Electrical computers and digital processing systems: support – Computer virus detection by cryptography
Reexamination Certificate
2000-10-03
2004-06-29
Moise, Emmanuel L. (Department: 2136)
Electrical computers and digital processing systems: support
Computer virus detection by cryptography
C713S152000, C713S152000, C709S226000
Reexamination Certificate
active
06757830
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
This invention relates to the field of data processing systems. More particularly, this invention relates to systems for detecting unwanted properties in received e-mail messages.
2. Description of the Prior Art
E-mail has become an accepted and fundamental part of both business and personal communication. Whilst the benefits of the widespread use of e-mail are considerable, a problem that has arisen is that received e-mail messages may have unwanted properties. As an example, it has become increasingly common for e-mail messages to bear computer viruses that can be damaging to computer systems upon which they are received. E-mail has the potential to rapidly distribute such computer viruses and is becoming an increasingly common and destructive technique used by virus writers to propagate their viruses. Another example of e-mail having unwanted properties is so called spam e-mail, which is unsolicited by the recipient and often contains advertising or other unwanted material. As a consequence of the speed and low cost of sending such spam e-mails, the number of spam e-mails received by a user may become inconvenient to the degree that it interferes with their legitimate desired received e-mails.
It is known to provide e-mail anti-virus computer systems for automatically scanning received e-mails to detect any computer viruses they may be carrying. It is also known to provide anti-spamming filters that may be set to detect the receipt of multiple e-mails with the same title or from the same recipient and then block such e-mails as they are highly likely to be spam e-mails.
A problem with the above anti-virus and anti-spamming systems is that they are necessarily at least one step behind the virus writer or spam originator. More particularly, a new computer virus may be mass e-mailed to a large number of recipients causing a rapid outbreak of computer virus induced damage to computer systems. It takes a finite amount of time before anti-virus system providers can react to a new virus and generate appropriate counter measures which may then be distributed to their customers. During this delay period, many computer virus infected e-mails may be received by users and cause damage to their computer systems. Considerable effort is made to react as quickly as possible to computer virus outbreaks and create and distribute appropriate counter measures, but even if this process takes less than one hour, the speed of e-mail distribution is such that there may still be a considerable amount of damage to computer systems caused during this period.
In the case of anti-spamming systems, such as title, sender or content filters, it is normally only after receipt of a threshold number of e-mails containing consistent characteristics that such filters may be triggered or created. By this time, the spam e-mails already received will have made their way to end users causing disruption to those end users.
SUMMARY OF THE INVENTION
Viewed from one aspect the present invention provides a method of detecting an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said method comprising the steps of:
receiving an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message;
determining a minimum delay period in dependence upon said one or more e-mail message characteristics;
storing said e-mail message for said minimum delay period;
applying said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties;
if said e-mail message does not have any of said one or more unwanted properties, then sending said e-mail message to said one or more recipients; and if said e-mail message does have any of said one or more unwanted properties, then blocking sending of at least a portion of said e-mail message to said one or more recipients.
Whilst it is normally the aim in e-mail processing systems to transfer a received e-mail message onto its intended recipient as rapidly as possible, the present invention moves against this preconception by deliberately introducing a minimum delay period for which an e-mail message is stored prior to being passed onto the intended recipient or recipients. Introducing such a deliberate minimum delay period significantly increases the likelihood that the tests for unwanted properties that are current at the expiry of the minimum delay period will include counter-measures developed and distributed during the minimum delay period and so may identify the problem e-mail before it reaches the user. Furthermore, by determining the minimum delay period in dependence upon characteristics of the e-mail message concerned, the delay may be selected to reflect the likelihood of a particular e-mail-message having unwanted properties.
Whilst it will be appreciated that the characteristics of the e-mail message that may be used in determining the minimum delay period could take many different forms, particularly well suited to use in this way are a sender address, a sender organisation, a recipient address, a recipient organisation, an attachment type and an e-mail message content type.
These characteristics may be used individually or in combination in many different ways. E-mail messages received from a particular organisation known to have a history of sending computer virus infected e-mails can be subject to a higher level of minimum delay period than e-mails received from other sources. However, if it is know that within such a sender organisation there is a particular sending individual who is careful to avoid sending computer virus infected e-mails, then e-mail messages from that particular individual may be subjected to a shorter minimum delay period if required. In a similar way, particular recipient organisations or recipient individuals may be known to be more likely to receive computer virus or unwanted e-mails and accordingly these recipient organisations or recipient individuals may have their received e-mails subject to a higher level of minimum delay period. If an e-mail message contains attachment types, then certain forms of attachment type represent a higher risk of computer virus infection, e.g. executable file attachments or file attachments of a type that may contain a macrovirus are of a higher risk category than a plain text or pure data attachment. Similarly, certain e-mail message content types, such as for example html message content, may represent a higher likelihood of showing unwanted properties than other types, such as plain text.
It will be appreciated that if unwanted characteristics are detected, then various different courses of action are possible. For example, the e-mail message could be disinfected and sent onto the recipient, offending attachments could be blocked but the remainder of the message sent on or the e-mail message in its entirety could be blocked as the safest course of action.
Whilst it will be appreciated that the technique of the present invention could be used to reduce the problem of e-mails having a wide variety of unwanted properties, the present invention is particularly useful when those unwanted properties are the presence of computer viruses. In this context, the advantage of providing an extra minimum delay period before an e-mail message is passed on significantly increases the likelihood that updated virus definition data will be available to detect newly released viruses before they are passed on.
The advantage of the use of up-to-date virus definition data is enhanced when this data is automatically periodically updated, particularly using a remote internet server.
Another type of e-mail having unwanted properties which the present invention helps to detect and prevent being spread is spam e-mail containing common characteristics. The minimum delay period imposed by t
Kelly Nicholas Paul
Lawson Tarbotton Lee Codel
Wolff Daniel Joseph
Hamaty Christopher J.
Moise Emmanuel L.
Networks Associates Technology Inc.
Silicon Valley IP Group PC
Zilka Kevin J.
LandOfFree
Detecting unwanted properties in received email messages does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Detecting unwanted properties in received email messages, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Detecting unwanted properties in received email messages will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3365989