ELECTRONIC MESSAGE MANAGER SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR SCANNING AN ELECTRONIC MESSAGE FOR UNWANTED CONTENT AND ASSOCIATED UNWANTED SITES

• US 20140096243A1
• Filed: 11/19/2013
• Published: 04/03/2014
• Est. Priority Date: 04/30/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Christopher S. Bolin, George L. Heron, Paul Nicholas Gartside
• Inventors: Heron, George L., Bolin, Christopher S., Gartside, Paul Nicholas
• Granted Patent: US 9,037,668 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A system, method, and computer program product are provided for scanning an electronic message for unwanted content and associated unwanted sites in response to a request. In use, a request is received via a network to scan an electronic message prior to opening the electronic message, utilizing an electronic message manager. In addition, the electronic message is scanned for unwanted content and associated unwanted sites, in response to the request. Further, a response to the request is sent via the network.

Claims

1-23. -23. (canceled)

24. A method, comprising:

receiving, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

analyzing the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content; and

sending a response to the request to a client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.

25. The method of claim 24, wherein the electronic message is analyzed by performing a comparison of the electronic message with known data stored in a database.

26. The method of claim 25, wherein the known data includes at least one of known clean data and known unwanted data.

27. The method of claim 25, wherein the database of known data is updated based on the analyzing.

28. The method of claim 24, wherein the response prompts a display of a notification to a user.

29. The method of claim 24, wherein the request to scan the electronic message is sent by a user in response to a determination that the electronic message has been intercepted.

30. The method of claim 24, wherein the information associated with the electronic message further includes at least one of a source of the electronic message, a path by which the electronic message is communicated, a behavior of the electronic message, and a reputation associated with the electronic message.

31. A computer-readable medium comprising one or more instructions that when executed on a processor configure the processor to:

receive, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

analyze the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content; and

send a response to the request to a client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.

32. The computer-readable medium of claim 31, wherein the request is generated by a plug-in installed at the client.

33. The computer-readable medium of claim 31, wherein the request is generated automatically in response to a user attempting to open the electronic message.

34. The computer-readable medium of claim 31, wherein the electronic message is analyzed by performing a comparison of the electronic message with known data stored in a database.

35. The computer-readable medium of claim 34, wherein the known data includes at least one of known clean data and known unwanted data.

36. The computer-readable medium of claim 34, wherein the response is sent in response to the comparison resulting in a match.

37. The computer-readable medium of claim 34, wherein the response is sent in response to the analysis indicating that the electronic message is clean.

38. The computer-readable medium of claim 34, wherein the database of known data is updated based on the analyzing.

39. The computer-readable medium of claim 31, wherein the response prompts a display of a notification to a user.

40. The computer-readable medium of claim 31, wherein the unwanted content includes malware.

41. The computer-readable medium of claim 31, wherein the unwanted content includes at least one unwanted site.

42. The computer-readable medium of claim 41, wherein the at least one site includes at least one of a phishing site and a site including unwanted content.

43. The computer-readable medium of claim 31, wherein the request is generated by a preview pane of an electronic message manager.

44. The computer-readable medium of claim 31, wherein the electronic message is downloaded to an electronic message manager, and the request to scan the electronic message is initiated at a client after downloading the electronic message and prior to opening the downloaded electronic message.

45. The computer-readable medium of claim 31, wherein the request to scan the electronic message is sent by a user in response to a determination that the electronic message has been intercepted.

46. The computer-readable medium of claim 31, wherein the information associated with the electronic message further includes at least one of a source of the electronic message, a path by which the electronic message is communicated, a behavior of the electronic message, and a reputation associated with the electronic message.

48. The system of claim 46, wherein the server stores results of scanning electronic messages transmitted by a plurality of clients in a database, and the analyzing utilizes the database.

47. A system, comprising:

an application program installed on a client for transmitting, via a network, a request to scan an electronic message prior to opening the electronic message, the request including at least a portion of the electronic message and information associated with the electronic message, wherein the information includes an indication of a number of times an instance of the electronic message has been previously sent to users;

a server in communication with the client via the network for receiving the request, analyzing the received portion of the electronic message and the received information associated with the electronic message to determine whether the electronic message includes unwanted content, and sending a response to the request to the client via the network, wherein the response indicates whether the electronic message is determined to include unwanted content.