Executable Content Filtering in Network Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increased prevalence of Web 2.0 sites has led to a higher risk of malicious code injection through network messages, as conventional security measures can impact system performance and fail to effectively capture all malicious executable content.
Innovation Solution
An executable content message stream filter is implemented, which applies multiple filters to parsed network message elements based on rule sets, targeting and disabling executable content, thereby enhancing security without significantly affecting system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security measures are applied to filter network messages, then system security is improved, but system performance deteriorates
Solution Approach 1:
The security filtering system is divided into multiple specialized filters (script filter, HTML filter, executable filter) that process different aspects of network messages separately. Each filter targets specific types of malicious content, allowing parallel processing and reducing the performance overhead compared to a single comprehensive security check.
Solution Approach 2:
The system performs preliminary parsing of network messages into structured elements before filtering. By pre-processing the message into parseable components (tags, attributes, text nodes), the filtering operation becomes more efficient as it operates on already-structured data rather than raw text, improving overall system performance.
2Reliability
If comprehensive filtering rules are applied to all network messages, then security coverage is improved, but processing complexity increases
Solution Approach 1:
Different filtering rules and strategies are applied to different parts of the network message based on their structure and content type. For example, script filters target specific script tags and attributes, while HTML filters handle different HTML elements differently. This localized filtering approach provides comprehensive security coverage while keeping each individual filter rule set manageable and less complex.
Solution Approach 2:
The filtering system dynamically selects and applies appropriate filters based on the message type and content. The system can adaptively choose which filters to apply (script, HTML, executable) depending on the parsed message structure, making the overall system flexible and manageable rather than statically complex.
3Measurement precision
If multiple executable content filters are applied to parsed message elements, then detection accuracy is improved, but processing time increases
Solution Approach 1:
Multiple filtering operations are merged into a unified filtering framework that processes parsed message elements through multiple filters in sequence. The script filter, HTML filter, and executable filter work together in an integrated manner, sharing the parsed element structure and collectively achieving high detection accuracy while optimizing processing time through coordinated operation.
Solution Approach 2:
The filtering process operates continuously on the stream of parsed message elements without interruption. Each filter processes elements as they flow through the system, maintaining continuous useful action rather than batch processing, which reduces overall processing time while maintaining high detection accuracy through multiple filtering passes.
Data Source
AI summary
A executable content message stream filter applies a plurality of executable content filters to a stream of parsed elements of a network message. Each of the plurality of executable content filters targets executable content and is instantiated based on a set of one or more rule sets selected based, at least in part, on a type of the network message. For each of the plurality of executable content filters, it is determined if one or more of the stream of parsed elements includes executable content targeted by the executable content filter. The executable content message stream filter modifies those of the stream of parsed elements that include the executable content targeted by the plurality of executable content filters to disable the executable content.