Time Zero Detection of Infectious Messages

• US 20080104703A1
• Filed: 10/29/2007
• Published: 05/01/2008
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: MailFrontier Incorporated (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan, Rihn, Jennifer
• Granted Patent: US 8,850,566 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Detecting infectious messages comprises performing an individual characteristic analysis of a message to determine whether the message is suspicious, determining whether a similar message has been noted previously in the event that the message is determined to be suspicious, classifying the message according to its individual characteristics and its similarity to the noted message in the event that a similar message has been noted previously.

Claims

1. A method of detecting infectious messages, comprising:

performing an individual characteristic analysis of a message to determine whether the message is suspicious;

in the event that the message is determined to be suspicious, determining whether a similar message has been noted previously;

in the event that a similar message has been noted previously, classifying the message according to its individual characteristics and its similarity to the noted message.

2-20. -20. (canceled)