Patent Document ID: 9430646
Application ID: 13830573
Patent Flag: 1

Claim One:
1. A computer implemented method for detecting callbacks from malicious code, comprising: A) local analyzers including a first local analyzer and a second local analyzer, the first local analyzer capturing packets of outbound communications, generating a signature from header information obtained from each of the captured packets, determining whether the signature matches a stored signature within a local signature cache, and, if a match is not found, analyzing the captured packet associated with the signature, including performing deep packet inspection; and B) a central analyzer receiving at least the signature and results of analysis associated with the captured packet from the first local analyzer; determining whether the signature matches a callback signature stored within a global signature cache; and coordinating, when the signature matches the callback signature, a sharing of the signature with the second local analyzer; and, when the signature fails to match any callback signature in the global signature cache, (i) performing an analysis on information contained in the captured packet; (ii) generating a callback probability score associated with the captured packet; (iii) declaring the captured packet having the callback probability score exceeding a predetermined threshold as associated with callbacks; and (iv) storing a designation of malware status with the signature associated with the captured packet having the callback probability score exceeding the predetermined threshold in the global signature cache.