Patent ID: 7539871

Claim:
A method of tracking incoming transmissions comprising: identifying an incoming transmission including at least one identifiable portion; computing, for each identifiable portion in the incoming transmission, a fingerprint indicative of the at least one identified portion, the fingerprint being substantially unique to the at least one identified portion; storing the computed fingerprint to generate a set of stored fingerprints in a hardware implemented mail server; receiving at the hardware implemented mail server a set of comparison fingerprints corresponding to a known portion of the incoming transmission, the set of comparison fingerprints being predetermined; comparing at the hardware implemented mail server the set of stored fingerprints to the set of comparison fingerprints to identify stored fingerprints matching at least one of the set of comparison fingerprints and, if a match is found, identifying a previous incoming transmission corresponding to a matching stored fingerprint of the set of stored fingerprints; storing an indication of a subsequent disposition of the incoming transmission in the hardware implemented mail server; receiving at the hardware implemented mail server a subsequent set of comparison fingerprints, the subsequent set of comparison fingerprints indicative of refinements to the known portion of the incoming transmission; matching the subsequent set of comparison fingerprints to the stored fingerprints at the hardware implemented mail server; determining, based on the matching of the subsequent set of comparison fingerprints, if the subsequent set of comparison fingerprints is indicative of an undesirable portion in the incoming transmission at the hardware implemented mail server; selectively performing, based on the determining, a remedial action in response to the subsequent disposition at the hardware implemented mail server; wherein the set of comparison fingerprints are virus signatures computed from known undesirable transactions; demarcating the incoming transmission into segments at the hardware implemented mail server, each segment operable to yield a fingerprint, wherein the comparing further comprises comparing each value in the set of comparison fingerprints with at least one of the segments at the hardware implemented mail server; identifying a segment type of each segment, the segment type corresponding to the content included in the segment; categorizing each of the segments according to a heuristic, the heuristic indicative of a likelihood of the categorized segment including an undesirable transmission; identifying a risk assessment of each of the segment types; and storing the segment according to the identified risk assessment, storing further including identifying a duration.