Patent ID: 11968228
Assignee: FORTINET, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 5:
6. A sandbox server device, implemented at least partially in hardware and coupled to a plurality of networking devices on a data communication network, for identifying malware by capturing relations in sequences with recursive neural networks (RNNs) during runtime in a sandbox runtime, without full execution, the sandbox server device comprising:
a processor;
a network communication interface, coupled to the data communication network; and
a memory, comprising:
a first module to receive from a malware detection module of a remote networking device of the plurality of networking devices, a request for runtime behavioral analysis of a file, along with a copy of the file, and responsive to the malware detection module detecting an anomaly without a matching known malware signature;
a second module to invoke the virtual runtime environment to execute a copy of the file-from a pool of available virtual runtime environments;
a third module to execute the copy of the file a copy of the file in the virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time;
a fourth module to identify on-the-fly a behavior sequence during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution;
a fifth module to, responsive to the identification, terminate the execution and returning the virtual runtime environment to the pool of available virtual runtime environments; and
a sixth module to respond to the malware detection module of the remote networking device with a positive result to prevent file execution at the remote networking device.