Adaptive firewall model to detect email viruses

This paper presents an adaptive approach to preventing the damage caused by viruses that travel via email. The approach protects intranet machines from outside infected machines by spreading email viruses. This directly addresses the two ways that viruses cause damage: less machines spreading the virus will reduce the number of machines infected and reduce the traffic generated by the virus. We present our firewall model and address how to detect email viruses based on protocol sanity, probabilistic estimation of maliciousness, and patterns recognition.