System and method for providing passive screening of transient messages in a distributed computing environment

A method for providing passive screening of transient messages in a distributed computing environment, comprising:

• passively monitoring a transient packet stream at a network boundary comprising receiving incoming datagrams structured in compliance with a network protocol layer;
• reassembling one or more of the incoming datagrams into a segment structured in compliance with a transport protocol layer;
• scanning contents of the reassembled segment for a presence of at least one of a computer virus and malware to identify infected message contents;
• processing each reassembled datagram based on the transport protocol layer employed by the reassembled datagram;
• and
• sending a spoofed network protocol packet responsive to an occurrence of at least one of an infection and a network attack;
• wherein the spoofed network protocol packet spoofs an origin server by being utilized to send a legitimate packet to a network domain in place of an infected packet.

A system for passively detecting computer viruses and malware and denial of service-type network attacks in a distributed computing environment, comprising:

• a network interface receiving copies of datagrams transiting a boundary of a network domain into an incoming packet queue, each datagram being copied from a packet stream;
• a packet receiver reassembling one or more such datagrams from the incoming packet queue into network protocol packets, each staged in a reassembled packet queue;
• an antivirus scanner scanning each network protocol packet from the reassembled packet queue to ascertain an infection of at least one of a computer virus and malware;
• an event correlator evaluating events identified from the datagrams in the packet stream to detect a denial of service-type network attack on the network domain;
• and
• a spoof module sending a spoofed network protocol packet responsive to an occurrence of at least one of the infection and the network attack;
• wherein a protocol-specific module processes each reassembled datagram based on an upper protocol layer employed by the reassembled datagram;
• wherein the spoofed network protocol packet spoofs an origin server by being utilized to send a legitimate packet to the network domain in place of an infected packet.

A method for passively detecting computer viruses and malware and denial of service-type network attacks in a distributed computing environment, comprising:

• receiving copies of datagrams transiting a boundary of a network domain into an incoming packet queue, each datagram being copied from a packet stream;
• reassembling one or more such datagrams from the incoming packet queue into network protocol packets, each staged in a reassembled packet queue;
• scanning each network protocol packet form the reassembled packet queue to ascertain an infection of at least one of a computer virus and malware;
• evaluating events identified from the datagrams in the packet stream to detect a denial of service-type network attack on the network domain;
• and
• sending a spoofed network protocol packet responsive to an occurrence of at least one of the infection and the network attack;
• wherein a protocol-specific module processes each reassembled datagram based on an upper protocol layer employed by the reassembled datagram;
• wherein the spoofed network protocol packet spoofs an origin server by being utilized to send a legitimate packet to the network domain in place of an infected packet.