Abstract: Methods, apparati, and computer-readable media for detecting the presence of malicious computer code in a plurality of e-mails. In a method embodiment of the present invention, the following steps are performed for each e-mail: calculating a feature vector (80), said feature vector (80) being representative of a presence of at least one preselected feature in the e-mail; calculating at least one score (S) based upon said feature vector (80), each said score (S) being representative of a frequency of occurrence of an instance of a feature; determining whether any score (S) exceeds a preselected malicious threshold representative of malicious computer code; and when a score (S) exceeds a preselected malicious threshold, blocking said e-mail.

Abstract: Methods, systems, and computer readable media utilize a stream manager (101) to efficiently scan stream (105) based data (103). A stream manager (101) receives (801) data (103) from a stream (105). The stream manager (101) makes (807) received data (103) serially available to a plurality of modify scanners (109) in a specific order, and makes (809) received data (103) available in parallel to a plurality of read-only scanners (111). The stream manager (101), responsive to data (103) having been released by each modify scanner (109) of the plurality and by each read-only scanner (111) of the plurality, transmits (515) released data (103) to a destination (113).

Abstract: Methods, systems, and computer readable media utilize a stream manager (101) to efficiently scan stream (105) based data (103). A stream manager (101) receives (801) data (103) from a stream (105). The stream manager (101) makes (807) received data (103) serially available to a plurality of modify scanners (109) in a specific order, and makes (809) received data (103) available in parallel to a plurality of read-only scanners (111). The stream manager (101), responsive to data (103) having been released by each modify scanner (109) of the plurality and by each read-only scanner (111) of the plurality, transmits (515) released data (103) to a destination (113).

Abstract: Methods, apparati, and computer-readable media for detecting the presence of malicious computer code in a plurality of e-mails. In a method embodiment of the present invention, the following steps are performed for each e-mail: calculating a feature vector (80), said feature vector (80) being representative of a presence of at least one preselected feature in the e-mail; calculating at least one score (S) based upon said feature vector (80), each said score (S) being representative of a frequency of occurrence of an instance of a feature; determining whether any score (S) exceeds a preselected malicious threshold representative of malicious computer code; and when a score (S) exceeds a preselected malicious threshold, blocking said e-mail.