8.1 Gateway AntiVirus (GAV) & IntelligentAV

8.1 Gateway AntiVirus (GAV) & IntelligentAV

Quick Answer: WatchGuard Fireware delivers multi-tiered on-box malware prevention through two complementary engines: Gateway AntiVirus (GAV), which uses a high-performance Bitdefender signature-based engine to scan files and decompressed archives across Layer 7 proxies (HTTP, FTP, SMTP, POP3, IMAP), and IntelligentAV, which uses Cylance machine learning algorithms to predictively analyze Portable Executable (PE) binaries without relying on signatures. While GAV catches millions of known threats across diverse file formats, IntelligentAV catches polymorphic and zero-day Windows executables before they execute.

---

Perimeter Antivirus Architecture

Traditional host-based antivirus operates at endpoints, scanning files after they have already crossed network boundaries and been written to local storage. While endpoint detection is vital, perimeter antivirus inspection on the WatchGuard Firebox stops malicious code before it ever reaches client operating systems, servers, or unmanaged IoT hardware.

+-----------------------------------------------------------------------------------------+
|                        LAYER 7 PROXY-BASED ANTIVIRUS PIPELINE                           |
+-----------------------------------------------------------------------------------------+
|  1. Layer 7 Proxy Interception (HTTP, HTTPS Decryption, FTP, SMTP, POP3, IMAP)          |
|  2. Protocol Normalization & MIME Stream Reassembly in Firebox Memory                   |
|  3. Real-Time Archive Decompression (ZIP, RAR, 7Z, TAR, GZ, CAB)                        |
|  4. File Size Limit Verification (Model Buffer Check: e.g., 10 MB - 50 MB)              |
|  5. Engine 1: Gateway AntiVirus (GAV) Signature Scan (Bitdefender Engine)               |
|  6. Engine 2: IntelligentAV Machine Learning Analysis (Cylance PE AI Model)            |
|  7. Enforcement Action Execution (Clean, Drop, Quarantine, Block Source IP, Allow)      |
+-----------------------------------------------------------------------------------------+

Mandatory Proxy Requirement

A fundamental operational concept tested on the WatchGuard certification exam is that Gateway AntiVirus and IntelligentAV cannot operate on standard packet filter policies. Packet filters operate strictly at OSI Layers 3 and 4, inspecting only IP headers and TCP/UDP ports without reassembling data streams.

To scan for viruses, the Firebox must inspect the actual application payload at OSI Layer 7. Consequently, GAV and IntelligentAV require Application Proxy Policies:

• HTTP-proxy and HTTPS-proxy (with TLS Content Inspection enabled)
• FTP-proxy
• SMTP-proxy
• POP3-proxy
• IMAP-proxy

When encrypted web traffic traverses an HTTPS-proxy, TLS Content Inspection must be enabled to decrypt the HTTPS session; otherwise, the payload remains ciphertext, preventing the antivirus engines from inspecting the data stream.

---

Gateway AntiVirus (GAV) Mechanics

Gateway AntiVirus is a licensed subscription security service that integrates an enterprise-grade signature scanning engine powered by Bitdefender into the Fireware OS proxy architecture.

Signature Database & Automatic Synchronization

GAV identifies malicious files by calculating cryptographic hashes and matching binary patterns against a local database containing millions of known virus, trojan, worm, spyware, and ransomware signatures:

• Signature Updates: The Firebox automatically connects to WatchGuard update servers over HTTPS (TCP port 443) to check for and download incremental signature updates.
• Update Frequency: Fireware can be configured to check for updates at automated intervals (typically hourly). Administrators can also manually trigger an immediate update check via Firebox System Manager (FSM) or the Fireware Web UI.
• High Availability Synchronization: In a high-availability FireCluster deployment, the active cluster master downloads updated signatures and synchronizes them across the cluster heartbeat to the backup master, ensuring identical protection levels without separate external downloads.

Real-Time Archive Decompression Engine

Attackers routinely encapsulate malware inside compressed archives to bypass perimeter defenses. GAV contains an integrated decompression engine that unpacks and inspects files in real time before delivering them to the recipient.

Scan File Size Limits & Buffer Management

Scanning files at wire speed requires the Firebox to hold packet fragments in RAM to reassemble complete files for signature analysis. Because hardware models have finite memory resources, Fireware enforces Scan File Size Limits:

• Model-Specific Limits: Depending on the hardware model (from compact tabletop T-series units up to rackmount M-series enterprise appliances), the maximum scannable file size ranges from 10 MB to 50 MB or more.
• Configurable Oversize Action: In proxy action settings under Gateway AntiVirus, administrators must configure the action to take when an incoming file exceeds the scan limit:
  • Allow: The Firebox permits the file to pass without scanning, logging an informational event. This prioritizes business workflow over strict security.
  • Drop / Deny: The Firebox blocks the file transfer, terminating the connection and logging a security violation. This enforces zero-trust compliance in high-security environments.

Configurable Detection Actions

When GAV matches an inspected file against a known signature, it executes the action configured in the active Proxy Action:

+-----------------------------------------------------------------------------------------+
|                            GAV DETECTION ACTIONS BY PROTOCOL                            |
+---------------------+-------------------+-----------------------------------------------+
| PROTOCOL / PROXY    | AVAILABLE ACTIONS | TECHNICAL BEHAVIOR                            |
+---------------------+-------------------+-----------------------------------------------+
| HTTP / HTTPS / FTP  | Drop Connection   | Terminates TCP session immediately; sends RST |
|                     | Block Source IP   | Adds remote server IP to Blocked Sites list   |
|                     | Allow             | Logs detection but permits download           |
+---------------------+-------------------+-----------------------------------------------+
| SMTP / POP3 / IMAP  | Clean             | Strips infected attachment; replaces with txt |
|                     | Quarantine        | Routes email to central Quarantine Server     |
|                     | Drop              | Silently discards or rejects email with 5xx   |
|                     | Block Source IP   | Blocks sending MTA IP address on firewall     |
|                     | Allow             | Forwards intact message with virus warning    |
+---------------------+-------------------+-----------------------------------------------+

[!IMPORTANT] The Clean action is available only within email proxies (SMTP-proxy, POP3-proxy, IMAP-proxy). In mail protocols, the proxy can parse multi-part MIME structures, strip the infected payload, insert an administrative notification text file (e.g., attachment_removed.txt), and deliver the remaining clean email body to the recipient. In HTTP or FTP transfers, "cleaning" is impossible because raw data streams cannot be dynamically rewritten without corrupting the file transfer; thus, HTTP and FTP proxies enforce Drop Connection or Block.

---

IntelligentAV: Machine Learning Malware Detection

While signature-based GAV is highly efficient at detecting known threats, cybercriminals generate hundreds of thousands of new malware variants daily using automated packers, crypters, and polymorphic code generators. By altering a single byte in an executable binary, attackers generate a unique cryptographic hash that bypasses traditional signature databases.

To counter unknown, polymorphic, and zero-day executable threats, WatchGuard introduced IntelligentAV.

+-----------------------------------------------------------------------------------------+
|                         INTELLIGENTAV PREDICTIVE AI EVALUATION                          |
|                                                                                         |
|  Incoming Binary: Win32/Win64 PE File (.exe, .dll, .scr)                                |
|                               |                                                         |
|                               v                                                         |
|  +-----------------------------------------------------------------------------------+  |
|  |                     CYLANCE ARTIFICIAL INTELLIGENCE ENGINE                        |  |
|  |                                                                                   |  |
|  |  • PE Header Parsing         • Import / Export Table Analysis                     |  |
|  |  • Section Entropy & Packing • Compiler & Linker Signature Anomalies             |  |
|  |  • Obfuscated Code Detection • Structural Feature Extraction (Millions of Traits) |  |
|  +-----------------------------------------------------------------------------------+  |
|                               |                                                         |
|                               v                                                         |
|  Algorithmic Classification: Predict Malicious Intent Score (0.00 to 1.00)              |
|                               |                                                         |
|               +---------------+---------------+                                         |
|               |                               |                                         |
|               v                               v                                         |
|      [ Score >= Threshold ]          [ Score < Threshold ]                              |
|         MALICIOUS (Drop)                 CLEAN (Permit)                                 |
+-----------------------------------------------------------------------------------------+

Cylance AI Engine Integration

IntelligentAV is powered by artificial intelligence and machine learning technology developed by Cylance (BlackBerry Cylance):

• Algorithmic Feature Analysis: Instead of checking for static string signatures or specific hash values, IntelligentAV inspects the internal structural characteristics of the binary. It decomposes the file into millions of discrete mathematical features—including section entropy, header anomalies, dynamic-link library (DLL) import tables, function call sequences, and compiler artifacts.
• Offline Predictive Model: The Firebox maintains a pre-trained, highly compact mathematical model in memory. The model evaluates extracted features against statistical patterns derived from billions of analyzed benign and malicious binaries.
• Zero-Day Efficacy: Because the machine learning model identifies the underlying structural DNA of malicious code rather than specific signatures, it predictively detects zero-day malware, mutating ransomware, and custom exploits months before traditional antivirus vendors craft a matching signature.

Targeted File Scope: Portable Executable (PE) Files

IntelligentAV does not scan every file format traversing the network. It is specifically engineered to analyze Portable Executable (PE) binaries:

• Windows 32-bit and 64-bit executables (.exe)
• Dynamic Link Libraries (.dll)
• Screensavers (.scr)
• Device drivers and system binaries (.sys, .ocx)

Non-executable file types—such as PDF documents, Microsoft Office spreadsheets, JPEG images, and plain text files—are not processed by IntelligentAV (these formats are inspected by GAV, APT Blocker, and Content Filtering).

Hardware & Licensing Prerequisites

Due to the algorithmic intensity of running deep mathematical feature extraction and machine learning vector calculations in real time, IntelligentAV imposes specific platform requirements:

• Total Security Suite: IntelligentAV is included exclusively in the Total Security Suite license bundle (it is not part of the Basic Security Suite).
• Hardware Architecture: The appliance must possess sufficient physical RAM to host the Cylance mathematical model. It is supported on Firebox models with at least 4 GB of RAM (including modern T-series units like the T40, T70, T80, T85, and all M-series enterprise appliances, as well as FireboxV and Firebox Cloud). It is not supported on smaller entry-level legacy tabletop units (e.g., T15, T20, T35).

---

Architectural Comparison: GAV vs. IntelligentAV

The following technical comparison details the operational boundaries and synergies between Fireware's two on-box antivirus technologies:

---

Defense-in-Depth Inspection Sequence

When both services are enabled within a proxy action, Fireware orchestrates their execution in a strict, resource-optimized pipeline:

1. Proxy Reassembly: The proxy policy intercepts the connection, decrypts the payload (if HTTPS inspection is active), and reassembles data chunks in memory.
2. Archive Decompression: GAV unpacks any compressed archives within configured limits.
3. GAV First Pass (Known Signatures): GAV scans all reassembled files. If a file matches a known Bitdefender signature, the configured action (e.g., Drop Connection or Clean) is executed immediately. Evaluation halts, saving CPU cycles.
4. IntelligentAV Second Pass (Zero-Day Binaries): If the file passes GAV inspection as clean, Fireware checks whether the file is a Windows Portable Executable (PE) binary. If it is a PE binary, IntelligentAV extracts its structural features and runs the Cylance predictive AI algorithm. If classified as malware, the file is dropped and logged.
5. APT Blocker Cloud Sandbox (Total Security Suite): If the file passes both GAV and IntelligentAV, but exhibits suspicious characteristics or is an unknown executable/document, Fireware can submit the file's hash and binary to the APT Blocker cloud sandbox for full dynamic detonation.