Method, apparatus and system for detecting unwanted digital content delivered to a mail box

Abstract

Email messages stored on a mail server are filtered to identify the email messages that contain unwanted content. The mail server receives incoming email messages over a network. A content filter performs an initial scan to identify the incoming email messages that contain unwanted content by determining whether signatures associated with the email messages are included on a list of signatures that identify email messages that are known to include unwanted content. The email messages that are not identified as containing unwanted content are forwarded to appropriate mail boxes on the mail server. Multiple scanning threads perform a subsequent scan of the email messages in the mail boxes to identify those email messages containing unwanted content that were not identified by the initial scan. The subsequent scan determines whether signatures associated with the email messages in the mail boxes are included in an updated list of the signatures.

What is claimed is: 
     
         1 . A server system comprising:
 a content filter comprising a first list of signatures that identifies email messages that are known to include unwanted content, wherein the content filter performs a first scan on an incoming email message to determine whether a signature associated with the incoming email message is included on the first list of signatures, the first list of signatures being updated to comprise a second list of signatures that identifies email messages that are known to include unwanted content; and   a mail store comprising a mail box for storing the incoming email message after the first scan is performed;   wherein in the event that the first scan determines that a signature associated with the incoming email message is not included in the first list of signatures, the content filter performs a second scan on the incoming email message in the mail box to determine whether a signature associated with the incoming email message is included on the second list of signatures.   
     
     
         2 . The server system of  claim 1  wherein:
 in the event that the first scan determines that a signature associated with the incoming email message is not included in the first list of signatures, the email message is stored in an inbox folder of the mail box, and 
 in the event that the second scan determines that the signature associated with the incoming email message is included in the second list of signatures, the email message is moved from the inbox folder to a junk folder of the mail box. 
 
     
     
         3 . The server system of  claim 1  wherein in the event that the second scan determines that the signature associated with the incoming email message is included in the second list of signatures, the incoming email message is discarded. 
     
     
         4 . The server system of  claim 1  wherein an incoming email message is identified as having been re-scanned after the second scan is performed such that a subsequent scan will not be performed on the incoming email message identified as having been re-scanned. 
     
     
         5 . A method for detecting unwanted digital content, the method comprising:
 receiving digital content at a mail server system;   performing a first scan of the digital content, wherein the first scan determines whether a signature associated with the digital content is included in a first list of signatures corresponding to unwanted digital content;   determining in the first scan that the signature associated with the digital content is not included in the first list of signatures;   responsive to the determination that the signature associated with the digital content is not included in the first list of signatures, forwarding the digital content to a mailbox associated with a user; and   performing a second scan of the digital content in the mailbox, wherein the second scan determines whether the signature associated with the digital content is included in a second list of signatures corresponding to unwanted digital content.   
     
     
         6 . The method of  claim 5 , wherein the second list of signatures is an updated list of the first list of signatures. 
     
     
         7 . The method of  claim 5 , wherein the digital content is forwarded to an inbox folder of the mailbox. 
     
     
         8 . The method of  claim 7 , further comprising:
 determining in the second scan that the signature associated with the digital content is included in the second list of signatures; and   responsive to the determination that the signature associated with the digital content is included in the second list of signatures, removing the digital content from the inbox folder.   
     
     
         9 . The method of  claim 5 , further comprising:
 determining in the second scan that the signature associated with the digital content is included in the second list of signatures; and   responsive to the determination that the signature associated with the digital content is included in the second list of signatures, discarding the digital content.   
     
     
         10 . A server system comprising:
 a communication interface;   at least one processor; and   a computer-readable medium having computer-executable instructions embodied thereon, wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to:   receive digital content via the communication interface;   perform a first scan of the digital content, wherein the first scan determines whether a signature associated with the digital content is included in a first list of signatures corresponding to unwanted digital content;   determine in the first scan that the signature associated with the digital content is not included in the first list of signatures;   responsive to the determination that the signature associated with the digital content is not included in the first list of signatures, forward the digital content to a mailbox associated with a user; and   perform a second scan of the digital content in the mailbox, wherein the second scan determines whether the signature associated with the digital content is included in a second list of signatures corresponding to unwanted digital content.   
     
     
         11 . The server system of  claim 10 , wherein the second list of signatures is an updated list of the first list of signatures. 
     
     
         12 . The server system of  claim 10 , wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to forward the digital content to an inbox folder of the mailbox. 
     
     
         13 . The server system of  claim 12 , wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to:
 determine in the second scan that the signature associated with the digital content is included in the second list of signatures; and   responsive to the determination that the signature associated with the digital content is included in the second list of signatures, remove the digital content from the inbox folder.   
     
     
         14 . The server system of  claim 10 , wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to:
 determine in the second scan that the signature associated with the digital content is included in the second list of signatures; and   responsive to the determination that the signature associated with the digital content is included in the second list of signatures, discard the digital content.   
     
     
         15 . A server system comprising:
 a communication interface configured to receive email messages;   a mail store configured to store a plurality of mail boxes;   at least one processor; and   a computer-readable medium having computer-executable instructions embodied thereon, wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to:   perform a first scan of an email message received over the communication interface to determine whether the email message includes unwanted content, wherein the first scan is performed by executing an algorithm to determine whether a signature associated with the email message is included in a first list of signatures that identify email messages known to include unwanted content;   forward the email message to an appropriate one of the mail boxes after the first scan is performed; and   in the event that the first scan determines that the first scan determines that the email message does not include unwanted content, perform a second scan of the email message in the appropriate one of the mail boxes, after the email message is forwarded, to determine whether the email message includes unwanted content.   
     
     
         16 . The server system of  claim 15 , wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to:
 determine in the first scan that the email message does not include unwanted content;   determine in the second scan that the email message contains unwanted content; and   limit access to the email message after the second scan is performed.   
     
     
         17 . The server system of  claim 16 , wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to limit access to the email message by moving the email message to a junk email folder. 
     
     
         18 . The server system of  claim 16 , wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to limit access to the email message by deleting the email message. 
     
     
         19 . The server system of  claim 15 , wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to perform the second scan by determining whether a signature associated with the email message is included in a second list of signatures that identify email messages known to include unwanted content, the second list of signatures being an updated version of the first list of signatures. 
     
     
         20 . The server system of  claim 15 , wherein the computer-executable instructions, when executed by the at least one processor, cause the server system to perform the second scan by executing a second algorithm. 
     
     
         21 . The server system of  claim 15 , wherein the computer-executable instructions, when executed by the at least one processor, further cause the server system to:
 identify the email message as having been re-scanned after the second scan is performed on the email message, wherein a subsequent scan will not be performed on the email message identified as having been re-scanned.