Delayed-delivery quarantining of network communications having suspicious contents

• US 7,080,408 B1
• Filed: 11/30/2001
• Issued: 07/18/2006
• Est. Priority Date: 11/30/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kouznetsov, Victor, Pak, Michael C.
• Primary Examiner(s): Barrón, Jr., Gilberto
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US10/006,549
• Time in Patent Office: 1,691 Days
• Field of Search: 713/201
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system, method and computer program product are provided for network-based scanning for potentially malicious content. Incoming and/or outgoing network communications traveling over a network are monitored, preferably at a gateway. Potentially malicious content in the network communications is identified. The identified potentially malicious content of the network communications is quarantined to help prevent damage that could be caused if the content is indeed malicious. In one embodiment, a pattern for testing the potentially malicious content network communications for malicious code can be executed. The network communications are conditionally delivered over the network based on the testing. In other embodiments, the network communications are delivered over the network after a predetermined delay and/or upon receiving a user request to release the suspect content from quarantine.

Claims

1. A method for network-based scanning for potentially malicious content, comprising:

(a) monitoring network communications over a network;

(b) identifying potentially malicious content in the network communications;

(c) quarantining the potentially malicious content of the network communications;

(d) executing a pattern for testing the potentially malicious content network communications for malicious code; and

(e) conditionally delivering the network communications over the network based on the testing;

wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content.

2. The method as recited in claim 1, further comprising scanning the network communications for known malicious content.

3. The method as recited in claim 1, wherein the malicious content includes a mass-mailer virus.

4. The method as recited in claim 1, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value.

5. The method as recited in claim 1, wherein the network communications include electronic mail messages.

6. The method as recited in claim 5, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value.

7. The method as recited in claim 1, further comprising cleaning the potentially malicious content if malicious code is found, which is disabling of malicious code.

21. The method as recited in claim 1, wherein the potentially malicious content is identified utilizing heuristics.

22. The method as recited in claim 21, wherein the heuristics include generating a histogram of content that has been sent over the network during a period of time and analyzing the histogram to determine whether a number of copies of the potentially malicious content that have been sent over the network during the period of time exceed a predetermined value.

23. The method as recited in claim 1, wherein the quarantining includes containing the potentially malicious content and preventing the potentially malicious content from creating damage.

24. The method as recited in claim 1, wherein when multiple recipients are to receive a copy of the potentially malicious content over the network, a single copy of the potentially malicious content is quarantined and each of the recipients is placed in a list such that after the potentially malicious content is determined to be clean based on the testing, the single copy is forwarded to each of the recipients.

25. The method as recited in claim 1, wherein an intended recipient of the network communications is notified that the potentially malicious content is quarantined.

26. The method as recited in claim 1, wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with the malicious code detection file received after the potentially malicious content and after the potentially malicious content is quarantined.

27. The method of claim 1, wherein the malicious code detection file is created after the potentially malicious content is identified such that a latest malicious code detection file is utilized in the scanning of the potentially malicious content.

28. The method of claim 1, wherein the malicious code detection file is created after the potentially malicious content is received such that a latest malicious code detection file is utilized in the scanning of the potentially malicious content.

8. A computer program product embodied on a computer readable medium for network-based scanning for potentially malicious content, comprising:

(a) computer code that monitors network communications over a network;

(b) computer code that identifies potentially malicious content in the network communications;

(c) computer code that quarantines the potentially malicious content of the network communications;

(d) computer code that executes a pattern for testing the potentially malicious content network communications for malicious code; and

(e) computer code that conditionally delivers the network communications over the network based on the testing;

wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content.

9. A system for network-based scanning for potentially malicious content, comprising:

(a) logic that monitors network communications over a network;

(b) logic that identifies potentially malicious content in the network communications;

(c) logic that quarantines the potentially malicious content of the network communications;

(d) logic that executes a pattern for testing the potentially malicious content network communications for malicious code; and

(e) logic that conditionally delivers the network communications over the network based on the testing;

wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content.

10. A method for network-based scanning for potentially malicious content, comprising:

(a) monitoring network communications over a network;

(b) identifying potentially malicious content in the network communications;

(c) quarantining the potentially malicious content of the network communications; and

(d) delivering the network communications over the network after a predetermined delay;

wherein the delay is for allowing quarantining of the potentially malicious content until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content.

11. The method as recited in claim 10, further comprising scanning the network communications for known malicious content.

12. The method as recited in claim 10, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value.

13. The method as recited in claim 10, wherein the network communications include electronic mail messages.

14. The method as recited in claim 13, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value.

15. A method for network-based scanning for potentially malicious content, comprising:

(a) monitoring network communications over a network;

(b) identifying potentially malicious content in the network communications;

(c) quarantining the potentially malicious content of the network communications in a quarantine; and

(d) delivering the network communications from the quarantine over the network in response to a request from a user;

wherein it is determined whether the user is authorized, and the network communications are delivered only if the user is determined to be authorized;

wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content.

16. The method as recited in claim 15, wherein the user is an intended recipient of the quarantined network communications.

17. The method as recited in claim 15, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value.

18. The method as recited in claim 15, wherein the network communications include electronic mail messages.

19. The method as recited in claim 18, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value.

20. A method for network-based scanning for potentially malicious content, comprising:

(a) monitoring incoming and outgoing network communications over a network at a gateway;

(b) scanning the network communications for known malicious content;

(c) identifying potentially malicious content in the network communications;

(d) wherein content is identified as potentially malicious when a number of identical instances of the content in the network communications passing through the network for a given period of time is greater than a predetermined value;

(e) wherein the network communications include electronic mail messages, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line passing through the network for a given period of time is greater than a predetermined value;

(f) quarantining the potentially malicious content of the network communications;

(g) delivering the network communications over the network upon occurrence of the first of;

(i) scanning the potentially malicious content with a malicious code detection file received after the potentially malicious content is received;

(ii) upon receiving a user request;

(iii) upon passage of a predetermined amount of time;

(h) notifying an intended recipient of the potentially malicious content that the potentially malicious content has been quarantined;

(i) notifying a sender of the potentially malicious content that the potentially malicious content has been quarantined; and

(j) cleaning the potentially malicious content if malicious code is found, which is disabling of malicious code.