Patent ID: 7343624
Filing Date: 2008-03-11
Classification: G06F,H04L

Abstract:
1. A method of evaluating a message for infectious file attachments, comprising: receiving a message, the message including an attachment having a file name; comparing the file name of the attachment with a plurality of previously received legitimate messages having a legitimate attachment, the legitimate messages including a legitimate attachment file name; identifying an anomaly in the file name of the attachment for the message with respect to a file name of the legitimate attachment for one or more of the plurality of previously received legitimate messages; executing a second test in response to identification of the file name anomaly, wherein the second test identifies the presence of a further anomaly related to the file name of the attachment; calculating a probability as to whether the attachment is infectious based on the presence of the identified file name anomaly and the results of the second test; and forwarding the message to a data store for subsequent processing, the data store associated with the probability as to whether the attachment is infectious.