Systems and methods for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines

1. A computer-implemented method for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines, at least a portion of the method being performed by an endpoint machine comprising at least one processor, the method comprising:

monitoring, using a networking-monitoring module installed on the endpoint machine, electronic-mail traffic on the endpoint machine by:

monitoring all network activity on the endpoint machine;

detecting, within the network activity on the endpoint machine, the electronic-mail traffic by:

detecting incoming-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for incoming-mail protocols;

detecting outgoing-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for outgoing-mail protocols;

identifying, using a program-identification module installed on the endpoint machine, a computer program on the endpoint machine that is responsible for at least a portion of the electronic-mail traffic on the endpoint machine;

accessing, using a rule-application module installed on the endpoint machine, at least one rule for determining, based on characteristics of the program, whether the program comprises a spam program;

determining, by applying the rule to the program using the rule-application module installed on the endpoint machine, that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine;

in response to the determination that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine, using a security module installed on the endpoint machine to perform a security operation on the program.

2. The method of claim 1 , wherein monitoring the electronic-mail traffic comprises monitoring header information associated with the electronic-mail traffic.

3. The method of claim 1 , wherein the rule comprises at least one of:

criteria for determining whether the program generates outgoing electronic-mail messages without receiving incoming electronic-mail messages;

criteria for determining whether the program generates more than a predetermined number of outgoing electronic-mail messages without receiving any incoming electronic-mail messages;

criteria for determining whether the program generates outgoing electronic-mail messages using multiple sender identities;

criteria for determining whether the program generates outgoing electronic-mail messages using more than a predetermined number of sender identities within a predetermined period of time;

criteria for determining whether the program generates outgoing electronic-mail messages using more than a predetermined number of outgoing-mail servers;

criteria for determining whether the program generates outgoing electronic-mail messages without employing a visible user interface;

criteria for determining whether the program generates outgoing electronic-mail messages without making any file-system reads;

criteria for determining whether the program participates in IRC communications prior to generating outgoing electronic-mail messages;

criteria for determining whether the program participates in suspicious HTTP traffic prior to generating outgoing electronic-mail messages;

criteria for determining whether any outgoing electronic-mail messages generated by the program are rejected by outgoing-mail servers.

4. The method of claim 3 , further comprising assigning weight values to at least one of the criteria.

5. The method of 1 , wherein the security operation comprises at least one of:

removing the program from the endpoint machine;

blocking the program from generating network activity;

quarantining the program;

transmitting a notification that identifies the program as a security risk.

6. The method of claim 1 , wherein the incoming-mail-protocol traffic comprises at least one of:

POP traffic;

IMAP traffic;

MAPI/RPC traffic;

DIIOP traffic;

SMTP traffic.

7. The method of claim 1 , wherein the outgoing-mail-protocol traffic comprises SMTP traffic.

8. A system for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines, the system comprising:

a network-monitoring module installed on an endpoint machine comprising at least one processor, the networking-monitoring module being programmed to monitor electronic-mail traffic on the endpoint machine by:

monitoring all network activity on the endpoint machine;

detecting, within the network activity on the endpoint machine, the electronic-mail traffic by:

detecting incoming-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for incoming-mail protocols;

detecting outgoing-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for outgoing-mail protocols;

a program-identification module installed on the endpoint machine, the program-identification module being programmed to identify a computer program on the endpoint machine that is responsible for at least a portion of the electronic-mail traffic on the endpoint machine;

a rule-application module installed on the endpoint machine, the rule-application module being programmed to:

access at least one rule for determining, based on characteristics of the program, whether the program comprises a spam program;

determine, by applying the rule to the program, that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine;

a security module installed on the endpoint machine, the security module being programmed to perform a security operation on the program in response to the determination that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine.

9. The system of claim 8 , wherein the network-monitoring module monitors the electronic-mail traffic by monitoring header information associated with the electronic-mail traffic.

10. The system of claim 8 , wherein the rule comprises at least one of:

criteria for determining whether the program generates outgoing electronic-mail messages without receiving incoming electronic-mail messages;

criteria for determining whether the program generates more than a predetermined number of outgoing electronic-mail messages without receiving any incoming electronic-mail messages;

criteria for determining whether the program generates outgoing electronic-mail messages using multiple sender identities;

criteria for determining whether the program generates outgoing electronic-mail messages using more than a predetermined number of sender identities within a predetermined period of time;

criteria for determining whether the program generates outgoing electronic-mail messages using more than a predetermined number of outgoing-mail servers;

criteria for determining whether the program generates outgoing electronic-mail messages without employing a visible user interface;

criteria for determining whether the program generates outgoing electronic-mail messages without making any file-system reads;

criteria for determining whether the program participates in IRC communications prior to generating outgoing electronic-mail messages;

criteria for determining whether the program participates in suspicious HTTP traffic prior to generating outgoing electronic-mail messages;

criteria for determining whether any outgoing electronic-mail messages generated by the program are rejected by outgoing-mail servers.

11. The system of claim 10 , wherein the rule-application module is further programmed to assign weight values to at least one of the criteria.

12. The system of 8 , wherein the security operation comprises at least one of:

removing the program from the endpoint machine;

blocking the program from generating network activity;

quarantining the program;

transmitting a notification that identifies the program as a security risk.

13. A non-transitory computer-readable medium having thereon computer-executable instructions that, when executed by one or more processors of an endpoint machine, cause the endpoint machine to perform a method for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines, the method comprising:

monitoring, using a networking-module installed on the endpoint machine, electronic-mail traffic on the endpoint machine by:

monitoring all network activity on the endpoint machine;

detecting, within the network activity on the endpoint machine, the electronic-mail traffic by:

detecting incoming-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for incoming-mail protocols;

detecting outgoing-mail-protocol traffic within the network activity by comparing the network activity with digital signatures for outgoing-mail protocols;

identifying, using a program-identification module installed on the endpoint machine, a computer program on the endpoint machine that is responsible for at least a portion of the electronic-mail traffic on the endpoint machine;

accessing, using a rule-application module installed on the endpoint machine, at least one rule for determining, based on characteristics of the program, whether the program comprises a spam program;

determining, by applying the rule to the program using the rule-application module installed on the endpoint machine, that the program comprises a spam program designed to transmit unauthorized electronic mail via the endpoint machine;

in response to the determination that the program comprises a spam program, using a security module installed on the endpoint machine to perform a security operation on the program.