Network security apparatus which extracts a data stream from network traffic and performs an initial operation on the data before scanning for viruses.

摘要

Disclosed is a network security apparatus and a method of operating said apparatus. The apparatus has one or more network traffic processors receiving network traffic and extracting a data stream. A content processing means then perform a preliminary content function on the content of the data stream creating function results. Scanners are then use the function results to scan the content for viruses. The apparatus may include a programmable interface to control which preliminary content functions are performed on the content and to control which further functions are called, in dependence on the results of the scanner results. The preliminary content functions may be decompression, pattern matching, attribute checking, op-code distribution processing, protocol decode, e-mail decode or e-mail formatting. The apparatus may also log statistical data relating to the content and store samples of the content.