Trend Micro InterScan M Series, Administrator'S Manual

Page: 72 / 480

Trend Micro™ InterScan™ Gateway Security Appliance M-Series Administrator’s Guide
3
-
12
F
IGURE
3-2.
How the Standard Reputation and Dynamic Reputation
databases work
Antivirus
Since viruses are still among the most numerous and serious threats on the Internet,
virus scanning is a critical and integral part of the set of security services in InterScan
Gateway Security Appliance. During a scan, the Trend Micro scan engine works
together with the virus pattern file to perform the first level of detection, using a pro-
cess called pattern matching. Since each virus contains a unique “pattern” or string of
telltale characters that distinguish it from any other code, the virus experts at
TrendLabs capture inert snippets of this code in the pattern file. The engine then com-
pares certain parts of each scanned file to the pattern in the virus pattern file, looking
for a match. When the scan engine detects a file containing a virus or other malware,
it executes an action such as clean, delete, or replace with text/file. You can customize
these actions when you set up your scanning tasks.
InterScan Gateway Security Appliance protects you from a wide range of viruses,
including:
• HTML viruses
• Macro viruses
• ActiveX malicious code
• COM and EXE file infectors
Sam’s
SMTP server
The appliance
John’s
SMTP server
Standard
Reputation
Database
Dynamic
Reputation
Database
Standard: The appliance
queries the Standard
Reputation database
only.
Advanced: The
appliance first queries
the Standard Reputation
database and then, if no
problem is detected,
queries the Dynamic
Reputation database.