Instant message scanning

A system to detect a malicious message for an instant messaging service, wherein the system is configured to:

• (a) originate a message in an instant messaging client application included in a first processing system, wherein the message comprises an entity of interest, and wherein a second processing system is a designated recipient of the message;
• (b) prior to transferring a portion of the message from the instant messaging client application, analyse, by the first processing system, the entity of interest to determine if the message is malicious, wherein a malicious entity of interest is configured to cause damage to the first processing system and the second processing system;
• (c) in response to detecting that the message is malicious, restrict the message from threatening:
• the first processing system;
• and
• the second processing system in data communication with the first processing system;
• (d) set the entity of interest as a base entity;
• (e) determine an entity property of the base entity;
• (f) establish at least one related entity rule based on the entity property of the base entity;
• (g) scan the first processing system to locate an entity that satisfies the at least one entity rule;
• (h) in response to locating an entity that satisfies the at least one related entity rule, classify the entity as a related entity to the base entity;
• and
• (i) in response to detecting that at least a portion of the message is malicious, remove the malicious portion of the message.

A computer program product comprising a non-transitory and tangible computer readable medium having a computer program recorded therein or thereon, the computer program enabling detection of a malicious message for an instant messaging service, wherein the computer program product configures the processing system to:

• (a) originate a message in an instant messaging client application included in a first processing system, wherein the message comprises an entity of interest, and wherein a second processing system is a designated recipient of the message;
• (b) prior to transferring a portion of the message from the instant messaging client application, analyse, by the first processing system, the entity of interest to determine if the message is malicious, wherein a malicious entity of interest is configured to cause damage to the first processing system and the second processing system;
• (c) in response to detecting that the message is malicious, restrict the message from threatening:
• the first processing system;
• and
• the second processing system in data communication with the first processing system;
• (d) set the entity of interest as a base entity;
• (e) determine an entity property of the base entity;
• (f) establish at least one related entity rule based on the entity property of the base entity;
• (g) scan the first processing system to locate an entity that satisfies the at least one entity rule;
• (h) in response to locating an entity that satisfies the at least one related entity rule, classify the entity as a related entity to the base entity;
• and
• (i) in response to detecting that at least a portion of the message is malicious, removing the malicious portion of the message.

A method of detecting a malicious message for an instant messaging service, wherein the method comprises:

• (a) generating, in an instant messaging client application included in a first processing system, input data for a server processing system indicative of an instruction to transfer a message to a second processing system, wherein the message comprises an entity of interest, and wherein the second processing system is a designated recipient of the message;
• (b) prior to transferring a portion of the message from the instant messaging client application, analyzing, by the first processing system, the entity of interest to be transferred to determine if the message is malicious, wherein a malicious entity of interest is configured to cause damage to the first processing system and the second processing system;
• (c) in response to detecting that the message is malicious, restricting the message from being transferred to the second processing system;
• (d) setting the entity of interest as a base entity;
• (e) determining an entity property of the base entity;
• (f) establishing at least one related entity rule based on the entity property of the base entity;
• (g) scanning the first processing system to locate an entity that satisfies the at least one entity rule;
• (h) in response to locating an entity that satisfies the at least one related entity rule, classifying the entity as a related entity to the base entity;
• and
• (i) in response to detecting that at least a portion of the message is malicious, removing the malicious portion of the message.

A computer program product comprising a non-transitory and tangible computer readable medium having a computer program recorded therein or thereon, the computer program enabling detection of a malicious message for an instant messaging service, wherein the computer program product configures a processing system to:

• (a) generate, by an instant messaging client application included in a first processing system, input data for a server processing system indicative of an instruction to transfer a message to a second processing system, wherein the message comprises an entity of interest, and wherein the second processing system is a designated recipient of the message;
• (b) prior to transferring a portion of the message from the instant messaging client application, analyse, by the first processing system, the entity of interest to be transferred to determine if the message is malicious, wherein a malicious entity of interest is configured to cause damage to the first processing system and the second processing system;
• (c) in response to detecting that the message is malicious, restrict the message from being transferred to the second processing system;
• (d) set the entity of interest as a base entity;
• (e) determine an entity property of the base entity;
• (f) establish at least one related entity rule based on the entity property of the base entity;
• (g) scan the first processing system to locate an entity that satisfies the at least one entity rule;
• (h) in response to locating an entity that satisfies the at least one related entity rule, classify the entity as a related entity to the base entity;
• and
• (i) in response to detecting that at least a portion of the message is malicious, remove the malicious portion of the message.