Patent ID: 7237008
Filing Date: 2007-06-26
Classification: G06Q,H04L

Abstract:
1. A computer program product embodied on a tangible computer readable medium operable to control a computer to detect an item of malware carried by an e-mail message, said computer program product comprising: rule receiving code operable to receive from a remote source an e-mail identifying content filtering rule defining one or more characteristics of an e-mail message indicative of said e-mail message carrying said item of malware; message receiving code operable to receive a target e-mail message; content filtering code operable to apply said e-mail identifying content filtering rule to said target e-mail message to detect if said target e-mail message has said one or more characteristics and, if said target e-mail message has said one or more characteristics, then triggering a suspected malware found action; wherein detection action of said e-mail identifying content filtering rule is reported with a detection activity report to a remote report collector; wherein said detection activity report includes an indication of whether a target e-mail message which has said one or more characteristics was inbound to a predetermined computer network or outbound from said predetermined computer network; wherein said suspected malware found action includes suspending delivery of said target e-mail message; wherein a target e-mail message for which delivery has been suspended may be released to be rescanned by one or more content filtering rules at a later time; wherein said one or more characteristics include one or more of: wherein said e-mail identifying content filtering rule is auto-rescinding in response to detection of predetermined conditions.