SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR PREVENTING COMMUNICATION OF UNWANTED NETWORK TRAFFIC BY HOLDING ONLY A LAST PORTION OF THE NETWORK TRAFFIC

• US 20130263248A1
• Filed: 05/10/2013
• Published: 10/03/2013
• Est. Priority Date: 10/05/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Garrick Zhu, Zheng Bu
• Inventors: Bu, Zheng, Zhu, Garrick
• Granted Patent: US 8,910,269 B2
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are provided for preventing communication of unwanted network traffic by holding only a last portion of the network traffic. In use, network traffic associated with a file transfer is received. Additionally, only a last portion of the network traffic associated with the file transfer is held for determining whether the file is unwanted. Further, the last portion of the network traffic associated with the file transfer is conditionally forwarded to a destination device, based on the determination.

Claims

1. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code to receive network traffic through an input port, where the network traffic is segmented into predetermined portion types and the content of the network traffic is associated with a file being transferred from a source device to a destination device,

computer code to determine identifying information regarding the file;

computer code to employ the identifying information to consult a file reputation database over a network;

computer code to receive a message based upon the consultation with the file reputation database;

computer code to prevent passage to the destination device of a last portion of network traffic until the message is received, and

computer code to conditionally forward the last portion of the network traffic associated with the file transfer if the message does not indicate that the file is unwanted;

wherein the last portion of network traffic comprises a positive integer quantity of the predetermined portion types.

2. The computer program product of claim 1, wherein the predetermined portion type is a packet.

3. The computer program product of claim 1 further comprising computer code to identify the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

4. The computer program product of claim 1, wherein the identifying information includes a hash of the file.

5. The computer program product of claim 1 further comprising computer code to prevent forwarding the last portion of network traffic if the message indicates the file is unwanted.

19. The computer program product of claim 1, wherein the message is based at least in part upon a comparison of the identifying information with data regarding known unwanted files.

20. The computer program product of claim 1, further comprising computer code to read a network header.

6. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code to receive network traffic associated with a file being transferred from a source device to a destination device, wherein the network traffic is segmented into predetermined portion types;

computer code to determine information regarding the file;

computer code to employ the information regarding the file to consult a computing resource, the consultation regarding whether the file is unwanted;

computer code to receive from the computing resource a message, the message based upon information received over a network and the message indicating whether or not the file is unwanted;

computer code to prevent passage to the destination device by a last portion of network traffic associated with the file transfer, until the message is received; and

computer code to forward the last portion of the network traffic to the destination device if the message does not indicate that the file is unwanted;

wherein the last portion of network traffic comprises a positive integer quantity of the predetermined portion types.

7. The computer program product of claim 6, wherein the predetermined portion type is a packet.

8. The computer program product of claim 6 further comprising computer code to identify the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

9. The computer program product of claim 6, wherein the information regarding the file includes a hash of the file.

10. The computer program product of claim 6 further comprising computer code to prevent forwarding the last portion of network traffic, if the message indicates the file is unwanted.

11. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code to receive network traffic through an input port, the network traffic being segmented into predetermined portion types and associated with a file being transferred to a destination device;

computer code to determine identifying information regarding the file;

computer code to create a query based upon the identifying information;

computer code to employ the query to consult a database, the consultation regarding whether the file is unwanted;

computer code to receive a query result as a response to the consultation, the query result based upon information received over a network and through a second input port, the query result also indicating whether or not the file is unwanted;

computer code to prevent passage to the destination device of a last portion of network traffic associated with the file transfer until the query result is received; and

computer code to forward, through an output port, the last portion of the network traffic if the query result does not indicate that the file is unwanted;

wherein the last portion of network traffic comprise a positive integer quantity of the predetermined portion types.

12. The computer program product of claim 11, wherein the predetermined portion type is a packet.

13. The computer program product of claim 11 further comprising computer code to identify the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

14. The computer program product of claim 11, wherein the identifying information includes a hash of the file.

15. The computer program product of claim 11, wherein the query result is based at least in part upon a comparison of the identifying information with data regarding known unwanted files.

16. The computer program product of claim 11, further comprising computer code to read a network header.

17. The computer program product of claim 11 further comprising computer code to prevent forwarding the last portion of network traffic if the query result indicates the file is unwanted.

18. The method of claim 11, wherein the input part and the second input part are different.