Reassembly free deep packet inspection for peer to peer networks

1. A method for scanning computer data, the method comprising:

scanning at an application layer in a peer-to-peer network an out of order first portion of a dataset from an input state associated with a portion of a set of malware, wherein the out of order first portion of the dataset is sent to a destination after the scanning of the out of order first portion of the dataset and the scanning occurs by a processor executing instructions out of a memory;

identifying by the processor executing the instructions out of the memory that the dataset includes the portion of the set of malware based on the scanning of the out of order first portion of the dataset from the state associated with the portion of the set of malware;

scanning at the application layer in the peer-to-peer network a second out of order portion of the dataset that immediately precedes the first out of order portion of the dataset, the scanning of the second out of order portion of the dataset resulting in generation of an output state that matches the input state, wherein the scanning of the second out of order portion of the dataset also occurs by the processor executing the instructions out of the memory; and

blocking by the processor executing the instructions out of the memory the second portion of the out of order dataset from being sent to the destination based on the output state matching the input state and an identification that the dataset includes the set of malware.

2. The method of claim 1 , further comprising:

scanning a third portion of the dataset that immediately precedes the second dataset portion;

generating a first output state based on the scanning of the third dataset portion;

identifying that the first output state matches a second input state associated with the set of malware, wherein the second dataset portion was scanned from the second input state to generate the output state; and

identifying that the dataset includes the malware based on the scanning of the third dataset portion and the out of order scanning of the first and the second dataset portions.

3. The method of claim 1 , further comprising:

receiving the first dataset portion from a first computer in the peer-to-peer network; and

receiving the second data set portion from a second computer in the peer-to-peer network.

4. The method of claim 1 , further comprising:

scanning the out of order first dataset portion from a plurality of additional input states, wherein each of the plurality of additional input states are associated with at least one of the set of malware or another set of malware; and

comparing the input state and the plurality of additional input states to the output state when identifying that the output state matches the input state.

5. The method of claim 1 , further comprising:

receiving the out of order first portion of the dataset at a first layer of a plurality of layers of a computer architecture; and

passing the out of order first portion of the dataset to the application layer in the peer-to-peer network.

6. The method of claim 1 , further comprising preparing to send a first piece of a second dataset to a first computer in the peer-to-peer network, the first piece of the second dataset including one or more data blocks, wherein the one or more data blocks are received by the first computer in an out of order sequence as compared to one or more other data blocks associated with the second dataset.

7. The method of claim 1 , further comprising:

generating a state mapping associated with the dataset based on the scanning of first and the second portion of the dataset; and

identifying that the dataset includes the set of malware based on the state mapping corresponding to a malware pattern.

8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to implement a method for scanning computer data, the method comprising the processor executing instructions of the program out of a memory to:

scan at an application layer in a peer-to-peer network an out of order first portion of a dataset from an input state associated with a portion of a set of malware, wherein the out of order first portion of the dataset is sent to a destination after the scanning of the out of order first portion of the dataset;

identify that the dataset includes the portion of the set of malware based on the scanning of the out of order first portion of the dataset from the state associated with the portion of the set of malware;

scan at the application layer in the peer-to-peer network a second out of order portion of the dataset that immediately precedes the first out of order portion of the dataset, the scanning of the second out of order portion of the dataset resulting in a generation of an output state that matches the input state; and

block the second portion of the out of order dataset from being sent to the destination based on the output state matching the input state and an identification that the dataset includes the set of malware.

9. The non-transitory computer-readable storage medium of claim non-transitory computer-readable storage medium of claim 8 , the program further executable to:

scan a third portion of the dataset that immediately precedes the second dataset portion;

generate a first output state based on the scanning of the third dataset portion;

identify that the first output state matches a second input state associated with the set of malware, wherein the second dataset portion was scanned from the second input state to generate the output state; and

identify that the dataset includes the malware based on the scanning of the third dataset portion and the out of order scanning of the first and the second dataset portions.

10. The non-transitory computer-readable storage medium of claim 8 , the program further executable to:

receive the first dataset portion from a first computer in the peer-to-peer network; and

receive the second data set portion from a second computer in the peer-to-peer network.

11. The non-transitory computer-readable storage medium of claim 8 , the program further executable to:

scan the out of order first dataset portion from a plurality of additional input states, wherein each of the plurality of additional input states are associated with at least one of the set of malware or another set of malware; and

compare the input state and the plurality of additional input states to the output state when identifying that the output state matches the input state.

12. The non-transitory computer-readable storage medium of claim 8 , the program further executable to:

receive the out of order first portion of the dataset at a first layer of a plurality of layers of a computer architecture; and

pass the out of order first portion of the dataset to the application layer in the peer-to-peer network.

13. The non-transitory computer-readable storage medium of claim 8 , the program further executable to prepare to send a first piece of a second dataset to a first computer in the peer-to-peer network, the first piece of the second dataset including one or more data blocks, wherein the one or more data blocks are received by the first computer in an out of order sequence as compared to one or more other data blocks associated with the second dataset.

14. The non-transitory computer-readable storage medium of claim 8 , the program further executable to:

generate a state mapping associated with the data set based on the scanning of first and the second portion of the first dataset; and

identify that the first dataset includes the first malware set based on the state mapping corresponding to a malware pattern.

15. An apparatus for scanning computer data, the apparatus comprising:

a memory; and

a processor that executes instructions out of the memory to:

scan at an application layer in a peer-to-peer network an out of order first portion of a dataset from an input state associated with a portion of a set of malware, wherein the out of order first portion of the dataset is sent to a destination after the scanning of the out of order first portion of the dataset,

identify that the dataset includes the portion of the set of malware based on the scanning of the out of order first portion of the dataset from the state associated with the portion of the set of malware,

scan at the application layer in the peer-to-peer network a second out of order portion of the dataset that immediately precedes the first out of order portion of the dataset, the scanning of the second out of order portion of the dataset resulting in a generation of an output state that matches the input state, and

block the second portion of the out of order dataset from being sent to the destination based on the output state matching the input state and an identification that the dataset includes the set of malware.

16. The apparatus of claim 15 , further comprising:

scanning a third portion of the dataset that immediately precedes the second dataset portion;

generating a first output state based on the scanning of the third dataset portion;

identifying that the first output state matches a second input state associated with the set of malware, wherein the second dataset portion was scanned from the second input state to generate the output state; and

identifying that the dataset includes the malware based on the scanning of the third dataset portion and the out of order scanning of the first and the second dataset portions.

17. The apparatus of claim 15 , further comprising a network interface that:

receives the first dataset portion from a first computer in the peer-to-peer network; and

receives the second data set portion from a second computer in the peer-to-peer network.

18. The apparatus of claim 15 , wherein the processor executes further instructions out of the memory to:

scan the out of order first dataset portion from a plurality of additional input states, wherein each of the plurality of additional input states are associated with at least one of the set of malware or another set of malware; and

compare the input state and the plurality of additional input states to the output state when identifying that the output state matches the input state.

19. The apparatus of claim 15 , wherein the processor executes further instructions out of the memory to:

receive the out of order first portion of the dataset at a first layer of a plurality of layers of a computer architecture; and

pass the out of order first portion of the dataset to the application layer in the peer-to-peer network.

20. The apparatus of claim 15 , further comprising a network interface that sends a first piece of a second dataset to a first computer in the peer-to-peer network, wherein the first piece of the second dataset includes one or more data blocks and the one or more data blocks are received by the first computer in an out of order sequence as compared to one or more other data blocks associated with the second dataset.