Patent Document ID: 9609015
Application ID: 14796422
Patent Flag: 1

Claim One:
1. A zero day/zero hour malware detection method implemented by a processor in a behavior analysis system, the malware detection method comprising: receiving unknown content at a server in the behavior analysis system from a distributed security system based on inline monitoring of a plurality of users with the distributed security system which is a cloud-based system; performing malware detection through the server by: securely storing the unknown content in a Secure Storage Engine (SSE); performing a static analysis of the unknown content to determine properties of the unknown content using a set of tools based on a type of file of the unknown content and securely storing static results in the SSE, wherein the set of tools comprise checking third party services to match the unknown content to known viruses detected by various anti-virus engines, using a Perl Compatible Regular Expressions (PCRE) engine to check the unknown content for known signatures, identifying code signing certificates to form a whitelist of known benign content using Portable Executable (PE)/Common Object File Format (COFF) specifications, and evaluating destinations of any communications from the dynamic analysis; sending the unknown content to a behavior analysis controller which is connected to a sandbox which performs a dynamic analysis based on scheduling by the behavior analysis controller, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner where the sandbox is controlled by the behavior analysis controller to perform the dynamic analysis; receiving dynamic results from the dynamic analysis and storing the dynamic results in the SSE; determining if the unknown content is malware based on a combination of the static results and the dynamic results; and subsequent to the malware detection, updating the distributed security system with a malware signature of the unknown content if the unknown content is malware.