Method and apparatus for the early detection of machines infected by e-mail based computer viruses

Abstract

A method and apparatus for the early detection of machines infected by e-mail based computer viruses advantageously employs a network behavioral analysis rather than a direct technical analysis of attached executable code. Specifically, an SMTP (Simple Mail Transfer Protocol) log associated with a mail gateway system interconnected to a plurality of machines is examined, and based on an analysis of information comprised in a plurality of log entries thereof, it may be determined that one of these machines has a possible infection by an e-mail based computer virus. Illustratively, information extracted from each entry in the SMTP log (i.e., for each incoming e-mail message) of the mail gateway includes (i) the unique identity of the sending machine; (ii) the “hello” name that the sending machine calls itself, (iii) the e-mail “From:” address; and (iv) whether the message contains a potentially virus-like (e.g., executable) attachment.

Dependencies are inferred from the claim text.