E-mail user behavior modification system and mechanism for computer virus avoidance

• US 20020091940A1
• Filed: 01/05/2001
• Published: 07/11/2002
• Est. Priority Date: 01/05/2001
• Status: Abandoned Application

• Current Assignee: Christopher Michael Welborn, Kimberly Joyce Welborn
• Original Assignee: Christopher Michael Welborn, Kimberly Joyce Welborn
• Inventors: Welborn, Christopher Michael, Welborn, Kimberly Joyce
• Application Number:
  US09/755,509
• Publication Number:
  US 20020091940A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Nearly all computer viruses require an action by a computer user to infect and spread. The key is to educate users not to open e-mail attachments that might carry computer viruses. The key is behavior modification, as education is not sufficient. Effective behavior modification must have a means to reinforce the change and to measure how widespread the change is in a population. The invention is used to reinforce and measure the change in user behavior. The invention sends an e-mail with an attachment to e-mail users and creates a list of all users that open the attachment. The user is sent an e-mail with an attachment that looks similar to attachments that contain computer viruses. If the attachment is opened, an e-mail is sent to a specific e-mail address. This e-mail address collects all of the e-mail from users who have not changed behavior and need additional education or management attention.

Claims

1. An e-mail user behavior modification system for computer virus avoidance, an e-mail system with users each with an e-mail address and a first, second, and third computer in a computer network, wherein the e-mail user behavior modification system provides:

means for a first computer to select a set of e-mail addresses from an e-mail directory;

means for the first computer to transmit the set of e-mail addresses to a second computer in the computer network;

means for the second computer to send an e-mail with a mock computer virus attachment to a user with an e-mail address in the set of e-mail addresses;

means for the mock computer virus attachment when opened by a user, to send an e-mail to the e-mail address of a third computer indicating that the mock virus attachment was opened by the user;

means for the third computer to compile a list of users with e-mail addresses that opened the mock computer virus attachment.

2. The e-mail user behavior modification system of claim 1 wherein the computer network is the Internet.

3. The e-mail user behavior modification system of claim 1 wherein the first computer and second computer are the same computer.

4. The e-mail user behavior modification system of claim 1 wherein the first computer and third computer are the same computer.

5. The e-mail user behavior modification system of claim 1 wherein the second computer and third computer are the same computer.

6. The e-mail user behavior modification system of claim 1 wherein the first computer, second computer and third computer are the same computer.

7. The e-mail user behavior modification system of claim 1 wherein the list of users with email addresses that opened the mock computer virus attachment is accessible as a web page or sent as an e-mail.

8. The e-mail user behavior modification system of claim 1 wherein there is a fourth computer in the computer network and the second computer receives authorization from the fourth computer to send an e-mail with a mock computer virus attachment to an email address.

9. The e-mail user behavior modification system of claim 1 wherein the first computer has a means to determine the number or type of e-mail addresses in the set of e-mail addresses and sends this information to a fourth computer.

10. The e-mail user behavior modification system of claim 9 wherein the number or type of email addresses in the set of e-mail addresses is used to determine the billing for use of the e-mail user behavior modification system.

11. The e-mail user behavior modification system of claim 1 wherein the second computer has a means to determine the number or type of e-mail with mock computer virus attachments sent to e-mail addresses.

12. The e-mail user behavior modification system of claim 11 wherein the number or type of e-mail sent to e-mail addresses is used to determine the billing for use of the e-mail user behavior modification system.

13. The e-mail user behavior modification system of claim 1 wherein the third computer has a means to determine the number or type of e-mail received from e-mail addresses.

14. The e-mail user behavior modification system of claim 13 wherein the number or type of e-mail received from e-mail addresses is used to determine the billing for use of the e-mail user behavior modification system.

15. The e-mail user behavior modification system of claim 1 wherein the fourth computer has a means to determine the number or type of e-mail with mock computer virus attachments authorized to be sent by the second computer to e-mail addresses.

16. The e-mail user behavior modification system of claim 15 wherein the number or type of e-mail with mock computer virus attachments authorized to be sent to e-mail addresses is used to determine the billing for use of the e-mail user behavior modification system.

17. The e-mail user behavior modification system of claim 7 wherein there is a means to determine the number or type of accesses to the list of users at e-mail addresses that opened the mock computer virus attachment.

18. The e-mail user behavior modification system of claim 17 wherein number or type of accesses to the list of users at e-mail addresses that opened the mock computer virus attachment is used to determine the billing for use of the e-mail user behavior modification system.

19. The e-mail user behavior modification system of claim 1 wherein the list or number of users with e-mail addresses who did not open the mock computer virus attachment is determined by waiting a time delay and then comparing the list of e-mail addresses sent the e-mail with the mock virus attachment with the list of e-mail addresses that opened the mock virus attachment.

20. The e-mail user behavior modification system of claim 19 wherein the list or number of users with e-mail address who did not open the mock computer virus attachment is used to determine the billing for use of the e-mail user behavior modification system.

21. The e-mail user behavior modification system of claim 1 wherein the fourth computer can change the mock virus attachment sent by the second computer.

22. The e-mail user behavior modification system of claim 1 wherein the second computer can change the mock virus attachment.

23. The e-mail user behavior modification system of claim 1 wherein the second computer can change the mock virus attachment with authorization from the fourth computer.

24. The e-mail user behavior modification system of claims 21, 22, or 23 wherein the change in mock virus attachment is used to determine the billing for use of the e-mail user behavior modification system.

25. The e-mail user behavior modification system of claim 1 wherein the fourth computer can change the e-mail address selection means used by the first computer to select a different set of e-mail addresses.

26. The e-mail user behavior modification system of claim 1 wherein the first computer can change the e-mail address selection means to select a different set of e-mail addresses.

27. The e-mail user behavior modification system of claim 1 wherein the fourth computer can authorize the first computer to change the e-mail address selection means to select a different set of e-mail addresses.

28. The e-mail user behavior modification system of claims 25, 26, or 27 wherein the change in address selection means is used to determine the billing for use of the e-mail user behavior modification system.

29. The e-mail user behavior modification system of claim 1 wherein the list of users with email addresses that opened the mock computer virus attachment is sent as an e-mail.

30. The e-mail user behavior modification system of claim 1 wherein the list of users with email addresses that opened the mock computer virus attachment is sent as an e-mail with a URL to a web page containing the list.

31. The e-mail user behavior modification system of claims 7, 29, or 30 wherein the access to the list of users with e-mail addresses that opened the mock virus attachment is used to determine the billing for use of the e-mail user behavior modification system.

32. An e-mail user behavior modification system for computer virus avoidance, an e-mail system with e-mail users, each with an e-mail address, and a first, second, and third computer in a computer network, wherein the e-mail user behavior modification system provides to the computers a first, second, third, and fourth program and an e-mail with a mock computer virus which are used as follows:

the first program executes in a first computer to select a set of e-mail addresses from the email directory of the e-mail system;

the second program executes in the first computer to transmit the set of e-mail addresses to a second computer in the computer network;

the third program executes in the second computer to send the e-mail with a mock computer virus attachment to a user with an e-mail address in the set of e-mail addresses;

the mock computer virus attachment is a program that when opened by the user, sends an email to the e-mail address of a third computer indicating that the user opened the mock virus attachment;

the fourth program executes in the third computer to compile a list of users with e-mail addresses that opened the mock computer virus attachment.

33. An e-mail user behavior modification system for computer virus avoidance wherein a mock virus is sent to a set of e-mail users with e-mail addresses and a list of those e-mail users that open the mock virus is created.

36. The e-mail user behavior modification system of claim 35 wherein the network is the Internet.

39. The e-mail user behavior modification system of claim 38 wherein the network is the Internet.

34. An e-mail user behavior modification system for computer virus avoidance wherein a list of e-mail addresses is extracted from an e-mail system, an e-mail with a mock virus attachment is sent to an e-mail address in the list of e-mail addresses, and if the user with the e-mail address opens the mock virus attachment, the e-mail address is added to a list of e-mail users that opened the mock virus.

35. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a program to a computer which when executed extracts an e-mail addresses from the directory of an e-mail server and sends an e-mail with a mock virus attachment to the e-mail address.

37. An e-mail user behavior modification system for computer virus avoidance wherein a computer with an e-mail address receives an e-mail message from an opened mock virus email attachment and compiles a list of e-mail address that opened the mock virus.

38. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a program to a computer which when executed extracts a list of e-mail addresses from the directory of an e-mail server and sends an e-mail with a mock virus attachment to an e-mail address in the list.

40. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a mock virus e-mail attachment which when opened sends an email to a specified e-mail address.

41. The e-mail user behavior modification system of claim 40 wherein the network is the Internet.

42. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a program that sends a mock virus e-mail attachment to an e-mail address.

43. The e-mail user behavior modification system of claim 42 wherein the network is the Internet.

44. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a program for receiving an e-mail sent by an opened mock virus e-mail attachment and adding the sending e-mail address to a list of e-mail users that opened the mock virus e-mail attachment.

45. The e-mail user behavior modification system of claim 44 wherein the network is the Internet.

47. The e-mail user behavior modification system of claim 46 wherein the network is the Internet.

49. The e-mail user behavior modification system of claim 48 wherein the network is the Internet.

46. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a list of e-mail users that opened a mock virus e-mail attachment.

48. An e-mail user behavior modification system for computer virus avoidance wherein a network server provides a list of e-mail users that were sent a mock virus e-mail attachment but had not opened the mock virus e-mail attachment.