Notification for reassembly-free file scanning
Techniques for notification of reassembly-free file scanning are described herein. According to one embodiment, a first request for accessing a document provided by a remote node is received from a client. In response to the first request, it is determined whether a second request previously for accessing the document of the remote node indicates that the requested document from the remote node contains offensive data. If the requested document contains offensive data, a message is returned to the client, without accessing the requested document of the remote node, indicating that the requested document is not delivered to the client.
1. A method for network protection, the method comprising:
receiving a first request at a gateway from a first client device, the first request requesting retrieval of a dataset from a server device;
forming, by the gateway, a first connection between the gateway and the server device in response to the first request;
retrieving, by the gateway, a portion of the dataset from the server device via the first connection between the gateway and the server device in response to the first request;
identifying, by the gateway, that the dataset includes offensive content based on the retrieved portion of the dataset;
terminating, by the gateway in response to the identification that the dataset includes the offensive content, the first connection between the gateway and the server device before the dataset is delivered in full, wherein at least another portion of the dataset is prevented from being transmitted to the first client device, wherein the termination of the first connection blocks the dataset from being received in full at the first client device, wherein in response to the termination of the first connection, a timeout notification is provided to the first client device and information including at least one reason to block the dataset is not provided to the first client device;
storing, by the gateway, an identifier of the dataset in a data structure that is remote from the gateway, wherein the identifier is hashed and stored in association with the information including the at least one reason to block the dataset in the data structure in response to the termination of the first connection;
receiving a second request at the gateway from a second client device, the second request requesting retrieval of the dataset from the server device, the second request including the identifier; and
blocking, by the gateway, formation of a second connection between the gateway and the server device in response to the second request based on the identification that the dataset includes the offensive content, wherein the information including the at least one reason to block the dataset is provided to the second client device based at least in part on the identifier of the dataset stored in the data structure in response to the blocking of the formation of the second connection.
2. The method of claim 1 , wherein the identifier includes an address and the at least one reason to block the dataset includes the identification that the dataset includes the offensive content.
3. The method of claim 2 , wherein the blocking of the formation of the second connection between the gateway and the server device includes querying the data structure and retrieving the identifier from the data structure.
4. The method of claim 2 , wherein the address is a Uniform Resource Locator (URL) address associated with the dataset.
5. The method of claim 2 , wherein the address is an Internet Protocol (IP) address associated with the dataset.
6. The method of claim 1 , wherein the first connection between the gateway and the server device is a Transmission Control Protocol (TCP) connection.
7. The method of claim 1 , wherein the dataset includes a hypertext transport protocol (HTTP) file.
8. The method of claim 1 , wherein the dataset includes a HyperText Markup Language (HTML) file.
9. The method of claim 1 , wherein the dataset includes an email file.
10. The method of claim 1 , wherein the dataset includes a media file.
11. The method of claim 1 , further comprising transmitting an initially retrieved portion of the dataset to the first client device before identifying that the dataset includes the offensive content.
12. The method of claim 1 , wherein the offensive content includes at least one of a virus or a spyware.
13. A gateway system for network protection, the gateway system comprising:
a communication interface that receives a first request from a first client device and a second request from a second client device, the first request requesting retrieval of a dataset from a server device, the second request also requesting retrieval of the dataset from the server device;
a memory; and
a processor that executes instructions stored in the memory, wherein execution of the instructions by the processor:
forms a first connection with the server device via the communication interface in response to the first request,
retrieves a portion of the dataset from the server device via the first connection with the server device in response to the first request,
identifies that the dataset includes offensive content based on the retrieved portion of the dataset,
terminates, in response to the identification that the dataset includes the offensive content, the first connection with the server device before the dataset is delivered in full, wherein at least another portion of the dataset is prevented from being transmitted to the first client device, wherein the termination of the first connection blocks the dataset from being received in full at the first client device, wherein in response to the termination of the first connection, a timeout notification is provided to the first client device and information including at least one reason to block the dataset is not provided to the first client device,
stores an identifier of the dataset in a data structure that is remote from the gateway system, wherein the identifier is hashed and stored in association with the information including the at least one reason to block the dataset in the data structure in response to the termination of the first connection, and
blocks formation of a second connection with the server device in response to the second request based on the identification that the dataset includes the offensive content, wherein the information including the at least one reason to block the dataset is provided to the second client device based at least in part on the identifier of the dataset stored in the data structure in response to the blocking of the formation of the second connection.
14. The gateway system of claim 13 , wherein the at least one reason includes the identification that the dataset includes the offensive content, and the blocking of the formation of the second connection with the server device includes querying the data structure and retrieving the identifier from the data structure.
15. The gateway system of claim 14 , wherein the identifier is at least one of a Uniform Resource Locator (URL) or an Internet Protocol (IP) address associated with the dataset.
16. A method for network protection, the method comprising:
receiving a request from a client device at a gateway, the request requesting retrieval of a dataset from a server device;
identifying, by the gateway in response to the request, that an identifier of the dataset is not stored in a data structure that is remote from the gateway;
allowing, by the gateway, a first connection to be formed between the gateway and the server device, wherein the client device receives a portion of the dataset from the gateway in response to transmitting the request from the client device to the gateway;
identifying, by the gateway, that the dataset includes offensive content based on at least another portion of the dataset retrieved from the server device;
blocking, by the gateway in response to the identification that the dataset includes the offensive content, the dataset by terminating the first connection and by not sending the at least another portion of the dataset to the client device, wherein in response to the termination of the first connection, a timeout notification is provided to the client device and information identifying at least one reason to block the dataset is not sent to the client device;
storing, by the gateway, the identifier of the dataset in the data structure in association with the information identifying the at least one reason to block the dataset in response to the termination of the first connection, wherein the identifier is hashed;
receiving, by the gateway, a subsequent request from the client device to retrieve the dataset;
blocking, by the gateway, the dataset from being sent in response to the subsequent request by not forming a second connection between the gateway and the server device to retrieve the dataset to the client device, wherein the blocking of the dataset from being sent in response to the subsequent request is based on the identifier of the dataset stored in the data structure; and
sending a message from the gateway to the client device, the message identifying that the dataset was identified as including the offensive content, wherein the message indicates the at least one reason to block the dataset based on the identifier of the dataset stored in the data structure.