Monitoring eletronic mail message digests

• US 20040064515A1
• Filed: 10/17/2003
• Published: 04/01/2004
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Clearswift Limited (Government of Switzerland)
• Original Assignee: Clearswift Limited (Government of Switzerland)
• Inventors: Hockey, Alyn
• Granted Patent: US 7,801,960 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

A method for monitoring electronic mail messages, each mail message comprising header information and a main body, particularly for protection against virus attacks and unsolicited commercial email (UCE). The method comprises generating a summary digest of only the subject line and the message content of the main body, wherein the message content may comprise textual content and/or attached files. The generated summary digest is stored in a memory, and compared with existing summary digests stored in memory. If the number of matches exceeds a threshold value, an alert signal is raised and appropriate action initiated. A timestamp may be stored with each summary digest, together with sender/recipient details and the internet protocol (IP) address of origin, to detection of the originator of the message.

Claims

1. A method for monitoring electronic mail messages, wherein each mail message may comprise:

(a) subject header information

(b) non-subject header information

(c) a main body, comprising message content;

the method comprising;

receiving an electronic mail message,

generating a characteristic numerical representation of at least a part of said message content, but not of said non-subject header information;

storing said generated characteristic numerical representation in a memory; and

comparing said characteristic numerical representation with each characteristic numerical representation stored in memory.

2. A method for monitoring electronic mail messages as claimed in claim 1, in which said step of generating comprises generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

3. A method for monitoring electronic mail messages as claimed in claims 1 or 2, in which said step of generating a characteristic numerical representation of at least a part of said message content comprises generating a characteristic numerical representation of at least textual content in said message content.

4. A method for monitoring electronic mail messages as claimed in any preceding claim, in which said step of generating a characteristic numerical representation of at least a part of said message content comprises generating a characteristic numerical representation of at least attached files in said message content.

5. A method for monitoring electronic mail messages as claimed in any preceding claim, in which the step of storing further comprises storing a timestamp of said electronic mail message.

6. A method for monitoring electronic mail messages as claimed in any preceding claim, in which the step of storing further comprises storing the internet protocol (IP) address of origin of said electronic mail message.

7. A method for monitoring electronic mail messages as claimed in any preceding claim, in which said step of storing further comprises storing header information of said electronic mail message.

8. A method for monitoring electronic mail messages as claimed in claim 7, in which said step of storing further comprises storing message source and destination details.

9. A method for monitoring electronic mail messages as claimed in any preceding claim, in which the characteristic numerical representation is a message digest.

10. A method for monitoring electronic mail messages as claimed in claim 9, in which said message digest is generated using a message digest 5 (MD5) algorithm.

11. A method for monitoring electronic mail messages as claimed in claim 9, in which said message digest is generated using a secure hash algorithm 1 (SHA-1) algorithm.

12. A method for monitoring electronic mail messages as claimed in any preceding claim, further comprising, if said characteristic numerical representation matches a characteristic numerical representation stored in memory, the step of incrementing a count value associated with said characteristic numerical representation.

13. A method for monitoring electronic mail messages as claimed in claim 12, further comprising the step of comparing said count value with a predetermined threshold.

14. A method for monitoring electronic mail messages as claimed in claim 13, in which said predetermined threshold is determined on the basis of said header information.

15. A method for monitoring electronic mail messages as claimed in claims 13 or 14, further comprising, if said count value exceeds said predetermined threshold, raising an alert.

16. A method for monitoring electronic mail messages as claimed in claim 15, in which said alert is determined on the basis of said header information.

18. A method for monitoring electronic mail messages as claimed in claims 15 to 17, in which said alert comprises delivering a fixed portion of said message.

19. A method for monitoring electronic mail messages as claimed in claims 15 to 18, in which said alert comprises delivering an audit notification to the recipient.

20. A method for monitoring electronic mail messages as claimed in claims 15 to 19, in which said alert comprises deleting said message.

21. A method for monitoring electronic mail messages as claimed in claims 15 to 19, in which said alert comprises deleting a file attachment from the message.

22. A method for monitoring electronic mail messages as claimed in any preceding claim, comprising allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

23. A method for monitoring electronic mail messages as claimed in any preceding claim, in which said characteristic numerical representation is stored in cache memory.

24. A method for monitoring electronic mail messages as claimed in claim 23, in which said cache memory may be periodically copied to a storage means.

28. A software product as claimed in any preceding claim, in which said code for generating a characteristic numerical representation of at least a part of said message content comprises code for generating a characteristic numerical representation of at least textual content in said message content.

29. A software product as claimed in any preceding claim, in which said code for generating a characteristic numerical representation of at least a part of said message content comprises code for generating a characteristic numerical representation of at least attached files in said message content.

30. A software product as claimed in any preceding claim, in which the code for storing further comprises code for storing a timestamp of said electronic mail message.

31. A software product as claimed in any preceding claim, in which the code for storing further comprises code for storing the internet protocol (IP) address of origin of said electronic mail message.

32. A software product as claimed in any preceding claim, in which said code for storing further comprises code for storing header information of said electronic mail message.

33. A software product as claimed in claim 32, in which said code for storing further comprises code for storing message source and destination details.

34. A software product as claimed in any preceding claim, in which the characteristic numerical representation is a message digest.

35. A software product as claimed in claim 34, in which said message digest is generated using a message digest 5 (MD5) algorithm.

36. A software product as claimed in claim 35, in which said message digest is generated using a secure hash algorithm 24 (SHA-1) algorithm.

37. A software product as claimed in any preceding claim, further comprising, if said characteristic numerical representation matches a characteristic numerical representation stored in memory, code for incrementing a count value associated with said characteristic numerical representation.

38. A software product as claimed in claim 37, further comprising code for comparing said count value with a predetermined threshold.

39. A software product as claimed in claim 37, in which said predetermined threshold is determined on the basis of said header information.

40. A software product as claimed in claims 38 or 39, further comprising, if said count value exceeds said predetermined threshold, code for raising an alert.

41. A software product as claimed in claim 40, in which said alert is determined on the basis of said header information.

42. A software product as claimed in claims 40 or 41, in which said alert comprises a marker prefixed to the subject line of the message.

43. A software product as claimed in claims 40 to 42, in which said alert comprises delivering a fixed portion of said message.

44. A software product as claimed in claims 40 to 43, in which said alert comprises delivering an audit notification to the recipient.

45. A software product as claimed in claims 40 to 44, in which said alert comprises deleting said message.

46. A software product as claimed in claims 40 to 44, in which said alert comprises deleting a file attachment from the message.

47. A software product as claimed in any preceding claim, comprising code for allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

48. A software product as claimed in any preceding claim, in which said characteristic numerical representation is stored in cache memory.

49. A software product as claimed in claim 48, in which said cache memory may be periodically copied to a storage means.

54. A computer system for monitoring electronic mail messages as claimed in any preceding claim, in which the means for storing further comprises means for storing a timestamp of said electronic mail message.

55. A computer system for monitoring electronic mail messages as claimed in any preceding claim, in which the means for storing further comprises means for storing the internet protocol (IP) address of origin of said electronic mail message.

56. A computer system for monitoring electronic mail messages as claimed in any preceding claim, in which said means for storing further comprises means for storing header information of said electronic mail message.

57. A computer system for monitoring electronic mail messages as claimed in claim 56, in which said means for storing further comprises means for storing message source and destination details.

58. A computer system for monitoring electronic mail messages as claimed in any preceding claim, in which the characteristic numerical representation is a message digest.

59. A computer system for monitoring electronic mail messages as claimed in claim 58, in which said message digest is generated using a message digest 5 (MD5) algorithm.

60. A computer system for monitoring electronic mail messages as claimed in claim 58, in which said message digest is generated using a secure hash algorithm 1 (SHA-1) algorithm.

61. A computer system for monitoring electronic mail messages as claimed in any preceding claim, further comprising, if said characteristic numerical representation matches a characteristic numerical representation stored in memory, means for incrementing a count value associated with said characteristic numerical representation.

62. A computer system for monitoring electronic mail messages as claimed in claim 61, further comprising means for comparing said count value with a predetermined threshold.

63. A computer system for monitoring electronic mail messages as claimed in claim 62, in which said predetermined threshold is determined on the basis of said header information.

64. A computer system for monitoring electronic mail messages as claimed in claims 62 or 63, further comprising, if said count value exceeds said predetermined threshold, means for raising an alert.

65. A computer system for monitoring electronic mail messages as claimed in claim 64, in which said alert is determined on the basis of said header information.

66. A computer system for monitoring electronic mail messages as claimed in claims 64 or 65, in which said alert comprises a marker prefixed to the subject line of the message.

67. A computer system for monitoring electronic mail messages as claimed in claims 64 to 66, in which said alert comprises means for delivering a fixed portion of said message.

68. A computer system for monitoring electronic mail messages as claimed in claims 64 to 67, in which said alert comprises delivering an audit notification to the recipient.

69. A computer system for monitoring electronic mail messages as claimed in claims 64 to 68, in which said alert comprises deleting said message.

70. A computer system for monitoring electronic mail messages as claimed in claims 64 to 68, in which said alert comprises deleting a file attachment from the message.

71. A computer system for monitoring electronic mail messages as claimed in any preceding claim, comprising means for allowing said message to be delivered, if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

72. A computer system for monitoring electronic mail messages as claimed in any preceding claim, in which said characteristic numerical representation is stored in cache memory.

73. A computer system for monitoring electronic mail messages as claimed in claim 72, in which said cache memory may be periodically copied to a storage means.

17. A method for monitoring electronic mail messages as claimed in claims is or 16, in which said alert comprises a marker prefixed to the subject line of the message.

25. A software product for use in a server or organisation'"'"'s mail transfer agent (MTA), for monitoring electronic mail messages, wherein each mail message may comprise:

(a) subject header information

(b) non-subject header information

(c) a main body, comprising message content;

the software containing code for;

receiving an electronic mail message,

generating a characteristic numerical representation of at least a part of said message content, but not of said non-subject header information;

storing said generated characteristic numerical representation in a memory; and

comparing said characteristic numerical representation with each characteristic numerical representation stored in memory.

27. A software product as claimed in claims 25 or 26, in which said code for generating comprises code for generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

26. A software product for use in a client'"'"'s mail user agent (UA), for monitoring electronic mail messages, wherein each mail message may comprise:

(a) subject header information

(b) non-subject header information

(c) a main body, comprising message content;

the software containing code for;

receiving an electronic mail message,

generating a characteristic numerical representation of at least a part of said message content, but not of said non-subject header information;

storing said generated characteristic numerical representation in a memory; and

comparing said characteristic numerical representation with each characteristic numerical representation stored in memory.

50. A computer system for monitoring electronic mail messages, wherein each mail message may comprise:

(a) subject header information

(b) non-subject header information

(c) a main body, comprising message content;

the system containing;

means for receiving an electronic mail message,

means for generating a characteristic numerical representation of at least a part of said message content, but not of said non-subject header information;

a memory for storing said generated characteristic numerical representation; and

means for comparing said characteristic numerical representation with each characteristic numerical representation stored in memory.

51. A computer system for monitoring electronic mail messages as claimed in claim 50, in which said means for generating comprises means for generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

52. A computer system for monitoring electronic mail messages as claimed in claims 50 or 51, in which said means for generating a characteristic numerical representation of at least a part of said message content comprises means for generating a characteristic numerical representation of at least textual content in said message content.

53. A computer system for monitoring electronic mail messages as claimed in claims 51 or 52, in which said means for generating a characteristic numerical representation of at least a part of said message content comprises means for generating a characteristic numerical representation of at least attached files in said message content.

74. A method for monitoring electronic mail messages substantially as described herein with reference to FIG. 3 of the accompanying drawings.

75. A software product for use in a server or organisation'"'"'s mail transfer agent (MTA) for monitoring electronic mail messages substantially as described herein with reference to FIG. 3 of the accompanying drawings.

76. A software product for use in mail user agent (UA) for monitoring electronic mail messages substantially as described herein with reference to FIG. 3 of the accompanying drawings.

77. A computer system for monitoring electronic mail messages substantially as described herein with reference to FIG. 3 of the accompanying drawings.