systems information about misclassified messages information from databases of known spam such as distributed checksum clearinghouse http www rhyolite com anti spam dcc and razor http razor sourceforge net 2 virus information from virus signatures or other sources of virus information such as virus alert newsletters and or virus alert databases the system can use this information to develop virus information before signatures are available this information can be obtained from anti virus vendors sophos and mcafee for example this information can be retrieved via http ftp smtp by direct database access or other appropriate means in some embodiments the system can create rules to block virus outbreaks before virus signatures are available as well as for deployments that do not have other anti virus systems deployed 3 intrusion information this information can be extracted from vulnerability alerts from sources such as bugtraq cert software vendors open source projects information sharing projects such as the fbi infragard or other sources as appropriate the information can also be received from distributed intrusion detection systems or it can be manually entered by users the system can perform input parsing and feature extraction according to input type and source in the case of spam messages the input can include spam messages that are stored in proprietary formats such as microsoft 39 s pst format unix mbox format forwarded spam or spam sent as an attachment an archive of spam messages or other source the spam messages can be accessed from local storage or from remote storage using protocols such as.