TARGET DATA DETECTION IN A STREAMING ENVIRONMENT
In embodiments of the present invention improved capabilities are described for a data stream scanner. The present invention may provide for a data portion received in association with a data stream, and the data portion may be analyzed to make an assessment. An identity pool may then be selected from a universe of identities based on the assessment, and identities from the identity pool may be selected in a scanning process to analyze the data stream. Further, an unmatched identity may remove the identity from the pool upon finding that the unmatched identity does not match data in the data stream.
1 . A method, comprising:
receiving a data portion associated with a data stream;
analyzing the data portion to make an assessment;
selecting an identity pool from a universe of identities based on the assessment; and
selecting identities from the identity pool in a scanning process to analyze the data stream.
2 . The method of claim 1 , further comprising removing an unmatched identity from the identity pool upon finding that the unmatched identity does not match data in the data stream.
3 . The method of claim 1 , further comprising removing a matched identity from the identity pool upon finding that the matched identity matches data in the data stream.
4 . The method of claim 1 , wherein the scanning process analyzes each byte of the data stream.
5 . The method of claim 1 , wherein the scanning process analyzes a plurality of byte portions from the data stream.
6 . The method of claim 1 , wherein the scanning process analyzes a pattern of bytes from the data stream.
7 . The method of claim 1 , wherein the identity is byte code.
8 . The method of claim 7 , wherein the process of scanning involves executing the identities in the identity pool.
9 . The method of claim 7 , wherein at least one identity executes a matching process.
10 . The method of claim 7 , wherein at least one identity executes a hashing process.
11 . The method of claim 7 , wherein at least one identity executes a determination process, wherein a decision about the data stream can be made following its execution.
12 . The method of claim 1 , wherein the identity is a data pattern.
13 . The method of claim 12 , wherein the process of scanning involves comparing the identities in the identity pool to data from the data stream.
14 . The method of claim 1 , wherein the scanning process is attempting to identify malware.
15 . The method of claim 1 , wherein the scanning process is attempting to identify information in accordance to a corporate policy.
16 . The method of claim 1 , wherein the scanning process is attempting to identify a file.
17 . A system, comprising:
a data portion associated with a data stream;
an assessment facility for analyzing the data portion;
the assessment facility selecting an identity pool from a universe of identities based on analysis from the assessment facility; and
the assessment facility selecting identities from the identity pool for scanning in order to analyze the data stream.
18 . The system of claim 17 , further comprising the assessment facility removing an unmatched identity from the identity pool upon finding that the unmatched identity does not match data in the data stream.
19 . The system of claim 17 , further comprising the assessment facility removing a matched identity from the identity pool upon finding that the matched identity matches data in the data stream.
20 . The system of claim 17 , wherein the scanning analyzes each byte of the data stream.
21 . The system of claim 17 , wherein the scanning analyzes a plurality of byte portions from the data stream.
22 . The system of claim 17 , wherein the scanning analyzes a pattern of bytes from the data stream.
23 . The system of claim 17 , wherein the identity is byte code.
24 . The system of claim 23 , wherein the scanning involves executing the identities in the identity pool.
25 . The system of claim 23 , wherein at least one identity executes a matching process.
26 . The system of claim 23 , wherein at least one identity executes a hashing process.
27 . The system of claim 23 , wherein at least one identity executes a determination, wherein a decision about the data stream can be made following its execution.
28 . The system of claim 17 , wherein the identity is a data pattern.
29 . The system of claim 28 , wherein the scanning involves comparing the identities in the identity pool to data from the data stream.
30 . The system of claim 17 , wherein the scanning is attempting to identify malware.
31 . The system of claim 17 , wherein the scanning is attempting to identify information in accordance to a corporate policy.
32 . The system of claim 17 , wherein the scanning is attempting to identify a file.