WO2004098148A1 - A method of, and system for detecting mass mailing computer viruses - Google Patents
A method of, and system for detecting mass mailing computer viruses Download PDFInfo
- Publication number
- WO2004098148A1 WO2004098148A1 PCT/GB2004/000990 GB2004000990W WO2004098148A1 WO 2004098148 A1 WO2004098148 A1 WO 2004098148A1 GB 2004000990 W GB2004000990 W GB 2004000990W WO 2004098148 A1 WO2004098148 A1 WO 2004098148A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- attachment
- attachments
- examining
- created
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims description 18
- 241000700605 Viruses Species 0.000 title abstract description 12
- 230000003612 virological effect Effects 0.000 claims description 14
- 230000011664 signaling Effects 0.000 claims description 8
- 230000002155 anti-virotic effect Effects 0.000 abstract description 5
- 239000000284 extract Substances 0.000 abstract description 5
- 238000004458 analytical method Methods 0.000 description 4
- 238000001514 detection method Methods 0.000 description 4
- 241000452734 Eudoraea Species 0.000 description 3
- 235000006508 Nelumbo nucifera Nutrition 0.000 description 1
- 240000002853 Nelumbo nucifera Species 0.000 description 1
- 235000006510 Nelumbo pentapetala Nutrition 0.000 description 1
- 150000001875 compounds Chemical class 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
- H04L51/07—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail characterised by the inclusion of specific contents
- H04L51/08—Annexed information, e.g. attachments
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
- H04L51/07—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail characterised by the inclusion of specific contents
- H04L51/18—Commands or executable codes
Definitions
- the present invention relates to a method of, and system for, detecting mass mailing viruses
- the internet and local- and wide-area networks are susceptible to the exploits of mass mailing viruses.
- these viruses involve an email with an executable attachment which, when it executes, causes more virus-containing emails to be created and sent, flooding the network w ith traffic and its email users with unwanted emails.
- These mass mailing viruses have become increasingly sophisticated early forms of them chose the addressees from the name and address book associated with the recipient's email client, while more recent forms use a variety of techniques to gather addresses
- signature scanning where a file, an executable attachment in the case of email, is scanned for signatures, I e sequences, or patterns of sequences, of bytes which have been identified as characteristic of particular viruses
- signature-based scanning is not particularly effective for dealing with mass mailing viruses, because the time taken for the vims to do its work and cause copies of itself to be sent is small compared with the time it takes for anti-virus software houses to disseminate updates to their system to deal with it when an outbreak of a new vims occurs
- This is particularly a problem where the anti-virus service is being operated on behalf of a large number of users, as may be the case where an ISP (Internet Service Provider) carries out anti-vims scanning, of email and other files in transit, on behalf of customers as a value-added service.
- ISP Internet Service Provider
- the present invention is based upon an appreciation of the fact that concentrating on executable attachments overlooks a fertile source of viral-indicating information, namely the email itself and operates by carefully considering the whole email, rather than just the attachments
- a method of anti-virus processing an email having one or more executable attachments comprising the steps, executed by a machine, of a) extracting structural elements from the email, b) examining the executable attachments for code, data or encoded data that could have created the structural elements extracted earlier; and c) examining signalling that the attachment is possibly viral or not on the basis of the extent to which the examining step b) finds evidence that the structural elements have been created.
- the invention also provides a system for anti-vims processing an email having an executable attachment comprising the following means, implemented by a machine: a) means for extracting structural elements from the email; b) means for examining the executable attachments for code, data or encoded data that could have created the structural elements extracted earlier; and c) means for signalling that the attachment is possibly viral or not on the basis of the extent to which the examining step b) finds evidence that the structural elements have been created by that attachment.
- FIG. 1 illustrates one embodiment of system according to the present invention.
- the system 100 operates on emails arriving at an input 101 and processes each one to signal either at an output 102 that the system regards that email as non-viral or at an output 103 that the system regards it as viral or possibly viral.
- the system may be operated as a stand-alone system, or as part of a larger anti vims system either as the module with responsibility for processing e-mails or in conjunction with additional subsystems which apply additional vims-detection heuristics to emails which it has signalled as possibly viral.
- the system 100 operates on the basis that by carefully considering the email as a whole, rather than just the attachments, it is possible to greatly increase the chances of detecting mass mailing viruses.
- Each email client creates emails in its own unique way, producing what one might term an email 'fingerprint' which is discernible in emails created by it.
- By examining the structure of emails it is possible with some certainty to say, for instance, that a particular email was created by Microsoft Outlook, or Lotus Notes, or Eudora.
- Mass mailing vimses are also one form of email client, since they generate emails, and they will create emails with a particular fingerprint.
- the system 100 operates according to the following algorithm:
- a 'gatherer' 104 takes the email from input 101, and creates fingerprint information about the email structure.
- An 'extractor' 105 extracts the next attachment from the email. If there are no more attachments left, processing stops.
- An 'exception checker' 107 checks for known exceptions. If an exception list match is found, return to step 2.
- the gatherer 104 parses the email, searching for structural information. For example, this could include (but is not limited to) the following: • Standard Mime headers created
- Encoding method used for attachments Text content of the email HTML/XHTML content of the email
- a simple implementation of the extractor 105 parses the email, presenting attachments in turn to the analyser/matcher 106. This can be improved by recursively analysing compound attachments. For instance, if the attachment is an archive such as a ZIP file, it will extract each file, presenting these in rum to the analyser/matcher 106. If these files are also archives, these will also be extracted in rum and so on until no more extraction can be done. Files packed using packers such as UPX or ASPack can be unpacked. Self-extracting executables can have the files they contain extracted.
- the extractor 105 can also have extra logic to detect situations where a malicious attacker tries to attack the system by sending files that extract to extremely large sizes, or that take a very long time to extract.
- the analyser/matcher 105 analyses the file to try and determine whether it contains code that creates emails matching the fingerprint created by the gatherer.
- Each match-type is assigned a certain score. For instance, a match of a particular deviation from an RFC standard may score X, and a match of the text content of the email may score Y. Scores are added together and if they pass a set value, this is deemed a match.
- the analyser/matcher 106 can be incredibly simple. For instance, an analyser that merely extracts strings from a file using the standard linux 'strings' command (which returns the strings of printable characters in a file), and matches these against the text content of the email, is sufficient to detect most mass mailing vimses currently in existence.
- the exception checker 107 contains mles to filter out false positives that have occurred in the past. For instance, if someone uses the Eudora email client to mail a copy of Eudora to a friend, the fingerprints will match the attachment causing the email to be treated as viral. This can be overcome by for instance, creating an MD5 checksum of the attachment, and comparing to a list of known MD5 checksums for standard mail clients; the exception checker can then recognise these known email clients and ignore them. MD5 is an example of a checksum or hashing method sensitive enough to detect whether even a single bit in the data from which the checksum is derived has been changed.
- the system 100 can be used as a stand-alone vims detection algorithm, or combined with others implementing other vims-detection techniques as part of a larger system. For instance, files flagged as mass mailing vimses by this method may be allocated a certain score, or variety of scores depending which tests pass and fail. File which score some matches, but not enough for the matcher to flag as a mass mailing vims may be assigned a lower score.
- Code analysis can also be used by the analyser/matcher 106.
- the MIME headers in a mail will be present in a certain order, and if it can be ascertained by code analysis that the attachment creates emails with the MIME headers in that exact order, then this is a very good sign that the attachment created the email.
- a simple implementation can be achieved by finding references in the code to the data areas used to constmct the email, and then noting the order in which these references occur. Vims writers often encode parts of the data area of their programs in order to try and hide what they are doing. Attempts can be made in various ways to match parts of the email to data which is encrypted in the attachment. For instance, if the email contains the text: we seem to sew this might be encoded as er drrz yp dre First we number the string
- the potential encoded string so far seems to be the same as the original string, but with the letter 'e' replacing the letter V and letter V replacing the letter 'e ⁇ If we can repeat this test successfully for each different character in the original string, then it is highly likely that the second string really is an encoded version of the original string.
- the analyser/matcher 106 may be arranged to execute algorithms such as the one just described in order to find evidence that the attacliment could have created stmctural elements of the email.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Information Transfer Between Computers (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/500,960 US7472284B2 (en) | 2003-04-25 | 2004-03-08 | Method of, and system for detecting mass mailing viruses |
EP04718333.0A EP1620991B1 (en) | 2003-04-25 | 2004-03-08 | Method and system for detecting mass mailing computer viruses |
AU2004234909A AU2004234909B2 (en) | 2003-04-25 | 2004-03-08 | A method of, and system for detecting mass mailing computer viruses |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB0309465A GB2400934B (en) | 2003-04-25 | 2003-04-25 | A method of,and system for detecting mass mailing viruses |
GB0309465.3 | 2003-04-25 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2004098148A1 true WO2004098148A1 (en) | 2004-11-11 |
Family
ID=33042178
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/GB2004/000990 WO2004098148A1 (en) | 2003-04-25 | 2004-03-08 | A method of, and system for detecting mass mailing computer viruses |
Country Status (6)
Country | Link |
---|---|
US (1) | US7472284B2 (en) |
EP (1) | EP1620991B1 (en) |
AU (1) | AU2004234909B2 (en) |
GB (1) | GB2400934B (en) |
HK (1) | HK1070706A1 (en) |
WO (1) | WO2004098148A1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7520883B2 (en) | 2002-06-20 | 2009-04-21 | Tyco Healthcare Group Lp | Method and apparatus for anastomosis including an anchoring sleeve |
US7998154B2 (en) | 2002-06-19 | 2011-08-16 | Tyco Healthcare Group Lp | Method and apparatus for radical prostatectomy anastomosis |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8544097B2 (en) * | 2005-10-14 | 2013-09-24 | Sistema Universitario Ana G. Mendez, Inc. | Attachment chain tracing scheme for email virus detection and control |
US20090013405A1 (en) * | 2007-07-06 | 2009-01-08 | Messagelabs Limited | Heuristic detection of malicious code |
US8202063B2 (en) * | 2009-04-30 | 2012-06-19 | Briggs & Stratton Corporation | Base plate for power equipment configured for mounting an engine and a tool |
US20120323775A1 (en) * | 2011-06-14 | 2012-12-20 | Bank Of America | Enhanced searchability of fields associated with online billpay memo data |
US8893278B1 (en) | 2011-07-12 | 2014-11-18 | Trustwave Holdings, Inc. | Detecting malware communication on an infected computing device |
RU2487405C1 (en) | 2011-11-24 | 2013-07-10 | Закрытое акционерное общество "Лаборатория Касперского" | System and method for correcting antivirus records |
US9135439B2 (en) | 2012-10-05 | 2015-09-15 | Trustwave Holdings, Inc. | Methods and apparatus to detect risks using application layer protocol headers |
US9471783B2 (en) | 2013-03-15 | 2016-10-18 | Mcafee, Inc. | Generic unpacking of applications for malware detection |
WO2015100327A1 (en) | 2013-12-26 | 2015-07-02 | Mcafee, Inc. | Generic unpacking of program binaries |
US10721198B1 (en) * | 2019-04-15 | 2020-07-21 | Microsoft Technology Licensing, Llc | Reducing avoidable transmission of an attachment to a message by comparing the fingerprint of a received attachment to that of a previously received attachment and indicating to the transmitting user when a match occurs that the attachment does not need to be transmitted |
US10721193B1 (en) * | 2019-04-15 | 2020-07-21 | Microsoft Technology Licensing, Llc | Reducing avoidable transmission of an attachment to a message by comparing the fingerprint of the attachment to be sent to that of an attachment that was previously sent or received by the user and indicating to the user when a match occurs that the attachment is redundant |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002019069A2 (en) * | 2000-08-31 | 2002-03-07 | Clearswift Limited | Monitoring electronic mail message digests |
US20020199120A1 (en) * | 2001-05-04 | 2002-12-26 | Schmidt Jeffrey A. | Monitored network security bridge system and method |
EP1280039A2 (en) * | 2001-07-26 | 2003-01-29 | Networks Associates Technology, Inc. | Detecting e-mail propagated malware |
US20030079142A1 (en) * | 2001-10-22 | 2003-04-24 | Aladdin Knowledge Systems Ltd. | Classifying digital object security category |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5832208A (en) * | 1996-09-05 | 1998-11-03 | Cheyenne Software International Sales Corp. | Anti-virus agent for use with databases and mail servers |
GB0016835D0 (en) * | 2000-07-07 | 2000-08-30 | Messagelabs Limited | Method of, and system for, processing email |
US7487544B2 (en) * | 2001-07-30 | 2009-02-03 | The Trustees Of Columbia University In The City Of New York | System and methods for detection of new malicious executables |
US7657935B2 (en) * | 2001-08-16 | 2010-02-02 | The Trustees Of Columbia University In The City Of New York | System and methods for detecting malicious email transmission |
-
2003
- 2003-04-25 GB GB0309465A patent/GB2400934B/en not_active Expired - Fee Related
-
2004
- 2004-03-08 AU AU2004234909A patent/AU2004234909B2/en not_active Ceased
- 2004-03-08 US US10/500,960 patent/US7472284B2/en active Active
- 2004-03-08 EP EP04718333.0A patent/EP1620991B1/en not_active Expired - Lifetime
- 2004-03-08 WO PCT/GB2004/000990 patent/WO2004098148A1/en active Application Filing
-
2005
- 2005-03-15 HK HK05102245A patent/HK1070706A1/en not_active IP Right Cessation
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002019069A2 (en) * | 2000-08-31 | 2002-03-07 | Clearswift Limited | Monitoring electronic mail message digests |
US20020199120A1 (en) * | 2001-05-04 | 2002-12-26 | Schmidt Jeffrey A. | Monitored network security bridge system and method |
EP1280039A2 (en) * | 2001-07-26 | 2003-01-29 | Networks Associates Technology, Inc. | Detecting e-mail propagated malware |
US20030079142A1 (en) * | 2001-10-22 | 2003-04-24 | Aladdin Knowledge Systems Ltd. | Classifying digital object security category |
Non-Patent Citations (1)
Title |
---|
"Postfix Configuration - UCE Controls", INTERNET CITATION, 13 April 2003 (2003-04-13), pages 1 - 12, XP002287121, Retrieved from the Internet <URL:http://web.archive.org/web/20030413192015/http://www.postfix.org/uce.html> [retrieved on 20040705] * |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7998154B2 (en) | 2002-06-19 | 2011-08-16 | Tyco Healthcare Group Lp | Method and apparatus for radical prostatectomy anastomosis |
US8486095B2 (en) | 2002-06-19 | 2013-07-16 | Covidien Lp | Method and apparatus for radical prostatectomy anastomosis |
US7520883B2 (en) | 2002-06-20 | 2009-04-21 | Tyco Healthcare Group Lp | Method and apparatus for anastomosis including an anchoring sleeve |
US8109950B2 (en) | 2002-06-20 | 2012-02-07 | Tyco Healthcare Group Lp | Method and apparatus for anastomosis including an anchoring sleeve |
Also Published As
Publication number | Publication date |
---|---|
US20050091512A1 (en) | 2005-04-28 |
AU2004234909B2 (en) | 2008-10-09 |
AU2004234909A1 (en) | 2004-11-11 |
US7472284B2 (en) | 2008-12-30 |
GB2400934B (en) | 2005-12-14 |
EP1620991A1 (en) | 2006-02-01 |
EP1620991B1 (en) | 2018-11-07 |
HK1070706A1 (en) | 2005-06-24 |
GB2400934A (en) | 2004-10-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7664754B2 (en) | Method of, and system for, heuristically detecting viruses in executable code | |
Stolfo et al. | Towards stealthy malware detection | |
EP1891571B1 (en) | Resisting the spread of unwanted code and data | |
US9774607B2 (en) | Detection of undesired computer files using digital certificates | |
US20020004908A1 (en) | Electronic mail message anti-virus system and method | |
US7493658B2 (en) | System for and method of detecting malware in macros and executable scripts | |
EP1620991B1 (en) | Method and system for detecting mass mailing computer viruses | |
EP1560112B1 (en) | Detection of files that do not contain executable code | |
US8365283B1 (en) | Detecting mutating malware using fingerprints | |
EP2278516A1 (en) | Detection and minimization of false positives in anti-malware processing | |
US20090013405A1 (en) | Heuristic detection of malicious code | |
CN101611412A (en) | To stoping the improvement of harmful code and data diffusion | |
WO2012112944A2 (en) | Managing unwanted communications using template generation and fingerprint comparison features | |
US20050080816A1 (en) | Method of, and system for, heurisically determining that an unknown file is harmless by using traffic heuristics | |
WO2008068459A2 (en) | Detecting exploits in electronic objects | |
US7389538B2 (en) | Static code image modeling and recognition | |
WO2005103895A1 (en) | Computer virus unique information extraction device, computer virus unique information extraction method, and computer virus unique information extraction program | |
US7448085B1 (en) | Method and apparatus for detecting malicious content in protected archives | |
Pungila | Hybrid compression of the aho-corasick automaton for static analysis in intrusion detection systems | |
Policicchio | Bulk Analysis of Malicious PDF Documents | |
Venmaa Devi et al. | R4 Model For Malware Detection And Prevention Using Case Based Reasoning | |
CITP et al. | Detecting Unknown Viruses | |
Dai | Malicious PDF Document Analysis |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 10500960 Country of ref document: US |
|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): BW GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2004718333 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2004234909 Country of ref document: AU |
|
ENP | Entry into the national phase |
Ref document number: 2004234909 Country of ref document: AU Date of ref document: 20040308 Kind code of ref document: A |
|
WWP | Wipo information: published in national office |
Ref document number: 2004234909 Country of ref document: AU |
|
WWP | Wipo information: published in national office |
Ref document number: 2004718333 Country of ref document: EP |