Attachment chain tracing scheme for email virus detection and control
AssigneeSistema Universitario Ana G. Mendez, Inc.
InventorJintao Xiong
Life of this patent
Estimating the term…
Abstract
An automated email virus detection and control scheme using attachment chain tracing (ACT) technique is provided. Based on conventional epidemiology, ACT detects virus propagation by identifying the existence of transmission chains in the network. It uses contact tracing to find epidemiological links between hosts. A soft-quarantine scheme controls virus propagation by detecting and quarantining without virus signature information. A progressive immunization strategy uses transmission chain information to guide the immunization process.
Claims43
A computer-implemented method for email virus detection comprising the steps of:
- providing an attachment chain tracing server configured to monitor a plurality of emails sent from a plurality of computer hosts connected in a network, wherein each email is associated to a computer host;
- identifying at said attachment chain tracing server at least one email with attachment sent from a computer host;
- executing at said attachment chain tracing server a case finding routine based on said identifying step to detect at least one computer host with at least one previous defined symptom;
- executing at said attachment chain tracing server a transmission chain management routine based on the outcome of said case finding routine, said transmission chain management routine:
- a) determines if a computer host that has showed a symptom has no epidemiological link from any computer host and establishes a contact trace stack beginning with an index layer assigned to said computer host that has showed a symptom but has no epidemiological link from any computer host and additional successive layers, wherein each of said additional successive layers stores contacts which are computer hosts having epidemiological links from any contact of an immediate preceding layer;
- b) determines if a computer host that has showed a symptom has an epidemiological link so that said computer host is already stored on a layer of an existing contact trace stack and adds a successive layer to said layer, wherein a length of said contact trace stack is defined by its amount of layers;
- and
- detecting an email virus based on said transmission chain management routine when the length of said contact trace stack reaches a preset value.
An email virus detection system comprising:
- an attachment chain tracing server running a case finding routine to detect at least one previous defined symptom on a computer host that sent an email with an attachment;
- and a transmission chain routine based on said detection to:
- a) determine if a computer host that has showed a symptom has no epidemiological link from any computer host and establishes a contact trace stack beginning with an index layer assigned to said computer host that has showed a symptom but has no epidemiological link from any computer host and additional successive layers, wherein each of said additional successive layers stores contacts which are computer hosts having epidemiological links from any contact of an immediate preceding layer and b) determine if a computer host that has showed a symptom has an epidemiological link so that said computer host is already stored on a layer of an existing contact trace stack and adds a successive layer to said layer, wherein a length of said contact trace stack is defined by its amount of layers so that an email virus is detected based on said transmission chain routine when the length of said contact trace stack reaches a preset value.
Dependencies are inferred from the claim text.