Patent ID: 8544097

Claim:
A computer-implemented method for email virus detection comprising the steps of: providing an attachment chain tracing server configured to monitor a plurality of emails sent from a plurality of computer hosts connected in a network, wherein each email is associated to a computer host; identifying at said attachment chain tracing server at least one email with attachment sent from a computer host; executing at said attachment chain tracing server a case finding routine based on said identifying step to detect at least one computer host with at least one previous defined symptom; executing at said attachment chain tracing server a transmission chain management routine based on the outcome of said case finding routine, said transmission chain management routine: a) determines if a computer host that has showed a symptom has no epidemiological link from any computer host and establishes a contact trace stack beginning with an index layer assigned to said computer host that has showed a symptom but has no epidemiological link from any computer host and additional successive layers, wherein each of said additional successive layers stores contacts which are computer hosts having epidemiological links from any contact of an immediate preceding layer; b) determines if a computer host that has showed a symptom has an epidemiological link so that said computer host is already stored on a layer of an existing contact trace stack and adds a successive layer to said layer, wherein a length of said contact trace stack is defined by its amount of layers; and detecting an email virus based on said transmission chain management routine when the length of said contact trace stack reaches a preset value.