# US 8,544,097 B2 · Attachment chain tracing scheme for email virus detection and control

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,097 B2
- Document ID: US8544097B2
- Status: Granted
- Kind: B2
- Application number: 11/549,690
- Filed: 2006-10-16
- Published: 2007-06-14
- Granted: 2013-09-24
- Earliest claimed: 2005-10-14
- Assignees: Sistema Universitario Ana G. Mendez, Inc.
- Applicants: Jintao Xiong
- Inventors: Jintao Xiong
- Web page: https://patentgrep.com/patent/US8544097B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An automated email virus detection and control scheme using attachment chain tracing (ACT) technique is provided. Based on conventional epidemiology, ACT detects virus propagation by identifying the existence of transmission chains in the network. It uses contact tracing to find epidemiological links between hosts. A soft-quarantine scheme controls virus propagation by detecting and quarantining without virus signature information. A progressive immunization strategy uses transmission chain information to guide the immunization process.

## Claims

### Claim 1

A computer-implemented method for email virus detection comprising the steps of:
providing an attachment chain tracing server configured to monitor a plurality of emails sent from a plurality of computer hosts connected in a network, wherein each email is associated to a computer host;
identifying at said attachment chain tracing server at least one email with attachment sent from a computer host;
executing at said attachment chain tracing server a case finding routine based on said identifying step to detect at least one computer host with at least one previous defined symptom;
executing at said attachment chain tracing server a transmission chain management routine based on the outcome of said case finding routine, said transmission chain management routine:
a) determines if a computer host that has showed a symptom has no epidemiological link from any computer host and establishes a contact trace stack beginning with an index layer assigned to said computer host that has showed a symptom but has no epidemiological link from any computer host and additional successive layers, wherein each of said additional successive layers stores contacts which are computer hosts having epidemiological links from any contact of an immediate preceding layer;
b) determines if a computer host that has showed a symptom has an epidemiological link so that said computer host is already stored on a layer of an existing contact trace stack and adds a successive layer to said layer, wherein a length of said contact trace stack is defined by its amount of layers; and
detecting an email virus based on said transmission chain management routine when the length of said contact trace stack reaches a preset value.

### Claim 2 (depends on 1)

The method of claim 1, further comprising the steps of: performing a quarantine process; and performing an immunization and treatment process.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein said at least one previous defined symptom comprises the number of emails sent from said at least one computer host in a predefined time interval being greater than a preset threshold.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein said case finding routine is executed at said attachment chain tracing server by performing the following instructions:
for all sending address do
check ni, wherein ni is the number of emails computer host i has sent,
if ni>Rd, wherein RD is the preset threshold, then report computer host i and its internal recipient email addresses to the transmission chain management routine
end if
end for.

### Claim 5 (depends on 3)

The computer-implemented method of claim 3, wherein said predefined time interval is set from about 1 minute to about 5 minutes.

### Claim 6 (depends on 3)

The computer-implemented method of claim 3, wherein said preset threshold is selected from at least one of: a value greater than normal average email traffic, individual user thresholds, or a combination thereof.

### Claim 7 (depends on 1)

The method of claim 1, wherein said transmission chain management process comprises at least one of: creating at least one contact trace stack (CTS), updating at least one contact trace stack (CTS), removing at least one contact trace stack (CTS); updating at least one host category, refreshing at least one CTS buffer, finishing at least one transmission chain, or any combinations thereof.

### Claim 8 (depends on 7)

The method of claim 7, wherein creating at least one contact trace stack (CTS) comprises identifying an index case of a transmission chain as a case that has showed infectious symptom but has no link from any host that has infectious symptom.

### Claim 9 (depends on 8)

The method of claim 8, further comprising assigning the normal email receivers of said index case to a first layer of said at least one contact trace stack (CTS).

### Claim 10 (depends on 9)

The method of claim 9, further comprising updating a category of said index case from normal to suspicious and a category of all the receivers in said first layer to linked.

### Claim 11 (depends on 7)

The method of claim 7, wherein said creating at least one contact trace stack (CTS) is defined by the following algorithm:
if (i is an internal normal host) or (i is an external host but is not an index case of any existing CTS) then
assign i to be the index case of a new CTS
for all receivers of i with normal category do
add receivers to layer 1 of CTS
change receivers' category to linked
end for
end if
if i is an internal host then
change index case category to suspicious
end if.

### Claim 12 (depends on 7)

The method of claim 7, wherein said updating at least one contact trace stack (CTS) comprises identifying that a received host is not a normal host and that is already in a specific CTS.

### Claim 13 (depends on 12)

The method of claim 12, wherein a category of said received host is changed to suspicious.

### Claim 14 (depends on 12)

The method of claim 12, further comprising adding new normal receivers to a next layer of said specific CTS.

### Claim 15 (depends on 14)

The method of claim 14, further comprising comparing the number of layers of said specific CTS with a predefined length to determine that a transmission chain has been formed in said specific CTS.

### Claim 16 (depends on 7)

The method of claim 7, wherein said updating at least one contact trace stack (CTS) is defined by the following algorithm: TABLE-US-00007 Change the category of the received host to suspicious, find the location of i, for all r.sub.i(new recipients of i with normal category) do add new normal receivers to next layer of CTS end for if number of layers in CTS=K (predefined number of layers) then finish the transmission chain for that CTS end if.

### Claim 17 (depends on 7)

The method of claim 7, wherein said finishing at least one transmission chain comprises updating the category of the hosts in a specific CTS by changing all suspicious cases to probable category and all linked cases to potential category.

### Claim 18 (depends on 17)

The method of claim 17, further comprising reporting all probable and potential cases to a quarantine process.

### Claim 19 (depends on 7)

The method of claim 7, wherein said finishing at least one transmission chain is defined by the following algorithm:
for all suspicious hosts in a specific CTS do
change their category to probable
end for
for all linked hosts in a specific CTS do
change their category to potential
end for
pass the address and category information of all nodes in the index of the specific CTS to the quarantine process' remove said specific CTS.

### Claim 20 (depends on 7)

The method of claim 7, wherein said refreshing at least one CTS buffer comprises refreshing said buffer every predetermined amount of time.

### Claim 21 (depends on 20)

The method of claim 20, further comprising the step of removing at least one CTS from the transmission chain management process.

### Claim 22 (depends on 21)

The method of claim 21, wherein said removing said at least one CTS from the transmission chain management process comprises at least one of: removing said at least one CTS when a transmission chain has been formed and related information has been reported to the quarantine process, when said at least one CTS buffer has not been updated for a predetermined period of time, or a combination thereof.

### Claim 23 (depends on 2)

The method of claim 2, wherein said quarantine process comprises receiving from said transmission chain management process information including at least one of: addresses of at least one probable case, addresses of at least one potential case, or a combination thereof.

### Claim 24 (depends on 2)

The method of claim 2, wherein said quarantine process further comprises a two-level quarantine scheme.

### Claim 25 (depends on 24)

The method of claim 24, wherein said two-level quarantine scheme comprises a first strict quarantine policy and a second less strict quarantine policy.

### Claim 26 (depends on 2)

The method of claim 2, wherein said quarantine process further comprises at least one of: a hard quarantine policy, a soft quarantine policy, or a combination thereof.

### Claim 27 (depends on 26)

The method of claim 26, wherein said hard quarantine policy comprises filtering out all emails with attachments sent from a probable case and issuing at least one warning indication to a recipient when said recipient attempts to open an attachment from a potential case.

### Claim 28 (depends on 26)

The method of claim 26, wherein said soft quarantine policy comprises a two-level indication system.

### Claim 29 (depends on 28)

The method of claim 28, wherein said two-level indication system comprises at least one of: a two-level visual system, a two-level audio system, or any combination thereof.

### Claim 30 (depends on 29)

The method of claim 29, wherein said two-level visual system comprises a two-level color code warning system.

### Claim 31 (depends on 30)

The method of claim 30, further comprising a first color representing emails sent from probable cases.

### Claim 32 (depends on 31)

The method of claim 31, further comprising a second color representing emails sent from potential cases.

### Claim 33 (depends on 31)

The method of claim 31, wherein said first color is red.

### Claim 34 (depends on 32)

The method of claim 32, wherein said second color is yellow.

### Claim 35 (depends on 1)

The method of claim 1, wherein said case finding process comprises at least one of: a threshold-based scheme, a non-threshold scheme, or a combination thereof.

### Claim 36 (depends on 35)

The method of claim 35, wherein said threshold-based scheme further comprises dynamically adjusting a value representing a predetermined number of contact trace stack layers.

### Claim 37 (depends on 1)

The method of claim 1, wherein said transmission chain management process is performed: online, off-line, or a combination thereof.

### Claim 38 (depends on 2)

The method of claim 2, wherein said immunization and treatment process comprises a progressive immunization process.

### Claim 39 (depends on 38)

The method of claim 38, wherein said progressive immunization process provides immunization to probable cases as new probable cases are identified by the transmission chain management process.

### Claim 40

An email virus detection system comprising:
an attachment chain tracing server running a case finding routine to detect at least one previous defined symptom on a computer host that sent an email with an attachment; and a transmission chain routine based on said detection to: a) determine if a computer host that has showed a symptom has no epidemiological link from any computer host and establishes a contact trace stack beginning with an index layer assigned to said computer host that has showed a symptom but has no epidemiological link from any computer host and additional successive layers, wherein each of said additional successive layers stores contacts which are computer hosts having epidemiological links from any contact of an immediate preceding layer and b) determine if a computer host that has showed a symptom has an epidemiological link so that said computer host is already stored on a layer of an existing contact trace stack and adds a successive layer to said layer, wherein a length of said contact trace stack is defined by its amount of layers so that an email virus is detected based on said transmission chain routine when the length of said contact trace stack reaches a preset value.

### Claim 41 (depends on 40)

The system of claim 40, further comprising at least one of: a sensor, a quarantine process, or a combination thereof, installed on each server that handles host email requests.

### Claim 42 (depends on 41)

The system of claim 41, wherein said host email requests comprise at least one of: a SMTP service, an email gateway, or any combination thereof.

### Claim 43 (depends on 42)

The system of claim 42, wherein said at least one of: a sensor, a quarantine process, or a combination thereof, is implemented by at least one of: writing SMTP event sinks, catching CDO_OnArrival events, or any combination thereof.