Patent ID: 8782790

Claim:
A computer-implemented method of creating a traffic signature for detecting content in network traffic, comprising: distributing detection data comprising behavior-based heuristics to a plurality of endpoints via a computer network, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack; receiving, from at least some of the plurality of endpoints of the computer network, descriptions of content associated with an attack detected by the endpoints using the behavior-based heuristics of the distributed detection data; generating a traffic signature for the described content associated with the attack detected by at least some of the plurality of the endpoints of the computer network by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic; and providing the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic.