JNCIS-SEC [ Antivirus ]

There are two types of protection techniques

a) Full Antivirus Protection
b) Express Antivirus Protection

A) Full Antivirus Protection

Files are scanned against a signature database.  Data packets are received and the original application content e.g email attachment is reconstructed. Kaspersky lab provides scan engine and if antivirus license expires, you can continue to use scanning feature with the locally stored signatures without updates.

Pattern Updates

Downloaded by pattern-update command. As opposed to express antivirus.  It detects all malicious code, viruses (polymorphic and other advanced types), worms,  trojans and malware.

Database pattern server is accessible through HTTP or HTTPS and by default antivirus module checks for database updates automatically every 60 minutes and local copy of the pattern database is saved locally.

Sample Pattern Update Config (Automatic)

[edit security]
root@host# show utm
feature-profile {
    anti-virus {
        type kaspersky-lab-engine;
        kaspersky-lab-engine {
            pattern-update {
                url https://kaskerskytest.net;
                interval 120;
            }
        }
    }
}Manual Pattern Update
root@host> request security utm anti-virus kaspersky-lab-engine ?
Possible completions:
  <[Enter]>            Execute this command
  pattern-delete       Delete kaspersky-lab-engine pattern
  pattern-reload       Reload kaspersky-lab-engine pattern
  pattern-update       Update kaspersky-lab-engine pattern
  |                    Pipe through a command

Full Antivirus Scan Engine

Scan engine works as follows;

1) A client establishes a TCP connection with a server and then starts a transaction
2) If the application protocol in question is marked for antivirus scanning, the traffic is forwarded to an application  proxy for parsing
3) When the scan request is sent, the scan engine scans the data by querying a virus pattern database
4) The scan manager monitors antivirus scanning sessions, checking the properties of the data content against the existing antivirus settings
5) After scanning has occurred, the result is then handled by the scan manager
 Scan Modes
* scan-all : This option tells scan engine to scan all the data it receives
* scan-by-extension: This option bases scanning decision on the file extensions
Sample config:
[edit security]
root@host# show utm
custom-objects {
    filename-extension {
        extlist1 {
            value [ exe vbs bat ];
        }
    }
}
feature-profile {
    anti-virus {
        kaspersky-lab-engine {
            profile avprof1 {
                scan-options {
                    scan-mode by-extension;
                    scan-extension extlist1;
                }
            }
        }
    }
}Full Antivirus Intelligent Prescreening
This is to improve scanning performance.  Antivirus module generally begins to scan data after the gateway has received all the packets of a file.  By intelligent way, the scan engine uses the first or first several packets to determine if a file contains malicious code or not. If it does, it bypasses the normal procedure.
*TIP : use with non-encoded traffic. Not applicable for MIME encoded traffic (SMTP,POP3,IMAP) and HTTP POST
Content Size Limit
Due to resource constraints, there is a default device dependent limit on maximum content size.
FIXME: Needs to add more content in here
Monitoring Antivirus Sessions and Scan Results

root@host> show security utm anti-virus status

AV Key Expire Date: 03/01/2010 00:00:00
Update Server: http://update.juniper-updates.net/AV/SRX210
interval: 60 minutesauto update status: next update in 12 minutes
last result: new database loaded
AV signature version: 12/21/2008 00:35 GMT, virus records: 154018
Scan Engine Info: last action result: No error(0x00000000)
root@host> show security utm session    
 UTM session info:
 Maximum sessions:                 4000
 Total allocated sessions:         0
 Total freed sessions:             0
 Active sessions:                  0
root@host> show security utm anti-virus statistic  
 UTM Anti Virus statistics:
 Intelligent-prescreening passed:      0
 MIME-whitelist passed:                0
 URL-whitelist passed:                 0
 Scan Mode:
     scan-all:                         0
     Scan-extension:                   0
 Scan Request:
  Total           Clean         Threat-found    Fallback
       0               0              0               0
 Fallback:
                           Log-and-permit         Block
  Engine not ready:                0                      0
  Password file:                   0                      0
  Decompress layer:                0                      0
  Corrupt files:                   0                      0
  Out of resources:                0                      0
  Timeout:                         0                      0
  Maximum content size:            0                      0
  Too many requests:               0                      0
  Others:                          0                      0

B) Express Antivirus Protection

FIXME

You have a feedback?