Method and system for preventing exploiting an email message

• US 20050081057A1
• Filed: 10/10/2003
• Published: 04/14/2005
• Est. Priority Date: 10/10/2003
• Status: Abandoned Application

• Current Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Cohen, Oded, Margalit, Yanki, Margalit, Dany
• Application Number:
  US10/681,904
• Publication Number:
  US 20050081057A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention relates to a method for preventing exploiting an email message and a system thereof. The method comprising: decomposing the email message to its components; for each of the components, correcting the structural form (e.g. structure, format, and content) of the component to comply with common rules thereof whenever the structural form of the component deviates from the rules; and recomposing the email message from its components (in their recent state). The rules relate to email messages structure, for preventing malformed structure of email messages, for preventing exploiting an email message, etc. In case where the structural form of the component cannot be identified, the component may not be included within the recomposed email message, or included as is to the recomposed email message.

Claims

1. A method for preventing exploiting an email message, comprising:

decomposing said email message to its components;

for each of said components, correcting the structural form of said component to comply with rules thereof, if the structural form of said component deviates from said rules; and

recomposing said email message from components thereof.

2. A method according to claim 1, wherein said rules relate to common structure of an email message.

3. A method according to claim 1, wherein at least one of said rules relates to detecting malformed structure of said email message.

4. A method according to claim 1, wherein at least one of said rules relates to detecting exploits within said email message.

5. A method according to claim 1, wherein said structural form is selected from the group comprising:

structure, format, and content.

6. A method according to claim 1, wherein said correcting comprises omitting components that violate said rules from said recomposing.

7. A method according to claim 1, further comprising detecting hostile content within at least one of said components.

8. A method according to claim 3, wherein said malformed structure of an email message is selected from the group including:

invalid structure of a component, invalid content of a component, contradicting information, malformed attachment, proprietary encoding type, and file-type masquerading.

9. A system for preventing exploiting an email message, said system implemented at a hosting platform, said system comprising:

a module for identifying components of an email message;

a module for testing a compliance of the structural form of said email message with rules thereof;

a module for correcting the structural form of said email message; and

a module for recomposing said email message from components thereof.

10. A system according to claim 9, wherein said rules relate to common structure of an email message.

11. A system according to claim 9, wherein at least one of said rules relates to detecting malformed structure of said email message.

12. A system according to claim 9, wherein at least one of said rules relates to detecting exploits within said email message.

13. A system according to claim 9, wherein said structural form is selected from the group consisting of:

structure, format, and content.

14. A system according to claim 9, further comprising a module for detecting hostile content within said components.