Patent ID: 8903920

Claim:
In a packet network for selectively communicating messages between a plurality of messaging clients, said messaging clients comprising a first network malware evaluator conditioned by training to learn characteristics of malware messages, a method practiced at said first network malware evaluator, the method comprising accepting received messages from at least one other of said messaging clients, said received messages being suspected of containing malware, said received messages comprising forwarded messages from at least one other of said messaging clients, at least some of said forwarded messages received at said first network malware evaluator comprising flagged information indicative of suspicious malware content, updating said training at said first network malware evaluator in response to said received messages at said first malware evaluator, and when said first network malware evaluator achieves a level of training sufficient to allow a classification of messages received at said first malware evaluator with a predetermined likelihood, generating a classification indication for at least selected ones of said received messages, the classification indication selected from the group of classification indications comprising (i) a malware-present indication, and (ii) a malware-not-present indication.