System, method, and computer program product for preventing communication of unwanted network traffic by holding only a last portion of the network traffic

• US 8,448,232 B1
• Filed: 08/15/2011
• Issued: 05/21/2013
• Est. Priority Date: 10/05/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Zhu, Ge, Bu, Zheng
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US13/210,070
• Time in Patent Office: 645 Days
• Field of Search: 709217-228
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are provided for preventing communication of unwanted network traffic by holding only a last portion of the network traffic. In use, network traffic associated with a file transfer is received. Additionally, only a last portion of the network traffic associated with the file transfer is held for determining whether the file is unwanted. Further, the last portion of the network traffic associated with the file transfer is conditionally forwarded to a destination device, based on the determination.

Claims

1. A method, comprising:

receiving, through an input port, network traffic associated with a file being transferred from a source device to a destination device, wherein the network traffic is segmented into predetermined portion types;

determining, by a processor, identifying information regarding the file;

employing the identifying information to consult a file reputation database over a network;

receiving, through a second input port, a message based upon the consultation with the file reputation database;

until the message is received, preventing passage to the destination device of a last portion of network traffic associated with the file transfer; and

forwarding, through an output port, the last portion of the network traffic when the message does not indicate that the file is unwanted;

wherein the last portion of network traffic comprise a positive integer quantity of the predetermined portion types.

2. The method of claim 1, wherein the predetermined portion type is a packet.

3. The method of claim 1 comprising the further step of identifying the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

4. The method of claim 1, wherein the identifying information includes a hash of the file.

5. The method of claim 1 comprising the further step of not forwarding the last portion of network traffic, if the message indicates the file is unwanted.

6. A method, comprising:

receiving, through an input port, network traffic associated with a file being transferred from a source device to a destination device, wherein the network traffic is segmented into predetermined portion types;

determining, by a processor, information regarding the file;

employing the information regarding the file to consult a computing resource, the consultation regarding whether the file is unwanted;

receiving, from the computing resource as a response to the consultation, a message based upon information received over a network and through a second input port, the message indicating whether or not the file is unwanted;

until the message is received, preventing passage to the destination device of a last portion of network traffic associated with the file transfer; and

forwarding, through an output port, the last portion of the network traffic when the message does not indicate that the file is unwanted;

wherein the last portion of network traffic comprise a positive integer quantity of the predetermined portion types.

7. The method of claim 6, wherein the predetermined portion type is a packet.

8. The method of claim 6 comprising the further step of identifying the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

9. The method of claim 6, wherein the information regarding the file includes a hash of the file.

10. The method of claim 6 comprising the further step of not forwarding the last portion of network traffic, if the message indicates the file is unwanted.

11. A method, comprising:

receiving, through an input port, network traffic associated with a file being transferred to a destination device, wherein the network traffic is segmented into predetermined portion types;

determining, by a processor, identifying information regarding the file;

creating a query based upon the identifying information;

employing the query to consult a database, the consultation regarding whether the file is unwanted;

receiving a query result as a response to the consultation, the query result based upon information received over a network and through a second input port, the query result also indicating whether or not the file is unwanted;

until the query result is received, preventing passage to the destination device of a last portion of network traffic associated with the file transfer; and

forwarding, through an output port, the last portion of the network traffic when the query result does not indicate that the file is unwanted;

wherein the last portion of network traffic comprise a positive integer quantity of the predetermined portion types.

12. The method of claim 11, wherein the predetermined portion type is a packet.

13. The method of claim 11 comprising the further step of identifying the last portion of network traffic by comparing a size of the file to a size of all received portions of the network traffic.

14. The method of claim 11, wherein the identifying information includes a hash of the file.

15. The method of claim 11 comprising the further step of not forwarding the last portion of network traffic, if the query result indicates the file is unwanted.