Руководство Пользователя для Cisco Cisco Web Security Appliance S170
Chapter 19 Anti-Malware Services
McAfee Scanning
19-8
Cisco IronPort AsyncOS 7.1 for Web User Guide
OL-23207-01
•
Server response. When the appliance retrieves a URL, Webroot scans the
server response content and compares it to the Webroot signature database.
server response content and compares it to the Webroot signature database.
For more information about how the DVS engine uses malware scanning verdicts
to handle web traffic, see
to handle web traffic, see
For information about Web Reputation Filtering and URL scores, see
McAfee Scanning
The McAfee scanning engine inspects objects downloaded from a web server in
HTTP responses. After inspecting the object, it passes a malware scanning verdict
to the DVS engine so the DVS engine can determine whether to monitor or block
the request.
HTTP responses. After inspecting the object, it passes a malware scanning verdict
to the DVS engine so the DVS engine can determine whether to monitor or block
the request.
The McAfee scanning engine uses the following methods to determine the
malware scanning verdict:
malware scanning verdict:
•
Matching virus signature patterns
•
Heuristic analysis
For more information about how the DVS engine uses malware scanning verdicts
to handle web traffic, see
to handle web traffic, see
Matching Virus Signature Patterns
McAfee uses virus definitions in its database with the scanning engine to detect
particular viruses, types of viruses, or other potentially unwanted software. It
searches for virus signatures in files.
particular viruses, types of viruses, or other potentially unwanted software. It
searches for virus signatures in files.
When you enable McAfee, the McAfee scanning engine always uses this method
to scan server response content.
to scan server response content.