MALWARE DETECTION SYSTEM BASED ON STORED DATA

• US 20170318049A1
• Filed: 05/11/2017
• Published: 11/02/2017
• Est. Priority Date: 09/15/2015
• Status: Active Grant

• Current Assignee: Mimecast Services Limited (Mimecast Limited)
• Original Assignee: Mimecast Services Limited (Mimecast Limited)
• Inventors: Maylor, Jackie, Tyler, Simon, Bauer, Peter, Benamram, Gilly, Sowden, Paul, Malone, Steven, Van Ry, Wayne, Ribeiro, Francisco
• Granted Patent: US 10,764,316 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A malware detection system based on stored data that analyzes an electronic message for threats by comparing it to previously received messages in a message archive or to a contacts list. Threat protection rules may be generated dynamically based on the message and contacts history. A message that appears suspicious may be blocked, or the system may insert warnings to the receiver not to provide personal information without verifying the message. Threat checks may look for unknown senders, senders with identities that are similar to but not identical to previous senders or to known contacts, or senders that were added only recently as contacts. Links embedded in messages may be checked by comparing them to links previously received or to domain names of known contacts. The system may flag messages as potential threats if they contradict previous messages, or if they appear unusual compared to the patterns of previous messages.

Claims

1. A malware detection system based on stored data, comprising:

a messaging system database comprising one or more of

an archive of electronic messages,

a contacts list,

summary data derived from one or more of said archive of electronic messages and said contacts list;

a message filter coupled to said messaging system database, and configured to receive an electronic message comprising one or more message parts, said message parts comprising

a sender,

one or more receivers,

a message contents,

a subject,

one or more attachments,

one or more links to web sites,

a message thread;

determine whether said electronic message represents a potential threat, based on an analysis of

said message parts, and

said messaging system database;

if said electronic message represents a potential threat, perform one or more of block access to said electronic message or to one or more of said message parts;

transform said electronic message to provide a warning to a user who attempts to access said electronic message or attempts to access one or more of said one or more message parts.

2-30. -30. (canceled)