Electronic message manager system, method, and computer program product for scanning an electronic message for unwanted content and associated unwanted sites

• US 9,037,668 B2
• Filed: 11/19/2013
• Issued: 05/19/2015
• Est. Priority Date: 04/30/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gartside, Paul Nicholas, Heron, George L., Bolin, Christopher S.
• Primary Examiner(s): Towfighi, Afshawn
• Application Number:
  US14/083,546
• Publication Number:
  US 20140096243A1
• Time in Patent Office: 546 Days
• Field of Search: None
• US Class Current: 709/206
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A system, method, and computer program product are provided for scanning an electronic message for unwanted content and associated unwanted sites in response to a request. In use, a request is received via a network to scan an electronic message prior to opening the electronic message, utilizing an electronic message manager. In addition, the electronic message is scanned for unwanted content and associated unwanted sites, in response to the request. Further, a response to the request is sent via the network.

Claims

1. A method, comprising:

receiving, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

analyzing the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content; and

sending a response to the request to a client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.

2. The method of claim 1, wherein the electronic message is analyzed by performing a comparison of the electronic message with known data stored in a database.

3. The method of claim 2, wherein the known data includes at least one of known clean data and known unwanted data.

4. The method of claim 2, wherein the database of known data is updated based on the analyzing.

5. The method of claim 1, wherein the response prompts a display of a notification to a user.

6. The method of claim 1, wherein the request to scan the electronic message is sent by a user in response to a determination that the electronic message has been intercepted.

7. The method of claim 1, wherein the information associated with the electronic message further includes at least one of a source of the electronic message, a path by which the electronic message is communicated, a behavior of the electronic message, and a reputation associated with the electronic message.

8. A non-transitory computer-readable medium comprising one or more instructions that when executed on a processor configure the processor to:

receive, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

analyze the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content; and

send a response to the request to a client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.

9. The non-transitory computer-readable medium of claim 8, wherein the request is generated by a plug-in installed at the client.

10. The non-transitory computer-readable medium of claim 8, wherein the request is generated automatically in response to a user attempting to open the electronic message.

11. The non-transitory computer-readable medium of claim 8, wherein the electronic message is analyzed by performing a comparison of the electronic message with known data stored in a database.

12. The non-transitory computer-readable medium of claim 11, wherein the known data includes at least one of known clean data and known unwanted data.

13. The non-transitory computer-readable medium of claim 11, wherein the response is sent in response to the comparison resulting in a match.

14. The non-transitory computer-readable medium of claim 11, wherein the response is sent in response to the analysis indicating that the electronic message is clean.

15. The non-transitory computer-readable medium of claim 11, wherein the database of known data is updated based on the analyzing.

16. The non-transitory computer-readable medium of claim 8, wherein the response prompts a display of a notification to a user.

17. The non-transitory computer-readable medium of claim 8, wherein the unwanted content includes malware.

18. The non-transitory computer-readable medium of claim 8, wherein the unwanted content includes at least one unwanted site.

19. The non-transitory computer-readable medium of claim 18, wherein the at least one site includes at least one of a phishing site and a site including unwanted content.

20. The non-transitory computer-readable medium of claim 8, wherein the request is generated by a preview pane of an electronic message manager.

21. The non-transitory computer-readable medium of claim 8, wherein the electronic message is downloaded to an electronic message manager, and the request to scan the electronic message is initiated at a client after downloading the electronic message and prior to opening the downloaded electronic message.

22. The non-transitory computer-readable medium of claim 8, wherein the request to scan the electronic message is sent by a user in response to a determination that the electronic message has been intercepted.

23. The non-transitory computer-readable medium of claim 8, wherein the information associated with the electronic message further includes at least one of a source of the electronic message, a path by which the electronic message is communicated, a behavior of the electronic message, and a reputation associated with the electronic message.

25. The system of claim 23, wherein the server device stores results of scanning electronic messages transmitted by a plurality of clients in a database, and the analyzing utilizes the database.

24. A system, comprising:

an application program installed on a client for transmitting, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

a server device in communication with the client via the network for receiving the request, analyzing the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content, and sending a response to the request to the client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.