Patent attributes
In one embodiment, a data stream is scanned for presence of computer viruses using a stream-based protocol parser, a stream-based decoder/decompressor, and a stream-based pattern matching engine. The protocol parser may be configured to extract application layer content from the data stream to generate a file stream. The protocol parser may stream the file stream to the decoder/decompressor, which may decode/decompress the file stream to generate a plain stream. The decoder/decompressor may stream the plain stream to the pattern matching engine, which in turn may scan the plain stream for viruses. Advantageously, the aforementioned components may perform its function as soon as streaming data becomes available, without having to wait for the entirety of the data.
