Patent ID: 9294487
Filing Date: 2016-03-22
CPC Classification: G06F,H04L

Claim Text:
1. A method for providing network security, comprising the steps of: receiving a plurality of packets of a communication, each packet having a header and payload; extracting the payload from each of the plurality of packets of the communication and combining the extracted payload from each of the plurality of packets into an aggregate content, the plurality of packets having an associated source and destination; identifying, with a content processing component, a type of content of the aggregate content to determine whether to scan the aggregate content; generating, in response to the determination whether to scan the aggregate content, a threat profile for the aggregate content, with the content processing component, by inspecting at least a sub-set of the aggregate content, the threat profile depending upon at least one of an application for which the at least a sub-set of the aggregate content is intended, a program by which the at least a sub-set of the aggregate content is used, the type of content and a protocol type employed by the at least a sub-set of the aggregate content, wherein the content processing component comprises a plurality of types of content engine, each being configured to perform one or more different content processing functions; calculating at least one digest of at least a portion of the aggregated content, wherein a number of calculated digests is based on an application for which the at least a portion of the aggregate content is intended; determining whether the at least a sub-set of the aggregate content has been previously scanned based on a comparison of the calculated at least one digest with digests stored in a storage device, wherein scan results are indexed by digests; scanning, in response to the determination whether to scan the aggregate content when the at least a sub-set of the aggregate content has not been previously scanned, the at least a sub-set of the aggregate content with one or more scanners of a heterogeneous array of scanners, the one or more scanners being selected in dependence on the threat profile; controlling, in response to the determination whether to scan the aggregate content, access to at least a part of the plurality of packets according to the results of scanning the at least a sub-set of the aggregate content by the selected one or more scanners; retrieving a scan result corresponding to the calculated at least one digest when the calculated digest is determined to match a stored digest; and controlling access to at least a part of the plurality of packets according to the retrieved scan result.