Analyzing Traffic Patterns to Detect Infectious Messages

• US 20120151590A1
• Filed: 02/20/2012
• Published: 06/14/2012
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Rihn, Jennifer, Oliver, Jonathan J.
• Granted Patent: US 8,955,136 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Managing electronic messages comprises receiving a message, forwarding the message, determining that the forwarded message is infectious after the message has been forwarded and preventing the infectious forwarded message from spreading.

Claims

1. A method for classifying an electronic-mail message, comprising:

receiving a message sent over a communication network;

executing instructions stored in memory, wherein execution of the instructions by a processor;

determines that the received message is similar to one or more previously received messages classified as suspicious messages, the suspicious messages stored in memory,

determines that a total number of messages has exceeded a predefined threshold, wherein the total number of messages includes the suspicious messages and the received message, and

classifies the received message as infectious when the predefined threshold has been exceeded.

2. The method of claim 1, wherein the execution of instructions by the processor further performs a traffic analysis on the received message, wherein the traffic analysis is used to identify a traffic spike that is consistent with a pattern of a virus outbreak.

3. The method of claim 2, wherein the traffic analysis is analyzed on a global network level.

4. The method of claim 2, wherein the traffic analysis is analyzed on a subnet of a local network.

5. The method of claim 1, wherein the execution of instructions by the processor further quarantines the message.

6. The method of claim 1, wherein the execution of instructions by the processor further deletes the message.

7. The method of claim 1, wherein the message includes an executable attachment having a file name and one or more of the suspicious messages have the same attachment and file name.

8. The method of claim 1, wherein the execution of instructions by the processor further reports the received message classified as infectious to another user on the communications network to prevent the spread of the infectious message.

10. A system for classifying an electronic-mail message, comprising:

a mail server for receiving a message sent over a communication network; and

a network device coupled to the mail server, the network device including a processor for executing instructions stored in memory, wherein execution of the instructions by the processor;

determines that the received message is similar to one or more previously received messages classified as suspicious messages, the suspicious messages stored in memory,

determines that a total number of messages has exceeded a predefined threshold, wherein the total number of messages includes the suspicious messages and the received message, and

classifies the received message as infectious when the predefined threshold has been exceeded.

11. The system of claim 10, further comprising an infectious message detection mechanism stored in memory and executable by a processor to identify a virus associated with the infectious message.

12. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying an electronic-mail message, the method comprising:

receiving a message sent over a communication network;

determining that the received message is similar to one or more previously received messages classified as suspicious messages;

determining that a total number of messages has exceeded a predefined threshold, wherein the total number of messages includes the suspicious messages and the received message; and

classifying the received message as infectious when the predefined threshold has been exceeded.