Scanner-driven email message decomposition

• US 20080126493A1
• Filed: 11/29/2006
• Published: 05/29/2008
• Est. Priority Date: 11/29/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Morrey, Richard
• Granted Patent: US 8,560,614 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method, system, and computer program product for scanning emails by reducing the amount of decomposition processing that is performed to only the minimum necessary to fully scan the emails. This reduces the server resources needed, which improves server throughput and reduces costs. A method for processing email messages comprises the steps of receiving an email message comprising a plurality of items, scanning the email message with at least one scanner software, determining with each of the at least one scanner softwares what items of the plurality of items the email message is to be decomposed into, decomposing the email message to obtain the items determined by each of the at least one scanner software.

Claims

1. A method for processing email messages, comprising the steps of:

receiving an email message comprising a plurality of items;

scanning the email message with at least one scanner software;

determining with each of the at least one scanner softwares what items of the plurality of items the email message is to be decomposed into;

decomposing the email message to obtain the items determined by each of the at least one scanner software.

2. The method of claim 1, further comprising the step of:

scanning the items obtained by each of the at least one scanner softwares with that scanner software.

3. The method of claim 2, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

4. The method of claim 1, wherein the at least one scanner softwares comprises a plurality of scanner softwares and the decomposing step comprises the step of:

decomposing the email message to obtain each item determined by at least one of the plurality of scanner softwares only once.

5. The method of claim 4, further comprising the step of:

scanning the items obtained by at least one of the plurality of scanner softwares with that scanner software.

6. The method of claim 5, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

7. The method of claim 6, wherein the plurality of scanners comprise at least one of an anti-virus scanner, an anti-spam scanner, and a bad content scanner.

8. The method of claim 7, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

9. The method of claim 1, wherein the email messages are incoming email messages.

10. The method of claim 1, wherein the email messages are outgoing email messages.

11. A system for processing email messages comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

receiving an email message comprising a plurality of items;

scanning the email message with at least one scanner software;

determining with each of the at least one scanner softwares what items of the plurality of items the email message is to be decomposed into;

decomposing the email message to obtain the items determined by each of the at least one scanner software.

12. The system of claim 11, further comprising the step of:

scanning the items obtained by each of the at least one scanner softwares with that scanner software.

13. The system of claim 12, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

14. The system of claim 11, wherein the at least one scanner softwares comprises a plurality of scanner softwares and the decomposing step comprises the step of:

decomposing the email message to obtain each item determined by at least one of the plurality of scanner softwares only once.

15. The system of claim 14, further comprising the step of:

scanning the items obtained by at least one of the plurality of scanner softwares with that scanner software.

16. The system of claim 15, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

17. The system of claim 16, wherein the plurality of scanners comprise at least one of an anti-virus scanner, an anti-spam scanner, and a bad content scanner.

18. The system of claim 17, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

19. The system of claim 11, wherein the email messages are incoming email messages.

20. The system of claim 11, wherein the email messages are outgoing email messages.

21. A computer program product for processing incoming email messages comprising:

a computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of

receiving an email message comprising a plurality of items;

scanning the email message with at least one scanner software;

determining with each of the at least one scanner softwares what items of the plurality of items the email message is to be decomposed into;

decomposing the email message to obtain the items determined by each of the at least one scanner software.

22. The computer program product of claim 21, further comprising the step of:

scanning the items obtained by each of the at least one scanner softwares with that scanner software.

23. The computer program product of claim 22, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

24. The computer program product of claim 21, wherein the at least one scanner softwares comprises a plurality of scanner softwares and the decomposing step comprises the step of:

decomposing the email message to obtain each item determined by at least one of the plurality of scanner softwares only once.

25. The computer program product of claim 24, further comprising the step of:

scanning the items obtained by at least one of the plurality of scanner softwares with that scanner software.

26. The computer program product of claim 25, wherein the determining step comprises the step of:

determining what items of the plurality of items the email message is to be decomposed into based on the items of the plurality of items that a scanner software is capable of scanning.

27. The computer program product of claim 26, wherein the plurality of scanners comprise at least one of an anti-virus scanner, an anti-spam scanner, and a bad content scanner.

28. The computer program product of claim 27, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

29. The computer program product of claim 21, wherein the email messages are incoming email messages.

30. The computer program product of claim 21, wherein the email messages are outgoing email messages.