Der Multiple Scan Engine Manager (MEM) bei Forefront Server Security ist die essentielle Komponente, die einerseits die verschiedenen Scan Engines verwaltet und überwacht und andererseits dafür zuständig ist, welche Engine in Kombination mit der Bias-Setting und dem aktuellen Rating der Engines für einen Scan herangezogen wird.
Den besten Überblick zu MEM, Bias-Setting und Engine-Raking liefert das Whitepaper Sybari Antigen: A Case for Multiple Integrated Scan Engines. Obwohl das Dokument noch für Antigen geschrieben wurde, treffen die Features genauso auch für Forefront Server Security zu. Auszug:
The Role of Multiple Engine Manager
Antigen’s Multiple Scan Engine Manager (MEM) is a powerful component that manages the antivirus scan engines for each scanning layer within Antigen. MEM is responsible for balancing performance, scanning intensity and for providing uninterrupted scanning uptime, even during signature file updates. In addition, to ensure that all scan engines remain current and effective, engine and signature file updates for each and every integrated scan engine are downloaded, tested and brought online as soon as they are available. If the downloaded file is found to be corrupt or has other problems, MEM rolls back to the previous version, and alerts the administrator so the problem can be corrected prior to installation and use.
Bias Settings
Bias settings within MEM give administrators the ability to manage the performance and protection of the multiple scan engines. They allow companies to control how engines are used for a given scan job and define different settings for SMTP and e-mail scanning. In this way, administrators have complete control in how the balance is struck between performance and virus scanning. These settings include the following:
- Max Certainty: After the administrator has selected the scan engines at each layer, choosing Max Certainty will set MEM to use every scan engine to scan each message and attachment concurrently. Even if one of the scan engines determines a file is infected with a virus, the remaining engines will continue to scan. This thorough scanning is essential for historical data analysis.
- Favor Certainty: Favor Certainty uses 75 percent of the available scanning engines, and allows MEM to choose the right combination of each. In a four engine scan scenario, each message and attachment will be scanned by three scan engines, with the fourth invoked if further validation is required. The order of the first three engines depends on several factors, including which scan engine has the most recently updated signature files. (Anmerkung: Die aktuelle CPU-Auslastung ist hier auch ein wichtiger Faktor bei der Auswahl.)
- Neutral: Neutral mode ensures that all messages and attachments are scanned by at least half the available engines. For instance, in a four-engine scan scenario, every message will be scanned by two scan engines, with the third invoked if further validation is required. This bias setting provides the optimal balance between performance and protection. In addition, the order and combination of engines employed is based on Antigen’s engine ranking algorithms.
- Favor Performance: Using Favor Performance, MEM scans messages with 25 percent of the available engines. In a four scan engine scenario, every message will be scanned by one or two engines. This setting is recommended for the Exchange Information Store, where high performance is desired.
- Max Performance: With Max Performance, MEM is configured to use only one scan engine. To ensure maximum protection, the engine with the most recently updated signature files is always used.
The bias setting can be configured as needed. For instance, administrators can define one standard for back-end servers and another for front-end servers.
Engine Rankings
MEM uses engine rankings to determine the order in which different scan engines are used. Engine rankings depend on a number of criteria, such as the number of signature files, an appropriate mix of technologies, and the engine’s “age,” which is determined by the last time its signature files were updated.
Engine rankings also rely heavily on past performance. For example, every time a particular engine detects a virus successfully, it is assigned a greater credibility. Similarly, if one engine keeps detecting viruses that are not found by other engines, it is accorded less credibility in order to reduce false positives. Using an algorithm that takes all of these factors into consideration, MEM gives better-performing engines priority during the scanning process. When a virus has been successfully detected, it is cleaned by the first engine that detected the virus. If that particular engine is unable to clean the file, the next engine in line is used.