Distributed cloud-based security systems and methods

1. A method comprising:

monitoring, in a processing node in a distributed security system, a content item sent from or requested by an external system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node; and

determining, responsive to a security policy associated with the external system, a threat classification of the content item utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash; and

performing one of in the processing node based on comparison of the index with the detection processing filter:

allowing the content item through the processing node if the threat classification is clean;

precluding the content item at the processing node if the threat classification is violating; and

threat detecting the content item at the processing node if the threat classification is unknown and one of allowing or precluding the content item based on the threat detecting,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

2. The method of claim 1 , further comprising:

obtaining the security policy from an authority node based on a specific enterprise associated with the external system.

3. The method of claim 1 , wherein the threat detecting utilizes one or more data inspection engines the content item at the processing node.

4. The method of claim 3 , wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

5. The method of claim 3 , wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.

6. The method of claim 1 , wherein the detection processing filter is a Bloom filter.

7. A processing node in a distributed security system, comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or processors to

communicate with an external system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node;

monitor a content item sent from or requested by an external system; and

determine, responsive to a security policy associated with the external system, a threat classification of the content item utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash; and

perform one of based on comparison of the index with the detection processing filter:

allow the content item through the processing node if the threat classification is clean;

preclude the content item at the processing node if the threat classification is violating; and

threat detect the content item at the processing node if the threat classification is unknown and one of allow or preclude the content item based on the threat detection,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

8. The processing node of claim 7 , wherein the memory storing instructions that, when executed, further cause the one or processors to

obtain the security policy from an authority node based on a specific enterprise associated with the external system.

9. The processing node of claim 7 , wherein the threat detection utilizes one or more data inspection engines the content item at the processing node.

10. The processing node of claim 9 , wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

11. The processing node of claim 9 , wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.

12. An external system comprising one of a computer device and a mobile device, comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or processors to

communicate on a Wide Area Network (WAN) through a processing node in a distributed security system, wherein the processing node is external from a network edge of the external system and communications between the processing node and the external system are via a proxy, a tunnel, and redirection such that all the communications from the external system which are destined for or received from the Internet are processed through the processing node; and

one of send and request a content item over the WAN, wherein, responsive to a security policy associated with the external system, the content item is threat classified by the processing node utilizing a hash of an information key associated with the content item to generate an index that is compared with a detection processing filter, the information key including an identification of a file name of an executable file associated with the content item and an identification of a file size of the executable file associated with the content item that are represented in the index generated by the hash, and, based on comparison of the index with the detection processing filter, one of:

allowed through the processing node if a threat classification is clean;

precluded at the processing node if the threat classification is violating; and

threat detected at the processing node if the threat classification is unknown and one of allowed or precluded the content item based on the threat detection,

wherein the content item is one of spyware, malware, a virus, spam, and undesirable content which is precluded based on the security policy, and

wherein the information key further includes an address of the content item.

13. The external system of claim 12 , wherein the threat detection utilizes one or more data inspection engines the content item at the processing node.

14. The external system of claim 13 , wherein the one or more data inspection engines are a plurality of data inspection engines and the content item is precluded if any one of the plurality of data inspection engines has a violation.

15. The external system of claim 13 , wherein master security policy for the one or more data inspection engines is provided by an authority node based on updates received from other nodes in the distributed security system.