Patent ID: 7802303

Claim:
A method of detecting a computer virus in a data stream in a computer network, the method comprising: receiving a data stream in a protocol parser, the data stream carrying a file in an application layer, the protocol parser extracting compressed portions of the file from the application layer; streaming the compressed portions of the file to a decompressor as the protocol parser is still extracting other compressed portions of the file from the application layer, the decompressor decompressing the compressed portions of the file to generate plain portions of the file without receiving the entirety of the file from the protocol parser; and streaming the plain portions of the file to a pattern matching engine as the decompressor is still decompressing the other compressed portions of the file, the pattern matching engine sequentially scanning the plain portions of the file for computer viruses without receiving an entirety of the file; wherein the pattern matching engine scans the plain portions of the file for computer viruses by comparing the plain portions of the file against virus signatures, each virus signature comprising: a first signature segment and a second signature segment, each of the first and second signature segments comprising a byte string indicative of a computer virus; and a distance information specifying a distance between the first and second signature segments in the plain portions of the file.