Feedback Email Worm Defense System For Enterprise Networks

As email becomes one of the most convenient and indispensable communication mediums in our life, it is very important to protect email users from increasing email worm attacks. In this paper, we present the architecture and system design of a "feedback email worm defense system" to protect email users in enterprise networks. The defense system is flexible and able to integrate many existing detection techniques to provide e#ective and e#cient email worm defense. First, in response to a "detection score" of a detected worm email and information on the possible appearance of a malicious email worm in the global Internet, the defense system adaptively chooses a cost-e#ective defense action that can range from simply labelling this email to aggressively deleting it from an email server. Second, the system uses "honeypot" [13] to thoroughly detect worm emails received by email servers and also to early detect the presence of an email worm in the global Internet. Third, the defense system implements a "multi-sifting detection" technique and "di#erential email service" to achieve accurate detection without causing much delay on most emails. Furthermore, the defense system separates email attachments from email texts and saves attachments in separate "attachment caching servers", which facilitate both email worm detection and email service e#ciency. 1