WO2012006885A1 - 代理网关防病毒实现方法，预分类器和代理网关 - Google Patents

代理网关防病毒实现方法，预分类器和代理网关 Download PDF

Info

Publication number
WO2012006885A1
WO2012006885A1 PCT/CN2011/072847 CN2011072847W WO2012006885A1 WO 2012006885 A1 WO2012006885 A1 WO 2012006885A1 CN 2011072847 W CN2011072847 W CN 2011072847W WO 2012006885 A1 WO2012006885 A1 WO 2012006885A1
Authority
WO
WIPO (PCT)
Prior art keywords
resource
transmitted
attribute information
virus
request
Prior art date
Application number
PCT/CN2011/072847
Other languages
English (en)
French (fr)
Inventor
吴昊
黄冕
Original Assignee
成都市华为赛门铁克科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都市华为赛门铁克科技有限公司 filed Critical 成都市华为赛门铁克科技有限公司
Publication of WO2012006885A1 publication Critical patent/WO2012006885A1/zh
Priority to US13/707,016 priority Critical patent/US8769694B2/en
Priority to US14/282,506 priority patent/US9313220B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • Proxy gateway anti-virus implementation method, pre-classifier and proxy gateway The application is submitted to the Chinese Patent Office on July 13, 2010, and the application number is 201010228197. 6.
  • the invention name is "proxy gateway anti-virus implementation method, pre-classifier and The priority of the Chinese Patent Application for the Proxy Gateway is incorporated herein by reference.
  • the present invention relates to a network antivirus technology, and in particular, to a proxy gateway antivirus implementation method, a preclassifier, and a proxy gateway.
  • BACKGROUND OF THE INVENTION Anti-Virus (AV) technology as an important component of Unified Threat Management (UTM) function, has attracted more and more people's attention. Its advantage is that it can perform malware on the gateway side. Shielding, in the true sense, intercepts the threat before the attack occurs, and protects the user's security to a greater extent.
  • agent-based anti-virus gateways which can be called proxy-type anti-virus gateways, also referred to as proxy gateways
  • stream-based anti-virus gateways The proxy-type anti-virus gateway starts the proxy when the three-way handshake, and the proxy gateway includes the proxy server and the proxy client, respectively, and the client (to avoid confusion with the proxy client in the proxy gateway, the next is called the real client)
  • the server To avoid confusion with the proxy server in the proxy gateway, referred to as the real server) interaction, in the process of interactive communication
  • the Cache & Scanner is responsible for receiving, caching files, when the file is received Upon completion, it is sent to the scan engine for virus scanning and identification, and if the file is free of virus threats, it is sent to the real client or server. Real clients and servers usually don't know the true identity of the peers with which they interact.
  • the proxy gateway needs to send a proxy layer to each data packet received, first cached by the virus scan cache module, and needs to be scanned.
  • the virus scanning cache module is sent to the scan engine for anti-virus scanning.
  • the file is not scanned by the user or cannot be scanned, it needs to be transparently transmitted through the proxy layer.
  • the foregoing implementation occupies too many proxy layer resources, which makes the transmission efficiency very low, significantly reduces the performance of the gateway, and further reduces the user experience.
  • Summary of the invention The embodiment of the invention provides a proxy gateway anti-virus implementation method, a pre-classifier and a proxy gateway, so as to improve the transmission efficiency of the proxy gateway and reduce resource waste.
  • the embodiment of the invention provides a proxy gateway anti-virus implementation method, including:
  • the embodiment of the invention further provides a pre-classifier, including:
  • a probe acquisition module configured to receive a resource acquisition request for obtaining a resource to be transmitted, and send a pre-detection request to the network element where the resource to be transmitted is located according to the resource acquisition request;
  • An attribute obtaining module configured to receive attribute information of the to-be-transmitted resource returned by the network element, and a policy determining module, configured to determine, according to the attribute information, whether the to-be-transmitted resource needs to perform an anti-virus scan according to the anti-virus policy ;
  • the scan initiating module is configured to: when the policy judging module determines that an antivirus scan is required, perform the antivirus scan on the subsequently acquired resource to be transmitted;
  • the transparent transmission initiating module is configured to transparently transmit the subsequently acquired resource to be transmitted when the policy judging module determines that the antivirus scanning is not required.
  • the embodiment of the present invention further provides a proxy gateway, including a proxy client, a proxy server, and a virus scan cache module, where: the pre-classifier provided by the embodiment of the present invention is further included; The lower layer of the proxy client and the proxy server.
  • the technical solution of the embodiments of the present invention provides a technical solution capable of performing pre-detection on whether an anti-virus scan needs to be performed on a transmission resource.
  • the pre-detection of the transmission resource is performed through the attribute information, and the anti-virus scan can be directly transmitted through the anti-virus scan, thereby achieving the anti-virus function, improving the transmission efficiency, and reducing the waste of the cache, the scan, and the upper-layer transmission resources.
  • FIG. 1 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of a network architecture according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic diagram of another network architecture applicable to Embodiment 1 of the present invention.
  • FIG. 4 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 2 of the present invention.
  • FIG. 5 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 3 of the present invention.
  • FIG. 6 is a signaling flowchart of a proxy gateway anti-virus implementation method according to Embodiment 4 of the present invention.
  • FIG. 7 is a schematic structural diagram of a pre-classifier according to Embodiment 5 of the present invention.
  • the purpose of the present invention is to clearly and completely describe the technical solutions in the embodiments of the present invention, and it is obvious that the technical solutions in the embodiments of the present invention are clearly and completely described.
  • the described embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.
  • FIG. 1 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 1 of the present invention.
  • the method may be performed by a pre-classifier set in a proxy gateway, where the pre-classifier may be an added hardware device in the proxy gateway or inherited.
  • the software module is used to pre-detect the anti-virus scans to be transmitted, and then sort according to whether scanning is needed.
  • the process performed by the preclassifier is as follows:
  • Step 110 Receive a resource acquisition request.
  • the pre-classifier intercepts the received resource acquisition request in the proxy gateway
  • Step 120 Send a pre-detection request to the network element where the resource to be transmitted is located according to the resource acquisition request, to obtain attribute information of the resource to be transmitted.
  • the pre-classifier actively detects and acquires the attribute information of the transmission resource
  • the resource acquisition request is generally a download request from the real client to download the resource from the real server or an upload request to upload the resource to the real server, of course, in a specific application. It can also be applied to the case where the real server requests the real client to transmit data.
  • the proxy gateway intercepts the resource acquisition request, constructs and sends a pre-detection request, to request to obtain the pending transmission.
  • the attribute information of the resource is generally a download request from the real client to download the resource from the real server or an upload request to upload the resource to the real server, of course, in a specific application. It can also be applied to the case where the real server requests the real client to transmit data.
  • the proxy gateway intercepts the resource acquisition request, constructs and sends a pre-detection request, to request to obtain the pending transmission.
  • the attribute information of the resource is generally a download request from the real client to download the resource from the real server or an upload request
  • Step 130 Based on the anti-virus policy, determine, according to the attribute information, whether the resource to be transmitted needs to be scanned for anti-virus, and if yes, go to step 140, if no, go to step 150;
  • the specific antivirus policy can be set according to the attribute information.
  • the attribute information can be the file type, size, and file name of the resource to be transmitted, and the corresponding antivirus policy can set which type of resource needs to be scanned. , Set the resources above the threshold to scan, etc.
  • the operation of specifically performing the judgment may be implemented in different manners.
  • the pre-classifier may be based on the locally stored anti-virus policy, and determine, according to the attribute information, whether the resource to be transmitted needs to be scanned for anti-virus, that is, the operation is completely completed in the pre-classifier; or, the pre-classifier may also be the attribute.
  • the information is sent to the external server to instruct the external server to use the anti-virus policy to determine whether the resource to be transmitted needs to be scanned for antivirus and return the judgment result according to the attribute information.
  • the pre-classifier obtains the judgment result to determine which resources to be transmitted need to be anti-virus. scanning.
  • Step 140 Perform an antivirus scan on the subsequently acquired resource to be transmitted.
  • the pre-classifier can specifically send the subsequently acquired resource stream to be sent to the corresponding module of the agent layer for file caching and anti-virus scanning.
  • the resource to be transmitted after the virus scanning can be processed differently according to the set processing policy. For example, when the real client initiates a download request, in one case, the resource to be transmitted after the scan can be continuously transmitted to the resource. The real client, in another case, can also discard the downloaded file due to the virus, prompting the real client to download failed.
  • Step 150 Transparently transmit the subsequently acquired resource to be transmitted
  • the pre-classifier can directly transmit the to-be-transmitted resource stream to the real client or the real server without processing the corresponding module of the proxy layer for processing.
  • This embodiment provides a technical solution capable of performing anti-virus scanning for pre-detection whether a resource to be transmitted needs to be transmitted. Since the prior art implements anti-virus scanning at the proxy gateway, it is usually required to upload the file to be scanned to the proxy layer for caching, and then perform anti-virus scanning on the cached file, so the cache and anti-virus scanning process will occupy a lot. Upper resources and cache space, such as taking up a lot of memory resources.
  • the technical solution of the embodiment is that the pre-classifier actively performs resource pre-detection in the resource request acquisition phase, and then pre-detects the transmission resource through the attribute information, and can directly transmit the transparent transmission without performing anti-virus scanning, thereby achieving Anti-virus function can improve transmission efficiency and reduce waste of cache, scan and upper-layer transmission resources.
  • the file is uploaded to the proxy layer for caching, and then the cached file is scanned for antivirus, so the cache and antivirus scanning process will occupy a lot of upper layer resources.
  • Source and cache space such as taking up a lot of memory resources.
  • the technical solution of the present embodiment is that the pre-classifier actively performs resource pre-detection in the resource request acquisition phase, and pre-detects the resource to be transmitted through the attribute information of the resource (ie, the resource to be transmitted) requested by the resource acquisition request, so that After receiving the resource to be transmitted, the anti-virus scan can be directly transmitted without being sent to the proxy layer for caching and anti-virus scanning, thereby achieving anti-virus function, improving transmission efficiency, and reducing cache, Scanning and waste of upper layer transmission resources.
  • the technical solution of this embodiment can be applied to the network architecture shown in FIG. 2, and a pre-classifier is added in the proxy gateway, and the pre-classifier is respectively connected to the upper proxy server and the proxy client, and is in the operating system layer and the real
  • the server is connected to the client, that is, the pre-classifier is installed between the underlying receiving module and the upper agent layer.
  • the pre-classifier can intercept the upload or download request of the real client first, and actively detect and obtain the file to be transmitted that the real client needs to upload or download.
  • the file to be transmitted is judged, and the file to be scanned is transmitted to the proxy server or the proxy client according to the judgment result, and then provided to the virus scan cache module for anti-virus scanning, and the file that does not need to be scanned can be directly transmitted through the file.
  • the destination real server or real client
  • the technical solution of this embodiment is also applicable to the network architecture shown in FIG.
  • typical anti-virus protection is mainly for anti-virus scanning of files transmitted to users, and it is usually the case that real clients send out resource acquisition requests to real servers.
  • the pre-classifier is connected to the proxy server.
  • the subsequently received resource to be transmitted is provided to the virus scan cache module through the proxy server. Perform an antivirus scan.
  • FIG. 4 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 2 of the present invention.
  • a real client downloads a file from a real server, and the following steps are included:
  • Step 410 The real client sends a file download request, that is, a resource acquisition request.
  • Step 420 The pre-classifier intercepts the download request, and the pre-classifier constructs and sends a pre-detection request to the real server.
  • Step 430 The pre-classifier receives the attribute information of the to-be-transmitted resource returned by the real server.
  • Step 440 the pre-classifier according to the attribute information to determine whether the resource to be transmitted should be anti-virus scanning, and if so, proceed to step 450, and if not, proceed to step 460;
  • Step 450 After sending the file download request to the real server, the pre-classifier sends the file transmitted by the real server to the proxy layer for caching and anti-virus scanning, and then can scan the scanned file according to a conventional processing manner. The processing is performed, and the scanned file is usually transmitted to the real client by the proxy client and the proxy server.
  • the technical solution of the embodiment actively performs resource pre-detection in the download request phase, and then pre-detects the transmission resource through the attribute information, and can directly transmit the transparent transmission without performing anti-virus scanning, thereby realizing the anti-virus function, and It can improve transmission efficiency and reduce waste of cache, scan and upper layer transmission resources.
  • FIG. 5 is a flowchart of a proxy gateway anti-virus implementation method according to Embodiment 3 of the present invention. This embodiment is similar to the second embodiment in that the real client uploads a file to a real server, and specifically includes the following steps:
  • Step 510 The real client sends a file upload request, that is, a resource upload request.
  • Step 520 The pre-classifier receives and intercepts the resource uploading request from the real client, and sends a pre-detection request for obtaining the attribute information of the resource to be transmitted to the real client, so as to obtain the attribute information of the resource to be transmitted returned by the real client.
  • Step 530 the pre-classifier is based on the anti-virus policy, based on the attribute information to determine whether the resource to be transmitted needs to be scanned for anti-virus, and if so, step 540 is performed, and if not, step 550 is performed;
  • Step 540 The pre-classifier sends the subsequently acquired resource to be sent to the proxy layer for anti-virus scanning.
  • the subsequently acquired resource stream to be transmitted may be sent to the corresponding module of the agent layer for file caching and prevention.
  • Virus scanning The resources to be transmitted after the anti-virus scanning can be processed differently according to the set processing policy. For example, in one case, the scanned resources can be continuously transmitted to the real server, or in another case, The file is discarded by the virus, indicating that the real client failed to upload the file. The upload process ends;
  • Step 550 The pre-classifier transparently transmits the subsequently acquired resource to be transmitted.
  • the technical solution of the present embodiment actively performs resource pre-detection in the upload request phase, and then pre-detects the transmission resource through the attribute information, and directly transmits the to-be-transmitted resource that does not need to perform anti-virus scanning, thereby realizing anti-virus.
  • the function can improve the transmission efficiency and reduce the waste of cache, scan and upper layer transmission resources.
  • FIG. 6 is a signaling flowchart of a proxy gateway anti-virus implementation method according to Embodiment 4 of the present invention.
  • This embodiment may be implemented on the basis of Embodiment 2 to implement Hypertext Transfer Protocol (HTTP) data packet transmission.
  • HTTP Hypertext Transfer Protocol
  • the proxy gateway anti-virus implementation method provided by the embodiment of the present invention may include the following steps: Step 601: The real client sends a SYN message to the real server through the proxy server and the proxy client of the proxy gateway.
  • Step 602 The real server returns a SYN-ACK message to the real client through the proxy gateway.
  • Step 603 The real client returns an ACK message to the real server through the proxy gateway.
  • Step 604 The proxy gateway receives the resource acquisition request (HTTP GET Request) sent by the real client, and the pre-classifier intercepts the resource acquisition request.
  • HTTP GET Request the resource acquisition request
  • Steps 605-607 perform a handshake interaction (interactive SYN, SYN-ACK, and ACK message) between the pre-classifier and the real server, and initiate a new connection to the real server, thereby
  • the probe request is prepared, and the pre-classifier and the real server establish a new connection by handshaking to avoid interference with the established connection channel for transmitting the resource to be transmitted;
  • Step 608 The pre-classifier constructs and sends a pre-detection request to the real server.
  • the pre-detection request is specifically an HTTP HEAD request, and the HTTP HEAD request is sent to the real server to request the file size of the resource to be transmitted as the attribute information;
  • Step 609 The server returns a corresponding response message to the pre-classifier according to the HTTP HEAD request.
  • the response message in this embodiment is an HTTP response, where the file size information of the resource to be transmitted is carried.
  • Step 610 The pre-classifier sends a resource acquisition request (HTTP GET with RNAGE Field) with a range field (RANGE) to the real server as a pre-detection request.
  • HTTP GET with RNAGE Field HTTP GET with RNAGE Field
  • RANGE range field
  • the range field is used to indicate that the byte of the set range in the resource to be transmitted is obtained, and the information carried in the byte of the set range is used as the attribute information.
  • the first 64 bytes of the resource to be transmitted may be set.
  • the first 64 bytes of the file correspond to the file type of the file to be acquired, and for the file transmission based on the HTTP protocol, a band may be constructed.
  • the HTTP GET with RNAGE Field request of the "Range" field is used to obtain information about the file to be transferred.
  • Step 611 The server returns a corresponding response message to the pre-classifier according to the HTTP GET with RNAGE Field request, that is, an HTTP Response, where the information of the set range byte is carried;
  • the above HTTP HEAD request and the resource acquisition request (HTTP GET with RNAGE Field) of the "Range" field can be used as a pre-probe request.
  • the pre-probe request can obtain the required attribute information by using a custom message, or can use the existing information in the protocol.
  • the message acquires the required attribute information one or more times.
  • steps 608 and 609, and steps 610 and 611 are two ways of respectively obtaining attribute information. In a specific application, either one of them may be used at the same time, or only one of them may be used, and two types of attribute information are acquired.
  • the order of execution of the modes is not limited.
  • Step 612 The pre-classifier sends an end probe session message to the real server, which may be a RESET message.
  • Step 614 The pre-classifier sends the resource acquisition request sent by the real client at the operating system layer to the real server without going through the proxy layer and the anti-virus scanning, and proceeds to step 615;
  • one of the implementations of the transparent transmission may be that the Transmission Control Protocol (TCP) flow is set to a flag that does not need to perform AV scanning, and all subsequent packets of the data flow will not be sent to the proxy.
  • TCP Transmission Control Protocol
  • Layer directly transmitted to the target in the receiving module, that is, the real client or server.
  • Step 615 The pre-classifier returns a response (HTTP Response) of the real server at the operating system layer, that is, the data stream of the resource to be transmitted is directly transmitted to the client without passing through the proxy layer and the anti-virus scan.
  • HTTP Response HTTP Response
  • the resource acquisition request and the subsequently transmitted resources are transmitted in the same data stream that is established, and the data stream can be identified by a five-tuple such as a destination address and a destination port of the data stream.
  • Step 616 the pre-classifier at the operating system layer to send the resource acquisition request sent by the real client through the proxy server to the virus scan cache module for anti-virus scanning, proceeds to step 617;
  • Step 617 The scanned resource acquisition request is sent to the real server by the proxy client, and the process proceeds to step 618.
  • the cache module performs an antivirus scan, and proceeds to step 619;
  • Step 619 The proxy server sends the scanned resource to the real client.
  • each stream of the resource to be transmitted may have multiple data packets, it may be divided into multiple responses, and each data packet is separately transmitted. At this time, steps 618 and 619 may be performed multiple times.
  • the pre-classifier can transmit the subsequently acquired resource to be transmitted to the proxy layer for caching and perform anti-virus scanning.
  • the attribute information used to determine whether or not to scan is included, but not limited to, file size, file type, file name, and/or file author. For an existing HTTP packet, it is usually only required to obtain the first 64 bytes of the resource to be transmitted to know the file type.
  • determining whether the resource to be transmitted needs to perform an anti-virus scan according to the attribute information may include the following methods:
  • file types For which file types need to be scanned, it can be set by the user, for example, for the document class: *. txt, *. doc, etc. can be set to a type that does not need to be scanned.
  • the file name (or file author) of the resource to be transmitted matches the predetermined field (such as a keyword) based on the file name (or file author) in the attribute information to determine whether an antivirus scan is required. Specifically, when the file name or file author of the resource to be transmitted matches the predetermined field, it is determined that an anti-virus scan is required; or, when the file name or file author of the resource to be transmitted matches the predetermined field, it is determined that anti-virus is not required. Scan and directly pass through. E.g:
  • a hash operation may be performed by detecting a number of bytes in front of the resource to be transmitted, a number of bytes in the middle, and a number of bytes in the back, and matching with a preset matching table to determine whether the transmission resource needs to be processed. scanning.
  • virus scanning mode in the embodiment of the present invention is not limited to performing anti-virus scanning by the virus scanning cache module local to the proxy gateway, and may also send the subsequently acquired resource to be transmitted to the anti-virus server. Perform an antivirus scan.
  • the above technical solution is also not limited to the HTTP protocol, and can also be applied to multiple network protocols, and can use the existing messages of various protocols to perform pre-detection of attribute information.
  • HTTP File Transfer Protocol
  • the technical solution of the embodiment of the present invention pre-detects the resource to be transmitted, and identifies whether an anti-virus scan is required, so that most traffic that does not need to be scanned by the anti-virus is directly transmitted. Thereby reducing the resource pressure of the proxy gateway, ensuring the transmission performance of the anti-virus proxy gateway without sacrificing security, and improving the user's online experience.
  • FIG. 7 is a schematic structural diagram of a pre-classifier according to Embodiment 5 of the present invention.
  • the pre-classifier includes: a probe acquisition module 50, an attribute acquisition module 10, a policy determination module 20, a scan initiation module 30, and a transparent transmission initiation module 40. among them:
  • the probe acquisition module 50 is configured to receive a resource acquisition request, and send a pre-detection request to the network element where the resource to be transmitted is located according to the resource acquisition request;
  • the resource obtaining request may be a download request or an upload request from a real client, or may be a related request that the real server obtains resources from the real client.
  • the resource transmission is performed based on different protocols, the corresponding existing information in the protocol may be utilized as a pre-probing request.
  • the pre-probe request may include a resource with a range field. Get the request, the range field is used to indicate the byte of the set range in the resource to be transmitted.
  • the probe acquisition module 50 may include: a receiving unit, configured to receive a download request or an upload request from the real client as the resource acquisition request; and/or receive a request from the real server to request real client to transmit data as the And a sending unit, configured to send a pre-detection request to the network element where the resource to be transmitted is located according to the resource obtaining request received by the receiving module.
  • the attribute obtaining module 10 is configured to receive attribute information of the resource to be transmitted returned by the network element.
  • the attribute information of the resource to be transmitted may include a file size, a file type, a file name, and/or a file according to different antivirus policies and pre-detection requirements. Author and other information.
  • the policy judging module 20 is configured to determine, according to the anti-virus policy, whether the resource to be transmitted needs to be scanned for anti-virus according to the attribute information;
  • the policy judging module 20 may have different structures according to different judging manners.
  • the policy judging module 20 includes a local judging unit 21 and/or an external judging unit 22, where:
  • the local judging unit 21 is configured to determine, according to the attribute information, whether the resource to be transmitted needs to perform an anti-virus scan according to the attribute information, that is, the judging process after the pre-detection is completed by the pre-classifier.
  • the external judging unit 22 is configured to send the attribute information to the external server, to instruct the external server to determine, according to the anti-virus policy, whether the resource to be transmitted needs to perform an anti-virus scan and return a judgment result according to the attribute information. In this way, the pre-classifier obtains the judgment result by means of the judgment function of the external server.
  • the local judging unit 21 and the external judging unit 22 may have only one, or may exist at the same time and be used in combination, and may be set according to the pre-detection situation.
  • different judging operations may be performed according to different attribute information and anti-virus policies. For example, whether the size of the resource to be transmitted is greater than a set threshold may be determined according to the file size in the attribute information to determine whether An antivirus scan is required; and/or, based on the file type in the attribute information, whether the type of the resource to be transmitted belongs to the set type may be determined to determine whether an antivirus scan is required.
  • the policy determining module 20 determines that the to-be-transmitted resource needs to perform an anti-virus scan;
  • the policy determining module 20 determines that the resource to be transmitted needs to perform an antivirus scan.
  • the scan initiating module 30 is configured to: when the policy judging module 20 determines that an antivirus scan is required, perform an antivirus scan on the subsequently acquired resource to be transmitted;
  • the subsequently acquired resource to be transmitted may be transmitted to the agent layer for caching and anti-virus scanning, or may be provided to other anti-virus servers for anti-virus scanning, and then the scanning result is obtained.
  • the scanning result is obtained.
  • files without viruses can be transferred, and if there are viruses or other problems, the files are discarded.
  • the transparent transmission initiating module 40 is configured to transparently transmit the subsequently acquired resource to be transmitted when the policy judging module 20 determines that the antivirus scanning is not required.
  • This embodiment provides a technical solution capable of performing anti-virus scanning for pre-detection whether a resource to be transmitted needs to be transmitted.
  • the technical solution of the embodiment obtains the attribute information by actively sending the pre-detection request in the resource request acquisition stage, and then pre-detects the transmission resource according to the attribute information, and can directly transmit the transparent transmission without performing the anti-virus scanning, thereby realizing Anti-virus function can improve transmission efficiency and reduce waste of cache, scan and upper-layer transmission resources.
  • the foregoing technical solution is particularly applicable to the common situation in which a user initiates resource acquisition, and can enhance anti-virus protection for a user to acquire resources.
  • the pre-classifier provided by the embodiment of the present invention may be configured in a proxy gateway, and may specifically implement an anti-virus implementation method of the proxy gateway provided by the embodiment of the present invention, and have a corresponding functional module, which can improve the transmission efficiency of the proxy gateway and reduce resource waste. .
  • the embodiment of the present invention further provides a proxy gateway, which includes a proxy client, a proxy server, and a virus scan cache module.
  • the virus scan cache module can be disposed between the proxy client and the proxy server for implementing antivirus scanning.
  • the proxy gateway further includes a pre-classifier provided by any embodiment of the present invention; the pre-classifier is disposed at a lower layer of the proxy client and the proxy server, and when the policy judging module determines that an anti-virus scan is required, it is subsequently acquired.
  • the to-be-transmitted resource is provided to the virus scanning cache module for anti-virus scanning by the proxy client or the proxy server.
  • the proxy gateway provided by the embodiment of the invention can reduce the workload of the agent layer, reduce resource waste, and accelerate the data transmission of the proxy gateway.
  • the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种代理网关防病毒实现方法、预分类器和代理网关。该方法包括：接收请求获取待传输资源的资源获取请求；根据资源获取请求向待传输资源所在的网元发送预探测请求，以获取待传输资源的属性信息；基于防病毒策略，根据属性信息判断待传输资源是否需要进行防病毒扫描，若是，则将随后获取到的待传输资源进行防病毒扫描，若否，则透传随后获取到的待传输资源。本发明提供了一种能够对待传输资源是否需要进行防病毒扫描进行预探测的技术方案。通过属性信息对待传输资源进行预探测，对于不需要进行防病毒扫描的资源可以在送入代理层之前直接透传，因而既实现了防病毒功能，又能够提高传输效率，减少对缓存、扫描和上层传输资源的浪费。

Description

代理网关防病毒实现方法、 预分类器和代理网关 本申请要求于 2010年 07月 13日提交中国专利局、 申请号为 201010228197. 6、 发 明名称为"代理网关防病毒实现方法、预分类器和代理网关"的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域 本发明实施例涉及网络防病毒技术， 尤其涉及一种代理网关防病毒实现方法、 预分 类器和代理网关。 背景技术 防病毒（Anti-Virus，简称 AV)技术作为统一威胁管理（Unified Threat Management , 简称 UTM) 功能的重要组成部分， 越来越受到人们的关注， 其优点是能够在网关侧将恶 意软件进行屏蔽， 真正意义上把威胁拦截在攻击发生之前， 更大程度的保护了用户的安 全。
目前具备防病毒功能的网关主要有两种实现方式， 即基于代理的防病毒网关（可称 为代理型防病毒网关， 也可简称为代理网关） 和基于流扫描的防病毒网关。 其中， 代理 型防病毒网关在三次握手的时候即开始进行代理，代理网关包括代理服务端和代理客户 端， 分别与客户端 （为避免与代理网关中的代理客户端混淆， 下称为真实客户端）和服 务器（为避免与代理网关中的代理服务端混淆， 下称为真实服务器）交互， 在交互通信 过程中， 由病毒扫描缓存模块 （Cache & Scanner) 负责接收、 缓存文件， 当文件接收 完成时， 送入扫描引擎进行病毒的扫描识别， 如果文件没有病毒威胁则发送至真实的客 户端或服务器。 真实的客户端与服务器通常并不知道与其交互数据的对端的真实身份。
在进行本发明的研究过程中， 发明人发现现有技术存在如下缺陷： 代理网关对接收 到的每一个数据包， 都需要送上代理层， 先由病毒扫描缓存模块进行缓存， 对于需要进 行扫描的就由病毒扫描缓存模块送入扫描引擎进行防病毒扫描， 当发现不属于用户设定 的需扫描文件或者是无法进行扫描的文件时也需要通过代理层进行透传。上述实现方式 占用过多代理层资源， 使得传输效率十分低下， 显著降低了网关的性能， 更加降低了用 户的使用体验。 发明内容 本发明实施例提供一种代理网关防病毒实现方法、 预分类器和代理网关， 以提高代 理网关的传输效率， 减少资源浪费。
本发明实施例提供一种代理网关防病毒实现方法， 包括：
接收请求获取待传输资源的资源获取请求；
根据所述资源获取请求向所述待传输资源所在的网元发送预探测请求， 以获取所述 待传输资源的属性信息；
基于防病毒策略， 根据所述属性信息判断所述待传输资源是否需要进行防病毒扫 描， 若是， 则将随后获取到的所述待传输资源进行防病毒扫描， 若否， 则透传随后获取 到的所述待传输资源。
本发明实施例还提供一种预分类器， 包括：
探测获取模块， 用于接收请求获取待传输资源的资源获取请求， 并根据所述资源获 取请求向所述待传输资源所在的网元发送预探测请求；
属性获取模块， 用于接收所述网元返回的所述待传输资源的属性信息； 策略判断模块， 用于基于防病毒策略， 根据所述属性信息判断所述待传输资源是否 需要进行防病毒扫描；
扫描发起模块， 用于当所述策略判断模块判断出需要进行防病毒扫描时， 则将随后 获取到的所述待传输资源进行防病毒扫描；
透传发起模块， 用于当所述策略判断模块判断出不需要进行防病毒扫描时， 则透传 随后获取到的所述待传输资源。
本发明实施例又提供了一种代理网关， 包括代理客户端、 代理服务端和病毒扫描缓 存模块， 其中： 还包括本发明实施例提供的所述预分类器； 所述预分类器设置在所述代 理客户端和代理服务端的下层。
本发明各实施例的技术方案，提供了一种能够对待传输资源是否需要进行防病毒扫 描进行预探测的技术方案。 通过属性信息对待传输资源进行预探测， 对于不需要进行防 病毒扫描的可以直接透传， 因而既实现了防病毒功能， 又能够提高传输效率， 减少对缓 存、 扫描和上层传输资源的浪费。 附图说明 为了更清楚地说明本发明实施例中的技术方案， 下面将对实施例描述中所需要使用 的附图作简单地介绍， 显而易见地， 下面描述中的附图仅仅是本发明的一些实施例， 对 于本领域普通技术人员来讲， 在不付出创造性劳动的前提下， 还可以根据这些附图获得 其他的附图。
图 1为本发明实施例一提供的代理网关防病毒实现方法的流程图；
图 2为本发明实施例一所适用的一种网络架构示意图；
图 3为本发明实施例一所适用的另一种网络架构示意图；
图 4为本发明实施例二提供的代理网关防病毒实现方法的流程图；
图 5为本发明实施例三提供的代理网关防病毒实现方法的流程图；
图 6为本发明实施例四提供的代理网关防病毒实现方法的信令流程图；
图 7为本发明实施例五提供的预分类器的结构示意图。 具体实肺式 为使本发明实施例的目的、 技术方案和优点更加清楚， 下面将结合本发明实施例中 的附图， 对本发明实施例中的技术方案进行清楚、 完整地描述， 显然， 所描述的实施例 是本发明一部分实施例， 而不是全部的实施例。 基于本发明中的实施例， 本领域普通技 术人员在没有作出创造性劳动前提下所获得的所有其他实施例， 都属于本发明保护的范 围。
实施例一
图 1为本发明实施例一提供的代理网关防病毒实现方法的流程图， 该方法可以由代 理网关中设置的预分类器来执行，预分类器可以是代理网关中增设的硬件设备或者继承 的软件模块， 用于对待传输资源是否需要进行防病毒扫描进行预探测， 而后按照是否需 要进行扫描来分类。 预分类器所执行的流程如下：
步骤 110、 接收资源获取请求；
具体可以是预分类器在代理网关中拦截接收到的资源获取请求；
步骤 120、 根据资源获取请求向待传输资源所在的网元发送预探测请求， 以获取待 传输资源的属性信息；
本步骤具体是预分类器主动对待传输资源的属性信息进行探测获取， 资源获取请求 一般是来自真实客户端的从真实服务器下载资源的下载请求或向真实服务器上传资源 的上传请求， 当然， 在具体应用中， 也可以适用于真实服务器请求真实客户端传输数据 的情况。 或者可概括为， 代理网关所代理的网元中， 一个网元向另一个网元请求传输资 源的情况， 代理网关拦截该资源获取请求， 构造并发送预探测请求， 以请求获取该待传 输资源的属性信息。
步骤 130、 基于防病毒策略， 根据属性信息判断待传输资源是否需要进行防病毒扫 描， 若是， 则执行步骤 140， 若否， 则执行步骤 150;
具体的防病毒策略可以根据需要针对属性信息进行设定， 例如， 属性信息可以为待 传输资源的文件类型、 大小和文件名等， 则相应的防病毒策略可以设定哪种类型的资源 需要扫描、 设定阈值以上大小的资源需要扫描等。
另外， 在步骤 130 中， 具体执行判断的操作可以由不同方式实现。 例如， 可以是 预分类器基于本地存储的防病毒策略，根据属性信息判断待传输资源是否需要进行防病 毒扫描， 即判断操作完全在预分类器中完成； 或者， 还可以是预分类器将属性信息发送 至外部服务器， 以指示外部服务器基于防病毒策略， 根据属性信息判断待传输资源是否 需要进行防病毒扫描并返回判断结果，预分类器获取到判断结果可确定哪些待传输资源 需要进行防病毒扫描。
步骤 140、 将随后获取到的待传输资源进行防病毒扫描；
本步骤中，预分类器具体可以将随后获取到的待传输资源流送入代理层的相应模块 进行文件缓存和防病毒扫描。经过病毒扫描后的待传输资源可以根据设定的处理策略进 行不同的处理， 例如， 当真实客户端发起的是下载请求时， 在一种情况下， 可以将扫描 之后的待传输资源继续传输给真实客户端，在另一种情况下也可以因为病毒而丢弃下载 文件， 提示真实客户端下载失败。
步骤 150、 透传随后获取到的待传输资源；
本步骤可以是预分类器将该待传输资源流直接透传给真实客户端或真实服务器， 而 无须送入代理层的相应模块进行处理。
本实施例提供了一种能够对待传输资源是否需要进行防病毒扫描进行预探测的技 术方案。 由于现有技术在代理网关处实现防病毒扫描时， 通常都需要将待扫描的文件上 传至代理层， 进行缓存， 进而对缓存的文件进行防病毒扫描， 因此缓存、 防病毒扫描过 程将占用很多上层资源和缓存空间， 如占用了很多内存资源。 本实施例的技术方案为预 分类器在资源请求获取阶段即主动进行资源预探测， 而后通过属性信息对待传输资源进 行预探测， 对于不需要进行防病毒扫描的可以直接透传， 因而既实现了防病毒功能， 又 能够提高传输效率， 减少对缓存、 扫描和上层传输资源的浪费。
现有技术通常都是在接收到待传输资源（文件）之后， 将文件上传至代理层进行缓 存， 进而对缓存的文件进行防病毒扫描， 因此缓存、 防病毒扫描过程将占用很多上层资 源和缓存空间， 如占用了很多内存资源。 本实施例的技术方案为预分类器在资源请求获 取阶段即主动进行资源预探测， 通过资源获取请求所请求获取的资源 （即待传输资源） 的属性信息对待传输资源进行预探测， 这样在后续接收到待传输资源之后， 对于不需要 进行防病毒扫描的可以直接透传而无需送入代理层进行缓存和防病毒扫描， 因而既实现 了防病毒功能， 又能够提高传输效率， 减少对缓存、 扫描和上层传输资源的浪费。
本实施例的技术方案可以适用于图 2所示的网络架构，在代理网关中增设了预分类 器， 预分类器分别与上层的代理服务端和代理客户端相连， 且在操作系统层与真实的服 务器和客户端相连， 即将预分类器安装在底层收包模块和上层的代理层之间。 在真实客 户端需要向真实服务器上传文件， 或从真实服务器下载文件之前， 预分类器可以先拦截 真实客户端的上传或下载请求，针对真实客户端需要上传或下载的待传输的文件主动探 测获取其属性信息， 对待传输的文件进行判断， 根据判断结果将需要扫描的文件传输至 代理服务端或代理客户端， 进而提供给病毒扫描缓存模块进行防病毒扫描， 不需要扫描 的文件就可以直接透传给目的端 （真实服务器或真实客户端） ， 因此能够减小上层的代 理层的工作负荷。
本实施例的技术方案也适用于图 3所示的网络架构。 实际应用中， 典型的防病毒保 护主要是针对传输给用户的文件进行防病毒扫描， 并且通常也是真实客户端向真实服务 器发出资源获取请求的情况占绝大部分。 图 3所示的代理网关， 预分类器与代理服务端 相连， 在判断出真实客户端请求的待传输资源需要扫描时， 即将后续接收到的待传输资 源通过代理服务端提供给病毒扫描缓存模块进行防病毒扫描。
实施例二
图 4为本发明实施例二提供的代理网关防病毒实现方法的流程图，本实施例具体为 真实客户端从真实服务器下载文件的情况， 包括如下步骤：
步骤 410、 真实客户端发送文件下载请求， 即资源获取请求；
步骤 420、预分类器拦截获取该下载请求， 预分类器构造并向真实服务器发送预探 测请求；
步骤 430、 预分类器接收真实服务器返回的待传输资源的属性信息；
步骤 440、预分类器根据属性信息判断待传输资源是否应该进行防病毒扫描，若是， 则执行步骤 450， 若否， 则执行步骤 460;
步骤 450、预分类器在将文件下载请求发送给真实服务器之后， 将真实服务器传输 的文件送入代理层进行缓存和防病毒扫描，而后可以按照常规的处理方式对扫描后的文 件进行处理， 通常是经代理客户端和代理服务端将扫描后的文件传输给真实客户端； 步骤 460、 预分类器将真实服务器传输的文件直接透传给真实客户端。
本实施例的技术方案在下载请求阶段即主动进行资源预探测， 而后通过属性信息 对待传输资源进行预探测， 对于不需要进行防病毒扫描的可以直接透传， 因而既实现了 防病毒功能， 又能够提高传输效率， 减少对缓存、 扫描和上层传输资源的浪费。
实施例三
图 5为本发明实施例三提供的代理网关防病毒实现方法的流程图，本实施例与实施 例二类似， 是真实客户端向真实服务器上传文件的情况， 具体包括如下步骤：
步骤 510、 真实客户端发送文件上传请求， 即资源上传请求；
步骤 520、 预分类器接收并拦截来自真实客户端的资源上传请求， 向真实客户端发 送获取待传输资源的属性信息的预探测请求，从而获取真实客户端返回的待传输资源的 属性信息；
步骤 530、 预分类器基于防病毒策略， 根据属性信息判断待传输资源是否需要进行 防病毒扫描， 若是， 则执行步骤 540， 若否， 则执行步骤 550;
步骤 540、 预分类器将随后获取到的待传输资源送入代理层进行防病毒扫描； 本步骤中， 具体可以将随后获取到的待传输资源流送入代理层的相应模块进行文件 缓存和防病毒扫描。经过防病毒扫描后的待传输资源可以根据设定的处理策略进行不同 的处理， 例如， 在一种情况下， 可以将扫描之后的资源继续传输给真实服务器， 在另一 种情况下也可以因为病毒而丢弃该文件， 提示真实客户端上传文件失败。 本次上传流程 结束；
步骤 550、 预分类器透传随后获取到的待传输资源。
本实施例的技术方案在上传请求阶段即主动进行资源预探测， 而后通过属性信息 对待传输资源进行预探测， 对于不需要进行防病毒扫描的待传输资源可以直接透传， 因 而既实现了防病毒功能， 又能够提高传输效率， 减少对缓存、 扫描和上层传输资源的浪 费。
实施例四
图 6为本发明实施例四提供的代理网关防病毒实现方法的信令流程图，本实施例可 以以实施例二为基础， 以实现超文本传输协议 （Hypertext Transfer Protocol , 简称 HTTP)数据包传输的情况为例进行说明。 本发明实施例提供的代理网关防病毒实现方法 可以包括如下步骤： 步骤 601、 真实的客户端通过代理网关的代理服务端和代理客户端向真实的服务器 发送 SYN消息；
步骤 602、 真实的服务器通过代理网关向真实的客户端返回 SYN-ACK消息； 步骤 603、 真实的客户端通过代理网关向真实的服务器返回 ACK消息；
上述步骤 601〜603 即通过代理网关完成真实的客户端与服务器之间的握手， 在此 过程中未示出代理网关转发的细节。
步骤 604、 代理网关接收到真实客户端发送的资源获取请求 （HTTP GET Request ) ， 由预分类器拦截该资源获取请求；
步骤 605〜607、 与步骤 601〜603类似， 预分类器与真实的服务器之间进行一次握 手交互 （交互 SYN、 SYN-ACK和 ACK消息） ， 向真实服务器发起一个新的连接， 从而为 发起预探测请求作出准备， 预分类器与真实服务器之间通过握手建立新的连接， 避免对 已建立的传输待传输资源的连接通道造成干扰；
步骤 608、 预分类器构建并向真实服务器发送预探测请求；
本实施例中预探测请求具体为 HTTP HEAD请求， 向真实服务器发送该 HTTP HEAD请 求， 以请求获取待传输资源的文件大小作为属性信息；
步骤 609、 服务器根据 HTTP HEAD请求， 向预分类器返回相应的响应消息； 具体的， 本实施例中的响应消息为 HTTP Response, 其中携带有待传输资源的文件 大小信息；
步骤 610、 预分类器向真实服务器发送设置有范围字段 （RANGE) 的资源获取请求 (HTTP GET with RNAGE Field) 作为预探测请求；
其中， 范围字段用于指示获取待传输资源中设定范围的字节， 以该设定范围的字节 中携带的信息作为属性信息。
具体应用中， 可以设置为获取待传输资源的前 64个字节， 通常， 文件的前 64个字 节对应的是待获取文件的文件类型， 对于基于 HTTP协议的文件传输， 可以通过构造一 个带 "Range"字段的 HTTP GET with RNAGE Field请求来获得待传输文件的相关信息。
步骤 611、 服务器根据 HTTP GET with RNAGE Field请求， 向预分类器返回相应的 响应消息， 即 HTTP Response, 其中携带有设定范围字节的信息；
上述 HTTP HEAD请求和设置 "Range"字段的资源获取请求 （HTTP GET with RNAGE Field) 均可作为预探测请求， 预探测请求可以利用自定义消息获取需要的属性信息， 也可以利用协议中的已有消息经一次或多次获取需要的属性信息。 需要说明的是， 上述步骤 608和 609， 以及步骤 610和 611是分别获取属性信息的 两种方式， 在具体应用中， 既可以同时采用， 也可以只采用其中一种， 两种获取属性信 息的方式的执行顺序不限。
步骤 612、预分类器向真实服务器发送结束探测会话消息，具体可以是 RESET消息； 步骤 613、 预分类器基于防病毒策略， 根据属性信息判断待传输资源是否需要进行 防病毒扫描， 若否， 则执行步骤 614， 若是， 则执行步骤 616;
步骤 614、 预分类器在操作系统层将真实客户端发送的资源获取请求不经过代理层 和防病毒扫描， 直接透传至真实服务器， 进入步骤 615;
具体的， 透传的实现方式之一可以是将传输控制协议 （Transmission Control Protocol , 简称 TCP)流置为不需要进行 AV扫描的标志， 后续该条数据流的所有报文将 不会送到代理层， 直接在收包模块透传给目标， 即真实的客户端或服务器。
步骤 615、 预分类器在操作系统层将真实服务器返回的响应 （HTTP Response ), 即 待传输资源的数据流不经过代理层和防病毒扫描， 直接透传至客户端。
其中， 资源获取请求及随后传输的资源在建立的同一个数据流中传输， 该数据流可 以用数据流的诸如目的地址、 目的端口等五元组来标识。
步骤 616、 预分类器在操作系统层将真实客户端发送的资源获取请求经过代理服务 端提供至病毒扫描缓存模块进行防病毒扫描， 进入步骤 617;
步骤 617、 扫描后的资源获取请求经代理客户端向真实服务器发送， 进入步骤 618; 步骤 618、 真实服务器返回响应 （HTTP Response )给代理客户端， 从而将待传输资 源的数据流提供给病毒扫描缓存模块进行防病毒扫描， 进入步骤 619;
步骤 619、 代理服务端将扫描后的资源发送给真实客户端。
由于每个待传输资源的流可能有多个数据包， 所以可以分为多次响应， 将各个数据 包分别进行传输， 此时， 可以执行多次步骤 618和 619。
在本实施例中，预分类器可以将随后获取到的待传输资源传输至代理层进行缓存并 进行防病毒扫描。 用于判断是否需扫描的属性信息包括但是不限于为文件大小、 文件类 型、 文件名和 /或文件作者等。 对于现有的 HTTP数据包， 通常只要求获取待传输资源的 前 64个字节即可获知文件类型。
具体的防病毒策略可以根据需要进行设定。 例如基于防病毒策略， 根据属性信息判 断待传输资源是否需要进行防病毒扫描的操作可以包括下述几种方式：
在一种情况下， 可以根据属性信息中的文件大小判断该待传输资源的大小是否大于 设定门限值， 以确定是否需要进行防病毒扫描。 具体的， 由于代理网关的缓存空间通常 有限， 所以对于过大的文件无法进行缓存和扫描， 可以直接进行透传。
在另一种情况下，还可以根据属性信息中的文件类型判断待传输资源的类型是否属 于设定类型来确定是否需要对待传输资源进行防病毒扫描。对于哪些文件类型需要进行 扫描可以由用户来设定， 例如对于文档类的： *. txt、 *. doc等即可以设置为无须扫描的 类型。
另外，还可以根据属性信息中的文件名（或文件作者）判断待传输资源的文件名（或 文件作者） 是否与预定字段 （如关键字） 匹配， 以确定是否需要进行防病毒扫描。 具体 地， 当待传输资源的文件名或文件作者与预定字段匹配时， 确定需要进行防病毒扫描； 或者， 当待传输资源的文件名或文件作者与预定字段匹配时， 确定不需要进行防病毒扫 描而直接透传。 例如：
* 文件名中包含有 "免费"二字的文件需要进行防病毒扫描；
*文件作者为空的文件需要进行防病毒扫描；
*文件作者为 "Microsoft "或者其他认为可信的作者的文件不需要进行防扫描。 需要说明的是，待传输资源的属性信息和防病毒策略的具体内容包括但不限于上述 几种。 例如， 还可以通过探测待传输资源的前部数个字节、 中部数个字节、 后部数个字 节等，进行哈希运算，与预设的匹配表进行匹配来判断是否需要对待传输资源进行扫描。
此外， 还需要说明的是， 本发明实施例中的病毒扫描方式并不限于通过在代理网关 本地的病毒扫描缓存模块进行防病毒扫描，还可以将随后获取到的待传输资源发送至防 病毒服务器进行防病毒扫描。
上述技术方案也并不限于 HTTP协议， 还可以适用于多种网络协议， 并可以利用各 种协议已有的消息来进行属性信息预探测。 例如， 对于文件传输协议 （Fi le Transfer Protocol , 简称 FTP), 可以发送 SIZE命令来请求获取待传输资源的文件大小。
本发明实施例的技术方案通过对待传输资源进行预探测， 识别是否需要进行防病毒 扫描， 从而将大部分不需要进行防病毒扫描的流量直接透传。 从而降低了代理网关的资 源压力， 在不损失安全性的前提下保证了防病毒代理网关的传输性能， 提高了用户上网 的体验。
实施例五
图 7为本发明实施例五提供的预分类器的结构示意图， 该预分类器包括： 探测获取 模块 50、 属性获取模块 10、 策略判断模块 20、 扫描发起模块 30和透传发起模块 40。 其中：
探测获取模块 50，用于接收资源获取请求，并根据资源获取请求向待传输资源所在 的网元发送预探测请求；
具体的， 资源获取请求可以是来自真实客户端的下载请求或上传请求， 也可以是真 实服务器向真实客户端获取资源的相关请求。在基于不同的协议进行资源传输时， 对应 的可以利用协议中的已有消息作为预探测请求，例如待传输资源包括基于超文本传输协 议的文件时， 预探测请求可以包括设置有范围字段的资源获取请求， 该范围字段用于指 示获取待传输资源中设定范围的字节。
这样， 探测获取模块 50可以包括： 接收单元， 用于接收来自真实客户端的下载请求 或上传请求作为所述资源获取请求； 和 /或接收来自真实服务器的请求真实客户端传输 数据的请求作为所述资源获取请求； 发送单元， 用于根据所述接收模块接收到的所述资 源获取请求， 向所述待传输资源所在的网元发送预探测请求。
属性获取模块 10，用于接收网元返回的待传输资源的属性信息； 按照不同的防病毒 策略以及预探测的需求， 待传输资源的属性信息可以包括文件大小、 文件类型、 文件名 和 /或文件作者等信息。
策略判断模块 20，用于基于防病毒策略，根据属性信息判断待传输资源是否需要进 行防病毒扫描；
按照判断方式的不同， 策略判断模块 20可以具备不同的结构， 优选的是， 策略判 断模块 20包括本地判断单元 21和 /或外部判断单元 22， 其中：
本地判断单元 21， 用于基于本地存储的防病毒策略， 根据属性信息判断待传输资 源是否需要进行防病毒扫描， 即预探测后的判断过程由预分类器自行完成。
外部判断单元 22， 用于将属性信息发送至外部服务器， 以指示外部服务器基于防病 毒策略， 根据属性信息判断待传输资源是否需要进行防病毒扫描并返回判断结果。 该方式 即预分类器借助于外部服务器的判断功能来获取判断结果。
实际应用中， 本地判断单元 21和外部判断单元 22可以只具有一个， 也可以同时 存在、 结合使用， 按照预探测情况需要设定即可。
对于策略判断模块 20，根据不同的属性信息和防病毒策略，可以执行不同的判断操 作，例如，可以根据属性信息中的文件大小判断待传输资源的大小是否大于设定门限值， 以确定是否需要进行防病毒扫描； 和 /或， 还可以根据属性信息中的文件类型判断待传 输资源的类型是否属于设定类型， 以确定是否需要进行防病毒扫描。 具体地， 当所述属性信息中的文件大小指示所述待传输资源的大小大于设定门限值 时， 策略判断模块 20确定该待传输资源需要进行防病毒扫描； 当所述属性信息中的文 件类型指示所述待传输资源的类型属于设定类型时， 策略判断模块 20确定该待传输资 源需要进行防病毒扫描。
扫描发起模块 30， 用于当策略判断模块 20判断出需要进行防病毒扫描时， 则将随 后获取到的待传输资源进行防病毒扫描；
具体可以将随后获取到的待传输资源传输至代理层进行缓存并进行防病毒扫描， 或者也可以是提供给其他防病毒服务器进行防病毒扫描， 再获取扫描结果。 根据扫描结 果， 没有病毒的文件可以进行传输， 若有病毒或其他问题的则将文件丢弃。
透传发起模块 40， 用于当策略判断模块 20判断出不需要进行防病毒扫描时， 则透 传随后获取到的待传输资源。
本实施例提供了一种能够对待传输资源是否需要进行防病毒扫描进行预探测的技 术方案。本实施例的技术方案通过在资源请求获取阶段主动发送预探测请求来获取属性 信息， 再根据属性信息对待传输资源进行预探测， 对于不需要进行防病毒扫描的可以直 接透传， 因而既实现了防病毒功能， 又能够提高传输效率， 减少对缓存、 扫描和上层传 输资源的浪费。
上述技术方案尤其适用于用户发起资源获取的这种常见情况， 能够增强对用户获取 资源的防病毒保护。
本发明实施例所提供的预分类器可以设置在代理网关中， 具体可以执行本发明实施 例所提供代理网关防病毒实现方法， 具备相应的功能模块， 能够提高代理网关的传输效 率， 减少资源浪费。
本发明实施例还提供一种代理网关， 包括代理客户端、 代理服务端和病毒扫描缓存 模块，病毒扫描缓存模块可设置在代理客户端和代理服务端之间，用于实现防病毒扫描。 该代理网关还包括本发明任意实施例所提供的预分类器； 该预分类器设置在代理客户端 和代理服务端的下层， 当策略判断模块判断出需要进行防病毒扫描时， 则将随后获取到 的待传输资源经代理客户端或代理服务端提供给病毒扫描缓存模块进行防病毒扫描。
本发明实施例所提供的代理网关能够减少代理层的工作负荷， 减少资源浪费， 进而 加速代理网关的数据传输。
需要说明的是， 对于前述的各方法实施例， 为了简单描述， 故将其都表述为一系列 的动作组合， 但是本领域技术人员应该知悉， 本发明并不受所描述的动作顺序的限制， 因为依据本发明， 某些步骤可以采用其他顺序或者同时进行。 其次， 本领域技术人员也 应该知悉， 说明书中所描述的实施例均属于优选实施例， 所涉及的动作和模块并不一定 是本发明所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分， 可以参见其他实施例的相关描述。
本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步骤可以通过程 序指令相关的硬件来完成， 前述的程序可以存储于一计算机可读取存储介质中， 该程序 在执行时， 执行包括上述方法实施例的步骤； 而前述的存储介质包括： R0M、 RAM, 磁碟 或者光盘等各种可以存储程序代码的介质。 最后应说明的是： 以上实施例仅用以说明本发明的技术方案， 而非对其限制； 尽管 参照前述实施例对本发明进行了详细的说明， 本领域的普通技术人员应当理解： 其依然 可以对前述各实施例所记载的技术方案进行修改， 或者对其中部分技术特征进行等同替 换； 而这些修改或者替换， 并不使相应技术方案的本质脱离本发明各实施例技术方案的 精神和范围。

Claims

权利要求
1、 一种代理网关防病毒实现方法， 其特征在于， 包括：
接收请求获取待传输资源的资源获取请求；
根据所述资源获取请求向所述待传输资源所在的网元发送预探测请求， 以获取所述 待传输资源的属性信息；
基于防病毒策略， 根据所述属性信息判断所述待传输资源是否需要进行防病毒扫 描， 若是， 则将随后获取到的所述待传输资源进行防病毒扫描， 若否， 则透传随后获取 到的所述待传输资源。
2、 根据权利要求 1所述的方法， 其特征在于， 所述接收请求获取待传输资源的资源 获取请求包括：
接收来自真实客户端的下载请求或上传请求作为所述资源获取请求。
3、 根据权利要求 1或 2所述的方法， 其特征在于， 所述基于防病毒策略， 根据所述 属性信息判断所述待传输资源是否需要进行防病毒扫描包括：
根据所述属性信息中的文件大小判断所述待传输资源的大小是否大于设定门限值， 以确定是否需要进行防病毒扫描； 和 /或
根据所述属性信息中的文件类型判断所述待传输资源的类型是否属于设定类型， 以 确定是否需要进行防病毒扫描。
4、 根据权利要求 1或 2所述的方法， 其特征在于， 将随后获取到的所述待传输资源 进行防病毒扫描包括：
将随后获取到的所述待传输资源传输至所述代理网关的代理层进行缓存并进行防病毒 扫描。
5、 根据权利要求 1或 2所述的方法， 其特征在于， 基于防病毒策略， 根据所述属性 信息判断所述待传输资源是否需要进行防病毒扫描包括：
基于本地存储的防病毒策略， 根据所述属性信息判断所述待传输资源是否需要进 行防病毒扫描； 或
将所述属性信息发送至外部服务器， 以指示所述外部服务器基于防病毒策略， 根 据所述属性信息判断所述待传输资源是否需要进行防病毒扫描并返回判断结果。
6、 根据权利要求 1或 2所述的方法， 其特征在于： 所述待传输资源包括基于超文本 传输协议的文件， 所述预探测请求包括设置有范围字段的资源获取请求， 所述范围字段 用于指示获取所述待传输资源中设定范围的字节。
7、 根据权利要求 1或 2所述的方法， 其特征在于： 所述待传输资源的属性信息包括 文件大小、 文件类型、 文件名和 /或文件作者。
8、 根据权利要求 1或 2所述的方法， 其特征在于， 所述基于防病毒策略， 根据所述 属性信息判断所述待传输资源是否需要进行防病毒扫描包括：
根据所述属性信息中的文件名判断所述待传输资源的文件名是否与预定关键字匹 配， 以确定是否需要进行防病毒扫描； 和 /或
根据所述属性信息中的文件作者判断所述待传输资源的文件作者是否与预定关键 字匹配， 以确定是否需要进行防病毒扫描。
9、 一种预分类器， 其特征在于， 包括：
探测获取模块， 用于接收请求获取待传输资源的资源获取请求， 并根据所述资源获 取请求向所述待传输资源所在的网元发送预探测请求；
属性获取模块，用于接收所述网元根据所述预探测请求返回的所述待传输资源的属 性信息；
策略判断模块， 用于基于防病毒策略， 根据所述属性信息判断所述待传输资源是否 需要进行防病毒扫描；
扫描发起模块， 用于当所述策略判断模块判断出需要进行防病毒扫描时， 则将随后 获取到的所述待传输资源进行防病毒扫描；
透传发起模块， 用于当所述策略判断模块判断出不需要进行防病毒扫描时， 则透传 随后获取到的所述待传输资源。
10、 根据权利要求 9所述的预分类器， 其特征在于， 所述探测获取模块包括： 接收单元， 用于接收来自真实客户端的下载请求或上传请求作为所述资源获取请 求； 和 /或接收来自真实服务器的请求真实客户端传输数据的请求作为所述资源获取请 求；
发送单元， 用于根据所述接收模块接收到的所述资源获取请求， 向所述待传输资源 所在的网元发送预探测请求。
11、 根据权利要求 9或 10所述的预分类器， 其特征在于， 所述策略判断模块具体用 于根据以下至少之一来确定是否需要进行防病毒扫描： 所述属性信息中的文件大小判断 所述待传输资源的大小是否大于设定门限值； 所述属性信息中的文件类型判断所述待传 输资源的类型是否属于设定类型； 所述属性信息中的文件名判断所述待传输资源的文件 名是否与预定关键字匹配； 所述属性信息中的文件作者判断所述待传输资源的文件作者 是否与预定关键字匹配。
12、 根据权利要求 9或 10所述的预分类器， 其特征在于， 所述扫描发起模块具体用 于将随后获取到的所述待传输资源传输至代理网关的代理层进行缓存并进行防病毒扫 描。
13、 根据权利要求 9所述的预分类器， 其特征在于， 所述策略判断模块包括： 本地判断单元， 用于基于本地存储的防病毒策略， 根据所述属性信息判断所述待 传输资源是否需要进行防病毒扫描； 和 /或
外部判断单元， 用于将所述属性信息发送至外部服务器， 以指示所述外部服务器 基于防病毒策略，根据所述属性信息判断所述待传输资源是否需要进行防病毒扫描并返 回判断结果。
14、 根据权利要求 9或 10所述的预分类器， 其特征在于： 所述待传输资源包括基于 超文本传输协议的文件， 所述预探测请求包括设置有范围字段的资源获取请求， 所述范 围字段用于指示获取所述待传输资源中设定范围的字节。
15、 一种代理网关， 包括代理客户端、 代理服务端和病毒扫描缓存模块， 其特征在 于： 还包括权利要求 9至 14中任一项所述的预分类器； 所述预分类器设置在所述代理客 户端和代理服务端的下层。
PCT/CN2011/072847 2010-07-13 2011-04-15 代理网关防病毒实现方法，预分类器和代理网关 WO2012006885A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US13/707,016 US8769694B2 (en) 2010-07-13 2012-12-06 Proxy gateway anti-virus method, pre-classifier, and proxy gateway
US14/282,506 US9313220B2 (en) 2010-07-13 2014-05-20 Proxy gateway anti-virus method, pre-classifier, and proxy gateway

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010228197A CN101877710B (zh) 2010-07-13 2010-07-13 代理网关防病毒实现方法、预分类器和代理网关
CN201010228197.6 2010-07-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/707,016 Continuation US8769694B2 (en) 2010-07-13 2012-12-06 Proxy gateway anti-virus method, pre-classifier, and proxy gateway

Publications (1)

Publication Number Publication Date
WO2012006885A1 true WO2012006885A1 (zh) 2012-01-19

Family

ID=43020171

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/072847 WO2012006885A1 (zh) 2010-07-13 2011-04-15 代理网关防病毒实现方法，预分类器和代理网关

Country Status (3)

Country Link
US (2) US8769694B2 (zh)
CN (1) CN101877710B (zh)
WO (1) WO2012006885A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112751839A (zh) * 2020-12-25 2021-05-04 江苏省未来网络创新研究院 一种基于用户流量特性的防病毒网关处理加速策略

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101877710B (zh) * 2010-07-13 2012-10-17 成都市华为赛门铁克科技有限公司 代理网关防病毒实现方法、预分类器和代理网关
CN102547710B (zh) * 2010-12-22 2015-09-02 西门子公司 在移动通信系统中探测病毒的方法和装置
CN102594780B (zh) * 2011-01-12 2016-03-30 西门子公司 移动终端病毒的检测、清除方法及装置
CN102761535A (zh) * 2011-04-29 2012-10-31 北京瑞星信息技术有限公司 病毒监测方法和设备
US9237168B2 (en) * 2012-05-17 2016-01-12 Cisco Technology, Inc. Transport layer security traffic control using service name identification
CN102970294A (zh) * 2012-11-21 2013-03-13 网神信息技术（北京）股份有限公司 安全网关的病毒检测方法及装置
US8955137B2 (en) 2012-12-21 2015-02-10 State Farm Mutual Automobile Insurance Company System and method for uploading and verifying a document
US9571390B2 (en) * 2013-11-25 2017-02-14 Cisco Technology, Inc. Path optimization for adaptive streaming
CN103905419A (zh) * 2013-12-04 2014-07-02 哈尔滨安天科技股份有限公司 一种文件鉴定装置及方法
CN103701816B (zh) * 2013-12-27 2017-07-11 北京奇安信科技有限公司 执行拒绝服务攻击的服务器的扫描方法和扫描装置
US9237204B1 (en) * 2014-07-30 2016-01-12 Iboss, Inc. Web redirection for caching
KR101587161B1 (ko) 2014-09-03 2016-01-20 한국전자통신연구원 실시간 네트워크 안티바이러스 수행 장치 및 방법
CN104363136A (zh) * 2014-11-07 2015-02-18 网神信息技术（北京）股份有限公司 安全网关设备的测试方法和装置
CN105791233B (zh) * 2014-12-24 2019-02-26 华为技术有限公司 一种防病毒扫描方法及装置
US10747881B1 (en) 2017-09-15 2020-08-18 Palo Alto Networks, Inc. Using browser context in evasive web-based malware detection
EP3759630A4 (en) * 2018-03-02 2021-11-24 Blocksafe Technologies, Inc. BLOCKCHAIN ACCESS CONTROL SYSTEMS AND METHODS
CN112738062B (zh) * 2020-12-25 2023-04-07 江苏省未来网络创新研究院 一种基于用户策略的防毒网关
US11627150B2 (en) * 2021-06-30 2023-04-11 Microsoft Technology Licensing, Llc Proxy services for the secure upload of file system tree structures
CN113872936A (zh) * 2021-08-26 2021-12-31 上海宝康电子控制工程有限公司 一种流模式网络安全检测方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006034201A2 (en) * 2004-09-17 2006-03-30 Hobnob, Inc. Quarantine network
CN101150583A (zh) * 2007-10-23 2008-03-26 华为技术有限公司 终端设备防病毒的方法及设备
CN101599922A (zh) * 2008-06-02 2009-12-09 北京华凯兴网络科技有限公司 应用层协议病毒防护网关
CN101877710A (zh) * 2010-07-13 2010-11-03 成都市华为赛门铁克科技有限公司 代理网关防病毒实现方法、预分类器和代理网关

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7263616B1 (en) * 2000-09-22 2007-08-28 Ge Medical Systems Global Technology Company, Llc Ultrasound imaging system having computer virus protection
US9392002B2 (en) * 2002-01-31 2016-07-12 Nokia Technologies Oy System and method of providing virus protection at a gateway
US7290282B1 (en) * 2002-04-08 2007-10-30 Symantec Corporation Reducing false positive computer virus detections
CN101061454B (zh) * 2004-04-15 2011-09-28 清晰路径网络股份有限公司 用于管理网络的系统和方法
CN101495969B (zh) * 2005-05-05 2012-10-10 思科埃恩波特系统有限公司 识别电子消息中的威胁
GB2432933B (en) * 2006-03-14 2008-07-09 Streamshield Networks Ltd A method and apparatus for providing network security
US8316439B2 (en) * 2006-05-19 2012-11-20 Iyuko Services L.L.C. Anti-virus and firewall system
US7865965B2 (en) * 2007-06-15 2011-01-04 Microsoft Corporation Optimization of distributed anti-virus scanning
RU2449348C1 (ru) * 2010-11-01 2012-04-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ для антивирусной проверки на стороне сервера скачиваемых из сети данных

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006034201A2 (en) * 2004-09-17 2006-03-30 Hobnob, Inc. Quarantine network
CN101150583A (zh) * 2007-10-23 2008-03-26 华为技术有限公司 终端设备防病毒的方法及设备
CN101599922A (zh) * 2008-06-02 2009-12-09 北京华凯兴网络科技有限公司 应用层协议病毒防护网关
CN101877710A (zh) * 2010-07-13 2010-11-03 成都市华为赛门铁克科技有限公司 代理网关防病毒实现方法、预分类器和代理网关

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112751839A (zh) * 2020-12-25 2021-05-04 江苏省未来网络创新研究院 一种基于用户流量特性的防病毒网关处理加速策略

Also Published As

Publication number Publication date
US20130097666A1 (en) 2013-04-18
CN101877710B (zh) 2012-10-17
US20140325655A1 (en) 2014-10-30
US9313220B2 (en) 2016-04-12
US8769694B2 (en) 2014-07-01
CN101877710A (zh) 2010-11-03

Similar Documents

Publication Publication Date Title
WO2012006885A1 (zh) 代理网关防病毒实现方法，预分类器和代理网关
US9438702B2 (en) Techniques for protecting against denial of service attacks
Belshe et al. Hypertext transfer protocol version 2 (HTTP/2)
JP5442755B2 (ja) リモートデスクトッププロトコルのためのハードウェアアクセラレーション
US9413727B2 (en) Method and apparatus for content filtering on SPDY connections
EP2175603A1 (en) Dynamic access control policy with port restrictions for a network security appliance
US20160105469A1 (en) Transparent inline content inspection and modification in a TCP session
WO2014173365A1 (zh) Ftp的应用层报文过滤方法及装置、计算机存储介质
RU2635220C2 (ru) Система двухсторонней связи в реальном времени с использованием протокола НТТР
US20230275924A1 (en) Network security protection method and protection device
JP2017118545A5 (zh)
CN109787962A (zh) 一种基于多协议双向单连接的p2p软件识别方法
Thomson et al. HTTP/2
JP2010244134A (ja) Ｕｒｌフィルタリング装置およびｕｒｌフィルタリング方法
US11038994B2 (en) Technique for transport protocol selection and setup of a connection between a client and a server
JP6623702B2 (ja) ネットワーク監視装置及びネットワーク監視装置におけるウイルス検知方法。
JP6184381B2 (ja) 暗号化されたデータフローを分類する方法および装置、コンピュータプログラム、ならびに情報記憶手段
JP2005210352A (ja) Ｉｐアドレス変換装置及び変換方法
EP3408783B1 (en) Preventing malware downloads
WO2022100002A1 (zh) 网络安全防护方法以及防护设备
CN114070878B (zh) 网络连接处理方法及装置
US11683327B2 (en) Demand management of sender of network traffic flow
Thomson et al. Hypertext transfer protocol version 2
CN115603994A (zh) 一种可信通信方法、装置、设备及存储介质
Klimek SK: Nové prístupy k optimalizácii P2P dátových prenosov

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11806227

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11806227

Country of ref document: EP

Kind code of ref document: A1