Patent Document ID: 9171160
Application ID: 14042420
Patent Status: 1

Claim One:
1. A computer implemented method of detecting malware in a specimen of computer content or network traffic, the method comprising: responsive to receiving a specimen, determining, by a hardware controller, an analysis plan identifying an order for at least a first analysis and a second analysis to be performed, the first analysis comprises a static analysis and the second analysis comprises a dynamic analysis; performing the first analysis in accordance with the analysis plan to identify one or more suspicious indicators associated with malware and one or more characteristics related to processing of the specimen; performing the second analysis in accordance with the analysis plan, including processing of the specimen in a virtual environment including with one or more monitors to identify one or more unexpected behaviors each having one or more anomalies; responsive to a result of one of the first analysis or the second analysis, unpacking an object determined to be present in the specimen and performing a third analysis, wherein the third analysis comprises a static analysis on the object and is different from the first analysis and the second analysis when the first analysis is conducted prior to the second analysis; determining by a classifier whether the specimen should be classified as malicious based on at least one of (i) the one or more identified suspicious indicators, (ii) the one or more identified anomalies, or (iii) a result of the static analysis on the unpacked object; and storing one or more of (a) the analysis plan, (b) the one or more identified indicators, (c) the one or more characteristics, or (d) the one or more identified anomalies in a persistent memory.