Executable content filtering

An apparatus comprising:

• a set of one or more processor units;
• a network interface operable to receive a network message and coupled with the set of one or more processor units;
• and
• an executable content message stream filter module coupled with the network interface, the executable content message filter module operable to:
• determine a type of a network message;
• load a configuration file based on the type of the network message, wherein the configuration file indicates a plurality of rule sets for the type of the network message;
• instantiate a plurality of executable content filters based on the plurality of rule sets, wherein the plurality of executable content filters target executable content of a stream of parsed elements of the network message in accordance with the plurality of rule sets, wherein each of the plurality of executable content filters operates within a set of one or more scopes of the network message;
• for each of the plurality of executable content filters that operates within more than one scope of the network message, track which scope of the network message is being filtered;
• for each of the plurality of executable content filters, determine if one or more of the stream of parsed elements includes executable content targeted by the executable content filter;
• and
• modify those of the stream of parsed elements that include the executable content targeted by the plurality of executable content filters in accordance with the plurality of rule sets to disable the executable content.