Intrusion prevention system (IPS) mode for a malware detection system

A decomposition server, comprising:

• a hardware processor comprising processing circuitry configured to implement a module to clone a received message to create a copy of the electronic message;
• a memory to implement an inbound queue for holding the copy of the electronic message for processing until an analysis of the analysis of the copy of the electronic message has been completed or until a timeout threshold has been exceeded;
• and
• a message policy engine for modifying the copy of the received electronic message by adding queue information and host information as an X-header to the copy of the electronic message, wrapping the envelope from information and the envelope recipient information as an X-header, and changing envelope from information and envelope recipient information of the received electronic message, the queue information indicating which queue of the plurality of queues the electronic message is stored in, and the message policy engine for processing the copy of the electronic message to decompose the copy of the electronic message into pieces, the message policy engine for analyzing and detecting malware associated with the copy of the electronic message or an attachment associated with the copy of the electronic message.

A system for providing intrusion prevention arising from electronic messages, comprising:

• at least one staging server implemented by processing circuitry of a hardware processor, the staging server for intercepting an incoming electronic message, making a copy of the intercepted incoming electronic message, and holding the intercepted incoming electronic message in a queue of the staging server until an analysis of the copy of the intercepted incoming electronic message has been completed or until a timeout threshold has been exceeded;
• and
• a malware detection system implemented by the hardware processor, the malware detection system coupled to the at least one staging server, the at least one malware detection system including at least one decomposition server for receiving the copy of the intercepted incoming electronic message and processing the copy of the intercepted incoming electronic message to detect malware, the malware detection system including a message policy engine for modifying the copy of the received electronic message by adding queue information and host information as an X-header to the copy of the electronic message, wrapping the envelope from information and the envelope recipient information as an X-header, and changing envelope from information and envelope recipient information of the received electronic message, the queue information indicating the queue of the staging server the incoming electronic message is stored in.

A method for providing intrusion prevention arising from electronic messages, comprising:

• intercepting incoming electronic messages at a staging server;
• cloning the intercepted incoming electronic message to make a copy of the intercepted incoming electronic message;
• holding the intercepted incoming electronic message in a queue until an analysis of the copy of the electronic message has been completed or until a timeout threshold has been exceeded;
• adding queue information and host information as an X-header to the copy of the intercepted incoming electronic message;
• wrapping envelope from information and envelope recipient information as an X-header of the intercepted incoming electronic message;
• changing the envelope from information and the envelope recipient information of the intercepted incoming electronic message;
• forwarding the copy of the intercepted incoming electronic message to a decomposition server
• decomposing the copy of the intercepted incoming electronic message into pieces at the decomposition server;
• analyzing, at the pieces of the decomposed copy of the intercepted incoming electronic message to detect malware associated with the copy of the intercepted incoming electronic message or an attachment associated with the copy of the intercepted incoming electronic message;
• and
• based on the analysis of the pieces of the decomposed copy of the intercepted incoming electronic message, signaling the staging server to release, hold or delete the intercepted incoming electronic message from the queue at the staging server;
• and
• forwarding the intercepted incoming electronic message released from the queue when the copy of the intercepted incoming electronic message is deemed by the analysis not to be suspicious or when a timeout has occurred.

At least one non-transitory machine readable storage medium comprising instructions that, when executed by the machine, cause the machine to perform operations for providing intrusion prevention arising from electronic messages, the operations comprising:

• intercepting incoming electronic messages at a staging server;
• cloning the intercepted incoming electronic message to make a copy of the intercepted incoming electronic message;
• holding the intercepted incoming electronic message in a queue until an analysis of the copy of the electronic message has been completed or until a timeout threshold has been exceeded;
• adding queue information and host information as an X-header to the copy of the intercepted incoming electronic message;
• wrapping envelope from information and envelope recipient information as an X-header of the intercepted incoming electronic message;
• changing the envelope from information and the envelope recipient information of the intercepted incoming electronic message;
• forwarding the copy of the intercepted incoming electronic message to a decomposition server
• decomposing the copy of the intercepted incoming electronic message into pieces at the decomposition server;
• analyzing, at the pieces of the decomposed copy of the intercepted incoming electronic message to detect malware associated with the copy of the intercepted incoming electronic message or an attachment associated with the copy of the intercepted incoming electronic message;
• and
• based on the analysis of the pieces of the decomposed copy of the intercepted incoming electronic message, signaling the staging server to release, hold or delete the intercepted incoming electronic message from the queue at the staging server;
• and
• forwarding the intercepted incoming electronic message released from the queue when the copy of the intercepted incoming electronic message is deemed by the analysis not to be suspicious or when a timeout has occurred.