Patent ID: 7373664
Filing Date: 2008-05-13
Classification: G06F,H04L

Abstract:
1. A method for detecting the presence of malicious computer code in a plurality of e-mails, said method comprising, for each e-mail, the steps of: calculating a feature vector, said feature vector being representative of a presence of a plurality of preselected features in the e-mail, wherein a feature bin table is updated with an entry for each preselected feature and wherein at least one preselected feature is based on a file attached to the e-mail and at least one preselected feature is based on a script associated with the email; calculating at least one decaying weighted score based upon said feature vector, wherein each said score is calculated based on a number of entries in the feature bin table within a current time window, an application of a first decay function to a value which indicates a number of deleted entries in the feature bin table and an application of a second decay function to at least a first previously calculated at least one score based upon said feature vector; determining whether any score exceeds a preselected malicious threshold representative of malicious computer code; and when a score exceeds a preselected malicious threshold, blocking said e-mail.