Apparatus, methods and articles of manufacture for intercepting, examining and controlling code, data and files and their transfer

• US 20040199594A1
• Filed: 04/26/2004
• Published: 10/07/2004
• Est. Priority Date: 06/21/2001
• Status: Active Grant

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V., Perry, Richard J.
• Granted Patent: US 7,502,829 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes

Abstract

Apparatus, methods, and articles of manufacture are claimed for processing code comprising the preprocessing of code, transferring of the code from a storage area to a transfer component, decomposing the code, valuing the code, and comparing the code to a threshold value. The processing indicates the presence or absence of proscribed code, which may be spam, virii, confidential material, harassing material, etc. and so the code may be redirected. The especially preferred embodiments operate within a UNIX sendmail environment.

Claims

1. ) A method for processing stored and forwarded code comprising:

transferring code to be analyzed to a storage component;

preprocessing said code;

decomposing said code,

valuing said code and thereby obtaining a code value,

transferring said code, via a transfer component to a comparison component;

comparing said code value to a threshold value;

indicating, via said comparison component to said transfer component, whether said code contains proscribed code; and

,

transferring said code to at least one secondary storage component based on said indication.

2. ) A method as in claim 1 further comprising transferring said code from said at least one secondary storage component to a subsequent code transfer component.

3. ) A method as in claim 1 further comprising sorting said code prior to transfer to said at least one secondary storage component.

4. ) A method as in claim 3 further comprising transferring code to at least two secondary storage components, with a first of at least two secondary storage components receiving smaller stored and forwarded code groups and a second of at least two secondary storage components receiving larger stored and forwarded code groups.

5. ) A method as in claim 1 wherein said code comprises email.

6. ) A method as in claim 1 wherein said comparison component comprises a proscribed code scanner.

7. ) A method for processing stored and forwarded code comprising:

preprocessing said code;

transferring code, from a storage component, to a first transfer component;

decomposing said code,

valuing said code and thereby obtaining a code value,

transferring said code, from said first transfer component to a comparison component;

comparing said code value to a threshold value;

indicating, via said comparison component to said first transfer component, whether said code contains proscribed code;

sorting said code;

transferring said code, based on the results of said sort, to at least one first secondary storage component;

transferring said code from at least one first secondary storage component to at least one secondary storage component based on said indication.

8. ) A method as in claim 7 further comprising transferring said code from said at least one secondary storage component to a subsequent code transfer component.

9. ) A method as in claim 7 wherein the step of sorting said code further comprises sorting the code by size.

10. ) A method as in claim 7 wherein said code comprises email.

11. ) A method as in claim 7 wherein said comparison component comprises a proscribed code scanner.

12. ) A method as in claim 10 further comprising the step of transferring said email from said at least one secondary sendmail queue to a subsequent sendmail process.

13. ) A method as in claim 10 further comprising the step of sorting said email prior to transfer to said at least one secondary sendmail queue.

14. ) A method as in claim 12 wherein the step of sorting said email prior to transfer to said at least one secondary sendmail queue component further comprises sorting the email by size.

15. ) An apparatus for processing stored and forwarded code comprising:

a storage component, for storing code to be analyzed;

a preprocessing component;

a code decomposing component;

a valuation component,

a comparison component;

a secondary storage component;

whereby said code to be analyzed is received from said storage component by said preprocessing component and preprocessed in order to provide for a first analysis of said code, decomposed by said decomposing component to its lowest possible state, valued to a code value by said valuation component, and whereby said code value is processed by said comparison component by comparing said code value to a threshold value, following which comparison said code is transferred to said second secondary storage component.

16. ) An apparatus as in claim 15, wherein said secondary storage component contains proscribed code.

17. ) An apparatus as in claim 15 further comprising a first and a second secondary storage component, whereby said code is transferred to either said first or said second secondary storage component as a result of said comparison.

18. ) An apparatus as in claim 15 wherein said storage component comprises a sendmail queue.

19. ) An apparatus as in claim 17 wherein said first secondary storage component comprises a sendmail queue.

20. ) A computer readable signal bearing medium for analyzing code comprising:

a storage component, for storing code to be analyzed;

a preprocessing component;

a code decomposing component;

a valuation component,

a comparison component;

a secondary storage component;

whereby said code to be analyzed is received from said storage component by said preprocessing component and preprocessed in order to provide for a first analysis of said code, decomposed by said decomposing component ti its lowest possible state, valued to a code value by said valuation component, and whereby said code value is processed by said comparison component by comparing said code value to a threshold value, following which comparison said code is transferred to said second secondary storage component.