Patent ID: 7712136

Claim:
An apparatus, comprising: a network interface; one or more processors coupled to the network interface; logic coupled to the one or more processors which, when executed by the one or more processors, causes the one or more processors to perform: receiving and storing a plurality of rules specifying one or more criteria for electronic messages that indicate threats associated with the messages, wherein each rule has a priority value, wherein each rule is associated with a message element type, and wherein each rule has a weight proportional to a number of criteria specified in the rule; receiving an electronic mail message having a destination address for a recipient account, wherein the message comprises a plurality of message elements; extracting a first message element; determining a set of matching rules for the message by matching only the first message element to only selected rules having a message element type corresponding to the first message element, and according to an order of the priorities of the selected rules; computing a threat score value as a weighted average value of virus score values returned by each rule from the set of matching rules, by computing a first sum of products of each of the virus score values returned by the matching rules multiplied by the weight associated with the matching rule, and dividing the first sum by a second sum of the weights associated with the matching rules; when the threat score value is greater than a specified threshold, outputting the threat score value.