METHOD AND APPARATUS FOR PROVIDING NETWORK SECURITY BY SCANNING FOR VIRUSES

• US 20090307776A1
• Filed: 03/14/2007
• Published: 12/10/2009
• Est. Priority Date: 03/14/2006
• Status: Abandoned Application

• Current Assignee: BAE Systems Plc
• Original Assignee: BAE Systems Plc
• Inventors: Curnyn, Jon
• Application Number:
  US12/282,318
• Publication Number:
  US 20090307776A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The invention relates to the provision of virus scanning capabilities in a network environment. A plurality of preliminary content processing functions are carried out on content passed over the network before the content is passed to one or more virus scanners. The virus scanners then scan the content for viruses using one or more results of the content processing functions.

Claims

1. :

A network security apparatus, comprising;

one or more network traffic processors adapted to receive network traffic and to extract a data stream from the network traffic;

content processing means adapted to perform one or more preliminary content functions upon content in the data stream, thereby creating one or more function results, the function results defining one or more characteristics of the content; and

,

one or more scanners adapted to use the function results to scan the content for viruses.

2. :

An apparatus according to claim 1, further comprising a programmable interface adapted to control which preliminary content functions are performed on the content.

3. :

An apparatus according to claim 2, wherein the programmable interface is adapted to call one or more further preliminary content functions in dependence on results provided by one or more of the scanners.

4. :

An apparatus according to claim 1, wherein the preliminary content functions include decompression.

5. :

An apparatus according to claim 1, wherein the preliminary content functions include one or more of the following;

pattern matching, attribute checking, and op-code distribution processing.

6. :

An apparatus according to claim 1, wherein the preliminary content functions include one or more of the following;

protocol decode, e-mail decode, and e-mail formatting.

7. :

An apparatus according to claim 1, wherein the preliminary content processing functions include logging statistical data relating to the content.

8. :

An apparatus according to claim 1, wherein the preliminary content functions include storing samples of the content.

9. :

An apparatus according to claim 1, wherein the content processing means comprises a plurality of content engines.

10. :

An apparatus according to claim 1, further comprising a stream manager adapted to pass the data stream between the content processing means and the scanners as required.

11. :

A method for scanning network traffic for viruses, comprising the steps of;

extracting a data stream from network traffic;

performing one or more preliminary content functions upon content in the data stream, thereby creating one or more function results, the function results defining one or more characteristics of the content; and

,

scanning the content for viruses using the function results.

12. :

A method according to claim 11, further comprising the step of performing one or more further preliminary content functions in dependence on results of scanning the content.

13. :

A method according to claim 11, wherein the preliminary content functions include decompression.

14. :

A method according to claim 11, wherein the preliminary content functions include one or more of the following;

pattern matching, attribute checking, and op-code distribution processing.

15. :

A method according to claim 11, wherein the preliminary content functions include one or more of the following;

protocol decode, e-mail decode, and e-mail formatting.

16. :

A method according to claim 11, wherein the preliminary content processing functions include logging statistical data relating to the content.

17. :

A method according to, claim 11 wherein the preliminary content functions include storing samples of the content.