Patent ID: 8650638
Filing Date: 2014-02-11
Classification: G06F,H04L

Abstract:
1. A method, comprising: receiving a plurality of packets associated with a file at a node, which comprises a sensor that is to interact with a reputation system, wherein the file is an executable file embedded in a second file in a network flow; identifying a file format identifier associated with a beginning of the file; parsing the file based on the file format identifier to identify an end of the file, wherein only the file is parsed to identify the end of the file, and wherein portions of the second file that do not include the file are not parsed to identify the end of the file; calculating a hash value from the beginning of the file to the end of the file; sending the hash value to the reputation system; receiving a reputation value associated with the hash value from the reputation system; and taking a policy action based on the reputation value, wherein the policy action includes quarantining the file.