process detects the reception target mail, as an alarming mail candidate.