Patent ID: 8832829
Filing Date: 2014-09-09
Classification: G06F,H04L

Abstract:
1. A method for network-based file analysis for malware detection by a system, the method comprising: receiving network content; identifying a binary packet being assembled in accordance with one or more communication protocols from a plurality of communication protocols supported by the system and in accordance with one or more formats from a plurality of formats supported by the system, the binary packet being a portion of a binary file that is part of the network content; extracting the binary file from the network content, the binary file comprises one or more binary packets, including the binary packet; classifying the extracted binary file as suspicious network content or non-suspicious network content, wherein the suspicious network content has a suspicious characteristic related to malicious network content; processing the suspicious network content using a virtual environment component configured within a virtual environment to mimic operations of a real application configured to process the suspicious network content; and identifying the suspicious network content as malicious network content based on a behavior of the virtual environment component, the identifying of the suspicious network content as malicious network content based on the behavior of the virtual environment component comprises examining the behavior of the virtual environment component against an expected behavior.