An Effective Scheme for Email Virus Detection and Containment

Email has evolved to be a convenient and important communication media. It greatly facilitates the communication among people from all over the world. The existence of all kinds of free email services makes email communication even more attractive. The convenience and popularity of emails has also made them ideal vehicles to spread computer worms and viruses. Email viruses and worms have appeared more frequently in recent months. How to detect and contain the spread of email viruses and worms while minimizing the side effects on normal email communications is a very important topic. This paper proposes an email virus detection and containment scheme to address this issue. Our scheme is inspired by the infectious disease control schemes used in real world. An infected computer is identified if it meets two conditions. Firstly, the computer has to demonstrate abnormal behavior by sending out large number of emails with attachments. Secondly, some of the computers which receive these emails have to demonstrate similar abnormal behavior. We propose to apply the "stone-in-the-pond" principle to reduce the overhead of the email virus detection system. The identified infected computers can then be isolated. Simulation experiments demonstrate that our proposed scheme is effective in controlling the spread of email viruses.