Patent ID: 11968228
Assignee: FORTINET, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A computer-implemented method, in a sandbox server device, implemented at least partially in hardware and coupled to a plurality of networking devices on a data communication network, for identifying malware by capturing relations in sequences with recursive neural networks (RNNs) during runtime in a sandbox runtime, without full execution, the method comprising the steps of:
receiving from a malware detection module of a remote networking device of the plurality of networking devices, a request for runtime behavioral analysis of a file, along with a copy of the file, and responsive to the malware detection module detecting an anomaly without a matching known malware signature;
invoking a virtual runtime environment to execute the copy of the file from a pool of available virtual runtime environments;
executing the copy of the file in the virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time;
identifying on-the-fly a behavior sequence during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution;
responsive to the identification, terminating the execution and returning the virtual runtime environment to the pool of available virtual runtime environments; and
responding to the malware detection module of the remote networking device with a positive result to prevent file execution at the remote networking device.