Reassembly free deep packet inspection for peer to peer networks

A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to implement a method for scanning computer data, the method comprising:

• scanning at an application layer in a peer-to-peer network an out of order first portion of a dataset from an input state associated with a portion of a set of malware, wherein the out of order first portion of the dataset is sent to a destination after the scanning of the out of order first portion of the dataset;
• identifying that the dataset could include the set of malware based on the scanning of the out of order first portion of the dataset from the state associated with the portion of the set of malware;
• scanning at the application layer in the peer-to-peer network a second out of order portion of the dataset that immediately precedes the first out of order portion of the dataset, the scanning of the second out of order portion of the dataset resulting in a generation of an output state that matches the input state;
• and
• blocking the second portion of the out of order dataset from being sent to the destination based on the output state matching the input state and an identification that the set of dataset could include the set of malware.

An apparatus for scanning computer data, the apparatus comprising:

• a memory;
• and
• a processor that executes instructions out of the memory to:
• scan at an application layer in a peer-to-peer network an out of order first portion of a dataset from an input state associated with a portion of a set of malware, wherein the out of order first portion of the dataset is sent to a destination after the scanning of the out of order first portion of the dataset,
• identify that the dataset could include the set of malware based on the scanning of the out of order first portion of the dataset from the state associated with the portion of the set of malware,
• scan at the application layer in the peer-to-peer network a second out of order portion of the dataset that immediately precedes the first out of order portion of the dataset, the scanning of the second out of order portion of the dataset resulting in a generation of an output state that matches the input state, and
• block the second portion of the out of order dataset from being sent to the destination based on the output state matching the input state and an identification that the set of dataset could include the set of malware.