DYNAMIC RE-ORDERING OF SCANNING MODULES IN SECURITY DEVICES

摘要

A method and apparatus are provided for preserving bandwidth of a security gateway by dynamically placing a module with a highest ratio of block rate to run-time cost before other modules in the set of scanning modules such that a most effective scanning module blocks data units before scanning is wasted on those data units by other modules. By tracking a plurality of application data units that are sent through a set of scanning modules, a scanner history tracker records a rate with which the modules block application data units from forwarding to their intended destination. When the next period of application data units are received, a scanner driver re-orders the sequence of modules from highest block rate to lowest block rate such that some scanning modules are less likely to scan units that are likely to be blocked by other scanning modules.

主权项

1. A data processing method comprising:
using a security gateway, filtering application level data units by routing network traffic through a plurality of scanning modules in a module scanning sequence; using a scanner history tracker, computing a block rate for each module by tracking, over a period, which units are received by each module in a set of scanning modules and not forwarded toward a destination specified in those units; using a scanner driver, automatically re-ordering the module scanning sequence based on the block rate to preserve bandwidth of the security gateway by dynamically placing a module with a highest ratio of block rate to run-time cost before other modules in the set of scanning modules such that a most effective scanning module blocks data units before scanning is wasted on those data units by other modules; wherein the data processing method is performed by one or more computing devices.