Monitoring electronic mail message digests

• US 7,801,960 B2
• Filed: 08/29/2001
• Issued: 09/21/2010
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Clearswift Limited (Government of Switzerland)
• Original Assignee: Clearswift Limited (Government of Switzerland)
• Inventors: Hockey, Alyn
• Primary Examiner(s): Follansbee; John
• Assistant Examiner(s): Daftuar; Saket K
• Application Number:
  US10/362,840
• Publication Number:
  US 20040064515A1
• Time in Patent Office: 3,310 Days
• Field of Search: 709217-219, 709/227, 709/229, 709/206, 707/104.1, 707/10, 707/999.001, 707/999.01, 707/999.107
• US Class Current: 709/206
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

A method for monitoring electronic mail messages, each mail message comprising header information and a main body, particularly for protection against virus attacks and unsolicited commercial email (UCE). The method comprises generating a summary digest of only the subject line and the message content of the main body, wherein the message content may comprise textual content and/or attached files. The generated summary digest is stored in a memory, and compared with existing summary digests stored in memory. If the number of matches exceeds a threshold value, an alert signal is raised and appropriate action initiated. A timestamp may be stored with each summary digest, together with sender/recipient details and the internet protocol (IP) address of origin, to aid detection of the originator of the message.

Claims

1. A method for monitoring electronic mail messages comprising:

receiving at a computer an electronic mail message comprising message content and header information, wherein said header information consists of subject header information and non-subject header information;

generating a message digest from only the subject header information and the message content of the e-mail message;

using an algorithm executed by the computer to generate a characteristic numerical representation of at least a part of said message digest, wherein the message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

storing said generated characteristic numerical representation in a memory of the computer;

comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory;

if said characteristic numerical representation matches a previously-stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation;

determining that said received electronic mail message is an unwanted message if the incremented count value associated with said characteristic numerical representation matches a predetermined number; and

determining an originator of said received electronic mail message if it is determined that said received electronic mail message is an unwanted message.

2. The method of claim 1, wherein the step of using an algorithm to generate comprises generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

3. The method of claim 1, wherein the step of using an algorithm to generate comprises generating a characteristic numerical representation of at least textual content in said message content.

4. The method of claim 1, wherein said step of using an algorithm to generate comprises generating a characteristic numerical representation of at least attached files in said message content.

5. The method of claim 1, wherein said storing further comprises storing a timestamp of said electronic mail message.

6. The method of claim 1, wherein the storing further comprises storing the internet protocol address of origin of said electronic mail message.

7. The method of claim 1, wherein the storing further comprises storing header information of said electronic mail message.

8. The method of claim 7, wherein the storing said generated characteristic numerical representation in memory further comprises storing message source and destination details.

9. The method of claim 1, wherein the message digest is generated using a message digest-5 algorithm.

10. The method of claim 1, wherein the message digest is generated using a secure hash algorithm-1 algorithm.

11. The method of claim 1, further comprising comparing said count value with a predetermined threshold.

12. The method of claim 11, wherein said predetermined threshold is determined based on said header information.

13. The method of claim 11, further comprising, if said count value exceeds said predetermined threshold, raising an alert.

14. The method of claim 13, wherein said alert is determined based on said header information.

15. The method of claim 13, wherein said alert comprises a marker prefixed to the subject line of the message.

16. The method of claim 13, wherein said alert comprises delivering a fixed portion of said message.

17. The method of claim 13, wherein said alert comprises delivering an audit notification to the recipient.

18. The method of claim 13, wherein said alert comprises deleting said message.

19. The method of claim 13, wherein said alert comprises deleting a file attachment from the message.

20. The method of claim 1, further comprising allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in the memory.

21. The method of claim 1, wherein said characteristic numerical representation is stored in cache memory.

22. The method of claim 21, wherein said cache memory is periodically copied to a storage means.

89. A method as claimed in claim 1, wherein the step of determining the originator of the received electronic mail message comprises:

examining the characteristic numerical representations stored in the memory to determine a sender of a first message having a characteristic numerical representation matching the characteristic numerical representation of the received electronic mail message.

23. A software product stored on a non-transitory computer storage medium for use in a server or organization'"'"'s mail transfer agent, for monitoring electronic mail messages, the software containing code for:

receiving an electronic mail message comprising message content and header information, wherein said header information consists of subject header information and non-subject header information;

generating a message digest from only the subject header information and the message content of the e-mail message;

using an algorithm to generate a characteristic numerical representation of at least a part of said message digest, wherein the message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

storing said generated characteristic numerical representation in a memory;

comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory;

if said characteristic numerical representation matches a previously stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation to determine whether said received electronic mail message is an unwanted message if the incremented count value associated with said characteristic numerical representation matched a predetermined number; and

determining an originator of said received electronic mail message if it is determined that said received electronic mail message is an unwanted message.

25. The software product of claim 23, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

26. The software product of claim 23, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least textual content in said message content.

27. The software product of claim 23, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least attached files in said message content.

28. The software product of claim 23, wherein the code for storing further comprises code for storing a timestamp of said electronic mail message.

29. The software product of claim 23, wherein the code for storing further comprises code for storing the internet protocol address of origin of said electronic mail message.

30. The software product of claim 23, wherein said code for storing further comprises code for storing header information of said electronic mail message.

31. The software product of claim 23, wherein said code for storing further comprises code for storing message source and destination details.

32. The software product of claim 23, wherein said message digest is generated using a message digest-5 algorithm.

33. The software product of claim 23, wherein said message digest is generated using a secure hash algorithm-1 algorithm.

34. The software product of claim 23, further comprising code for comparing said count value with a predetermined threshold.

35. The software product of claim 34, wherein said predetermined threshold is determined based on said header information.

36. The software product of claim 34, further comprising, if said count value exceeds said predetermined threshold, code for raising an alert.

37. The software product of claim 36, wherein said alert is determined based on said header information.

38. The software product of claim 36, wherein said alert comprises a marker prefixed to the subject line of the message.

39. The software product of claim 36, wherein said alert comprises delivering a fixed portion of said message.

40. The software product of claim 36, wherein said alert comprises delivering an audit notification to the recipient.

41. The software product of claim 36, wherein said alert comprises deleting said message.

42. The software product of claim 36, wherein said alert comprises deleting a file attachment from the message.

43. The software product of claim 23, further comprising code for allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

44. The software product of claim 23, wherein said characteristic numerical representation is stored in cache memory.

45. The software product of claim 44, wherein said cache memory is periodically copied to a storage means.

90. The software product of claim 23, wherein the code for determining the originator of the received electronic mail message comprises:

examining the characteristic numerical representations stored in the memory to determine a sender of a first message having a characteristic numerical representation matching the characteristic numerical representation of the received electronic mail message.

24. A software product stored on a non-transitory computer storage medium for use in a client'"'"'s mail user agent, for monitoring electronic mail messages, the software containing code for:

receiving an electronic mail message comprising message content and header information, wherein said header information consists of subject header information and non-subject header information;

generating a message digest from only the subject header information and the message content of the e-mail message;

using an algorithm to generate a characteristic numerical representation of at least a part of said message digest, wherein the message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

storing said generated characteristic numerical representation in a memory;

comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory;

if said characteristic numerical representation matches a previously-stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation;

determining that said received electronic mail message is an unwanted message if the incremented count value associated with said characteristic numerical representation matches a predetermined number; and

determining an originator of said received electronic mail message if it is determined that said received electronic mail message is an unwanted message.

68. The software product of claim 24, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

69. The software product of claim 24, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least textual content in said message content.

70. The software product of claim 24, wherein said code for using an algorithm to generate comprises code for generating a characteristic numerical representation of at least attached files in said message content.

71. The software product of claim 24, wherein the code for storing further comprises code for storing a timestamp of said electronic mail message.

72. The software product of claim 24, wherein the code for storing further comprises code for storing the internet protocol address of origin of said electronic mail message.

73. The software product of claim 24, wherein said code for storing further comprises code for storing header information of said electronic mail message.

74. The software product of claim 24, wherein said code for storing further comprises code for storing message source and destination details.

75. The software product of claim 24, wherein said message digest is generated using a message digest-5 algorithm.

76. The software product of claim 24, wherein said message digest is generated using a secure hash algorithm-1 algorithm.

77. The software product of claim 24, further comprising code for comparing said count value with a predetermined threshold.

78. The software product of claim 77, wherein said predetermined threshold is determined based on said header information.

79. The software product of claim 77, further comprising, if said count value exceeds said predetermined threshold, code for raising an alert.

80. The software product of claim 79, wherein said alert is determined based on said header information.

81. The software product of claim 79, wherein said alert comprises a marker prefixed to the subject line of the message.

82. The software product of claim 79, wherein said alert comprises delivering a fixed portion of said message.

83. The software product of claim 79, wherein said alert comprises delivering an audit notification to the recipient.

84. The software product of claim 79, wherein said alert comprises deleting said message.

85. The software product of claim 79, wherein said alert comprises deleting a file attachment from the message.

86. The software product of claim 24, further comprising code for allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

87. The software product of claim 24, wherein said characteristic numerical representation is stored in cache memory.

88. The software product of claim 87, wherein said cache memory is periodically copied to a storage means.

91. The software product of claim 24, wherein the code for determining the originator of the received electronic mail message comprises:

examining the characteristic numerical representations stored in the memory to determine a sender of a first message having a characteristic numerical representation matching the characteristic numerical representation of the received electronic mail message.

46. A computer system for monitoring electronic mail messages comprising:

means for receiving an electronic mail message comprising message content and header information, wherein said header information consists of subject header information and non-subject header information;

means for generating a message digest from only the subject header information and the message content of the e-mail message;

an algorithm for generating a characteristic numerical representation of at least a part of said message digest, wherein said message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

a memory for storing said generated characteristic numerical representation;

means for comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory;

means for, if said characteristic numerical representation matches a previously stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation;

means for determining whether said received electronic mail message is an unwanted message if the incremented count value associated with said characteristic numerical representation matches a predetermined number; and

means for determining an originator of said received electronic mail message if it is determined that said received electronic mail message is an unwanted message.

47. The computer system of claim 46, wherein said means for generating comprises means for generating a characteristic numerical representation of at least a part of said message content and of said subject header information.

48. The computer system of claim 46, wherein said means for generating comprises means for generating a characteristic numerical representation of at least textual content in said message content.

49. The computer system of claim 47, wherein said means for generating comprises means for generating a characteristic numerical representation of at least attached files in said message content.

50. The computer system of claim 46, wherein said memory further comprises means for storing a timestamp of said electronic mail message.

51. The computer system of claim 46, wherein said memory further comprises means for storing the internet protocol address of origin of said electronic mail message.

52. The computer system of claim 46, wherein said memory further comprises means for storing header information of said electronic mail message.

53. The computer system of claim 46, wherein said memory further comprises means for storing message source and destination details.

54. The computer system of claim 46, wherein said message digest is generated using a message digest-5 algorithm.

55. The computer system of claim 46, wherein said message digest is generated using a secure hash algorithm-1 algorithm.

56. The computer system of claim 46, further comprising means for comparing said count value with a predetermined threshold.

57. The computer system of claim 56, wherein said predetermined threshold is determined based on said header information.

58. The computer system of claim 56, further comprising means for raising an alert if said count value exceeds said predetermined threshold.

59. The computer system of claim 58, wherein said alert is determined based on said header information.

60. The computer system of claim 58, wherein said alert comprises a marker prefixed to the subject line of the message.

61. The computer system of claim 58, wherein said alert comprises means for delivering a fixed portion of said message.

62. The computer system of claim 58, wherein said alert comprises delivering an audit notification to the recipient.

63. The computer system of claim 58, wherein said alert comprises deleting said message.

64. The computer system of claim 58, wherein said alert comprises deleting a file attachment from said message.

65. The computer system of claim 46, further comprising means for allowing said message to be delivered if said characteristic numerical representation matches an approved characteristic numerical representation stored in memory.

66. The computer system of claim 46, wherein said characteristic numerical representation is stored in cache memory.

67. The computer system of claim 66, wherein said cache memory is periodically copied to a storage means.

92. The computer system of claim 46, wherein the means for determining the originator of the received electronic mail message comprises:

means for examining the characteristic numerical representations stored in the memory to determine a sender of a first message having a characteristic numerical representation matching the characteristic numerical representation of the received electronic mail message.

93. A method for monitoring electronic mail messages comprising:

receiving at a computer an electronic mail message intended for a recipient, the message comprising message content and header information, wherein the header information consists of subject header information and non-subject header information;

generating a message digest from only the subject header information and the message content of the e-mail message;

using an algorithm executed by the computer to generate a characteristic numerical representation of at least a part of said message digest, wherein the message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

storing said generated characteristic numerical representation in a memory of the computer;

comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory

if said characteristic numerical representation matches a previously-stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation;

determining that the received electronic mail message is an unwanted message if the incremented count value associated with said characteristic numerical representation matches a predetermined number; and

forwarding a condensed form of the message and an audit notification to the recipient, if it is determined that the received electronic mail message is an unwanted message.

94. A method for monitoring electronic mail messages comprising:

receiving at a computer an electronic mail message comprising message content and header information, wherein said header information consists of subject header information and non-subject header information;

generating a message digest from only the subject header information and the message content of the e-mail message;

generating, using the computer, a characteristic numerical representation of at least a part of said message digest, wherein the message digest is generated using a message digest algorithm, and wherein the message digest algorithm is a hash algorithm;

storing said generated characteristic numerical representation in a memory of the computer;

comparing said characteristic numerical representation with each characteristic numerical representation stored in the memory;

if said characteristic numerical representation matches a previously-stored characteristic numerical representation, incrementing a count value associated with said characteristic numerical representation.