Method and apparatus for managing computer virus outbreaks

• US 7,748,038 B2
• Filed: 12/06/2004
• Issued: 06/29/2010
• Est. Priority Date: 06/16/2004
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Taylor, Craig, Olivier, Michael, Rosenstein, Larry, Sprosts, Craig, Quinlan, Daniel, Kennedy, Scot
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): SCHWARTZ, DARREN B
• Application Number:
  US11/006,209
• Publication Number:
  US 20050283837A1
• Time in Patent Office: 2,031 Days
• Field of Search: 713/188, 726 22- 25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Early detection of computer viruses is provided by collecting information about suspicious messages and generating virus outbreak information. In one embodiment, a method comprises receiving the virus outbreak information that has been determined by receiving message information for messages that have characteristics associated with computer viruses, wherein the messages were determined by a virus-check component as not comprising a virus, and mapping the message information received in a specified time period to the virus outbreak information; and when the virus outbreak information indicates initiation of a virus attack, performing a message flow control action for additional messages that have the same characteristics associated with computer viruses as the first messages. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages.

Claims

1. A method, comprising the computer-implemented steps of:

receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses;

in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses; and

in response to the determining that the one or more first messages do comprise one or more viruses, performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as the one or more first messages;

wherein the method is performed by one or more processors.

2. A method as recited in claim 1, wherein the virus score value is associated with a particular message, and wherein the virus score value is determined based on the mapping step.

3. A method as recited in claim 2, wherein the virus score value is determined without examining the contents of any attachment to the particular message.

4. A method as recited in claim 1, wherein the virus outbreak information includes one or more rules that each associates a virus score value with one or more first messages suspected to be associated with computer viruses.

5. A method as recited in claim 4, wherein each rule applies to one or more second messages that are suspected to be associated with computer viruses.

6. A method as recited in claim 5, wherein the virus outbreak information includes at least two rules that apply to a particular second message of the one or more second messages, and the virus outbreak information indicates initiation of the virus attack based on a highest virus score value from among the virus score values for the at least two rules.

7. A method as recited in claim 1, wherein the one or more first messages are suspected to be associated with computer viruses if the one or more first messages have file attachments having a file type associated with computer viruses.

8. A method as recited in claim 7, wherein the file type is any of EXE, ZIP, COM, SCR, BAT, and PIF.

9. A method as recited in claim 1, wherein receiving one or more sets of message information comprises receiving at least one set of message information from a spamtrap.

10. A method as recited in claim 1, wherein receiving one or more sets of message information comprises receiving, from one or more spamtraps, one or more counts of messages that are suspected to be associated with computer viruses, wherein the messages were determined by the virus-check component as not comprising a virus.

11. A method as recited in claim 1, wherein the virus outbreak information indicates initiation of the virus attack when the virus outbreak information satisfies a specified relationship with a specified threshold.

12. A method as recited in claim 1, wherein for each of a plurality of file attachment types of the one or more first messages to result in generating a plurality of percent-of-normal virus score values respectively associated with each of the plurality of file attachment types.

13. A method as recited in claim 12, further comprising computing an average of all the plurality of percent-of-normal virus score values to create an overall percent-of-normal value, and mapping the overall percent-of-normal value to the range of virus score values, to result in creating a particular virus score value for a particular file attachment type.

14. A method as recited in claim 1, wherein the message flow control action comprises delaying delivery of the one or more second messages for a specified time.

15. A method as recited in claim 14, wherein the message flow control action further comprises releasing the one or more second messages upon expiration of the specified time and then scanning the one or more second messages for viruses prior to delivery.

16. A method as recited in claim 1, wherein the message flow control action comprises storing the one or more second messages in a quarantine queue for a specified time.

17. A method as recited in claim 16, wherein the message flow control action further comprises releasing the one or more second messages upon expiration of the specified time and then scanning the one or more second messages for viruses prior to delivery.

18. A method as recited in claim 16, wherein the message flow control action further comprises applying an overflow policy when the quarantine queue is full.

19. A method as recited in claim 18, wherein the overflow policy comprises stripping any attachments from the one or more second messages and then delivering the one or more second messages without the attachments.

20. A method as recited in claim 18, wherein the overflow policy comprises releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

21. A method as recited in claim 18, wherein the overflow policy comprises appending a warning indication to a subject of the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

22. A method as recited in claim 16, further comprising the steps of:

receiving user input requesting deletion of the one or more second messages in the quarantine queue; and

deleting the one or more second messages in the quarantine queue in response to the user input.

23. A method as recited in claim 16, further comprising the steps of:

receiving user input requesting release of the one or more second messages from the quarantine queue; and

releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

24. A method as recited in claim 16, further comprising the steps of:

receiving user input requesting a rescan for virus of a particular second message of the one or more second messages from the quarantine queue; and

based on the particular second message not comprising a virus, releasing the one or more second messages and then scanning the one or more second messages for viruses prior to delivery.

25. A method as recited in claim 1, wherein the message flow control action comprises not delaying delivery of a particular second message because the particular second message is addressed to a recipient for whom message delivery has been specified to performed even if the virus outbreak information indicates initiation of a virus attack.

26. A method, comprising the computer-implemented steps of:

receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses;

in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses, and determining that the one or more first messages do comprise one or more viruses;

wherein the method is performed by one or more processors.

27. A method as recited in claim 26, wherein the file type is any of EXE, ZIP, COM, SCR, BAT, and PIF.

28. A method as recited in claim 26, wherein receiving one or more sets of message information comprises receiving at least one set of message information from a spamtrap.

29. A method as recited in claim 26, wherein receiving one or more sets of message information comprises receiving, from one or more spamtraps, one or more counts of messages that are suspected to be with computer viruses, wherein the messages were determined by the virus-check component as not comprising a virus.

30. A method as recited in claim 26, wherein the virus outbreak information indicates initiation of a virus attack when the virus outbreak information satisfies a specified relationship with a specified threshold.

31. A method as recited in claim 26, wherein for each of a plurality of file attachment types of the one or more first messages to result in generating a plurality of percent-of-normal virus score values respectively associated with each of the plurality of file attachment types.

32. A method as recited in claim 31, further comprising computing an average of all the plurality of percent-of-normal virus score values to create an overall percent-of-normal value, and mapping the overall percent-of-normal value to the range of virus score values, to result in creating a particular virus score value for a particular file attachment type.

33. A method, comprising the computer-implemented steps of:

receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses;

in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses; and

in response to the determining that the one or more first messages do comprise one or more viruses, performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as said first message;

wherein the method is performed by one or more processors.

34. The method of claim 33, wherein said one or more first messages are suspected to be associated with computer viruses if the one or more first messages include one or more of the following:

(a) an Internet Protocol (IP) address associated with the sender of said message,

(b) a number of hops taken by said message prior to receipt,

(c) an amount of aggregated data associated with said sender of said message, and

(d) a mime structure associated with said message.

35. A non-transitory machine-readable storage medium storing one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to perform:

receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses; and

in response to determining that the one or more first message do comprise one or more viruses, performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as the one or more first messages.

36. An apparatus, comprising:

one or more processors;

means for receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

means for sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

means for receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses;

means for determining that the one or more first messages do comprise one or more viruses in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values; and

means for performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as the one or more first messages in response to the determining that the one or more first messages do comprise one or more viruses.

37. An apparatus, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to perform;

receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses;

sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses;

receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses;

in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses; and

in response to the determining that the one or more first messages do comprise one or more viruses, performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as the one or more first messages.