Detecting unwanted properties in received email messages

• US 6,757,830 B1
• Filed: 10/03/2000
• Issued: 06/29/2004
• Est. Priority Date: 10/03/2000
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Wolff, Daniel Joseph, Kelly, Nicholas Paul
• Primary Examiner(s): MOISE, EMMANUEL LIONEL
• Application Number:
  US09/678,688
• Time in Patent Office: 1,365 Days
• Field of Search: 709/206, 713/188, 713/200, 713/202, 713/201, 714/26, 714/38, 707/3
• US Class Current: 713/188
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Received e-mail messages are subject to a minimum delay period determined in dependence upon characteristics of the e-mail message received. Prior to release of the e-mail message upon expiry of the minimum delay period a check is made that the most up-to-date anti-virus and anti-spamming tests have been applied to the e-mail message. Characteristics that may be used to determine the minimum delay period applied include sender characteristics, recipient characteristics, attachment type characteristics and message content type characteristics.

Claims

1. A method of detecting an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said method comprising the steps of:

receiving an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message, wherein the e-mail message characteristics include at least one of;

sender address;

sender organization;

recipient address;

recipient organization;

attachment type; and

e-mail message content type;

determining a minimum delay period in dependence upon said one or more e-mail message characteristics for increasing the likelihood that said one or more tests for said unwanted properties that are current at the expiry of the minimum delay period will include counter-measures developed during the minimum delay period;

storing said e-mail message for said minimum delay period;

applying said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties;

if said e-mail message does not have any of said one or more unwanted properties, then sending said e-mail message to said one or more recipients; and

if said e-mail message does have any of said one or more unwanted properties, then blocking sending of at least a portion of said e-mail message to said one or more recipients;

wherein said one or more tests are applied upon receipt of said e-mail message prior to expiry of said minimum delay period and are repeated upon expiry of said minimum delay period using one or more tests current at expiry if said one or more tests have been updated during said minimum.

2. A method as claimed in claim 1, wherein if said e-mail message does have any of said one or more unwanted properties, sending of all portions of said e-mail message is blocked.

3. A method as claimed in claim 1, wherein said one or more unwanted properties include said e-mail message containing a computer virus.

4. A method as claimed in claim 3, wherein said one or more tests include comparing said e-mail message with virus definition data to detect one of more computer viruses, said virus definition data being updateable to enable detection of newly encountered computer viruses.

5. A method as claimed in claim 4, wherein said virus definition data is periodically updated using a virus definition data update source.

6. A method as claimed in claim 5, wherein said virus definition data update source is a remote internet server.

7. A method as claimed in claim 1, wherein said one or more unwanted properties include receipt within said minimum delay period of more than a threshold level of e-mail messages having one or more common characteristics.

8. A method as claimed in claim 7, wherein said one of more common characteristics include one or more of:

a common sender;

a common recipient;

a common message title;

a common message size;

a common attachment;

a common attachment type; and

a common message content.

9. A method as claimed in claim 1, further comprising the step of adding applied delay data to said e-mail message indicative of said minimum delay period for which said e-mail message is stored.

10. A method as claimed in claim 9, wherein said e-mail message characteristics include presence of any applied delay data.

11. A method as claimed in claim 9, wherein authentication data is added to said e-mail message together with said applied delay data such that said applied delay data may be subsequently authenticated.

12. A method as claimed in claim 1, wherein said e-mail message is received from an external source by an e-mail server storing an e-mail postbox for at least one of said one or more recipients.

13. A method as claimed in claim 1, wherein said e-mail message is received from an internal source by an e-mail server storing an e-mail postbox for a sender of said e-mail message.

14. A method as claimed in claim 1, wherein said e-mail message is received by an e-mail server acting as a relay server for said e-mail message.

15. A method as claimed in claim 1, further comprising the step of checking for an update of said one or more tests whilst said e-mail message is being stored for said minimum delay period.

16. Apparatus for detecting an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said apparatus comprising:

a receiver operable to receive an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message, wherein the e-mail message characteristics include at least one of;

sender address;

sender organization;

recipient address;

recipient organization;

attachment type; and

e-mail message content type;

delay determining logic operable to determine a minimum delay period in dependence upon said one or more e-mail message characteristics for increasing the likelihood that said one or more tests for said unwanted properties that are current at the expiry of the minimum delay period will include counter-measures developed during the minimum delay period;

a storage device operable to store said e-mail message for said minimum delay period;

test logic operable to apply said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties; and

mail processing logic operable if said e-mail message does not have any of said one or more unwanted properties to send said e-mail message to said one or more recipients and operable if said e-mail message does have any of said one or more unwanted properties to block sending of at least a portion of said e-mail message to said one or more recipients;

wherein said one or more tests are applied upon receipt of said e-mail message prior to expiry of said minimum delay period and are repeated upon expiry of said minimum delay period using one or more tests current at expiry if said one or more tests have been updated during said minimum delay period.

17. Apparatus as claimed in claim 16, wherein if said e-mail message does have any of said one or more unwanted properties, said mail processing logic is operable to block sending of all portions of said e-mail message.

18. Apparatus as claimed in claim 16, wherein said one or more unwanted properties include said e-mail message containing a computer virus.

19. Apparatus as claimed in claim 18, wherein said one or more tests include comparing said e-mail message with virus definition data to detect one or more computer viruses, said virus definition data being updateable to enable detection of newly encountered computer viruses.

20. Apparatus as claimed in claim 19, further comprising virus definition update logic operable to periodically update said virus definition data using a virus definition data update source.

21. Apparatus as claimed in claim 20, wherein said virus definition data update source is a remote internet server.

22. Apparatus as claimed in claim 16, wherein said one or more unwanted properties include receipt within said minimum delay period of more than a threshold level of e-mail messages having one or more common characteristics.

23. Apparatus as claimed in claim 22, wherein said one of more common characteristics include one or more of:

a common sender;

a common recipient;

a common message title;

a common message size;

a common attachment;

a common attachment type; and

a common message content.

24. Apparatus as claimed in claim 16, further comprising delay stamping logic operable to add applied delay data to said e-mail message indicative of said minimum delay period for which said e-mail message is stored.

25. Apparatus as claimed in claim 24, wherein said e-mail message characteristics include presence of any applied delay data.

26. Apparatus as claimed in claim 24, wherein said delay stamping logic also adds authentication data to said e-mail message together with said applied delay data such that said applied delay data may be subsequently authenticated.

27. Apparatus as claimed in claim 16, wherein said e-mail message is received from an external source by an e-mail server storing an e-mail postbox for at least one of said one or more recipients.

28. Apparatus as claimed in claim 16, wherein said e-mail message is received from an internal source by an e-mail server storing an e-mail postbox for a sender of said e-mail message.

29. Apparatus as claimed in claim 16, wherein said e-mail message is received by an e-mail server acting as a relay server for said e-mail message.

30. Apparatus as claimed in claim 16, further comprising update checking logic operable to check for an update of said one or more tests whilst said e-mail message is being stored for said minimum delay period.

31. A computer program product carrying a computer program for controlling a computer to detect an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said computer program comprising:

receiver code operable to receive an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message, wherein the e-mail message characteristics include at least one of;

sender address;

sender organization;

recipient address;

recipient organization;

attachment type; and

e-mail message content type;

delay determining code operable to determine a minimum delay period in dependence upon said one or more e-mail message characteristics for increasing the likelihood that said one or more tests for said unwanted properties that are current at the expiry of the minimum delay period will include counter-measures developed during the minimum delay period;

storage code operable to store said e-mail message for said minimum delay period;

test logic operable to apply said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties; and

mail processing code operable if said e-mail message does not have any of said one or more unwanted properties to send said e-mail message to said one or more recipients and operable if said e-mail message does have any of said one or more unwanted properties to block sending of at least a portion of said e-mail message to said one or more recipients;

wherein said one or more tests are applied upon receipt of said e-mail message prior to expiry of said minimum delay period and are repeated upon expiry of said minimum delay period using one or more tests current at expiry if said one or more tests have been updated during said minimum delay period.

32. A computer program product as claimed in claim 31, wherein said e-mail message does have any of said one or more unwanted properties, said mail processing code is operable to block sending of all portions of said e-mail message.

33. A computer program product as claimed in claim 31, wherein said one or more unwanted properties include said e-mail in message containing a computer virus.

34. A computer program product as claimed in claim 33, wherein said one or more tests include comparing said e-mail message with virus definition data to detect one or more computer viruses, said virus definition data being updateable to enable detection of newly encountered computer viruses.

35. A computer program product as claimed in claim 34, further comprising virus definition update code operable to periodically update said virus definition data using a virus definition data update source.

36. A computer program product as claimed in claim 35, wherein said virus definition data update source is a remote internet server.

37. A computer program product as claimed in claim 31, wherein said one or more unwanted properties include receipt within said minimum delay period of more than a threshold level of e-mail messages having one or more common characteristics.

38. A computer program product as claimed in claim 37, wherein said one of more common characteristics include one or more of:

a common sender;

a common recipient;

a common message title;

a common message size;

a common attachment;

a common attachment type; and

a common message content.

39. A computer program product as claimed in claim 31, further comprising delay stamping code operable to add applied delay data to said e-mail message indicative of said minimum delay period for which said e-mail message is stored.

40. A computer program product as claimed in claim 39, wherein said e-mail message characteristics include presence of any applied delay data.

41. A computer program product as claimed in claim 39, wherein said delay stamping code also adds authentication data to said e-mail message together with said applied delay data such that said applied delay data may be subsequently authenticated.

42. A computer program product as claimed in claim 31, wherein said e-mail message is received from an external source by an e-mail server storing an e-mail postbox for at least one of said one or more recipients.

43. A computer program product as claimed in claim 31, wherein said e-mail message is received from an internal source by an e-mail server storing an e-mail postbox for a sender of said e-mail message.

44. A computer program product as claimed in claim 31, wherein said e-mail message is received by an e-mail server acting as a relay server for said e-mail message.

45. A computer program product as claimed in claim 31, further comprising update checking code operable to check for an update of said one or more tests whilst said e-mail message is being stored for said minimum delay period.