Identifying malware infected reply messages
View Patent ↗A technique for identifying reply mailer computer program viruses detects whether a reply message is generated in less than a threshold reply time and whether or not the reply message includes an attachment. The generation of a reply message in less than a threshold reply time and including an attachment is deemed indicative of an infected reply message and accordingly that message will be quarantined, deleted, disinfected or the like. The mail server using the present technique maintains a temporary log of email messages sent indicating the sender, the recipient, and the time of sending. This log is used to identify replies and determine whether or not those replies have been received in less than the reply threshold time.
1. A recording medium, including at least one of a random access memory, a read only memory and a hard disk drive, encoded with a computer program product executable by a processor of a computer for controlling the computer to identify a malware infected message, said computer program product comprising:
reference event logging code operable to log a reference event associated with a corresponding originating message;
reply time detecting code operable to detect a reply email message generated in less than a threshold reply time from said reference event associated with said corresponding originating message to which said reply email message is a reply;
attachment status detecting code operable to detect an attachment status of said reply email message matching a trigger attachment status;
infected message identifying code operable to identify said reply email message as a malware infected message when said reply email message was generated in less than said threshold reply time and said reply email message has an attachment status matching said trigger attachment status; and
performing code operable to perform an action in response to said identification of said reply email message as said malware infected message.
2. A computer program product as claimed in claim 1 , wherein said reference event is sending of said originating message.
3. A computer program product as claimed in claim 1 , wherein said reference event is reading of said originating message.
4. A computer program product as claimed in claim 1 , wherein said trigger attachment status is presence of an attachment with said reply email message.
5. A computer program product as claimed in claim 1 , wherein said trigger attachment status is an attachment with said reply email message having one or more of:
a size exceeding a threshold attachment size; and
an attachment file type matching one or more trigger file types.
6. A computer program product as claimed in claim 1 , comprising calibrating code operable to calibrate said threshold reply time by:
generating a calibrating originating message;
automatically generating a calibrating reply email message in response to said calibrating originating message; and
measuring a calibration time between generation of said calibrating originating message and generation of said calibrating reply email message.
7. A computer program product as claimed in claim 1 , comprising a threshold reply time logging code operable to store a threshold reply time associated with a user.
8. A computer program product as claimed in claim 7 , wherein said threshold reply time logging code is operable to store a plurality of threshold reply times respectively associated with different message destinations of said originating message.
9. A computer program product as claimed in claim 8 , wherein said different message destinations are different email servers.
10. A computer program product as claimed in claim 1 , wherein said malware infected message is infected with one or more of:
a computer program virus;
a computer program worm; and
a computer program Trojan.
11. A computer-implemented method of identifying a malware infected message, said method comprising:
logging a reference event associated with a corresponding originating message;
detecting a reply email message generated in less than a threshold reply time from said reference event associated with said corresponding originating message to which said reply email message is a reply, utilizing a central processing unit;
detecting an attachment status of said reply email message matching a trigger attachment status;
identifying said reply email message as a malware infected message when said reply email message was generated in less than said threshold reply time and said reply email message has an attachment status matching said trigger attachment status; and
performing an action in response to said identification of said reply email message as said malware infected message.
12. A method as claimed in claim 11 , wherein said reference event is sending of said originating message.
13. A method as claimed in claim 11 , wherein said reference event is reading of said originating message.
14. A method as claimed in claim 11 , wherein said trigger attachment status is presence of an attachment with said reply email message.
15. A method as claimed in claim 11 , wherein said trigger attachment status is an attachment with said reply email message having one or more of:
a size exceeding a threshold attachment size; and
an attachment file type matching one or more trigger file types.
16. A method as claimed in claim 11 , comprising calibrating said threshold reply time by:
generating a calibrating originating message;
automatically generating a calibrating reply email message in response to said calibrating originating message; and
measuring a calibration time between generation of said calibrating originating message and generation of said calibrating reply email message.
17. A method as claimed in claim 11 , comprising storing a threshold reply time associated with a user.
18. A method as claimed in claim 17 , comprising storing a plurality of threshold reply times respectively associated with different message destinations of said originating message.
19. A method as claimed in claim 18 , wherein said different message destinations are different email servers.
20. A method as claimed in claim 11 , wherein said malware infected message is infected with one or more of:
a computer program virus;
a computer program worm; and
a computer program Trojan.
21. Apparatus for identifying a malware infected message, said apparatus comprising:
a central processing unit for carrying out logic, the logic including:
logic for logging a reference event associated with a corresponding originating message;
logic for detecting a reply email message generated in less than a threshold reply time from said reference event associated with said corresponding originating message to which said reply email message is a reply;
logic for detecting an attachment status of said reply email message matching a trigger attachment status;
logic for identifying said reply email message as a malware infected message when said reply email message was generated in less than said threshold reply time and said reply email message has an attachment status matching said trigger attachment status; and
logic for performing an action in response to said identification of said reply email message as said malware infected message.
22. Apparatus as claimed in claim 21 , wherein said reference event is sending of said originating message.
23. Apparatus as claimed in claim 21 , wherein said reference event is reading of said originating message.
24. Apparatus as claimed in claim 21 , wherein said trigger attachment status is presence of an attachment with said reply email message.
25. Apparatus as claimed in claim 21 , wherein said trigger attachment status is an attachment with said reply email message having one or more of:
a size exceeding a threshold attachment size; and
an attachment file type matching one or more trigger file types.
26. Apparatus as claimed in claim 21 , comprising calibrating logic operable to calibrate said threshold reply time by:
generating a calibrating originating message;
automatically generating a calibrating reply email message in response to said calibrating originating message; and
measuring a calibration time between generation of said calibrating originating message and generation of said calibrating reply email message.
27. Apparatus as claimed in claim 21 , comprising a threshold reply time logging logic operable to store a threshold reply time associated with a user.
28. Apparatus as claimed in claim 27 , wherein said threshold reply time logging logic is operable to store a plurality of threshold reply times respectively associated with different message destinations of said originating message.
29. Apparatus as claimed in claim 28 , wherein said different message destinations are different email servers.
30. Apparatus as claimed in claim 21 , wherein said malware infected message is infected with one or more of:
a computer program virus;
a computer program worm; and
a computer program Trojan.
31. A computer program product as claimed in claim 1 , wherein said reference event is stored for a predetermined buffer period in a reference event log which includes a sender, a recipient, and a sending time associated with said corresponding originating message.
32. A computer program product as claimed in claim 31 , wherein said reply email message is determined to be said reply if said reply email message includes a recipient and a sender in said reference event log.
33. A computer program product as claimed in claim 1 , wherein said threshold reply time is recorded for each different server to which said reply email message is addressed.