Patent ID: 7748038
Filing Date: 2010-06-29
Classification: G06F,H04L

Abstract:
1. A method, comprising the computer-implemented steps of: receiving one or more sets of message information for one or more first messages that are suspected to be associated with computer viruses; sending the one or more sets of message information to a virus-check component to determine whether the one or more first messages comprise one or more viruses; receiving an indication from the virus-check component that the one or more first messages do not comprise any viruses; in response to receiving the indication that the one or more first messages do not comprise any viruses and that the one or more first messages was sent from a source not known to be associated with viruses but that sent a large number of messages according to a message sending pattern suspected to be associated with computer viruses and comprising at least one attachment, and based on mapping the one or more sets of message information received in a specified time period to virus outbreak information by generating a current average virus score value by combining one or more prior virus score values associated with respective one or more prior time periods, generating a percent-of-normal virus score value by comparing the current average virus score value with a long-term average virus score value and mapping the percent-of-normal virus score value to a range of virus score values, determining that the one or more first messages do comprise one or more viruses; and in response to the determining that the one or more first messages do comprise one or more viruses, performing a message flow control action for one or more second messages that are also suspected to be associated with computer viruses as the one or more first messages; wherein the method is performed by one or more processors.