Patent ID: 9690936
Date: 2017-06-27
CPC Classifications: G06F

Claim:
1. A method for detecting malicious content conducted by a preprocessor and a post-processor being software executed by a hardware processor, the method comprising: receiving an object including content over a network; determining, in the preprocessor, whether the content of the object is suspicious and whether the content is obfuscated by at least determining whether there is a high correlation between a portion of the content of the object and a first set of indicators of suspiciousness; responsive to determining that the content is suspicious and is not obfuscated, transmitting the suspicious content to a dynamic analyzer, the dynamic analyzer including one or more virtual machines that processes at least the content and monitors for anomalous behaviors occurring during the processing of the content; responsive to determining that the content of the object is obfuscated, removing non-suspicious content from further analysis.