System and method for near-real time network attack detection, and system and method for unified detection via detection routing

A system, comprising:

• a storage device configured to store unique identifiers for data blocks and indications associated with the stored unique identifiers whether each of the data blocks is good or bad;
• a processor device configured to:
• capture data that includes a data block;
• generate a unique identifier for the data block, the unique identifier including a hash value corresponding to the data block;
• receive a declaration of interest in one or more file-types including a file-type of the data block from one or more file-type specific detection components;
• determine whether the data block is indicated as good or bad in the unique identifier in the storage device;
• call all of the one-or more file-type specific detection component that declared interest in the file-type of the data block so that each of the one or more file-type specific detection components that declared interest in the file-type of the data block will perform inspect the data block so as to detect whether the file is malicious and each return a result of its own file inspection, and store the result of the full file inspection indicating whether the file is good or bad together with the unique identifier of the data block in the storage device, when the data block is determined to be not indicated in the unique identifier in the storage device;
• not call any of the one or more file-type specific detection components when the data block is determined to be indicated as good in the unique identifier in the storage device;
• and
• not call any of the one or more file-type specific detection components when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issue an alert indicating that the data block that was received is bad.

A method, comprising:

• in a processor device, receiving network traffic that includes a data block;
• generating a unique identifier for the data block as the data block is received in network traffic, the unique identifier including a hash value corresponding to the data block contents;
• determining during a packet scan operation on the network traffic of the packet that includes the data block whether the data block is indicated as good or bad in the unique identifier in the storage device;
• calling a file-type specific detection nugget corresponding to a file-type of the data block to perform a full file inspection of the data block so as to detect whether the file is malicious, and store a result of the full file inspection indicating whether the file is good or bad together with the unique identifier of the data block in the storage device, when the data block is determined to be not indicated in the unique identifier in the storage device;
• not calling the file-type specific detection nugget when the data block is determined to be indicated as good in the unique identifier in the storage device;
• and
• not calling the file-type specific detection nugget when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issue an alert indicating that the data block that was received is bad.

A method, comprising:

• in a storage device, storing unique identifiers for data blocks and indications associated with the stored unique identifiers whether each of the data blocks is good or bad;
• in a processor device, capturing data that includes a data block;
• generating a unique identifier for the data block, the unique identifier including a hash value corresponding to the data block;
• receiving a declaration of interest in one or more file-types including a file-type of the data block from one or more file-type specific detection components;
• determining whether the data block is indicated as good or bad in the unique identifier in the storage device;
• calling all of the one-or more file-type specific detection component that declared interest in the file-type of the data block so that each of the one or more file-type specific detection components that declared interest in the file-type of the data block will perform inspect the data block so as to detect whether the file is malicious and each return a result of its own file inspection, and store the result of the full file inspection indicating whether the file is good or bad together with the unique identifier of the data block in the storage device, when the data block is determined to be not indicated in the unique identifier in the storage device;
• not calling any of the one or more file-type specific detection components when the data block is determined to be indicated as good in the unique identifier in the storage device;
• and
• not calling any of the one or more file-type specific detection components when the data block is determined to be indicated as bad in the unique identifier in the storage device, and issuing an alert indicating that the data block that was received is bad.