Controlling a message quarantine

• US 7,712,136 B2
• Filed: 12/07/2006
• Issued: 05/04/2010
• Est. Priority Date: 05/05/2005
• Status: Expired due to Fees

• Current Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Original Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Inventors: Slater, Charles, Kennedy, Scot, Rosenstein, Larry, Sprosts, Craig, Quinlan, Daniel
• Primary Examiner(s): Lanier; Benjamin E
• Application Number:
  US11/636,150
• Publication Number:
  US 20070083929A1
• Time in Patent Office: 1,244 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Controlling a message quarantine is disclosed. A message scanning method is described in which early exit from parsing and scanning can occur by matching threat rules only to selected message elements and stopping rule matching as soon as a match on one message element exceeds a threat threshold.

Claims

1. An apparatus, comprising:

a network interface;

one or more processors coupled to the network interface;

logic coupled to the one or more processors which, when executed by the one or more processors, causes the one or more processors to perform;

receiving and storing a plurality of rules specifying one or more criteria for electronic messages that indicate threats associated with the messages,

wherein each rule has a priority value,

wherein each rule is associated with a message element type, and

wherein each rule has a weight proportional to a number of criteria specified in the rule;

receiving an electronic mail message having a destination address for a recipient account, wherein the message comprises a plurality of message elements;

extracting a first message element;

determining a set of matching rules for the message by matching only the first message element to only selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules;

computing a threat score value as a weighted average value of virus score values returned by each rule from the set of matching rules, by computing a first sum of products of each of the virus score values returned by the matching rules multiplied by the weight associated with the matching rule, and dividing the first sum by a second sum of the weights associated with the matching rules;

when the threat score value is greater than a specified threshold, outputting the threat score value.

3. The apparatus of claim 1 or 2, further comprising logic for determining an updated threat score value for the message by matching other message elements to other rules only when the threat score value is less than a specified threshold.

4. The apparatus of claim 1 or 2, wherein the message elements comprise one or more message headers, a message body, and one or more HTML elements in the message body.

5. The apparatus of claim 1 or 2, wherein the first message element comprises one or more message headers, the selected rules comprise only header rules, and the plurality of rules includes the header rules, raw body rules, and HTML body rules.

6. The apparatus of claim 1 or 2, further comprising logic for determining the threat score value for the message by matching only the first message element to only the selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules;

after matching each rule among the selected rules, testing whether the threat score value is greater than the specified threshold; and

when the threat score value is greater than a specified threshold, outputting the threat score value.

7. The apparatus of claim 1 or 2, further comprising logic for determining an updated threat score value for the message by decoding a body of the message and matching the body to one or more raw body rules only when the threat score value is less than a specified threshold.

8. The apparatus of claim 1 or 2, further comprising logic for determining an updated threat score value for the message by rendering markup language message elements and matching the rendered markup language message elements to one or more body rules only when the threat score value is less than a specified threshold.

9. The apparatus of claim 1 or 2, wherein the logic comprises an anti-spam scanning engine.

10. The apparatus of claim 1 or 2, wherein the threats comprise any one of a virus, spam, or a phishing attack.

2. An apparatus, comprising:

a processor;

a computer-readable storage medium storing one or more stored sequences of instructions causing the processors to provide;

means for receiving and storing a plurality of rules specifying one or more criteria for electronic messages that indicate threats associated with the messages,

wherein each rule has a priority value,

wherein each rule is associated with a message element type, and

wherein each rule has a weight proportional to a number of criteria specified in the rule;

means for receiving an electronic mail message having a destination address for a recipient account, wherein the message comprises a plurality of message elements;

means for extracting a first message element;

means for determining a set of matching rules for the message by matching only the first message element to only selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules;

means for computing a threat score value as a weighted average value of virus score values returned by each rule from the set of matching rules, by computing a first sum of products of each of the virus score values returned by the matching rules multiplied by the weight associated with the matching rule, and dividing the first sum by a second sum of the weights associated with the matching rules;

means for outputting the threat score value when the threat score value is greater than a specified threshold.

11. A method, comprising:

a network interface;

one or more processors coupled to the network interface;

logic coupled to the one or more processors which, when executed by the one or more processors, causes the one or more processors to perform;

receiving and storing a plurality of rules specifying one or more criteria for electronic messages that indicate threats associated with the messages,

wherein each rule has a priority value,

wherein each rule is associated with a message element type, and

wherein each rule has a weight proportional to a number of criteria specified in the rule;

receiving an electronic mail message having a destination address for a recipient account, wherein the message comprises a plurality of message elements;

extracting a first message element;

determining a set of matching rules for the message by matching only the first message element to only selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules;

computing a threat score value as a weighted average value of virus score values returned by each rule from the set of matching rules, by computing a first sum of products of each of the virus score values returned by the matching rules multiplied by the weight associated with the matching rule, and dividing the first sum by a second sum of the weights associated with the matching rules;

when the threat score value is greater than a specified threshold, outputting the threat score value.

12. The method of claim 11, further comprising logic for determining an updated threat score value for the message by matching other message elements to other rules only when the threat score value is less than a specified threshold.

13. The method of claim 11, wherein the message elements comprise one or more message headers, a message body, and one or more HTML elements in the message body.

14. The method of claim 11, wherein the first message element comprises one or more message headers, the selected rules comprise only header rules, and the plurality of rules includes the header rules, raw body rules, and HTML body rules.

15. The method of claim 11, further comprising logic for determining the threat score value for the message by matching only the first message element to only the selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules;

after matching each rule among the selected rules, testing whether the threat score value is greater than the specified threshold; and

when the threat score value is greater than a specified threshold, outputting the threat score value.

16. The method of claim 11, further comprising logic for determining an updated threat score value for the message by decoding a body of the message and matching the body to one or more raw body rules only when the threat score value is less than a specified threshold.

17. The method of claim 11, further comprising logic for determining an updated threat score value for the message by rendering markup language message elements and matching the rendered markup language message elements to one or more body rules only when the threat score value is less than a specified threshold.

18. The method of claim 11, wherein the logic comprises an anti-spam scanning engine.

19. The method of claim 11, wherein the threats comprise any one of a virus, spam, or a phishing attack.