SYSTEMS FOR BI-DIRECTIONAL NETWORK TRAFFIC MALWARE DETECTION AND REMOVAL

1 . A system, comprising:

A) one or more server computer communicatively coupled to a network configured to receive, from a client having a first network resource address, a request for a content from a website hosted on a hosting server computer having a second network resource address and resolving from a domain name, wherein said domain name is pointed in a DNS to a third network resource address for said one or more server computer;

B) a scrubbing center running on said one or more server computer, said scrubbing center comprising:

i) an intrusion prevention and detection module configured to:

a) determine whether an event associated with said first network resource address matches one or more of a plurality of event signatures in one or more network security device communicatively coupled to said network;

b) responsive to a determination that an event associated with said first network resource address matches one or more of said plurality of event signatures:

I) block said request for said content from reaching said hosting server; or

II) transmit said request for said content to a content sanitizer module running on said one or more of said one or more server computer

ii) a reputation service module configured to:

a) generate a second malicious network resource address database;

b) determine whether said second network resource address is stored in said second malicious network resource address database; and

c) responsive to a determination that said second network resource address is stored in said second malicious network resource address database:

I) transmit a response to said client indicating that said second network resource address is stored in said second malicious network resource address database; or

II) transmit said content to said content sanitizer module; and

iii) said content sanitizer module configured to:

a) receive a determination whether said request for said content comprises a server-directed malware and, responsive to receiving a determination that said request for said content comprises a server-directed malware:

I) block said request for content from reaching said hosting server; or

II) remove said server-directed malware from said request for said content; and transmit a scrubbed request for said content to said hosting server computer, said scrubbed request for said content comprising said request for said content having said server-directed malware removed; and

b) receive a determination whether said content comprises a client-directed malware and, responsive to receiving a determination that said content comprises a client-directed malware:

I) block said content from reaching said client; or

II) remove said client-directed malware from said content; and transmit a scrubbed content to said client, said scrubbed content comprising said content having said client-directed malware removed.

2 . The system of claim 1 , wherein said one or more network security device comprise a distributed denial of service mitigation device, an intrusion detection system, an intrusion prevention system, or a web application firewall.

3 . The system of claim 2 , wherein said plurality of event signatures comprise a plurality of attack signatures.

4 . The system of claim 3 , wherein said plurality of attack signatures comprise one or more signatures identifying a botnet attack, a shell code attack, a cross site scripting attack, a SQL injection attack, a directory reversal attack, a remote code execution attack, a distributed denial of service attack, a brute force attack, a remote file inclusion attack, a script injection attack, or an iFrame injection attack.

5 . The system of claim 4 , wherein said server-directed malware comprises a botnet, a shell code, a cross site scripting, a SQL injection, a directory reversal, a remote code execution attack, a distributed denial of service attack, or a brute force attack.

6 . The system of claim 5 , wherein said client-directed malware comprises a virus, a worm, a trojan horse, a rootkit, a backdoor, a spyware, a keystroke logger, a phishing application, a script injection, or an iFrame injection.

7 . The system of claim 1 , wherein said first network resource address comprises an IP address.

8 . The system of claim 7 , wherein said IP address comprises an IPv4 address.

9 . The system of claim 7 , wherein said IP address comprises an IPv6 address.

10 . The system of claim 1 , wherein said second network resource address comprises an IP address.

11 . The system of claim 10 , wherein said IP address comprises an IPv4 address.

12 . The system of claim 10 , wherein said IP address comprises an IPv6 address.

13 . The system of claim 1 , wherein said third network resource address comprises an IP address.

14 . The system of claim 13 , wherein said IP address comprises an IPv4 address.

15 . The system of claim 14 , wherein said IP address comprises an IPv6 address.

16 . The system of claim 1 , wherein said client further comprises a SmartProxy configured to route said request for content to said scrubbing center.

17 . The system of claim 16 , wherein said SmartProxy is configured to route said request for content to said scrubbing center by:

i) storing said second network address in association with said third network resource address; and

ii) routing one or more content requests directed to said second network resource address to said third network resource address.

18 . The system of claim 16 , wherein said SmartProxy is further configured to:

i) receive said content from said website; and

ii) route said content to said scrubbing center.

19 . The system of claim 18 , wherein said SmartProxy is further configured to receive said content or said scrubbed content from said scrubbing center.

20 . The system of claim 1 , further comprises a SmartProxy configured to route said request for content to said scrubbing center, wherein said SmartProxy runs on an edge server communicatively coupled to said network.

21 . The system of claim 20 , wherein said SmartProxy is configured to route said request for content to said scrubbing center by:

i) storing said second network address in association with said third network resource address;

ii) receiving said request for content from said client; and

ii) routing one or more content requests directed to said second network resource address to said third network resource address.

22 . The system of claim 21 , wherein said SmartProxy is further configured to:

i) receive said content from said website; and

ii) route said content to said scrubbing center.

23 . The system of claim 22 , wherein said SmartProxy is further configured to receive said content or said scrubbed content from said scrubbing center.