Retroactive identification of previously unknown malware based on network traffic analysis from a sandbox environment

A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

• obtaining a plurality of packet capture files comprising previously captured network communications of a plurality of malware programs that previously executed, relative to the obtaining of the plurality of packet capture files, in a sandbox environment, wherein each of said packet capture files is associated with a corresponding malware program that generated said network communications, wherein the packet capture files comprise at least a portion of the network communications of the corresponding malware program while executing in the sandbox environment;
• obtaining one or more signatures indicative of at least one of said malware programs;
• comparing, subsequent to the obtaining of the plurality of packet capture files, said one or more signatures to said plurality of packet capture files;
• and
• identifying, subsequent to the comparing, a given previously executed malware program as malware if one of said signatures matches a given packet capture file associated with said given malware program, wherein the previous execution of the given malware program is relative to the obtaining of the plurality of packet capture files.

A system, comprising:

• a memory;
• and
• at least one processing device, coupled to the memory, operative to implement the following steps:
• obtaining a plurality of packet capture files comprising previously captured network communications of a plurality of malware programs that previously executed, relative to the obtaining of the plurality of packet capture files, in a sandbox environment, wherein each of said packet capture files is associated with a corresponding malware program that generated said network communications, wherein the packet capture files comprise at least a portion of the network communications of the corresponding malware program while executing in the sandbox environment;
• obtaining one or more signatures indicative of at least one of said malware programs;
• comparing, subsequent to the obtaining of the plurality of packet capture files, said one or more signatures to said plurality of packet capture files;
• and
• identifying, subsequent to the comparing, a given previously executed malware program as malware if one of said signatures matches a given packet capture file associated with said given malware program, wherein the previous execution of the given malware program is relative to the obtaining of the plurality of packet capture files.