Patent ID: 8850571
Filing Date: 2014-09-30
Classification: G06F,H04L

Abstract:
1. A method for detecting malicious network content, comprising: monitoring an exchange of network content over a communications network between a sending system and a destination system, the monitoring comprising identifying a suspicious characteristic of one or more packets of network content; determining by a processor, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content; identifying by the processor the one or more packets of network content as suspicious when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies a first threshold value, wherein the network content identified as suspicious potentially includes malicious network content; filtering, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfying the first threshold value, the identified one or more packets of network content comprising filtered suspicious network content; executing a virtual machine by a controller to simulate receipt and processing of the filtered suspicious network content by the destination system, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score associated with another one or more packets of network content; and analyzing a response of the virtual machine by the controller to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying a second threshold value different from the first threshold value.