Abstract: A method and apparatus for managing connections and messages at a server by associating different actions for both different senders and different recipients is disclosed. The server manages connections from different senders by receiving incoming connections from the different senders and determining sender identifiers for the incoming connections. The server inspects a mapping of sender identifiers to actions to identify which action should be applied to each incoming connection. The server applies the actions, such as accepting the connection, rejecting the connection, relaying the connection, or refusing the connection. Also, the server manages electronic messages for different recipients by determining recipient identifiers for the electronic messages. The server inspects a mapping of recipient identifiers to actions to identify which action should be applied for the recipients of the email messages.

Abstract: Early detection of computer viruses and other message-borne threats is provided by applying heuristic tests to message content and examining sender reputation information when no virus signature information is available. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages. A dynamic and flexible threat quarantine queue is provided with a variety of exit criteria and exit actions that permits early release of messages in other than first in, first-out order. A message scanning method is described in which early exit from parsing and scanning can occur by matching threat rules only to selected message elements and stopping rule matching as soon as a match on one message element exceeds a threat threshold.

Abstract: A method and apparatus for managing connections, email messages, and directory harvest attacks at a server is disclosed. The server maintains a count of a parameter and compares the count to a specified maximum value, such that when the specified maximum value is met or exceeded, an action is taken by the server to limit the connections, email messages, or directory harvest attack. Actions include controlling the number of connections to the server from senders, controlling the flow of email messages injected to the server by senders, and controlling when rejection response messages are sent for invalid recipient email addresses to thwart a directory harvest attack. Senders are identified by one or more sender identifiers, which can be used to group senders together so that the same maximum value is applied collectively to all senders in the group.

Abstract: Techniques are provided for determining a reputation of a message sender by obtaining two or more lists from two or more list providers; determining which lists of the two or more lists indicate the message sender; and determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender. Techniques are also provided for indicating that a message is unsolicited based on a reputation score.

Abstract: Early detection of computer viruses is provided by collecting information about suspicious messages and generating virus outbreak information. In one embodiment, a method comprises receiving the virus outbreak information that has been determined by receiving message information for messages that have characteristics associated with computer viruses, wherein the messages were determined by a virus-check component as not comprising a virus, and mapping the message information received in a specified time period to the virus outbreak information; and when the virus outbreak information indicates initiation of a virus attack, performing a message flow control action for additional messages that have the same characteristics associated with computer viruses as the first messages. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages.

Abstract: Controlling a message quarantine is disclosed. A message scanning method is described in which early exit from parsing and scanning can occur by matching threat rules only to selected message elements and stopping rule matching as soon as a match on one message element exceeds a threat threshold.

Abstract: A method and apparatus for managing information relating to electronic messages is provided. A first set of data related to one or more message senders is obtained from a first source, such as an email sever or email gateway. Each message sender has sent one or more electronic messages. A second set of data related to the one or more message senders is obtained from a second source. Message volume information that describes the messages sent by the one or more message senders for a period of time is determined based on the first set of data and the second set of data. The message volume information may be used to determine whether a particular message sent by a particular message sender is unsolicited. If a particular message is determined to be unsolicited, various actions may be performed on messages sent by the sender of the particular message.

Abstract: Determining whether to quarantine a message is disclosed. A dynamic and flexible threat quarantine queue is provided with a variety of exit criteria and exit actions that permits early release of messages in other than first in, first-out order.

Abstract: Controlling a message quarantine is disclosed. A message scanning method is described in which early exit from parsing and scanning can occur by matching threat rules only to selected message elements and stopping rule matching as soon as a match on one message element exceeds a threat threshold.

Abstract: Early detection of computer viruses and other message-borne threats is provided by applying heuristic tests to message content and examining sender reputation information when no virus signature information is available. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages. A dynamic and flexible threat quarantine queue is provided with a variety of exit criteria and exit actions that permits early release of messages in other than first in, first-out order. A message scanning method is described in which early exit from parsing and scanning can occur by matching threat rules only to selected message elements and stopping rule matching as soon as a match on one message element exceeds a threat threshold.

Abstract: A method and apparatus for managing connections, email messages, and directory harvest attacks at a server is disclosed. The server maintains a count of a parameter and compares the count to a specified maximum value, such that when the specified maximum value is met or exceeded, an action is taken by the server to limit the connections, email messages, or directory harvest attack. Actions include controlling the number of connections to the server from senders, controlling the flow of email messages injected to the server by senders, and controlling when rejection response messages are sent for invalid recipient email addresses to thwart a directory harvest attack. Senders are identified by one or more sender identifiers, which can be used to group senders together so that the same maximum value is applied collectively to all senders in the group.

Abstract: Techniques are provided for determining a reputation of a message sender by obtaining two or more lists from two or more list providers; determining which lists of the two or more lists indicate the message sender; and determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender. Techniques are also provided for indicating that a message is unsolicited based on a reputation score.

Abstract: A method and apparatus for managing connections and messages at a server by associating different actions for both different senders and different recipients is disclosed. The server manages connections from different senders by receiving incoming connections from the different senders and determining sender identifiers for the incoming connections. The server inspects a mapping of sender identifiers to actions to identify which action should be applied to each incoming connection. The server applies the actions, such as accepting the connection, rejecting the connection, relaying the connection, or refusing the connection. Also, the server manages electronic messages for different recipients by determining recipient identifiers for the electronic messages. The server inspects a mapping of recipient identifiers to actions to identify which action should be applied for the recipients of the email messages.

Abstract: Early detection of computer viruses is provided by collecting information about suspicious messages and generating virus outbreak information. In one embodiment, a method comprises receiving the virus outbreak information that has been determined by receiving message information for messages that have characteristics associated with computer viruses, wherein the messages were determined by a virus-check component as not comprising a virus, and mapping the message information received in a specified time period to the virus outbreak information; and when the virus outbreak information indicates initiation of a virus attack, performing a message flow control action for additional messages that have the same characteristics associated with computer viruses as the first messages. As a result, a messaging gateway can suspend delivery of messages early in a virus outbreak, providing sufficient time for updating an anti-virus checker that can strip virus code from the messages.

Abstract: A method and apparatus for managing information relating to electronic messages is provided. A first set of data related to one or more message senders is obtained from a first source, such as an email sever or email gateway. Each message sender has sent one or more electronic messages. A second set of data related to the one or more message senders is obtained from a second source. Message volume information that describes the messages sent by the one or more message senders for a period of time is determined based on the first set of data and the second set of data. The message volume information may be used to determine whether a particular message sent by a particular message sender is unsolicited. If a particular message is determined to be unsolicited, various actions may be performed on messages sent by the sender of the particular message.