KR100496770B1 - Virus email blocking algorithm and system - Google Patents

Abstract

The present invention relates to a system and method for blocking a virus spread by an e-mail delivered through a communication network such as the Internet and a wireless network. It also blocks virus e-mail without requiring a virus repair program.

Description

VIRUS EMAIL BLOCKING ALGORITHM AND SYSTEM}

The present invention relates to a virus mail blocking system and method, and more particularly, to a system and method for blocking virus infection of a user's computer by distinguishing a mail containing a virus sent through a wired or wireless communication network.

Virus mail means a mail containing a virus program that infects a user's computer through an e-mail or containing a specific code for driving such an electronic virus. For example, a virus that automatically destroys a system or file on the recipient's computer when the recipient of the virus-infected mail opens the mail and automatically sends the infected mail to the recipient's name to all email accounts registered in the recipient's address book. This is the case with the recent rapid spread and malicious viruses appearing one after another to destroy the recipient's computer system or files. Therefore, various mail virus scan and repair programs have been released to protect recipients' computers and files from such viruses.

1 is a conceptual diagram of the application of the virus mail treatment program of the conventional antivirus program. First, when the mail arrives at the receiving mail server (101), the anti-virus program 102 for treating the virus is driven, and if the virus is included (103), the virus is normally received (104). If a virus is included, a virus treatment 105 is performed to cure or delete the virus.

In the conventional method, it is impossible to block or distinguish virus e-mail at the source. Since the virus vaccine program, which is a virus scanning software, checks only known virus patterns by using its own database, it is necessary to always use the latest database. This is because the latest database comes after a virus infection has been reported and analyzed, so it is impossible to cure a mail containing a new virus.

Accordingly, in order to solve the above problems, the present invention intends to devise a method and a system for fundamentally protecting a recipient from virus infection by analyzing, separating, and blocking an email containing a virus by analyzing the body of the mail.

If there is a certain pattern that must be included in the e-mail containing the virus and can be analyzed, the e-mail can be classified as a virus e-mail when the e-mail is sent and the virus is cleaned, deleted or blocked. You will be protected from this.

Fig. 2 shows the structure of a general e-mail presented to understand the principles of the present invention. If the received email (s200) is analyzed as a part, it can be largely divided into a header (s210) and a body (s220), and the body (s220) is again a contents part (s221) having a message part (s221) and a plurality of contents (s223). s222), and there may be a case where a Contents Part (s222) does not exist in some mails.

The Content (s223) part included in the transmitted mail is defined in the Content-Type name definition and Content-ID according to RFC2392: Content-ID and Message-ID Uniform Resource Locator protocol prescribed by IETE (Internet Engineering Task Force). Definitions may include definitions. Contents containing the virus portion of Contents Part (s222) included in all virus mails includes the * .exe, * .bat, *. It satisfies the condition that a Content-ID value exists while it contains an arbitrary file name with an executable extension such as lnk or * .scr. Therefore, this condition applies equally to any kind of virus mail, so this is the specific pattern that distinguishes virus mail.

There is no original case in which an e-mail normally sent by a sender and not a virus e-mail can be classified as a virus e-mail by applying the above conditions. For example, in case of an e-mail sent with an executable file attached by the sender's need, the Content (s223) part corresponding to the attachment part included in the mail includes an extension executable in the name definition of Content-Type. The file name that contains the file is included, but it does not have a Content-ID value. As another example, in case of a mail sent by inserting a picture file or the like as Content (s223) in a mail rather than an attachment, a Content-ID name is defined in the corresponding Content (s223) part, although a Content-ID value exists. It does not exist or does not contain an executable extension. Therefore, it can be judged that the mail applied to both of the above two conditions, that is, whether the definition of Content-Type includes an arbitrary file name with an executable extension and whether the Content-ID value exists is a virus mail. have.

The present invention has been made based on the above findings and based on this, the virus mail blocking system according to the present invention is a header / body separator for separating a header and a body from an e-mail received at a mail server of a receiver side, a separated body. Message / Contents separator that separates Message and Contents from, Content detail extractor that separates content with file name or name item from Contents section, Content-Type name definition includes executable extension characters and Content- Virus detector that scans and scans for ID values, classifies the scanned message as a normal message, accepts the recipient's mail, or classifies it as a virus-infected message, and blocks or deletes the message. Includes a virus vaccine program. The virus mail blocking system of the present invention blocks virus infection of a user computer system or file through the mail processor by processing a virus mail in accordance with a request of a virus detector.

Hereinafter, with reference to the accompanying drawings the principles and embodiments of the present invention will be described in more detail.

Figure 3 shows the operation principle of the virus mail blocker and the configuration of the functional module according to an embodiment of the present invention.

The header / body separator 310 receives mail at the receiving mail server or the mail client 300, and separates the header and body of the received mail 301 when the mail is received. Start the analysis.

The message / contents separator 320 functions to separate the separated body part into the message part and the content part again, and if the content part exists, delivers the corresponding content part part to the detail content extractor 330. The state includes a condition inspection step 322.

The detailed content extractor 330 separates a plurality of contents included in the contents part by parts, and extracts a content-type definition part and a content-ID definition part of each content.

The virus detector 340 analyzes (341) whether there is an executable extension in the file name specified in the Content-Type name definition included in each extracted detailed content information, and checks for the existence of a Content-ID value ( 342). At this time, if there is a syntax with executable extension in Content-Type name definition and Content ID exists, the mail is judged as a virus mail, and the information is forwarded to the mail processor 360 to block the mail. Or delete or contain any virus contained in it. The executable extensions detected by the virus detector 340 include .exe, .com, .bat, .lnk, .scr, and .pif, which are used as extensions of executable files in the Windows operating system. A specific word or phrase that points to the executable you are using.

The virus vaccine program a350 checks whether the virus has been included in the e-mail after the two condition checking steps 341 and 342 included in the virus detector 340, checks the virus (a351), and determines whether the virus exists. (A352), the information on whether to allow the reception of the mail or to judge the virus mail is transmitted to the mail processor 360. However, the virus vaccine program a350 is a database containing known virus patterns and treatment methods, and may not necessarily be included in a preferred example of the present invention.

The mail processor 360 blocks or deletes 361 the recipient from receiving the corresponding mail when there is a virus according to the information on the presence or absence of the virus transmitted from the virus detector 340 or the virus vaccine program a350. If there is no virus, it transmits the information to allow reception to the receiving mail server or the mail client 300 without additional measures (362) to allow the recipient to check the mail normally.

Figure 4 is a block diagram showing a preferred application of the virus mail blocker according to a preferred embodiment of the present invention applied to the mail server of the receiving side or the mail client of the recipient.

When the mail is received 500 at the receiving mail server, the receiving mail server 410 notifies the virus mail blocker 420 that the new mail has arrived and requests the analysis at the same time (411). The virus mail blocker 420 analyzes the contents of the mail and classifies whether it is a virus mail. If it is determined as a virus mail, the virus mail blocker 420 deletes or blocks the mail. In case the mail is returned to the receiving mail server 410 so that it can be processed normally (421). Then, when the mail client 440 used by the receiver requests the receiving mail server 410 to retrieve the mail, the mail is transmitted to the mail client 440 according to a protocol such as POP3 / IMAP / CGI. In addition, the virus mail blocker may be installed in the mail client 440 of the receiver. The virus mail blocker U411 thus installed has the same function as the virus mail blocker 420 installed in the mail server 410. The virus mail blocking function will be performed. The recipient finally checks the mail list from which the virus mail is removed by the virus mail blocker 420 installed in the mail server 410 of the receiving side or the virus mail blocker U420 installed in the mail client 440 of the recipient (450). The foregoing has outlined rather broadly the features and technical advantages of the present invention in order to better understand the claims of the invention that will be described later. Additional features and advantages that make up the claims of the present invention will be described below. It should be appreciated by those skilled in the art that the conception and specific embodiment of the invention disclosed can be readily used as a basis for designing or modifying other structures for carrying out similar purposes to the invention. The inventive concepts and embodiments disclosed herein can be used by those skilled in the art as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. In addition, such modifications or altered equivalent structures by those skilled in the art may be variously changed, substituted, and changed without departing from the spirit or scope of the invention described in the claims.

delete

According to the present invention, since the virus mail distributed by the intention of infecting the recipient's computer system and files is inherently blocked, the recipient does not suffer any damage from the virus mail.

1 is a flowchart of a virus mail treatment process using a conventional antivirus program.

Fig. 2 is a block diagram showing each part constituting an email.

Figure 3 is a flow chart and functional configuration showing the operation principle of the virus mail blocker according to the present invention.

Fig. 4 is a block diagram showing the mail system configuration of the receiving side to which the virus mail blocker is applied.

Claims (3)

A method of filtering and blocking email sent over a network, (a) The received email is identified and separated into a header (S210) and a body (S220) through a parsing process, and the body (S220) is separated into a message (S221) and content (S222) and extracted again. Doing; (b) If the content S222 is present in step (a), the file included in the detailed content has an extension such as exe, com, bat, lnk, scr, pif, or a specific recognition code at the beginning of the file. Determining whether a file exists in an executable format and whether a content ID exists; (c) separating and filtering the e-mail when the two discrimination conditions of step (b) are satisfied; Email filtering method comprising a. delete delete