Patent ID: 8533834

Claim:
A method comprising: receiving, by a network device, a packet from a device in a network; identifying, by the network device, a plurality of data transactions associated with the packet; assessing, by the network device, a risk level associated with a particular data transaction of the plurality of data transactions; performing, by the network device, a content type check for the particular data transaction; performing, by the network device, an infected content check for the particular data transaction; classifying, by the network device, the particular data transaction for a fast path virus scanning process based on the risk level, the content type check, and the infected content check; sending, by the network device and after classifying the particular data transaction for the fast path virus scanning process, a first portion of data, associated with the particular data transaction, to a destination device before scanning the data for a virus; detecting, by the network device and after classifying the particular data transaction for the fast path virus scanning process, the virus in a second portion of the data; and terminating, by the network device and based on the particular data transaction being classified for the fast path virus scanning process, a connection for the particular data transaction after sending the first portion of the data and after detecting the virus in the second portion of the data.