Optimized network cache for virus scanning by examining the magic bytes of a file
A system and method is provided for reliably detecting the file type of a client-requested and by-passing conventional ICAP processing if the detected file type corresponds to a non-viral file. The client-requested file is examined to determine whether it contains a predefined byte pattern (or “file signature”) corresponding to a non-viral type. The signature may be embodied as one or more predetermined “magic bytes” located at known offsets. For instance, the client-requested may be identified as a particular type of image file if it contains the set of magic bytes associated with that image format. Unlike prior implementations, when the client-requested file is determined to contain magic bytes corresponding to a non-viral file type, such as an image file, the file is returned to the requesting client without performing conventional ICAP virus-scanning operations.
1. A method for processing data-access requests at a network device, comprising:
receiving a data-access request at the network device, the data-access request specifying client-requested data to return to a requesting client;
retrieving the client-requested data;
determining, at the network device, if the client-requested data includes a predefined byte pattern corresponding to a non-viral data type;
forwarding a data-access response containing the client-requested data to the requesting client if the client-requested data is determined to include the predefined byte pattern; and
forwarding the data-access response to a remote server if the client-requested data is determined not to include the predefined byte pattern, the remote server being configured to scan the client-requested data for one or more viruses.
2. The method of claim 1 , wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.
3. The method of claim 1 , wherein the network device is a network caching device.
4. The method of claim 3 , wherein the network device is configured as a reverse-proxy cache.
5. The method of claim 3 , wherein the network device is configured as a forward-proxy cache.
6. The method of claim 1 , wherein the predefined byte pattern contains a single sequence of bytes.
7. The method of claim 1 , wherein the predefined byte pattern contains multiple byte sequences.
8. The method of claims 1 , wherein the non-viral data type corresponds to a type of image data.
9. The method of claim 8 , wherein the image data is a Joint Picture Expert's Group (JPEG) data type.
10. The method of claim 8 , wherein the image data is a Graphics Interchange Format (GIF) data type.
11. The method of claim 1 wherein determining comprises comparing the client-requested data with a data-signature table.
12. A network device, comprising:
means for receiving a data-access request at the network device, the data-access request specifying a client-requested data to return to a requesting client;
means for retrieving the client-requested data;
means for determining, at the network device, if the client-requested data includes a predefined byte pattern corresponding to a non-viral data type;
means for forwarding a data-access response containing the client-requested data to the requesting client if the client-requested data is determined to include the predefined byte pattern; and
means for forwarding the data access response to a remote server if the client-requested data is determined not to include the predefined byte pattern, the remote server being configured to scan the client-requested data for one or more viruses.
13. The network device of claim 12 , wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.
14. The network device of claim 12 , wherein the network device is a network caching device.
15. The network device of claim 12 , wherein the predefined byte pattern contains a single sequence of bytes.
16. The network device of claim 12 , wherein the predefined byte pattern contains multiple byte sequences.
17. A network device, comprising:
a processor;
a first network interface configured to receive a data-access request, the data-access request specifying client-requested data to return to a requesting client;
a second network interface configured to communicate with a remote server, the remote server being configured to scan the client-requested data for one or more viruses; and
a memory configured to store instructions which are executable by the processor for performing the steps of:
retrieving the client-requested data;
determining, at the network device, whether the client-requested data includes a predefined byte pattern corresponding to a non-viral data type;
forwarding a data-access response containing the client-requested data over the first network interface to the requesting client if the client-requested data is determined to include the predefined byte pattern; and
forwarding the data-access response over the second network interface to the remote server if the client-requested data is determined not to include the predefined byte pattern.
18. The network device of claim 17 , further comprising:
at least one storage device configured to store the client-requested data; and
a storage adapter configured to retrieve the client-requested data from the at least one storage device in response to the instructions for retrieving the client-requested data.
19. The network device of claim 17 , wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.
20. The network device of claim 17 , wherein the network device is a network caching device.
21. The network device of claim 17 , wherein the predefined byte pattern contains a single sequence of bytes.
22. The network device of claim 17 , wherein the predefined byte pattern contains multiple byte sequences.
23. A network, comprising:
a client device configured to transmit a data-access request specifying client-requested data;
a server device configured to scan the client-requested data for one or more viruses; and
a network device configured to receive the client-requested data and further configured to:
retrieve the client-requested data;
determine, at the network device, whether the client-requested data includes a predefined byte pattern corresponding to a non-viral data type;
forward a data-access response containing the client-requested data to the client device if the client-requested data is determined to include the predefined byte pattern; and
forward the data-access response to the server device if the client- requested data is determined not to include the predefined byte pattern.
24. The network of claim 23 , wherein the server device is an Internet Content Adaptation Protocol (ICAP) server.
25. The network of claim 23 , wherein the network device is a network caching device.
26. The network of claim 23 , wherein the predefined byte pattern contains a single sequence of bytes.
27. The network of claim 23 , wherein the predefined byte pattern contains multiple byte sequences.
28. A method for processing data-access requests, comprising:
receiving a data-access request at a network device, the data-access request specifying client-requested data to return to a requesting client;
retrieving the client-requested data;
comparing the client-requested data with a data-signature table to determine if the client-requested data contains a matching byte pattern indicting a non-viral data type, wherein the data-signature table is located on the network device; and
forwarding the data-access response to a remote server if the client-requested data is determined not to include the matching byte pattern, the remote server being configured to scan the client-requested data for one or more viruses.
29. A method for processing data-access requests, comprising:
receiving an access request at a network device, the access request specifying a client-requested object to return to a requesting client;
retrieving the client-requested object;
comparing, at the network device, the client-requested object with a table to determine if the client-requested object contains a matching pattern indicating a non-viral object type; and
forwarding the access response to a remote server if the client-requested object is determined not to include the matching pattern, the remote server being configured to scan the client-requested object for one or more viruses.
30. The method of claim 29 further comprising forwarding the data-access response containing the client-requested data to the requesting client if the client-requested data is determined to include the matching pattern object type.
31. The method of claim 29 wherein the object is a file.
32. The method of claim 29 wherein the pattern is a byte pattern.
33. The method of claim 29 wherein the table is a data-signature table.
34. The method of claim 33 further comprising maintaining the data-signature table using one or more threads, wherein the threads are embodied within an ICAP agent.
35. The method of claim 33 further comprising reading a signature data to generate the data-signature table.
36. The method of claim 33 further comprising indicating, by one or more data signatures stored in the data-signature table, at least one predetermined sequence of one or more bytes and corresponding offsets of the one or more bytes.
37. The method of claim 33 wherein the data-signature table includes at least one entry containing a known non-viral data type.
38. The method of claim 37 further comprising:
combining the known non-viral data type and the matching pattern object type; and
associating the combination of the known non-viral data type and the matching pattern object type with one or more predefined sequences of bytes.
39. A method for processing data-access requests, comprising:
generating a data-signature table on a network cache;
receiving a data-access request at the network cache, the data-access request specifying client-requested data to return to a requesting client;
retrieving the client-requested data;
comparing the client-requested data with the data-signature table to determine if the client-requested data contains a matching byte pattern indicating a non-viral data type; and
forwarding, in response to determining a viral data type for the client-requested data, the data-access response to an Internet Content Adaptation Protocol (ICAP) server to scan the client-requested data for one or more viruses.