Analyzing traffic patterns to detect infectious messages

• US 20080134336A1
• Filed: 10/29/2007
• Published: 06/05/2008
• Est. Priority Date: 07/13/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: MailFrontier Incorporated (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Rihn, Jennifer
• Granted Patent: US 8,122,508 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Managing electronic messages comprises receiving a message, forwarding the message, determining that the forwarded message is infectious after the message has been forwarded and preventing the infectious forwarded message from spreading.

Claims

1-20. -20. (canceled)

21. A method of detecting a malicious message in a stream of incoming messages, the method comprising:

creating a message identifier associated with an incoming message at a time of receipt of the incoming message;

calculating a probability that the incoming message is malicious;

calculating a traffic pattern variable associated with traffic on a network at the time of receipt of the message;

establishing a traffic pattern for the stream of incoming messages, the traffic pattern describing a variation over time of a plurality of message identifiers, probabilities that incoming messages are malicious, and associated traffic pattern variables;

monitoring the traffic pattern to establish a threshold, the threshold describing a range of expected variation of the traffic pattern; and

detecting a variation in the traffic pattern in excess of the established threshold, wherein the variation is indicative of a malicious message in the stream of incoming messages.

22. The method of claim 21, wherein monitoring the traffic pattern includes monitoring a global traffic pattern.

23. The method of claim 21, wherein monitoring the traffic pattern includes monitoring a local traffic pattern.

24. The method of claim 21, wherein monitoring the traffic pattern includes associating a pattern probability with the traffic pattern, the pattern probability describing a probability that the variation in the traffic pattern exceeds the threshold.

25. The method of claim 21, in which the message identifier includes a file type of an attachment to the message.

26. The method of claim 21, wherein calculating the probability that the incoming message is malicious includes evaluating a traffic pattern associated with the prior receipt of messages having similar probabilities.

27. The method of claim 21, wherein calculating the probability that the incoming message is malicious includes evaluating a traffic pattern associated with the prior receipt of messages having similar message identifiers.

28. The method of claim 21, wherein calculating the probability that the incoming message is malicious includes evaluating a traffic pattern associated with the prior receipt of messages having similar times of receipt.

29. The method of claim 21, wherein calculating the probability that the incoming message is malicious includes evaluating a traffic pattern associated with the prior receipt of messages having similar traffic pattern variables.

30. A computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method of detecting a malicious message in a stream of incoming messages, the method comprising:

creating a message identifier associated with an incoming message at a time of receipt of the incoming message;

calculating a probability that the incoming message is malicious;

calculating a traffic pattern variable associated with traffic on a network at the time of receipt of the message;

establishing a traffic pattern for the stream of incoming messages, the traffic pattern describing a variation over time of a plurality of message identifiers, probabilities that incoming messages are malicious, and associated traffic pattern variables;

monitoring the traffic pattern to establish a threshold, the threshold describing a range of expected variation of the traffic pattern; and

detecting a variation in the traffic pattern in excess of the established threshold, wherein the variation is indicative of a malicious message in the stream of incoming messages.