Trend Micro InterScan M Series, Руководство администратора

Страница: 438 / 480

Trend Micro™ InterScan™ Gateway Security Appliance M-Series Administrator’s Guide
C
-
10
Scan Engine Technology
IntelliScan
IntelliScan is a feature in Trend Micro products that allows optimization of scanning
time by enabling the product to skip file types that are safe from virus infection.
It is a safe compromise between performance and detection. Users can enable
IntelliScan at the gateway or in the desktop so that their product scans only scannable
file types. Scannable file types are those that can contain malicious code. Such file
types are known to be used by malware authors.
IntelliScan identifies true file type, such that it detects even renamed Win32
executable files.
IntelliTrap
IntelliTrap scans SMTP and POP3 traffic to catch packed malicious executables sent
as attachment to email messages. It is the Scan Engine technology that heuristically
catches packed malware at the gateway.
IntelliTrap evaluates attachments by checking for characteristics of compressed
Win32 files. It is based on the concept that average users do not usually pack
program files and send them through email. On the other hand, malware authors
usually use packers to change the binary image of their programs, and then spam
them via email or give them malware mass-mailing capability.
It is designed specifically to catch possibly malicious packed Win32 executable files.
It uses the detection name PAK_GENERIC.XXX. To minimize the possibility of
false positives, IntelliTrap uses exception patterns for normal software.
As with Trend Micro's other heuristics technologies, IntelliTrap detection is
superseded by specific detection.