Detecting malware carried by an e-mail message
View Patent ↗An anti-virus system provider distributes an e-mail identifying content filtering rule seeking to identify e-mail messages suspected of containing an item of malware from a central source ( 20 ) to users ( 2 ). This distribution may be by an e-mail message itself which is appropriately signed and encrypted. At the user system ( 2 ), the received e-mail identifying content filtering rule is extracted from the e-mail message and added to the content filtering rules ( 18 ) being applied within that user system. In this way, malware which is distributed by e-mail may be identified by characteristics of its carrier e-mail rather than characteristics of the malware itself which not yet have been properly analyzed or the mechanisms for detecting such characteristics of the malware itself not yet put in place.
1. A method of detecting an item of malware carried by an e-mail message, said method comprising the steps of:
receiving from a remote source an e-mail identifying content filtering rule
defining one or more characteristics of an e-mail message indicative of said e-mail message carrying said item of malware;
receiving a target e-mail message;
applying said e-mail identifying content filtering rule to said target e-mail message to detect if said target e-mail message has said one or more characteristics; and
if said target e-mail message has said one or more characteristics, then triggering a suspected malware found action;
wherein detection action of said e-mail identifying content filtering rule is reported with a detection activity report to a remote report collector;
wherein said detection activity report includes an indication of whether a target e-mail message which has said one or more characteristics was inbound to a predetermined computer network or outbound from said predetermined computer network;
wherein said suspected malware found action includes suspending delivery of said target e-mail message;
wherein said one or more characteristics include one or more of:
a sender field matching predetermined characteristics;
a relay field matching predetermined characteristics;
a subject field matching predetermined characteristics;
a body message matching predetermined characteristics;
an attachment having a file type matching predetermined characteristics;
an attachment having a filename matching predetermined characteristics; and
Simple Mail Transfer Protocol (SMTP) structure matching predetermined characteristics;
wherein said e-mail identifying content filtering rule is auto-rescinding in response to detection of predetermined conditions.
2. A method as claimed in claim 1 , wherein said e-mail identifying content filtering rule is received from said remote source within a rule transmitting e-mail message.
3. A method as claimed in claim 1 , wherein said e-mail identifying content filtering rule is received from said remote source by one of a multicast from said remote source and a download from said remote source.
4. A method as claimed in claim 2 , wherein said rule transmitting e-mail message includes an electronic signature for authentication and said electronic signature is verified before said e-mail identifying content filtering rule is used.
5. A method as claimed in claim 2 , wherein said rule transmitting e-mail message is encrypted and said rule transmitting e-mail message is decrypted before said e-mail identifying content filtering rule is used.
6. A method as claimed in claim 1 , wherein said detection activity report includes a sample of said item of malware.
7. A method as claimed in claim 1 , wherein a target e-mail message for which delivery has been suspended may be released for delivery at a later time.
8. A method as claimed in claim 1 , wherein said one or more characteristics include one or more characteristics of SMTP data forming said target e-mail message.
9. A method as claimed in claim 1 , wherein a received e-mail identifying content filtering rule is one of automatically made active or made active once confirmed for use by a user input.
10. A method as claimed in claim 9 , wherein a priority level associated with said received e-mail identifying content filtering rule and predetermined user specified parameters determine if said received e-mail identifying content filtering rule is automatically made active or made active once confirmed for use by a user input.
11. A method as claimed in claim 1 , further comprising the steps of:
receiving from a remote source a rule altering message; and
in response to receipt of said rule altering message altering said e-mail identifying content filtering rule.
12. A method as claimed in claim 11 , wherein a received rule altering message is one of automatically responded to or responded to once confirmed by a user input.
13. A method as claimed in claim 11 , wherein said rule altering message is one of a rule rescinding message which serves to rescind said e-mail identifying content filtering rule and a rule superseding message which serves to supersede said e-mail identifying content filtering rule.
14. A method as claimed in claim 1 , wherein if the indication indicates that the target e-mail message was outbound from said predetermined computer network, said predetermined computer network is considered already infected, and is given a high priority for the eventual distribution of an updated virus definition data.
15. A method as claimed in claim 1 , wherein the received e-mail identifying content filtering rule specifies detection activity report generation for detection activity reports to indicate a number of triggers of the rule that have taken place over at least one predetermined time period.
16. A method of detecting an item of malware carried by an e-mail message, said method comprising the steps of:
receiving from a remote source an e-mail identifying content filtering rule
defining one or more characteristics of an e-mail message indicative of said e-mail message carrying said item of malware;
receiving a target e-mail message;
applying said e-mail identifying content filtering rule to said target e-mail message to detect if said target e-mail message has said one or more characteristics; and
if said target e-mail message has said one or more characteristics, then triggering a suspected malware found action;
wherein detection action of said e-mail identifying content filtering rule is reported with a detection activity report to a remote report collector;
wherein said detection activity report includes an indication of whether a target e-mail message which has said one or more characteristics was inbound to a predetermined computer network or outbound from said predetermined computer network;
wherein said suspected malware found action includes suspending delivery of said target e-mail message;
wherein a target e-mail message for which delivery has been suspended may be released to be rescanned by one or more content filtering rules at a later time;
wherein said one or more characteristics include one or more of:
a sender field matching predetermined characteristics;
a relay field matching predetermined characteristics;
a subject field matching predetermined characteristics;
a body message matching predetermined characteristics;
an attachment having a file type matching predetermined characteristics;
an attachment having a filename matching predetermined characteristics; and
SMTP structure matching predetermined characteristics.
17. A method as claimed in claim 16 , wherein said e-mail identifying content filtering rule is received from said remote source within a rule transmitting e-mail message.
18. A method as claimed in claim 16 , wherein said e-mail identifying content filtering rule is received from said remote source by one of a multicast from said remote source and a download from said remote source.
19. A method as claimed in claim 17 , wherein said rule transmitting e-mail message includes an electronic signature for authentication and said electronic signature is verified before said e-mail identifying content filtering rule is used.
20. A method as claimed in claim 17 , wherein said rule transmitting e-mail message is encrypted and said rule transmitting e-mail message is decrypted before said e-mail identifying content filtering rule is used.
21. A method as claimed in claim 16 , wherein said detection activity report includes a sample of said item of malware.
22. A method as claimed in claim 16 , wherein a target e-mail message for which delivery has been suspended may be released for delivery at a later time.
23. A method as claimed in claim 16 , wherein said one or more characteristics include one or more characteristics of SMTP data forming said target e-mail message.
24. A method as claimed in claim 16 , wherein a received e-mail identifying content filtering rule is one of automatically made active or made active once confirmed for use by a user input.
25. A method as claimed in claim 24 , wherein a priority level associated with said received e-mail identifying content filtering rule and predetermined user specified parameters determine if said received e-mail identifying content filtering rule is automatically made active or made active once confirmed for use by a user input.
26. A method as claimed in claim 16 , further comprising the steps of:
receiving from a remote source a rule altering message; and
in response to receipt of said rule altering message altering said e-mail identifying content filtering rule.
27. A method as claimed in claim 26 , wherein a received rule altering message is one of automatically responded to or responded to once confirmed by a user input.
28. A method as claimed in claim 26 , wherein said rule altering message is one of a rule rescinding message which serves to rescind said e-mail identifying content filtering rule and a rule superseding message which serves to supersede said e-mail identifying content filtering rule.