Method and apparatus for managing computer virus outbreaks

• US 20050283837A1
• Filed: 12/06/2004
• Published: 12/22/2005
• Est. Priority Date: 06/16/2004
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Sprosts, Craig, Quinlan, Daniel, Kennedy, Scot, Taylor, Craig, Olivier, Michael, Rosenstein, Larry
• Granted Patent: US 7,748,038 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Early detection of computer viruses is provided by collecting information about suspicious messages and generating virus outbreak information. In one embodiment, a method comprises receiving the virus outbreak information that has been determined by receiving message information for messages that have characteristics associated with computer viruses, wherein the messages were determined by a virus-check component as not comprising a virus, and mapping the message information received in a specified time period to the virus outbreak information; and when the virus outbreak information indicates initiation of a virus attack, performing a message flow control action for additional messages that have the same characteristics associated with computer viruses as the first messages. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages.

Claims

1. A method, comprising the computer-implemented steps of:

receiving virus outbreak information, wherein the virus outbreak information has been determined by receiving one or more sets of message information for one or more first messages that have one or more characteristics associated with computer viruses, wherein the one or more first messages were determined by a virus-check component as not comprising a virus, and mapping the one or more sets of message information received in a specified time period to the virus outbreak information;

when the virus outbreak information indicates initiation of a virus attack, performing a message flow control action for one or more second messages that have the same characteristics associated with computer viruses as the one or more first messages.

2. A method as recited in claim 1, wherein the virus outbreak information includes a virus score value.

3. A method as recited in claim 2, wherein the virus score value is associated with a particular message, and wherein the virus score value is determined based on the characteristics of the particular message.

4. A method as recited in claim 3, wherein the virus score value is determined without examining the contents of any attachment to the particular message.

5. A method as recited in claim 1, wherein the virus outbreak information includes one or more rules that each associates a virus score value with at least one characteristic that is associated with viruses.

6. A method as recited in claim 5, wherein each rule applies to one or more second messages that include the at least one characteristic.

7. A method as recited in claim 6, wherein the virus outbreak information includes at least two rules that apply to a particular second message of the one or more second messages, and the virus outbreak information indicates initiation of the virus attack based on a highest virus score value from among the virus score values for the at least two rules.

8. A method as recited in claim 1, wherein the one or more characteristics are that the one or more first messages have file attachments having a file type associated with computer viruses.

9. A method as recited in claim 8, wherein the file type is any of EXE, ZIP, COM, SCR, BAT, and PIF.

10. A method as recited in claim 1, wherein receiving one or more sets of message information comprises receiving at least one set of message information from a spamtrap.

11. A method as recited in claim 1, wherein receiving one or more sets of message information comprises receiving, from one or more spamtraps, one or more counts of messages that have one or more characteristics associated with computer viruses, wherein the messages were determined by the virus-check component as not comprising a virus.

12. A method as recited in claim 1, wherein the virus outbreak information indicates initiation of the virus attack when the virus outbreak information satisfies a specified relationship with a specified threshold.

13. A method as recited in claim 1, wherein the virus outbreak information includes a virus score value, and wherein mapping the one or more sets of message information received in the specified time period to the virus outbreak information comprises:

generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods;

generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value;

mapping the percent-of-normal virus score value to a range of virus score values.

14. A method as recited in claim 13, further comprising performing the steps of claim 13 for each of a plurality of file attachment types of the one or more first messages to result in generating a plurality of percent-of-normal virus score values respectively associated with each of the plurality of file attachment types.

15. A method as recited in claim 14, further comprising computing an average of all the plurality of percent-of-normal virus score values to create an overall percent-of-normal value, and mapping the overall percent-of-normal value to the range of virus score values, to result in creating a particular virus score value for a particular file attachment type.

16. A method as recited in claim 1, wherein the message flow control action comprises delaying delivery of the one or more second messages for a specified time.

17. A method as recited in claim 16, wherein the message flow control action further comprises releasing the one or more second messages upon expiration of the specified time and then scanning the one or more second messages for viruses prior to delivery.

18. A method as recited in claim 1, wherein the message flow control action comprises storing the one or more second messages in a quarantine queue for a specified time.

19. A method as recited in claim 18, wherein the message flow control action further comprises releasing the one or more second messages upon expiration of the specified time and then scanning the one or more second messages for viruses prior to delivery.

20. A method as recited in claim 18, wherein the message flow control action further comprises applying an overflow policy when the quarantine queue is full.

21. A method as recited in claim 20, wherein the overflow policy comprises stripping any attachments from the one or more second messages and then delivering the one or more second messages without the attachments.

22. A method as recited in claim 20, wherein the overflow policy comprises releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

23. A method as recited in claim 20, wherein the overflow policy comprises appending a warning indication to a subject of the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

24. A method as recited in claim 18, further comprising the steps of:

receiving user input requesting deletion of the one or more second messages in the quarantine queue; and

deleting the one or more second messages in the quarantine queue in response to the user input.

25. A method as recited in claim 18, further comprising the steps of:

receiving user input requesting release of the one or more second messages from the quarantine queue; and

releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

26. A method as recited in claim 18, further comprising the steps of:

receiving user input requesting a rescan for virus of a particular second message of the one or more second messages from the quarantine queue; and

based on the particular second message not comprising a virus, releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

27. A method as recited in claim 1, wherein the message flow control action comprises not delaying delivery of a particular second message because the particular second message is addressed to a recipient for whom message delivery has been specified to performed even if the virus outbreak information indicates initiation of a virus attack.

39. A machine-readable medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, or 38.

40. An apparatus, comprising means for performing the functions recited in any of claims 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, or 38.

41. An apparatus, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, or 38.

28. A method, comprising the computer-implemented steps of:

receiving one or more sets of message information for one or more first messages that have one or more characteristics associated with computer viruses, wherein the one or more first messages were determined by a virus-check component as not comprising a virus;

mapping the one or more sets of message information received in a specified time period to virus outbreak information;

creating and storing the virus outbreak information in a data store that is accessible to one or more messaging gateways.

29. A method as recited in claim 28, wherein the one or more characteristics are that the one or more first messages have file attachments having a file type associated with computer viruses.

30. A method as recited in claim 28, wherein the file type is any of EXE, ZIP, COM, SCR, BAT, and PIF.

31. A method as recited in claim 28, wherein receiving one or more sets of message information comprises receiving at least one set of message information from a spamtrap.

32. A method as recited in claim 28, wherein receiving one or more sets of message information comprises receiving, from one or more spamtraps, one or more counts of messages that have one or more characteristics associated with computer viruses, wherein the messages were determined by the virus-check component as not comprising a virus.

33. A method as recited in claim 28, wherein the virus outbreak information indicates initiation of a virus attack when the virus outbreak information satisfies a specified relationship with a specified threshold.

34. A method as recited in claim 28, wherein the virus outbreak information includes a virus score value, and wherein mapping the one or more sets of message information received in the specified time period to the virus outbreak information comprises:

generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods;

generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value;

mapping the percent-of-normal virus score value to a range of virus score values.

35. A method as recited in claim 34, further comprising performing the steps of claim 34 for each of a plurality of file attachment types of the one or more first messages to result in generating a plurality of percent-of-normal virus score values respectively associated with each of the plurality of file attachment types.

36. A method as recited in claim 35, further comprising computing an average of all the plurality of percent-of-normal virus score values to create an overall percent-of-normal value, and mapping the overall percent-of-normal value to the range of virus score values, to result in creating a particular virus score value for a particular file attachment type.

37. A method, comprising the computer-implemented steps of:

determining virus outbreak information for a first message by analyzing one of more characteristics of said first message, wherein said first message was determined by a virus-check component as not comprising a virus;

when said virus outbreak information indicates initiation of a virus attack, performing a message flow control action for one or more second messages that have the same characteristics associated with computer viruses as said first message.

38. The method of claim 37, wherein said one or more characteristics include one or more of the following:

(a) an IP address associated with the sender of said message, (b) a number of hops taken by said message prior to receipt, (c) an amount of aggregated data associated with said sender of said message, and (d) a mime structure associated with said message.