Managing infectious forwarded messages
First Claim
Patent Images
1. A method of managing electronic messages, comprising:
- receiving over a communications network a first message having a plurality of characteristics;
executing instructions stored in memory, wherein execution of the instructions by a processor;
determines the first message is suspicious based on the characteristics of the first message,stores the characteristics of the first message in memory, andforwards the first message over the network to an email client of a recipient user;
receiving a second message having a plurality of characteristics after the first message has been forwarded over the network to the email client of the recipient user; and
executing instructions stored in memory, wherein execution of the instructions by the processor;
determines the second message is either suspicious or infectious based on the characteristics of the second message;
compares one or more of the characteristics of the second message to one or more of the characteristics of the first message stored in memory;
reclassifies the previously forwarded first message as infectious rather than suspicious after the first message has been forwarded over the network to the email client of the recipient user, wherein reclassification occurs when the comparison determines that the second message and the first message share a predetermined characteristic in common, and wherein the determination exceeds a predetermined threshold of instances in which a suspicious or infectious message was determined to share a predetermined characteristic with the previously forwarded first message; and
prevents the previously forwarded first message from spreading further in the network by instructing the email client of the recipient user to act upon the previously forwarded first message.
23 Assignments
0 Petitions
Accused Products
Abstract
Systems and methods for managing forwarded infectious messages are provided. Managing electronic message comprises receiving a message, forwarding the message, determining that the forwarded message is infectious after the message has been forwarded and preventing the infectious forwarded message from spreading.
-
Citations
20 Claims
-
1. A method of managing electronic messages, comprising:
-
receiving over a communications network a first message having a plurality of characteristics; executing instructions stored in memory, wherein execution of the instructions by a processor; determines the first message is suspicious based on the characteristics of the first message, stores the characteristics of the first message in memory, and forwards the first message over the network to an email client of a recipient user; receiving a second message having a plurality of characteristics after the first message has been forwarded over the network to the email client of the recipient user; and executing instructions stored in memory, wherein execution of the instructions by the processor; determines the second message is either suspicious or infectious based on the characteristics of the second message; compares one or more of the characteristics of the second message to one or more of the characteristics of the first message stored in memory; reclassifies the previously forwarded first message as infectious rather than suspicious after the first message has been forwarded over the network to the email client of the recipient user, wherein reclassification occurs when the comparison determines that the second message and the first message share a predetermined characteristic in common, and wherein the determination exceeds a predetermined threshold of instances in which a suspicious or infectious message was determined to share a predetermined characteristic with the previously forwarded first message; and prevents the previously forwarded first message from spreading further in the network by instructing the email client of the recipient user to act upon the previously forwarded first message. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. An electronic message management system, comprising:
-
a network interface that; receives a first message having a plurality of characteristics over a network, forwards the first message over the network to an email client of a recipient user, and receives a second message having a plurality of characteristics over the network after forwarding the first message; a memory that stores instructions; and a processor coupled to the interface, wherein execution of the instructions stored in the memory by the processor; determines the received first message is suspicious based on the characteristics of the first message, stores the characteristics of the first message in memory, instructs the interface to forward the first message over the network to the email client of the recipient user, determines the received second message is either suspicious or infectious based on the characteristics of the second message, compares one or more of the characteristics of the second message to one or more of the characteristics of the first message stored in memory, reclassifies the previously forwarded first message as infectious rather than suspicious after the first message has been forwarded over the network to the email client of the recipient user, wherein reclassification occurs when the comparison reveals that the second message and the first message share a predetermined characteristic in common, and wherein the determination exceeds a predetermined threshold of instances in which a suspicious or infectious message was determined to share a predetermined characteristic with the previously forwarded first message, and prevents the previously forwarded first message from spreading further in the network by instructing the email client of the recipient user to act upon the previously forwarded first message. - View Dependent Claims (11, 12, 13, 14, 15)
-
-
16. A non-transitory computer readable storage medium having embodied thereon a program, the program executable by a processor to perform a method for detecting infectious messages, the method comprising:
-
receiving over a communications network a first message having a plurality of characteristics; determining the first message is suspicious based on the characteristics of the first message; storing the characteristics of the first message in memory; forwarding the first message over the network to an email client of a recipient user; receiving a second message having a plurality of characteristics after the first message has been forwarded over the network to the email client of the recipient user; determining the second message is either suspicious or infectious based on the characteristics of the second message; comparing one or more of the characteristics of the second message to one or more of the characteristics of the first message stored in memory; reclassifying the previously forwarded first message as infectious rather than suspicious after the first message has been forwarded over the network to the email client of the recipient user, wherein reclassification occurs when the comparison reveals that the second message and the first message share a predetermined characteristic in common, and wherein the determination exceeds a predetermined threshold of instances in which a suspicious or infectious message was determined to share a predetermined characteristic with the previously forwarded first message; and preventing the previously forwarded first message from spreading further in the network by instructing the email client of the recipient user to act upon the previously forwarded first message. - View Dependent Claims (17, 18, 19, 20)
-
Specification