System, method, and computer program product for providing a rating of an electronic message

• US 8,655,959 B2
• Filed: 01/03/2008
• Issued: 02/18/2014
• Est. Priority Date: 01/03/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Yadava, Amit Kumar, Mathur, Asheesh Dayal
• Primary Examiner(s): Donabed, Ninos
• Application Number:
  US11/968,983
• Publication Number:
  US 20130246536A1
• Time in Patent Office: 2,238 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are included for providing a rating of an electronic message to a recipient. In use, an electronic message intended for a recipient is rated. Additionally, the rating and die electronic message are provided to the recipient.

Claims

1. A method, comprising:

receiving an electronic message intended for a recipient;

processing the electronic message;

determining a fingerprint for one or more portions of the electronic message;

comparing the fingerprint with a plurality of predetermined fingerprints that are stored in a database and that are associated with known unwanted data, known unsolicited data, a plurality of uniform resource locators (URLs), and a plurality of known harmful macro-instructions to be executed on a computer, wherein each of the plurality of predetermined fingerprints is assigned a predetermined rating within a predetermined scale indicative of a severity of risk of accessing electronic message content,

wherein the severity of risk indicated by the predetermined rating assigned to each of the plurality of predetermined fingerprints is based upon whether the predetermined fingerprint is associated with known unwanted data, known unsolicited data, a URL, or a known harmful macro-instruction; and

providing a rating for the electronic message if the fingerprint matches at least one of the plurality of predetermined fingerprints, the rating being based upon the predetermined rating assigned to the matching at least one predetermined fingerprint, wherein the rating is provided in conjunction with an icon that indicates whether the electronic message includes the unwanted data, and wherein a different icon is provided to indicate a presence of non-malicious data in the electronic message;

wherein the processing of the electronic message is performed in a virtual environment that includes utilizing a virtual machine, opening an attachment of the electronic message in the virtual environment, identifying results of the opening of the attachment within the virtual environment, and analyzing the results of the opening via a behavioral analysis; and

wherein a predetermined rating assigned to a predetermined fingerprint associated with a known harmful macro-instruction indicates a greater severity of risk than a predetermined rating assigned to a predetermined fingerprint associated with a URL.

2. The method as set forth in claim 1, wherein providing the rating to the recipient includes displaying an icon adjacent to a link to the electronic message.

3. The method as set forth in claim 1, wherein providing the rating to the recipient includes displaying the rating in a window when a cursor is placed over a link to the electronic message.

4. The method as set forth in claim 1, wherein providing the rating to the recipient includes displaying another electronic message containing the rating in a window when the electronic message is selected and prior to opening the electronic message.

5. The method as set forth in claim 1, further comprising scanning an attachment of the electronic message.

6. The method as set forth in claim 5, wherein the electronic message is rated based on the scanning of the attachment.

7. The method as set forth in claim 1, further comprising scanning a message body of the electronic message for one or more keywords.

8. The method as set forth in claim 7, wherein the electronic message is rated based on identification of the one or more keywords in the message body of the electronic message.

9. The method as set forth in claim 1, wherein the rating includes a categorization.

10. The method as set forth in claim 1, wherein one or more additional electronic messages are provided to the recipient based on the rating.

11. The method as set forth in claim 1, wherein an automatic response is initiated if the rating includes a predetermined rating.

12. The method as set forth in claim 1, wherein at least part of the electronic message is sent to the database, based on the rating.

13. The method as set forth in claim 1, wherein the electronic message is rated with a particular rating associated with the at least one of the predetermined fingerprints stored in the database that matches the fingerprint for the one or more portions of the electronic message.

14. The method as set forth in claim 1, wherein the determining of the fingerprint for the one or more portions of the electronic message includes determining a fingerprint for a header of the electronic message.

15. A computer program product embodied on a tangible non-transitory computer readable medium for performing operations on a computer, the operations comprising:

receiving an electronic message intended for a recipient;

processing the electronic message;

determining a fingerprint for one or more portions of the electronic message;

comparing the fingerprint with a plurality of predetermined fingerprints that are stored in a database and that are associated with known unwanted data, known unsolicited data, a plurality of uniform resource locators (URLs), and a plurality of known harmful macro-instructions to be executed on a particular computer, wherein each of the plurality of predetermined fingerprints is assigned a predetermined rating within a predetermined scale indicative of a severity of risk of accessing electronic message content, wherein the severity of risk indicated by the predetermined rating assigned to each of the plurality of predetermined fingerprints is based upon whether the predetermined fingerprint is associated with known unwanted data, known unsolicited data, a URL, or a known harmful macro-instruction; and

providing a rating for the electronic message if the fingerprint matches at least one of the plurality of predetermined fingerprints, the rating being based upon the predetermined rating assigned to the matching at least one predetermined fingerprint, wherein the rating is provided in conjunction with an icon that indicates whether the electronic message includes unwanted data, and wherein a different icon is provided to indicate a presence of non-malicious data in the electronic message;

wherein the processing of the electronic message is performed in a virtual environment that includes utilizing a virtual machine, opening an attachment of the electronic message in the virtual environment, identifying results of the opening of the attachment within the virtual environment, and analyzing the results of the opening via a behavioral analysis; and

wherein a predetermined rating assigned to a predetermined fingerprint associated with a known harmful macro-instruction indicates a greater severity of risk than a predetermined rating assigned to a predetermined fingerprint associated with a URL.

16. A system, comprising:

a processor; and

a memory coupled to the processor, wherein the system is configured for;

receiving an electronic message intended for a recipient;

processing the electronic message by the processor;

determining a fingerprint for one or more portions of the electronic message;

comparing the fingerprint with a plurality of predetermined fingerprints that are stored in a database and that are associated with known unwanted data, known unsolicited data, a plurality of uniform resource locators (URLs), and a plurality of known harmful macro-instructions to be executed on a computer, wherein each of the plurality of predetermined fingerprints is assigned a predetermined rating within a predetermined scale indicative of a severity of risk of accessing electronic message content, wherein the severity of risk indicated by the predetermined rating assigned to each of the plurality of predetermined fingerprints is based upon whether the predetermined fingerprint is associated with known unwanted data, known unsolicited data, a URL, or a known harmful macro-instruction, and

providing a rating for the electronic message if the fingerprint matches at least one of the plurality of predetermined fingerprints, the rating being based upon the predetermined rating assigned to the matching at least one predetermined fingerprint, wherein the rating is provided in conjunction with an icon that indicates whether the electronic message includes unwanted data, and wherein a different icon is provided to indicate a presence of non-malicious data in the electronic message;

wherein the processing of the electronic message is performed in a virtual environment that includes utilizing a virtual machine, opening an attachment of the electronic message in the virtual environment, identifying results of the opening of the attachment within the virtual environment, and analyzing the results of the opening via a behavioral analysis; and

wherein a predetermined rating assigned to a predetermined fingerprint associated with a known harmful macro-instruction indicates a greater severity of risk than a predetermined rating assigned to a predetermined fingerprint associated with a URL.

17. The system as set forth in claim 16, further comprising memory coupled to the processor via a bus.