Patent Document ID: 20110179487
Application ID: 12690638
Patent Status: 0

Claim One:
1. A computing system implemented process for employing honeypot systems to identify potential malware containing messages comprising: providing one or more honeypot computing systems; providing one or more decoy e-mail addresses associated with the one or more honeypot computing systems; receiving one or more e-mails at one of the one or more decoy e-mail addresses associated with the one or more honeypot computing systems; using one or more processors associated with one or more computing systems to perform a preliminary filtering of the one or more e-mails received at the one or more decoy e-mail addresses associated with one or more honeypot computing systems; as a result of the preliminary filtering of the one or more e-mails received at the one or more decoy e-mail addresses associated with one or more honeypot computing systems, identifying one or more of the one or more e-mails as potential malware containing e-mails; using one or more processors associated with one or more computing systems to extract one or more features, or feature values, associated with the identified potential malware containing e-mails; defining a burst threshold for one or more of the extracted one or more features, or feature values, associated with the identified potential malware containing e-mails, such that if one or more of the extracted one or more features, or feature values, associated with the identified potential malware containing e-mails, occurs more than the burst threshold number of times for the feature, or feature value, in a defined period of time, the feature, or feature value, is considered an indicator of a malware containing e-mail; using one or more processors associated with one or more computing systems to detect that an extracted feature, or feature value, associated with the identified potential malware containing e-mails, occurs more than the burst threshold number of times for the feature, or feature value, in the defined period of time; transforming a status of the feature, or feature value, associated with the identified potential malware containing e-mails to the status of suspicious e-mail parameter; and using one or more processors associated with one or more computing systems to distribute the suspicious e-mail parameter to one or more security systems or one or more e-mail systems for use in identifying potential malware containing e-mails being sent to one or more user computing systems through the one or more security systems or the one or more e-mail systems.