Scanner-driven email message decomposition

• US 8,560,614 B2
• Filed: 11/29/2006
• Issued: 10/15/2013
• Est. Priority Date: 11/29/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Morrey, Richard
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): MURPHY, CHARLES C
• Application Number:
  US11/605,369
• Publication Number:
  US 20080126493A1
• Time in Patent Office: 2,512 Days
• Field of Search: 726/8, 726/26, 726/24, 726/22, 726/25, 726/23, 726/11, 719/330, 719/328, 719/318, 717/178, 717/173, 717/170, 709/207, 709/206, 709/224, 709/201, 709/246, 709/230, 709/227, 709/223, 709/204, 709/203, 709/205, 707/9, 707/104.1, 707/102, 707/100, 706/55
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method, system, and computer program product for scanning emails by reducing the amount of decomposition processing that is performed to only the minimum necessary to fully scan the emails. This reduces the server resources needed, which improves server throughput and reduces costs. A method for processing email messages comprises the steps of receiving an email message comprising a plurality of items, scanning the email message with at least one scanner software, determining with each of the at least one scanner softwares what items of the plurality of items the email message is to be decomposed into, decomposing the email message to obtain the items determined by each of the at least one scanner software.

Claims

1. A method, comprising:

receiving an email message comprising a plurality of items;

scanning the email message with a plurality of scanner software, which are configured to perform activities that are based on a same decomposition tree used for scanning the e-mail message;

expanding the decomposition tree to satisfy sub-trees for scanners in the plurality of scanner software; and

employing a recursive function that identifies a node in the decomposition tree and a list of scanners with which to scan, wherein;

on the root node of the decomposition tree, the list of scanners comprises the plurality of scanners;

at each iteration of the recursive function, each scanner in the list of scanners is called to perform a scanning operation on the e-mail message and return whether it is satisfied such that it is removed from the list of scanners;

if there are any remaining scanners in the list, the node in the decomposition tree is decomposed; and

the recursive function is complete when the plurality of scanners have been removed from the list of scanners.

2. The method of claim 1, further comprising:

scanning the items obtained by each of the at least one of the plurality of scanner software with that scanner software.

3. The method of claim 2, wherein the determining comprises:

determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

4. The method of claim 1, further comprising:

scanning the items obtained by the at least one of the plurality of scanner software with that scanner software.

5. The method of claim 4, wherein the determining comprises:

determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

6. The method of claim 5, wherein the plurality of scanner software comprise at least one of an anti-virus scanner, an anti-spam scanner, and a bad content scanner.

7. The method of claim 6, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

8. The method of claim 1, wherein the email messages are incoming email messages.

9. The method of claim 1, wherein the email messages are outgoing email messages.

10. The method of claim 1, wherein each of the items obtained from the decomposing of the email message is included as a separate node of a decomposition tree.

11. The method of claim 10, wherein the decomposing of the email message to obtain the items includes a function determining whether a current node of the decomposition tree being processed is a type that is supported by the at least one of the plurality of scanner software, where if the type of the node is supported, the node is scanned, including recursively decomposing the node into at least one additional node of the decomposition tree.

12. The method of claim 1, wherein the email message is decomposed using a decomposition tree.

13. The method of claim 12, wherein each item in the decomposition tree is scanned by the at least one of the plurality of scanner software that is capable of scanning the at least one type of the item.

14. A system, comprising:

a processor; and

a memory element coupled to the processor, wherein the system is configured for;

receiving an email message comprising a plurality of items;

scanning the email message with a plurality of scanner software, which are configured to perform activities that are based on a same decomposition tree used for scanning the e-mail message;

expanding the decomposition tree to satisfy sub-trees for scanners in the plurality of scanner software; and

employing a recursive function that identifies a node in the decomposition tree and a list of scanners with which to scan, wherein;

on the root node of the decomposition tree, the list of scanners comprises the plurality of scanners;

at each iteration of the recursive function, each scanner in the list of scanners is called to perform a scanning operation on the e-mail message and return whether it is satisfied such that it is removed from the list of scanners;

if there are any remaining scanners in the list, the node in the decomposition tree is decomposed; and

the recursive function is complete when the plurality of scanners have been removed from the list of scanners.

15. The system of claim 14, wherein the system is operable such that the items obtained by each of the at least one of the plurality of scanner software are scanned with that scanner software.

16. The system of claim 15, wherein the determining comprises determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

17. The system of claim 14, wherein the system is operable such that the items obtained by the at least one of the plurality of scanner software are scanned with that scanner software.

18. The system of claim 17, wherein the determining comprises the processor for determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

19. The system of claim 18, wherein the plurality of scanner software comprises at least one of an anti-virus scanner, an anti-spam scanner, and a bad content scanner.

20. The system of claim 19, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

21. The system of claim 14, wherein the email messages are incoming email messages.

22. The system of claim 14, wherein the email messages are outgoing email messages.

23. A computer program product embodied on a tangible non-transitory computer readable medium for performing operations, comprising:

receiving an email message comprising a plurality of items;

scanning the email message with a plurality of scanner software, which are configured to perform activities that are based on a same decomposition tree used for scanning the e-mail message;

expanding the decomposition tree to satisfy sub-trees for scanners in the plurality of scanner software; and

employing a recursive function that identifies a node in the decomposition tree and a list of scanners with which to scan, wherein;

on the root node of the decomposition tree, the list of scanners comprises the plurality of scanners;

at each iteration of the recursive function, each scanner in the list of scanners is called to perform a scanning operation on the e-mail message and return whether it is satisfied such that it is removed from the list of scanners;

if there are any remaining scanners in the list, the node in the decomposition tree is decomposed; and

the recursive function is complete when the plurality of scanners have been removed from the list of scanners.

24. The computer program product of claim 23, further comprising computer code for scanning the items obtained by each of the at least one of the plurality of scanner software with that scanner software.

25. The computer program product of claim 24, wherein the determining comprises determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

26. The computer program product of claim 23, further comprising computer code for scanning the items obtained by the at least one of the plurality of scanner software with that scanner software.

27. The computer program product of claim 26, wherein the determining comprises:

determining what items of the plurality of items the email message is to be decomposed into based on items of the plurality of items that the at least one of the plurality of scanner software is capable of scanning.

28. The computer program product of claim 27, wherein the plurality of scanner software comprises at least one of an anti-virus scanner, and anti-spam scanner, and a bad content scanner.

29. The computer program product of claim 28, wherein the plurality of items of the email message comprises at least one of a MIME stream, MIME headers, an HTML item, a ZIP item, a text item, a document, and a list of URLs.

30. The computer program product of claim 23, wherein the email messages are incoming email messages.

31. The computer program product of claim 23, wherein the email messages are outgoing email messages.