Understanding the Full Antivirus Internal Scan Engine
The full file-based antivirus module is the software subsystem on the gateway device that scans specific Application Layer traffic to protect users from virus attacks and to prevent viruses from spreading. The antivirus software subsystem consists of a virus signature database, an application proxy, the scan manager, and the scan engine.
Kaspersky Lab provides the scan engine and it works in the following manner:
- A client establishes a TCP connection with a server and then starts a transaction.
- If the application protocol in question is marked for antivirus scanning, the traffic is forwarded to an application proxy for parsing.
- When the scan request is sent, the scan engine scans the data by querying a virus pattern database.
- The scan manager monitors antivirus scanning sessions, checking the properties of the data content against the existing antivirus settings.
- After scanning has occurred, the result is then handled by the scan manager.
The Kaspersky Lab scan engine supports regular file scanning and script file scanning. With regular file scanning, the input object is a regular file. The engine matches the input content with all possible signatures. With script file scanning, the input object is a script file. It can be JavaScript, VBScript, mIRC script, bat scripts (DOS bat files), and other text scripts. The engine matches the input content only with signatures for script files. Script scanning is only applicable for HTML content over the HTTP protocol. There are two criteria for this scan type. First, the content-type field of this HTML document must be text or HTML. Second, there is no content encoding in the HTTP header. If those two criteria are met, an HTML parser is used to parse the HTML document for scripts.
Related Topics
JUNOS Software Feature Support Reference for SRX Series and J Series Devices