System and method for detecting computer virus

• US 20060015747A1
• Filed: 07/16/2004
• Published: 01/19/2006
• Est. Priority Date: 07/16/2004
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Van de Ven, Adriaan D. M.
• Granted Patent: US 7,444,521 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method is disclosed for detecting computer viruses. The method allows receipt of an electronic mail message that includes at least one encrypted attachment. The electronic mail message is examined in order to identify potential encryption codes. The encryption codes are used in order to attempt and decrypt the attachments. The attachments are expanded into one or more files. The files are then checked for the presence of computer viruses.

Claims

1. A method of detecting computer viruses comprising the steps:

receiving an electronic mail message including at least one encrypted attachment;

examining the electronic mail message to identify one or more potential encryption codes;

using the potential encryption codes to attempt to decrypt one or more of the encrypted attachments; and

if an encrypted attachment is decrypted, scanning the decrypted attachment for computer viruses.

2. The method of claim 1, wherein the step of using the potential encryption codes includes expanding one or more of the encrypted attachments into one or more files.

3. The method of claim 1, further comprising a step of normalizing the electronic mail message prior to performing the step of examining.

4. The method of claim 3, wherein the step of normalizing comprises a step of removing formatting commands from the electronic mail message;

5. The method of claim 4, wherein the formatting commands include HTML commands.

6. The method of claim 4, wherein the formatting commands include XML commands.

7. The method of claim 1, wherein the step of examining further comprises the steps:

identifying an image contained in the electronic mail message;

applying one or more OCR techniques to convert the image to one or more symbols; and

examining the symbols to identify potential encryption codes.

8. The method of claim 7, wherein the one or more symbols are ASCII symbols.

9. The method of claim 7, further comprising a step of creating a database for storing data regarding potential encryption codes identified from the symbols.

10. The method of claim 9, wherein the database includes a table containing a hash representation of images and a potential encryption code corresponding to each hash representation.

11. The method of claim 1, further comprising a step of scanning the remainder of the electronic mail message for computer viruses.

12. A computer program product, residing on a computer-readable medium, for use in detecting computer viruses, the computer program product comprising instructions for causing a processor to:

examine an electronic mail message including one or more encrypted attachments to identify potential encryption codes;

use the potential encryption codes to attempt to decrypt one or more of the encrypted attachments; and

if an encrypted attachment is decrypted, scan the decrypted attachment for computer viruses.

13. The computer program product of claim 12, wherein the instructions further cause the processor to normalize the electronic mail message prior to examination.

14. The computer program product claim 12, wherein, during examination of the electronic mail message, the instructions further cause the processor to:

identify an image contained in the electronic mail message;

apply one or more OCR techniques to convert the image to one or more symbols; and

examine the symbols to identify potential encryption codes.

15. The computer program product of claim 14, wherein the instructions further cause the processor to create a database for storing data regarding potential encryption codes identified from the symbols.

16. A system for detecting computer viruses, said system comprising a computer configured to:

examine an electronic mail message including one or more encrypted attachments to identify potential encryption codes;

use the potential encryption codes to attempt to decrypt one or more of the encrypted attachments; and

if an encrypted attachment is decrypted, scan the decrypted attachment for computer viruses.

17. The system of claim 16, wherein said computer is further configured to normalize said electronic mail message prior to examination.

18. The system of claim 16, wherein, during examination of the electronic mail message, said computer is further configured to:

identify an image contained in said electronic mail message;

apply one or more OCR techniques to convert said image to one or more symbols; and

examine said symbols to identify potential encryption codes.

19. The system of claim 18, wherein said computer is further configured to create-a database for storing data regarding potential encryption codes identified from said symbols.

20. A system for detecting computer viruses comprising:

means for examining an electronic mail message including one or more encrypted attachments to identify potential encryption codes;

use the potential encryption codes to attempt to decrypt one or more of the encrypted attachments; and

means for scanning a decrypted attachment for computer viruses.

21. The system of claim 20, further comprising means for normalizing said electronic mail message.

22. The system of claim 20, wherein said means for examining further comprises:

means for identifying an image contained in said electronic mail message;

means for applying one or more OCR techniques to convert said image to one or more symbols; and

means for examining said symbols to identify potential encryption codes.

23. The system of claim 22, further comprising means for creating a database for storing data regarding potential encryption codes identified from said symbols.