Trend Micro InterScan M Series, Administrator'S Manual

Page: 73 / 480

How InterScan Gateway Security Appliance Works
3
-
13
InterScan Gateway Security Appliance supports virus scanning for SMTP, POP3,
HTTP, and FTP protocols, as well as the following features:
• The ability to enable or disable scanning of certain protocols
• The ability to configure scanning for different file types
• Compressed file handling
• Scanning of incoming and outgoing traffic
• The ability to set actions to take when viruses or malware are detected
• The ability to send notifications
• Virus logging
IntelliTrap
Virus writers often attempt to circumvent virus filtering by using different file com-
pression schemes. To deal with this issue, InterScan Gateway Security Appliance uses
IntelliTrap, which detects malicious code such as bots in compressed files. IntelliTrap
provides heuristic evaluation of compressed files to help reduce the risk that a bot or
other malware compressed using these methods will enter the network through HTTP
downloads/uploads or email.
IntelliTrap uses the virus scan engine, IntelliTrap pattern, and exception pattern to
scan compressed files downloaded or uploaded via HTTP and incoming email
messages and attachments to identify bots and other malware applications.
When InterScan Gateway Security Appliance detects a bot or other malware
application, it takes action according to the action chosen by the administrator under
the Action tab. InterScan Gateway Security Appliance will then send a notification
email to all persons specified under the Notification tab.
Note: IntelliTrap uses the same scan engine as virus scanning. As a result, the file
handling and scanning rules for IntelliTrap will be the same as the ones the
administrator defines for virus scanning.
The InterScan Gateway Security Appliance writes bot and other malware detections
to the IntelliTrap log. You can export the contents of the IntelliTrap log for inclusion
in reports.