1. Field of the Invention
Embodiments of the present invention generally relate to network security.
2. Description of the Related Art
Some network protocols, such as certain versions of Hypertext Transfer Protocol (HTTP), allow for the transparent use of compression and encoding algorithms in sessions between a client and server. Because certain data, such as web pages, tend to compress well, the use of compression may significantly improve network performance, while the use of encoding (e.g., in encryption algorithms) is important in maintaining security.
As a result, however, current network security devices, such as intrusion protection systems (IPSs) face the problem that a server can send malicious traffic compressed and/or encoded to a “victim” client. Writers of such malicious content can exploit the fact that many IPS devices cannot inspect encoded or compressed HTTP sessions. In order to inspect such traffic, an ISP would have to first decompress/decode the traffic for inspection, which may not be feasible at high speeds.
Accordingly, what is needed is an improved technique for inspecting server to client traffic in a session.