Methods and systems for detecting and preventing the spread of malware on instant messaging (IM) networks by analyzing message traffic patterns

• US 20070006027A1
• Filed: 07/01/2005
• Published: 01/04/2007
• Est. Priority Date: 07/01/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Imiogic Incorporated
• Inventors: Shah, Milan, Roychowdhary, Anandamoy, Sakoda, Jon, Lorenzo, Eric, Gilliland, Arthur, Desouza, Francis
• Granted Patent: US 7,823,200 B2
• Time in Patent Office: Days
• US Class Current: 714/12
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Methods and systems for reducing the spread of malware in communication between an instant message (IM) client and an IM server are described. An IM filter module (IM FM) is configured to examine incoming messages from an IM server to an IM client and outgoing messages from the IM client to the IM server. The IM filter module is further configured to analyze relationship among the incoming and outgoing messages and determine whether one or more messages contain malware based on the analysis of relationship among the incoming and outgoing messages.

Claims

1. A computer-assisted method of reducing the spread of malware in an instant message (IM) system, comprising:

examining incoming messages from an IM server to an IM client;

examining outgoing messages from the IM client to the IM server;

analyzing relationship among the incoming and outgoing messages; and

determining whether one or more messages contain malware based on the analysis of relationship among the incoming and outgoing messages.

2. The method of claim 1, wherein the act of analyzing relationship includes:

determining whether two or more outgoing messages from an IM user contain an identical or similar content.

3. The method of claim 1, wherein the act of analyzing relationship includes:

determining whether two or more messages from an IM user are sent at too short of an interval to be sent by a person.

4. The method of claim 1, wherein the act of analyzing relationship includes:

determining whether an IM user sends a large number of messages after receiving one message from another IM user.

5. The method of claim 1, wherein the act of determining whether one or messages contain malware includes:

determining that a message contains malware when a content of the message is longer than an average content of the examined message by a certain standard deviation.

6. The method of claim 1, wherein the act of determining whether one or messages contain malware includes:

resolving a URL contained in a message sent from the IM server to the IM client; and

identifying the message as containing malware when the URL resolves to a URL that is identical or similar to a known source of malware.

7. The method of claim 1, wherein the act of determining whether one or messages contain malware includes:

parsing a content of a message into individual words; and

identifying the message as containing malware when the average length is longer than an average length of words in the examined messages by a significant statistical amount.

8. The method of claim 1 further comprising:

blocking the one or more messages that have been determined as containing malware.

9. The method of claim 1 further comprising:

storing, into a database, unique identifiers of the one or more messages that have been determined as containing malware.

10. The method of claim 9 further comprising:

blocking any message that is sent by a user of the IM server having an identical or similar unique identifier with any unique identifiers stored in the database.

11. The method of claim 1 further comprising:

storing, into a database, contents of the one or more messages that have been determined as containing malware.

12. The method of claim 11 further comprising:

blocking any message that contains an identical or similar content with contents of messages stored in the database.

13. The method of claim 1, wherein the act of analyzing relationship further includes:

determining whether one or more messages from an IM user are sent at too short of an interval to be sent by a person in response to a event indicating that a buddy is ready to participate in a dialog.

14. A computer-assisted system of reducing the spread of malware in an instant message (IM) system, comprising:

an IM filter module configured to examine incoming messages from an IM server to an IM client and outgoing messages from the IM client to the IM server; and

the IM filter module is further configured to analyze relationship among the incoming and outgoing messages and determine whether one or more messages contain malware based on the analysis of relationship among the incoming and outgoing messages.

15. The system of claim 14, wherein the IM filter module is further configured to determine whether two or more outgoing messages from an IM user contain an identical or similar content.

16. The system of claim 14, wherein the IM filter module is further configured to determine whether two or more messages from an IM user are sent at too short of an interval to be sent by a person.

17. The system of claim 14, wherein the IM filter module is further configured to determine whether an IM user sends a large number of messages after receiving one message from another IM user.

18. The system of claim 14, wherein the IM filter module is further configured to determine that a message contains malware when a content of the message is longer than an average content of the examined message by a certain standard deviation.

19. The system of claim 14, wherein the IM filter module is further configured to resolve a URL contained in a message sent from the IM server to the IM client, and identify the message as containing malware when the URL resolves to a URL that is identical or similar to a known source of malware.

20. The system of claim 14, wherein the IM filter module is further configured to parse a content of a message into individual words, and identify the message as containing malware when the average length is longer than an average length of words in the examined messages by a significant statistical amount.

21. The system of claim 14, wherein the IM filter module is further configured to block the one or more messages that have been determined as containing malware.

22. The system of claim 14 further comprising:

a database configured to store unique identifiers of the one or more messages that have been determined as containing malware.

23. The system of claim 22, wherein the IM filter module is further configured to block any message that is sent by a user of the IM server having an identical or similar unique identifier with any unique identifiers stored in the database.

24. The system of claim 14 further comprising:

a database configured to store contents of the one or more messages that have been determined as containing malware.

25. The system of claim 24, wherein the IM filter module is further configured to block any message that contains an identical or similar content with contents of messages stored in the database.

26. A computer program product, residing on a computer-readable medium, the computer program product comprising computer instructions for configuring a computer to perform the acts of:

examining incoming messages from an IM server to an IM client;

examining outgoing messages from the IM client to the IM server;

analyzing relationship among the incoming and outgoing messages; and

determining whether one or more messages contain malware based on the analysis of relationship among the incoming and outgoing messages.

27. The product of claim 26, wherein the instruction for performing the act of analyzing relationship further includes the instructions to perform the act of:

determining whether two or more outgoing messages from an IM user contain an identical or similar content.

28. The product of claim 26, wherein the instruction for performing the act of analyzing relationship further includes the instructions to perform the act of:

determining whether two or more messages from an IM user are sent at too short of an interval to be sent by a person.

29. The product of claim 26, wherein the instruction for performing the act of analyzing relationship further includes the instructions to perform the act of:

determining whether an IM user sends a large number of messages after receiving one message from another IM user.

30. The product of claim 26, wherein the instructions for performing the act of determining whether one or messages contain malware further includes the instructions for performing the act of:

determining that a message contains malware when a content of the message is longer than an average content of the examined message by a certain standard deviation.

31. The product of claim 26, wherein the instructions for performing the act of determining whether one or messages contain malware further includes the instructions for performing the acts of:

resolving a URL contained in a message sent from the IM server to the IM client; and

identifying the message as containing malware when the URL resolves to a URL that is identical or similar to a known source of malware.

32. The product of claim 26, wherein the instructions for performing the act of determining whether one or messages contain malware further includes the instructions for performing the acts of:

parsing a content of a message into individual words; and

identifying the message as containing malware when the average length is longer than an average length of words in the examined messages by a significant statistical amount.

33. The product of claim 26 further comprising the instructions for performing the act of:

blocking the one or more messages that have been determined as containing malware.

34. The product of claim 26 further comprising the instructions for performing the act of:

storing, into a database, unique identifiers of the one or more messages that have been determined as containing malware.

35. The product of claim 34 further comprising the instructions for performing the act of:

blocking any message that is sent by a user of the IM server having an identical or similar unique identifier with any unique identifiers stored in the database.

36. The product of claim 26 further comprising the instructions for performing the act of:

storing, into a database, contents of the one or more messages that have been determined as containing malware.

37. The product of claim 36 further comprising the instructions for performing the act of:

blocking any message that contains an identical or similar content with contents of messages stored in the database.

38. The product of claim 26, wherein the instruction for performing the act of analyzing relationship further includes the instructions to perform the act of:

determining whether one or more messages from an IM user are sent at too short of an interval to be sent by a person in response to a event indicating that a buddy is ready to participate in a dialog.