Filtering data using malicious reference information

A method, comprising:

• obtaining, by a device, format information from a configuration device,
• the configuration device being different from the device, and
• the format information including information for identifying an encoding format;
• obtaining, by the device, text normalization information associated with transforming portions of data into normalized text;
• receiving, by the device, raw data,
• wherein the raw data contains obfuscated text as a result of transmitting a file using the encoding format,
• wherein characters related to the encoding format are included within text strings, resulting in the obfuscated text;
• identifying, by the device, the encoding format based on the raw data and the format information;
• processing, by the device, the raw data to generate the normalized text based on the encoding format and the text normalization information,
• wherein the normalized text presents text as previously presented in the file before the transmission of the file using the encoding format resulted in the obfuscated text;
• determining, by the device, that a first text string in the normalized text matches a second text string in a malicious reference feed;
• determining, by the device, whether the normalized text includes one or more malicious references identified by the malicious reference feed based on the first text string matching the second text string;
• and
• selectively blocking, by the device, the raw data from being forwarded based on determining that the normalized text includes the one or more malicious references.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive raw data,
• wherein the raw data contains obfuscated text as a result of transmitting a file using an encoding format,
• wherein characters related to the encoding format are included within text strings, resulting in the obfuscated text;
• identify the encoding format, associated with the raw data, based on format information,
• the format information including information for identifying the encoding format;
• obtain text normalization information associated with transforming portions of data into normalized text;
• process the raw data to generate the normalized text based on the encoding format and the text normalization information,
• wherein the normalized text presents text as previously presented in the file before the transmission of the file using the encoding format resulted in the obfuscated text;
• determine that a first text string in the normalized text matches a second text string in a malicious reference feed;
• determine whether the normalized text includes one or more malicious references identified by the malicious reference feed based on the first text string matching the second text string;
• and
• selectively drop the raw data based on determining that the normalized text includes the one or more malicious references.