# US 7,080,408 B1 · Delayed-delivery quarantining of network communications having suspicious contents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,080,408 B1 - Document ID: US7080408B1 - Status: Granted - Kind: B1 - Application number: 10/006,549 - Filed: 2001-11-30 - Granted: 2006-07-18 - Earliest claimed: 2001-11-30 - Assignees: McAfee, Inc. - Inventors: Michael C. Pak; Victor Kouznetsov - Web page: https://patentgrep.com/patent/US7080408B1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, method and computer program product are provided for network-based scanning for potentially malicious content. Incoming and/or outgoing network communications traveling over a network are monitored, preferably at a gateway. Potentially malicious content in the network communications is identified. The identified potentially malicious content of the network communications is quarantined to help prevent damage that could be caused if the content is indeed malicious. In one embodiment, a pattern for testing the potentially malicious content network communications for malicious code can be executed. The network communications are conditionally delivered over the network based on the testing. In other embodiments, the network communications are delivered over the network after a predetermined delay and/or upon receiving a user request to release the suspect content from quarantine. ## Claims ### Claim 1 A method for network-based scanning for potentially malicious content, comprising: (a) monitoring network communications over a network; (b) identifying potentially malicious content in the network communications; (c) quarantining the potentially malicious content of the network communications; (d) executing a pattern for testing the potentially malicious content network communications for malicious code; and (e) conditionally delivering the network communications over the network based on the testing; wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising scanning the network communications for known malicious content. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein the malicious content includes a mass-mailer virus. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the network communications include electronic mail messages. ### Claim 6 (depends on 5) The method as recited in claim 5, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value. ### Claim 7 (depends on 1) The method as recited in claim 1, further comprising cleaning the potentially malicious content if malicious code is found, which is disabling of malicious code. ### Claim 8 A computer program product embodied on a computer readable medium for network-based scanning for potentially malicious content, comprising: (a) computer code that monitors network communications over a network; (b) computer code that identifies potentially malicious content in the network communications; (c) computer code that quarantines the potentially malicious content of the network communications; (d) computer code that executes a pattern for testing the potentially malicious content network communications for malicious code; and (e) computer code that conditionally delivers the network communications over the network based on the testing; wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content. ### Claim 9 A system for network-based scanning for potentially malicious content, comprising: (a) logic that monitors network communications over a network; (b) logic that identifies potentially malicious content in the network communications; (c) logic that quarantines the potentially malicious content of the network communications; (d) logic that executes a pattern for testing the potentially malicious content network communications for malicious code; and (e) logic that conditionally delivers the network communications over the network based on the testing; wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content. ### Claim 10 A method for network-based scanning for potentially malicious content, comprising: (a) monitoring network communications over a network; (b) identifying potentially malicious content in the network communications; (c) quarantining the potentially malicious content of the network communications; and (d) delivering the network communications over the network after a predetermined delay; wherein the delay is for allowing quarantining of the potentially malicious content until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content. ### Claim 11 (depends on 10) The method as recited in claim 10, further comprising scanning the network communications for known malicious content. ### Claim 12 (depends on 10) The method as recited in claim 10, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value. ### Claim 13 (depends on 10) The method as recited in claim 10, wherein the network communications include electronic mail messages. ### Claim 14 (depends on 13) The method as recited in claim 13, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value. ### Claim 15 A method for network-based scanning for potentially malicious content, comprising: (a) monitoring network communications over a network; (b) identifying potentially malicious content in the network communications; (c) quarantining the potentially malicious content of the network communications in a quarantine; and (d) delivering the network communications from the quarantine over the network in response to a request from a user; wherein it is determined whether the user is authorized, and the network communications are delivered only if the user is determined to be authorized; wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with a malicious code detection file received after the potentially malicious content. ### Claim 16 (depends on 15) The method as recited in claim 15, wherein the user is an intended recipient of the quarantined network communications. ### Claim 17 (depends on 15) The method as recited in claim 15, wherein content is identified as potentially malicious when a number of instances of the content in the network communications is greater than a predetermined value. ### Claim 18 (depends on 15) The method as recited in claim 15, wherein the network communications include electronic mail messages. ### Claim 19 (depends on 18) The method as recited in claim 18, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line is greater than a predetermined value. ### Claim 20 A method for network-based scanning for potentially malicious content, comprising: (a) monitoring incoming and outgoing network communications over a network at a gateway; (b) scanning the network communications for known malicious content; (c) identifying potentially malicious content in the network communications; (d) wherein content is identified as potentially malicious when a number of identical instances of the content in the network communications passing through the network for a given period of time is greater than a predetermined value; (e) wherein the network communications include electronic mail messages, wherein an electronic mail message is identified as having potentially malicious content when a number of messages having an identical subject line passing through the network for a given period of time is greater than a predetermined value; (f) quarantining the potentially malicious content of the network communications; (g) delivering the network communications over the network upon occurrence of the first of: (i) scanning the potentially malicious content with a malicious code detection file received after the potentially malicious content is received; (ii) upon receiving a user request; (iii) upon passage of a predetermined amount of time; (h) notifying an intended recipient of the potentially malicious content that the potentially malicious content has been quarantined; (i) notifying a sender of the potentially malicious content that the potentially malicious content has been quarantined; and (j) cleaning the potentially malicious content if malicious code is found, which is disabling of malicious code. ### Claim 21 (depends on 1) The method as recited in claim 1, wherein the potentially malicious content is identified utilizing heuristics. ### Claim 22 (depends on 21) The method as recited in claim 21, wherein the heuristics include generating a histogram of content that has been sent over the network during a period of time and analyzing the histogram to determine whether a number of copies of the potentially malicious content that have been sent over the network during the period of time exceed a predetermined value. ### Claim 23 (depends on 1) The method as recited in claim 1, wherein the quarantining includes containing the potentially malicious content and preventing the potentially malicious content from creating damage. ### Claim 24 (depends on 1) The method as recited in claim 1, wherein when multiple recipients are to receive a copy of the potentially malicious content over the network, a single copy of the potentially malicious content is quarantined and each of the recipients is placed in a list such that after the potentially malicious content is determined to be clean based on the testing, the single copy is forwarded to each of the recipients. ### Claim 25 (depends on 1) The method as recited in claim 1, wherein an intended recipient of the network communications is notified that the potentially malicious content is quarantined. ### Claim 26 (depends on 1) The method as recited in claim 1, wherein the potentially malicious content is quarantined until the potentially malicious content has been scanned with the malicious code detection file received after the potentially malicious content and after the potentially malicious content is quarantined. ### Claim 27 (depends on 1) The method of claim 1, wherein the malicious code detection file is created after the potentially malicious content is identified such that a latest malicious code detection file is utilized in the scanning of the potentially malicious content. ### Claim 28 (depends on 1) The method of claim 1, wherein the malicious code detection file is created after the potentially malicious content is received such that a latest malicious code detection file is utilized in the scanning of the potentially malicious content.