Patent ID: 7917951

Claim:
A method of detecting an item of malware carried by an e-mail message, said method comprising the steps of: receiving from a remote source an e-mail identifying content filtering rule defining one or more characteristics of an e-mail message indicative of said e-mail message carrying said item of malware; receiving a target e-mail message; applying said e-mail identifying content filtering rule to said target e-mail message to detect if said target e-mail message has said one or more characteristics; and if said target e-mail message has said one or more characteristics, then triggering a suspected malware found action; wherein detection action of said e-mail identifying content filtering rule is reported with a detection activity report to a remote report collector; wherein said detection activity report includes an indication of whether a target e-mail message which has said one or more characteristics was inbound to a predetermined computer network or outbound from said predetermined computer network; wherein said suspected malware found action includes suspending delivery of said target e-mail message; wherein said one or more characteristics include one or more of: a sender field matching predetermined characteristics; a relay field matching predetermined characteristics; a subject field matching predetermined characteristics; a body message matching predetermined characteristics; an attachment having a file type matching predetermined characteristics; an attachment having a filename matching predetermined characteristics; and Simple Mail Transfer Protocol (SMTP) structure matching predetermined characteristics; wherein said e-mail identifying content filtering rule is auto-rescinding in response to detection of predetermined conditions.