Patent ID: 9300686
Filing Date: 2016-03-29
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method for detecting malicious links in electronic messages by processing logic including circuitry implemented within a malware analysis system, comprising: in response to receiving a plurality of uniform resource locator (URL) links for malicious determination, removing any known URL links from the plurality of URL links based on a list of known link signatures; for each of remaining URL links that are unknown, performing a link analysis by the processing logic on a URL link of the remaining URL links based on link heuristics to determine whether the URL link is suspicious; and responsive to determining the URL link is suspicious, performing a dynamic analysis in a virtual machine on a resource associated with the suspicious URL link and classifying whether the suspicious URL link is a malicious link based on a behavior of the resource during the dynamic analysis within the virtual machine.