Back to results
US 7,023,861 B2Granted
Malware scanning using a network bridge
AssigneeMcAfee, Inc.
InventorsGraham Arthur Makinson, Eamonn John Baulk, Daniel Joseph Wolff
Life of this patent
Estimating the term…
Abstract
A network bridge (14) has an associated malware scanner (16) that serves to concatenate portions of a data file from within data packets intercepted by the network bridge (14) and then scan the data file concerned before the data file is forwarded to its intended recipient by the network bridge (14). The network bridge (14) may be inserted in a network topology without requiring significant network configuration changes. The network bridge (14) may include a packet analysis unit (56) that serves to intercept only data packets having a predetermined network layer protocol or a predetermined application layer protocol.
Claims14
A network bridge, said network bridge including a malware scanner:
- wherein said network bridge is address-transparent with respect to data packets passing therethrough, such that at least in terms of addressing, no configuration changes are required when said network bridge is introduced in an associated network segment;
- wherein, upon receipt of at least one of said data packets, said network bridge determines if said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received;
- wherein, if it is determined that said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received, said at least one data packet is not passed by said network bridge;
- wherein, if it is determined that said at least one data packet is not intended for a recipient on a side of said network bridge on which said at least one data packet was received, it is determined if said at least one data packet has a predetermined network layer protocol selected from the group consisting of TCP/IP;
- IPX;
- SNA;
- and Appletalk;
- wherein, if it is determined that said at least one data packet has said predetermined network layer protocol, it is determined if said at least one data packet has a predetermined application layer protocol selected from the group consisting of SMTP;
- FTP;
- HTTP;
- SMB;
- and NFS;
- wherein, if it is determined that said at least one data packet has said predetermined application layer protocol, portions of a data file from a plurality of said data packets are concatenated to form a data file to be scanned;
- wherein, if it is determined that said at least one data packet does not have said predetermined application layer protocol, said at least one data packet is passed by said network bridge without being scanned.
11 more elements
A network bridge comprising:
- means for intercepting at least one data packet,
- means for forwarding at least a portion of said at least one data packet to a malware scanner for scanning, and
- means for forwarding data from said at least one data packet after scanning to an intended recipient;
- wherein said network bridge is address-transparent with respect to data packets passing therethrough, such that at least in terms of addressing, no configuration changes are required when said network bridge is introduced in an associated network segment;
- wherein, upon receipt of at least one of said data packets, said network bridge determines if said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received;
- wherein, if it is determined that said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received, said at least one data packet is not passed by said network bridge;
- wherein, if it is determined that said at least one data packet is not intended for a recipient on a side of said network bridge on which said at least one data packet was received, it is determined if said at least one data packet has a predetermined network layer protocol selected from the group consisting of TCP/IP;
- IPX;
- SNA;
- and Appletalk;
- wherein, if it is determined that said at least one data packet has said predetermined network layer protocol, it is determined if said at least one data packet has a predetermined application layer protocol selected from the group consisting of SMTP;
- FTP;
- HTTP;
- SMB;
- and NFS;
- wherein, if it is determined that said at least one data packet has said predetermined application layer protocol, portions of a data file from a plurality of said data packets are concatenated to form a data file to be scanned;
- wherein, if it is determined that said at least one data packet does not have said predetermined application layer protocol, said at least one data packet is passed by said network bridge without being scanned.
14 more elements
A malware scanner in combination with a network bridge, comprising:
- means for receiving at least a portion of at least one data packet intercepted by said network bridge,
- means for concatenating said at least one data packet into a data file to be scanned, and
- means for forwarding said data file after scanning to an intended recipient via said network bridge;
- wherein said network bridge is address-transparent with respect to data packets passing therethrough, such that at least in terms of addressing, no configuration changes are required when said network bridge is introduced in an associated network segment;
- wherein, upon receipt of at least one of said data packets, said network bridge determines if said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received;
- wherein, if it is determined that said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received, said at least one data packet is not passed by said network bridge;
- wherein, if it is determined that said at least one data packet is not intended for a recipient on a side of said network bridge on which said at least one data packet was received, it is determined if said at least one data packet has a predetermined network layer protocol selected from the group consisting of TCP/IP;
- IPX;
- SNA;
- and Appletalk;
- wherein, if it is determined that said at least one data packet has said predetermined network layer protocol, it is determined if said at least one data packet has a predetermined application layer protocol selected from the group consisting of SMTP;
- FTP;
- HTTP;
- SMB;
- and NFS;
- wherein, if it is determined that said at least one data packet has said predetermined application layer protocol, portions of a data file from a plurality of said data packets are concatenated to form a data file to be scanned;
- wherein, if it is determined that said at least one data packet does not have said predetermined application layer protocol said at least one data packet is passed by said network bridge without being scanned.
14 more elements
A method of malware scanning comprising the steps of:
- receiving at least one data packet at a network bridge;
- sending at least a portion of said at least one data packet from said network bridge to a malware scanner;
- concatenating data received by said malware scanner to form a data file to be scanned;
- scanning said data file with said malware scanner;
- and
- forwarding said data file after scanning via said network bridge to an intended recipient;
- wherein said network bridge is address-transparent with respect to data packets passing therethrough, such that at least in terms of addressing, no configuration changes are required when said network bridge is introduced in an associated network segment;
- wherein, upon receipt of at least one of said data packets, said network bridge determines if said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received;
- wherein, if it is determined that said at least one data packet is intended for a recipient on a side of said network bridge on which said at least one data packet was received, said at least one data packet is not passed by said network bridge;
- wherein, if it is determined tat said at least one data packet is not intended for a recipient on a side of said network bridge on which said at least one data packet was received, it is determined if said at least one data packet has a predetermined network layer protocol selected from the group consisting of TCP/IP;
- IPX;
- SNA;
- and Appletalk;
- wherein, if it is determined that said at least one data packet has said predetermined network layer protocol, it is determined if said at least one data packet has a predetermined application layer protocol selected from the group consisting of SMTP;
- FTP;
- HTTP;
- SMB;
- and NFS;
- wherein, if it is determined that said at least one data packet has said predetermined application layer protocol, portions of a data file from a plurality of said data packets are concatenated to form a data file to be scanned;
- wherein, if it is determined that said at least one data packet does not have said predetermined application layer protocol, said at least one data packet is passed by said network bridge without being scanned.
17 more elements
Dependencies are inferred from the claim text.