| 摘要 |
An apparatus and a method for preventing mass-mailing worm is provided to enable the blocking of new and mutant warm by discriminating an MM(Mass Mailing) warm based on the execution of warm in a virtual environment. A virtualization detection module(200) reads out an attached file stored at a mail storage database(120) by a mail proxy module(110), and loads the attached file to a memory of a virtual operating system and executes the file to judge whether or not the read attached file is an MM warm. The virtualization detection module monitors whether or not the attached file has the same pattern as the virtual MM warm detection pattern stored at a virtualization MM warm detection pattern database(210). If so, an inspection mail processing unit(220) controls the mail proxy module to store the corresponding mail to an isolation database for MM warm confirmation mail. |
