HASH-BASED SYSTEMS AND METHODS FOR DETECTING AND PREVENTING TRANSMISSION OF UNWANTED E-MAIL

• US 20090031129A1
• Filed: 10/01/2008
• Published: 01/29/2009
• Est. Priority Date: 06/19/2000
• Status: Abandoned Application

• Current Assignee: Azure Networks, LLC (Oso IP, LLC)
• Original Assignee: Azure Networks, LLC (Oso IP, LLC)
• Inventors: Milliken, Walter Clark, Milligan, Stephen Douglas, Strayer, William Timothy
• Application Number:
  US12/243,785
• Publication Number:
  US 20090031129A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system (120) detects transmission of potentially unwanted e-mail messages. The system (120) may receive e-mail messages and generate hash values based on one or more portions of the e-mail messages. The system (120) may then determine whether the generated hash values match hash values associated with prior e-mail messages. The system (120) may determine that one of the e-mail messages is a potentially unwanted e-mail message when one or more of the generated hash values associated with the e-mail message match one or more of the hash values associated with the prior e-mail messages.

Claims

1. In a network of cooperating mail servers, one of the mail servers comprising:

one or more hash memories configured to store information relating to hash values corresponding to previously-observed e-mails; and

a hash processor configured to;

receive at least some of the hash values from another one or more of the cooperating mail servers,

store information relating to the at least some of the hash values in at least one of the one or more hash memories,

receive an e-mail message,

hash one or more portions of the received e-mail message to generate hash values, as generated hash values,

determine whether the generated hash values match the hash values corresponding to previously-observed e-mails, and

identify the received e-mail message as a potentially unwanted e-mail message when one or more of the generated hash values associated with the received e-mail message match one or more of the hash values corresponding to previously-observed e-mails.