proxy vs flow based AV check

[Ralph1973]

Hello,

According to the Fortinet docs, flow based AV scanning should be (nearly) as secure as proxy based(from FortiOS 5.2.x on)  which is more resource intensive. Now I have a customer who just received the trojan.agent.bpwv on his desktop, i.e. Fortigate didn't detect it. The Fortigate is configured with flow based scanning and the infected file came in through smtp.

I was wondering if this also might have been the case if we did configure proxy based scanning, or whether someone have had any comparable cases.

Thanks and regards,

Ralph Willemsen

Arnhem, Netherlands

[ponder]

The first thing I would probably do it put that virus name into the virus encyclopedia at fortiguard.com

It will let you know which database should detect that virus.  It could be the virus would only be detected by the extended virus database and not the standard.  If that is the case, then flow vs proxy is a mute point.

[dbramblett]

Ralph,

They key difference between flow based and proxy based AV scanning (and the reason proxy based is more resource intensive) is that proxy based waits for the entire file to be received and scans it before sending it to the recipient while flow based checks each packet and sends it on. This means that in some cases the functional parts of a virus can get through before there is enough information gathered to identify it as a virus with flow based AV. Its a calculated risk for performance.

Its also possible its an older virus that isn't part of the library in use for current threats. I think there are three library categories for AV. Which more or less breakdown into a lightweight and thick library and one that basically holds all signatures going back to the 90s. Again performance considerations.

For what it's worth.

[Ralph1973]

Hi, thanks for your answers :) The extended db was already active. However, I noticed that according to the desktop AV program (this was F-secure), it concerns a so called false positive. So it appeared not to be malware and this is probably the reason Fortigate was not triggered. In Fortiguard Encyclopedia it isn't mentioned as well.

Kind regards,

Ralph