Patent ID: 8510839
Filing Date: 2013-08-13
Classification: G06Q,H04L

Abstract:
1. A method, comprising: receiving an e-mail message at a computer; evaluating characteristics of the e-mail message based on a set of filtering rules that are distinct from virus definition data, wherein the set of filtering rules are to be accessed by a malware scanner configured for scanning e-mail traffic propagating in a network environment, wherein the evaluating of the characteristics is performed without identifying offending virus code within a file in the e-mail message; using the characteristics to determine that the e-mail message includes malware for which there is no current virus definition data, wherein the set of filtering rules have an associated priority level indicative of a security threat posed by certain types of malware, and wherein an identification of certain malware instances in outbound e-mail messages of a particular network results in a high priority designation for the particular network to receive updated virus definition data; rescinding a particular one of the filtering rules, which was temporary, based, at least in part, on new virus definition data becoming available; determining whether a threshold number of trigger levels of a particular one of the filtering rules has been exceeded; and generating a detection activity report based on the threshold number of trigger levels.