Resisting the spread of unwanted code and data

Abstract

A method of processing an electronic file by identifying portions of content data in the electronic file and determining if each portion of content data is passive content data having a fixed purpose or active content data having an associated function. If a portion is passive content data, then a determination is made as to whether the portion of passive content data is to be re-generated. If a portion is active content data, then the portion is analysed to determine whether the portion active content date is to be re-generated. A re-generated electronic file is then created from the portions of content data which are determined to be re-generated.

We claim: 
     
         1 . A method of pre-processing an electronic file to be transmitted to a processing module, comprising the steps of:
 re-writing the electronic file such that portions of the electronic file to be processed together by the processing module are arranged in a sequential order; and   transmitting the rewritten electronic file to the processing module.   
     
     
         2 . A method according to  claim 1 , further comprising the steps of:
 receiving, at the processing module, portions of the re-written electronic file;   storing said received portions of the re-written electronic file in a buffer; and   processing the buffer received portions of the re-written electronic file once all portions to be processed together have been received.   
     
     
         3 . A computer readable medium comprising a computer program adapted to perform the method of  claim 1  when the computer program is run on a computer. 
     
     
         4 . A semiconductor device comprising a memory means including instructions for performing the method of  claim 1 . 
     
     
         5 . A system for pre-processing an electronic file to be transmitted to a processing module for malicious data detection, comprising:
 means for identifying discrete portions of the file that need to be processed together in the course of malicious code analysis by the processing module;   means for re-writing the electronic file such that the portions to be processed together are arranged contiguously; and   means for transmitting the re-written electronic file to the processing module.   
     
     
         6 . A system according to  claim 5 , further comprising a processing module arranged to:
 receive portions of the re-written electronic file;   store said received portions of the re-written electronic file in a buffer; and   process the buffered received portions of the re-written electronic file once all portions to be processed together have been received, prior to receiving the entire file.