Reply Mailer Virus Detection via Reply Time and Attachment Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are ineffective in detecting and defending against reply mailer viruses, which propagate by rapidly generating infected reply emails with attachments, as they lack distinctive traffic patterns and often mimic legitimate automated responses, leading to undetected infections until specific virus signatures are developed.
Innovation Solution
A computer program product and method that detect reply messages generated in less than a threshold reply time with specific attachment status, identifying infected messages by combining rapid generation and attachment presence, thereby providing early defense against malware without relying on specific virus signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing email monitoring techniques are used to detect mass mailer viruses, then characteristic patterns of email traffic can be identified, but reply mailer viruses cannot be detected because they do not produce characteristic traffic patterns
Solution Approach 1:
The invention changes the detection parameters from traffic pattern analysis to behavioral parameter analysis. Instead of monitoring email volume, recipient count, or traffic distribution, the system monitors reply time parameters and attachment status parameters. This parameter change enables detection of reply mailer viruses that do not exhibit characteristic traffic patterns but do exhibit characteristic behavioral parameters such as rapid automated replies with attachments.
2Reliability
If reply time threshold is set to detect rapid automated replies, then infected reply messages can be identified, but false alarms may occur from legitimate automated responses
Solution Approach 1:
The invention merges multiple detection criteria into a combined detection rule: reply time threshold AND attachment status threshold. Instead of relying solely on reply time (which causes false positives from legitimate automated responses), the system combines it with attachment status analysis. Both conditions must be met for an email to be flagged as suspicious, significantly reducing false alarms while maintaining detection of actual threats.
3Reliability
If attachment status monitoring is added to reply time detection, then false alarms from legitimate automated responses are reduced, but detection complexity increases
Solution Approach 1:
The invention leverages existing email system capabilities to monitor attachment status without requiring complex external analysis tools. The email server or scanning system already has access to attachment metadata (presence, size, type) as part of normal email processing. By utilizing these self-available data sources, the system adds detection capability without proportionally increasing complexity.
Data Source
AI summary
A technique for identifying reply mailer computer program viruses detects whether a reply message is generated in less than a threshold reply time and whether or not the reply message includes an attachment. The generation of a reply message in less than a threshold reply time and including an attachment is deemed indicative of an infected reply message and accordingly that message will be quarantined, deleted, disinfected or the like. The mail server using the present technique maintains a temporary log of email messages sent indicating the sender, the recipient, and the time of sending. This log is used to identify replies and determine whether or not those replies have been received in less than the reply threshold time.