C613-22104-00 REV B Anti-virus | Page 13
Feature Overview Advanced Network Protection
Anti-virus
This feature is supported from AlliedWare Plus version 5.4.5 or later.
AlliedWare Plus™ Anti-virus provides the first line of defense against a wide range of malicious
content, guarding against threats, such as viruses, Trojans, worms, spyware and adware. In addition
to protecting the local network by blocking threats in inbound traffic, it also prevents compromised
hosts or malicious users from launching attacks. This is essential for protecting your organization’s
reputation.
The scanning is performed by the Kaspersky Anti-virus engine. The signature database used by the
engine containing known threat patterns is regularly updated.
This section describes how AlliedWare Plus™ Anti-virus works. To configure this feature, see
"Configuring Anti-virus" on page 35.
How Anti-virus works
AlliedWare Plus™ Anti-virus uses proxy-based detection to scan traffic. Proxy-based detection can
provide the best detection rate. Proxy-based detection looks for known patterns in the traffic, using
signature analysis. A signature database containing a list of known threat patterns is kept up-to-date
to ensure the effectiveness of the detection. Heuristics analysis is also used to look for suspect
behaviors of executable code and malware. Heuristics analysis can therefore detect unknown
viruses as well as known polymorphic malware, which cannot be identified by using signature
analysis.
When AlliedWare Plus Anti-virus detects a virus, it blocks HTTP responses.
AlliedWare Plus Anti-virus provides the following features:
Scans HTTP responses
Supports Kaspersky Anti-virus
Blocks HTTP responses in which a virus has been detected
Scans packed, compressed or encoded object files
Scans objects up to 10MB in size
Scans 100MB of objects concurrently
Extracts nested files up to 3 levels deep
User configurable action upon scan failure
User configurable action when any limit is exceeded
To Next Page
Loading...
Need help?
General
