System and method for providing dynamic screening of transient messages in a distributed computing environment

• US 7,117,533 B1
• Filed: 12/10/2001
• Issued: 10/03/2006
• Est. Priority Date: 08/03/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Libenzi, Davide
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Assistant Examiner(s): Chankong, Dohm
• Application Number:
  US10/016,509
• Time in Patent Office: 1,758 Days
• Field of Search: 709/223, 709/227, 709/231, 709/232, 709/245, 709/250, 713/201
• US Class Current: 726/24
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method for providing dynamic screening of transient messages in a distributed computing environment is disclosed. An incoming message is intercepted at a network domain boundary. The incoming message includes a header having a plurality of address fields, each storing contents. A set of blocking rules is maintained. Each blocking rule defines readily-discoverable characteristics indicative of messages infected with at least one of a computer virus, malware and bad content. The contents of each address field are identified and checked against the blocking rules to screen infected messages and identify clean messages. Each such clean message is staged into an intermediate message queue pending further processing.

Claims

1. A system for providing dynamic screening of transient messages in a distributed computing environment, comprising:

an antivirus system intercepting an incoming message at a network domain boundary, the incoming message including a header comprising a plurality of address fields storing contents;

a stored set of blocking rules, each blocking rule defining readily-discoverable characteristics indicative of messages infected with at least one of a computer virus, malware and bad content;

a parser module identifying the contents of each address field;

a comparison module checking the contents of each address field against the blocking rules to screen infected messages and identify clean messages;

an intermediate message queue staging each such clean message pending further processing;

an antivirus scanner scanning each message in the intermediate message queue for at least one of a computer virus and malware; and

an event handler performing each scanning operation as an event responsive to each such clean message staged in the intermediate message queue;

wherein the infected messages are blocked from entering the intermediate message queue immediately after the comparison is made between the blocking rules and the contents of at least one of the address fields;

wherein the intermediate message queue is maintained at a constant size;

wherein the constant size is determined according to a progress of the antivirus scanner in order to prevent the intermediate message queue from becoming overloaded with messages awaiting scanning.

2. A system according to claim 1, further comprising:

a message receiver discarding each such infected message without further processing.

3. A system according to claim 1, wherein each such blocking rule is specified as a regular expression containing at least one of literal and wildcard values.

4. A system according to claim 1, further comprising:

a gateway receiving the incoming messages into the network domain boundary.

5. A system according to claim 1, wherein the structured fields comprise at least one of sender, recipient, copied recipient, blind copied recipient, date, time, and subject.

6. A system according to claim 1, wherein the incoming message comprises at least one attachment.

7. A system according to claim 1, wherein the distributed computing environment is TCP/IP-compliant and each incoming message is SMTP-compliant.

27. The system according to claim 1, wherein the antivirus scanner scans content of a body of the message and any attachments.

28. The system according to claim 1, wherein the infected messages are discarded immediately after being blocked from entering the intermediate message queue.

29. The system according to claim 1, wherein a connection to a sender of the incoming message is closed if the message is blocked.

8. A method for providing dynamic screening of transient messages in a distributed computing environment, comprising:

intercepting an incoming message at a network domain boundary, the incoming message including a header comprising a plurality of address fields storing contents;

maintaining a set of blocking rules, each blocking rule defining readily-discoverable characteristics indicative of messages infected with at least one of a computer virus, malware and bad content;

identifying and checking the contents of each address field against the blocking rules to screen infected messages and identify clean messages;

staging each such clean message into an intermediate message queue pending further processing;

scanning each message in the intermediate message queue for at least one of a computer virus and malware; and

performing each scanning operation as an event responsive to each such clean message staged in the intermediate message queue;

wherein the infected messages are blocked from entering the intermediate message queue immediately after the comparison is made between the blocking rules and the contents of at least one of the address fields;

wherein the intermediate message queue is maintained at a constant size;

wherein the constant size is determined according to a progress of an antivirus scanner in order to prevent the intermediate message queue from becoming overloaded with messages awaiting scanning.

9. A method according to claim 8, further comprising:

discarding each such infected message without, further processing.

10. A method according to claim 8, further comprising:

specifying each such blocking rule as a regular expression containing at least one of literal and wildcard values.

11. A method according to claim 8, further comprising:

receiving the incoming messages at a gateway into the network domain boundary.

12. A method according to claim 8, wherein the structured fields comprise at least one of sender, recipient, copied recipient, blind copied recipient, date, time, and subject.

13. A method according to claim 8, wherein the incoming message comprises at least one attachment.

14. A method according to claim 8, wherein the distributed computing environment is TCP/IP-compliant and each incoming message is SMTP-compliant.

15. A computer-readable storage medium holding code for performing the method according to claims 8, 9, 10, 11, 12, 13, or 14.

16. A system for efficiently detecting computer viruses and malware at a network domain boundary, comprising:

an antivirus system receiving an incoming message packet from a sending client at a network domain boundary through an open connection, the incoming message packet comprising a header including fields, which each store field values, wherein each incoming message packet further comprises a body storing message content;

a message receiver comprising;

a parser module parsing the field values from each field in the header of each incoming message packet by extracting tokens representing the field values;

a comparison module comparing the tokens to characteristics indicative of at least one of a computer virus and malware to identify screened incoming message packets, and forwarding each screened incoming message packet;

a message queue enqueueing each screened incoming message packet; and

an antivirus scanner scanning the message content of the body of each screened incoming message packet for at least one of a computer virus and malware to identify uninfected screened incoming message packets, and forwarding each uninfected screened incoming message packet;

wherein the screened incoming message packets determined to be infected are blocked from being forwarded immediately after the comparison is made between the tokens and the characteristics indicative of at least one of a computer virus and malware;

wherein the message queue is maintained at a constant size;

wherein the constant size is determined according to a progress of the antivirus scanner in order to prevent the message queue from becoming overloaded with messages awaiting scanning.

17. A system according to claim 16, wherein the antivirus system closes the open connection to the sending client of each non-screened incoming message packet.

18. A system according to claim 16, wherein the comparison module analyzes at least one of a sender, recipient, copied recipient, blind copied recipient, date, time, and subject field in the header of each incoming message packet.

19. A system according to claim 16, wherein the comparison module applies blocking rules to the field values of the header of each incoming message packet.

20. A system according to claim 16, wherein the distributed computing environment is TCP/IP-compliant and each incoming message packet is SMTP-compliant.

21. A method for efficiently detecting computer viruses and malware at a network domain boundary, comprising:

receiving an incoming message packet from a sending client at a network domain boundary through an open connection, the incoming message packet comprising a header including fields, which each store field values, wherein each incoming message packet further comprises a body storing message content;

parsing the field values from each field in the header of each incoming message packet by extracting tokens representing the field values;

comparing the tokens to characteristics indicative of at least one of a computer virus and malware to identify screened incoming message packets;

forwarding each screened incoming message packet;

scanning the message content of the body of each screened incoming message packet for at least one of a computer virus and malware to identify uninfected screened incoming message packets;

forwarding each uninfected screened incoming message packet; and

enqueueing each screened incoming message packet onto a message queue;

wherein the screened incoming message packets determined to be infected are blocked from being forwarded immediately after the comparison is made between the tokens and the characteristics indicative of at least one of a computer virus and malware;

wherein the intermediate message queue is maintained at a constant size;

wherein the constant size is determined according to a progress of an antivirus scanner in order to prevent the intermediate message queue from becoming overloaded with messages awaiting scanning.

22. A method according to claim 21, further comprising:

closing the open connection to the sending client of each non-screened incoming message packet.

23. A method according to claim 21, further comprising:

analyzing at least one of a sender, recipient, copied recipient, blind copied recipient, date, time, and subject field in the header of each incoming message packet.

24. A method according to claim 21, further comprising:

applying blocking rules to the field values of the header of each incoming message packet.

25. A method according to claim 21, wherein the distributed computing environment is TCP/IP-compliant and each incoming message packet is SMTP-compliant.

26. A computer-readable storage medium holding code for performing the method according to claims 21, 22, 23, 24, or 25.