​

Multi-layer malware detection for web traffic

​

Problem

Malware reaches endpoints through downloads and web content. Encrypted traffic hides payloads from passive inspection. Organizations need one or more scanning layers on the proxy with a clear integration path for external engines.

​

Benefits

SafeSquid offers SqScan (built-in), ClamAV integration, ICAP to third-party scanners, and an Adaptable External Parser for custom logic. Administrators pick layers that match operational maturity and vendor standards. Confirmed: HTTPS payloads require SSL Inspection for scanning to apply to encrypted web traffic.

​

Advantages

Confirmed: Multiple scanner integrations (SqScan, ClamAV, ICAP, external parser) ship in the documented module set; administrators can stack engines rather than rely on a single signature source. Draft (CTO confirmation): Detection rates versus cloud-only SWG sandboxes vary by threat type and update cadence—avoid numeric superiority claims without lab evidence in the source register.

​

Call to action

Enable SSL Inspection. Configure at least one scanner using the guides below. Validate with known-safe and test-malware samples per organizational policy, then monitor logs and alerts.

​

Malware scanner configuration and reference guides

​

SqScan

Built-in scanning alone may not cover all threat signatures or formats. SqScan is SafeSquid’s built-in module for scanning HTTP and HTTPS traffic for viruses, Trojans, and malware. It provides a first layer of protection without external daemons. Configure and use SqScan for HTTP and HTTPS scanning using this document.

​

ClamAV Malware Scanning

Enterprises need an extra layer of detection using a widely updated signature engine. ClamAV integration allows SafeSquid to send content to a ClamAV daemon for scanning. Multiple file formats and archives are supported. Integrate a dedicated ClamAV server with SafeSquid using this document.

​

ICAP

Organizations use third-party ICAP antivirus or content adaptation services for policy. ICAP integration lets SafeSquid send HTTP/HTTPS content to ICAP servers for virus scanning and content modification. Dr. Web, Kaspersky, Symantec, and Trend Micro are examples of ICAP-based solutions. Configure ICAP server connections using this document.

​

Adaptable External Parser

Custom or proprietary scanners may require a flexible integration pattern. The Adaptable External Parser allows SafeSquid to invoke external scanning or parsing logic for content. This supports integration with non-ICAP or custom antivirus and DLP tools. Use this document to configure and integrate external parsers.

​

Next steps

Enable SSL Inspection so HTTPS traffic is scanned; combine with Data Leakage Prevention for upload/download inspection.