Back to results
US 10,313,378 B2Granted
Methods and systems for detecting viruses in emails
AssigneeFacebook, Inc.
InventorNoam Makavy
Life of this patent
Estimating the term…
Abstract
A method of monitoring email use is performed at a server system by monitoring email use in a first email application at a first device distinct from the server system and monitoring email use in a second email application at a second device distinct from the server system. An inconsistency in the monitored email use is detected for a first email that is received by the second device and appears to have been sent from the first device. In response to detecting the inconsistency, the first email is identified as being potentially malicious. At least one of the first and second devices may be notified that the first email is potentially malicious.
Claims15
A method, comprising:
- at a server system associated with an email monitoring service, the server system having one or more processors and memory storing instructions for execution by the one or more processors:
- monitoring email use in a first email application at a first device distinct from the server system;
- monitoring email use in a second email application at a second device distinct from the server system;
- wherein:
- monitoring email use in the first and second email applications comprises installing an email monitoring application on the first and second devices;
- the email monitoring application installed on the first device creates an outgoing log of emails sent from the first email application, the outgoing log comprising respective entries for respective outgoing emails;
- and
- the email monitoring application installed on the second device creates an incoming log of emails received by the second email application, the incoming log comprising entries for respective incoming emails;
- receiving time stamps of log entries for respective outgoing emails from the email monitoring application on the first device, including a first time stamp of a log entry for a first email;
- receiving time stamps of log entries for respective incoming emails from the email monitoring application on the second device, including a second time stamp of a log entry for a first email;
- comparing the time stamps of the log entries for respective outgoing emails with the time stamps of the log entries for respective incoming emails;
- detecting an inconsistency in the monitored email use for the first email, which was received by the second device and appears to have been sent from the first device, wherein detecting the inconsistency comprises determining that the first time stamp is inconsistent with the second time stamp;
- and
- in response to detecting the inconsistency, identifying the first email as being potentially malicious, and notifying at least one of the first and second devices that the first email is potentially malicious.
11 more elements
A server system, comprising:
- one or more processors;
- and
- memory storing one or more programs for execution by the one or more processors, the one or more programs including instructions for:
- monitoring email use in a first email application at a first device distinct from the server system;
- monitoring email use in a second email application at a second device distinct from the server system;
- wherein:
- monitoring email use in the first and second email applications comprises installing an email monitoring application on the first and second devices;
- the email monitoring application installed on the first device creates an outgoing log of emails sent from the first email application, the outgoing log comprising respective entries for respective outgoing emails;
- and
- the email monitoring application installed on the second device creates an incoming log of emails received by the second email application, the incoming log comprising entries for respective incoming emails;
- receiving time stamps of log entries for respective outgoing emails from the email monitoring application on the first device, including a first time stamp of a log entry for a first email;
- receiving time stamps of log entries for respective incoming emails from the email monitoring application on the second device, including a second time stamp of a log entry for the first email;
- comparing the time stamps of the log entries for respective outgoing emails with the time stamps of the log entries for respective incoming emails;
- detecting an inconsistency in the monitored email use for the first email, which was received by the second device and appears to have been sent from the first device, wherein detecting the inconsistency comprises determining that the first time stamp is inconsistent with the second time stamp;
- and
- in response to detecting the inconsistency, identifying the email as being potentially malicious, and notifying at least one of the first and second devices that the first email is potentially malicious.
13 more elements
A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors of a server system, the one or more programs including instructions for:
- monitoring email use in a first email application at a first device distinct from the server system;
- monitoring email use in a second email application at a second device distinct from the server system;
- wherein:
- monitoring email use in the first and second email applications comprises installing an email monitoring application on the first and second devices;
- the email monitoring application installed on the first device creates an outgoing log of emails sent from the first email application, the outgoing log comprising respective entries for respective outgoing emails;
- and
- the email monitoring application installed on the second device creates an incoming log of emails received by the second email application, the incoming log comprising entries for respective incoming emails;
- receiving time stamps of log entries for respective outgoing emails from the email monitoring application on the first device, including a first time stamp of a log entry for a first email;
- receiving time stamps of log entries for respective incoming emails from the email monitoring application on the second device, including a second time stamp of a log entry for the first email;
- comparing the time stamps of the log entries for respective outgoing emails with the time stamps of the log entries for respective incoming emails;
- detecting an inconsistency in the monitored email use for the first email, which was received by the second device and appears to have been sent from the first device, wherein detecting the inconsistency comprises determining that the first time stamp is inconsistent with the second time stamp;
- and
- in response to detecting the inconsistency, identifying the email as being potentially malicious, and notifying at least one of the first and second devices that the first email is potentially malicious.
10 more elements
Dependencies are inferred from the claim text.