System and method of protecting a network

A network appliance comprising:

• an interceptor and a packer, said interceptor receives network traffic and analyzes said network traffic for at least one executable application;
• at least one predefined policy applied to said at least one executable application to separate an unknown executable application;
• said packer produces a wrapped executable application by wrapping only the unknown executable application to produce the wrapped executable application;
• said unknown executable application having an icon and a user account control manifest;
• said packer embedding said unknown executable application into a wrapper as a resource with a fixed resource identification and said packer extracting said icon of said unknown executable application;
• said packer adding an overlay icon to said unknown executable application and applying said overlay icon to said wrapper;
• said packer extracts said user account control manifest of said unknown executable application and applying said user account control manifest to said wrapper;
• said packer made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK;
• a data transmission connection to deliver said wrapped executable application wherein behavior analysis is performed on said wrapped executable application in a sandbox.

A method to protect end points of a network comprising:

• monitoring network traffic of a network;
• extracting at least one executable application from said network traffic;
• identifying an unknown executable application based on at least one rule after extracting said at least one executable application from said network traffic, said unknown executable application having an icon and a user account control manifest;
• wrapping the unknown executable application by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK;
• embedding, by said packer, said unknown executable application into a wrapper as a resource with a fixed resource identification;
• extracting said icon of said unknown executable application by said packer;
• adding an overlay icon by said packer to said unknown executable application;
• applying said overlay icon to said wrapper;
• extracting by said packer said user account control manifest of said unknown executable application
• applying said user account control manifest to said wrapper;
• sending the wrapped unknown executable application to an end user of the network performing behavior analysis on said wrapped unknown executable application in a sandbox.

A method to protect a network comprising:

• monitoring network email traffic of a network;
• wrapping at least one executable application from said email traffic by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK;
• determining if a sandbox exists on a computer or handheld device of an end user;
• extracting the at least one executable application from the wrapped application if a sandbox exists;
• sending only the at least one executable application to the sandbox on the computer or handheld device of the end user.

A method to securely deliver executables to an endpoint comprising:

• monitoring network traffic;
• identifying an unknown executable application based on at least one policy;
• wrapping the unknown executable application by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK;
• determining if a sandbox exists on a computer or handheld device of an end user;
• extracting the unknown executable application from the wrapped application if a sandbox exists;
• sending only the unknown executable application to the sandbox on the computer or handheld device of the end user.

A network appliance comprising:

• an interceptor which receives network traffic and analyzes said network traffic for executable applications;
• at least one predefined policy applied to said executable applications to separate an unknown executable application;
• a packer which produces a wrapped executable application by wrapping the unknown executable application;
• said network appliance determining if a sandbox exists on a computer or handheld device and extracts the unknown executable application from the wrapped application if a sandbox exists;
• a data transmission connection to deliver said wrapped executable application or deliver only the unknown executable application if said sandbox exists on said computer or handheld device.

A system for securely delivering executables to an endpoint comprising:

• a network appliance having an interceptor which receives network traffic from a network and analyzes said network traffic for executable applications;
• at least one predefined policy applied to said executable applications to separate an unknown executable application;
• a packer which produces a wrapped executable application by wrapping the unknown executable application;
• said network appliance determining if a sandbox exists on a computer or handheld device and extracts the unknown executable application from the wrapped application if a sandbox exists;
• a data transmission connection to deliver only said unknown executable application to a client system;
• said client system comprising said computer or handheld device connected to said network;
• said unknown executable application running in a sandbox on said client system and behaviour analysis is performed on said unknown executable application in said sandbox.