ZyXEL ZyWALL ATP700 User Guide - Page 574

Chapter 27 Anti-Malware Anti-Malware Scan Process Before going through the Anti-Malware scan, the Zyxel Device first identifies the packets sent by the following four major protocols with corresponding standard ports: • FTP (File Transfer Protocol) • HTTP (Hyper Text Transfer Protocol) • SMTP (Simple Mail Transfer Protocol) • POP3 (Post Office Protocol version 3) The Zyxel Device records the order of packets in TCP connection-oriented sessions to check for matching malware signatures. The order of non-setup packets such as SYN, ACK and FIN is ignored. Anti-Malware Scanning Procedure: 1 The Zyxel Device checks every packet of the file for matches with the local signature databases. If a malware pattern signature is matched, the actions you specify for identified malware will be applied. If Destroy infected file is enabled, the file will be modified. Logs/alerts will be sent according to your settings. Note: The receiver is not notified if a file is modified by the Zyxel Device. If the file cannot be used, the receiver should contact the Zyxel Device administrator to confirm if the Zyxel Device modified the file by checking the logs. 2 If no match is found with the local databases, the Zyxel Device uses Cloud Query to forward the file's hash value to Defend Center. 3 Defend Center checks its database for malware signature matches and sends the results back to the Zyxel Device. If a malware signature is matched, the actions you specify for identified malware will be applied. If Destroy infected file is enabled, the file will be modified. Logs/alerts will be sent according to your settings. The next figure shows a flow chart detailing the anti-malware scan. ZyWALL ATP Series User's Guide 574