# US 10,313,373 B2 · System and method of protecting a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,373 B2 - Document ID: US10313373B2 - Status: Granted - Kind: B2 - Application number: 14/877,402 - Filed: 2015-10-07 - Published: 2017-04-27 - Granted: 2019-06-04 - Earliest claimed: 2014-10-08 - Applicants: Melih Abdulhayoglu; Egemen Tas; Haibo Zhang - Inventors: Melih Abdulhayoglu; Egemen Tas; Haibo Zhang - Web page: https://patentgrep.com/patent/US10313373B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract There is provided a network appliance, methods and systems which intercept web and email traffic, extract executables, compare the executables with a policy and wrap the executables. Then, the wrapped executables are delivered to a client system in a manner to protect the network and end point devices, where the wrapped executables are run in a sandbox with all file system, registry accesses, communication and traffic isolated. ## Claims ### Claim 1 A system for protecting a network comprising: a network appliance having an interceptor and a packer, said interceptor receives network traffic from a network and analyzes said network traffic for any executable application; said network appliance having at least one predefined policy applied to said network traffic to separate a target executable application from said any executable application; said packer produces a wrapped executable application by wrapping only the target executable application, said target executable application having an icon and a user account control manifest; said packer embedding said target executable application into a wrapper as a resource with a fixed resource identification and said packer extracting said icon of said target executable application; said packer adding an overlay icon to said target executable application and applying said overlay icon to said wrapper; said packer extracts said user account control manifest of said target executable application and applying said user account control manifest to said wrapper; said packer made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK; a client system comprising at least one computer or handheld device connected to said network; a data transmission connection to deliver said wrapped executable application to said client system; said wrapped executable application running in a sandbox on said client system wherein behavior analysis is performed on said wrapped executable application in said sandbox. ### Claim 2 (depends on 1) The system of claim 1 wherein said packer which produces a wrapped executable application by wrapping of the target executable application includes a sandbox and the target executable application is placed inside the sandbox to produce the wrapped executable application. ### Claim 3 (depends on 1) The system of claim 1, wherein said packer which produces a wrapped executable application by wrapping includes at least one executable script provided with the target executable application; and the at least one executable script is delivered with the target executable application as the wrapped executable application. ### Claim 4 (depends on 3) The system of claim 3, wherein said at least one executable script is run on the at least one computer or handheld device. ### Claim 5 (depends on 1) The system of claim 1, wherein said packer which produces a wrapped executable application by wrapping the target executable application includes: said packer determining if a sandbox exists on a computer or handheld device; and extracting the target executable application from the wrapped application if a sandbox exists; said network appliance sending only the target executable application to the sandbox on the at least one computer or handheld device. ### Claim 6 A network appliance comprising: an interceptor and a packer, said interceptor receives network traffic and analyzes said network traffic for at least one executable application; at least one predefined policy applied to said at least one executable application to separate an unknown executable application; said packer produces a wrapped executable application by wrapping only the unknown executable application to produce the wrapped executable application; said unknown executable application having an icon and a user account control manifest; said packer embedding said unknown executable application into a wrapper as a resource with a fixed resource identification and said packer extracting said icon of said unknown executable application; said packer adding an overlay icon to said unknown executable application and applying said overlay icon to said wrapper; said packer extracts said user account control manifest of said unknown executable application and applying said user account control manifest to said wrapper; said packer made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK; a data transmission connection to deliver said wrapped executable application wherein behavior analysis is performed on said wrapped executable application in a sandbox. ### Claim 7 (depends on 6) The network appliance of claim 6, wherein the packer includes a sandbox and the unknown executable application is placed inside the sandbox to produce the wrapped executable application. ### Claim 8 (depends on 6) The network appliance of claim 6, wherein the packer includes at least one executable script provided with the unknown executable application; and the at least one executable script is delivered with the unknown executable application as the wrapped executable application. ### Claim 9 (depends on 8) The network appliance of claim 8, wherein said at least one executable script is run on a computer or handheld device of an end user. ### Claim 10 (depends on 6) The network appliance of claim 6, wherein said packer which produces a wrapped executable application by wrapping the unknown executable application includes: said packer determining if a sandbox exists on a computer or handheld device; and extracting the unknown executable application from the wrapped application if a sandbox exists; said network appliance sending only the unknown executable application to the sandbox on the computer or handheld device. ### Claim 11 A method to protect end points of a network comprising: monitoring network traffic of a network; extracting at least one executable application from said network traffic; identifying an unknown executable application based on at least one rule after extracting said at least one executable application from said network traffic, said unknown executable application having an icon and a user account control manifest; wrapping the unknown executable application by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK; embedding, by said packer, said unknown executable application into a wrapper as a resource with a fixed resource identification; extracting said icon of said unknown executable application by said packer; adding an overlay icon by said packer to said unknown executable application; applying said overlay icon to said wrapper; extracting by said packer said user account control manifest of said unknown executable application applying said user account control manifest to said wrapper; sending the wrapped unknown executable application to an end user of the network performing behavior analysis on said wrapped unknown executable application in a sandbox. ### Claim 12 (depends on 11) The method of claim 11, wherein the wrapping step includes: placing the unknown executable application inside a sandbox and delivering the unknown executable application and the sandbox to the end user. ### Claim 13 (depends on 11) The method of claim 11, wherein the wrapping step comprises: including at least one executable script with the unknown executable application; delivering the at least one executable script with the unknown executable application to the end user; running the at least one executable script on a computer or handheld device of the end user. ### Claim 14 A method to protect a network comprising: monitoring network email traffic of a network; wrapping at least one executable application from said email traffic by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK; determining if a sandbox exists on a computer or handheld device of an end user; extracting the at least one executable application from the wrapped application if a sandbox exists; sending only the at least one executable application to the sandbox on the computer or handheld device of the end user. ### Claim 15 (depends on 14) The method of claim 14 further comprising: identifying an unknown executable application based on at least one policy after the step of monitoring network email traffic; wrapping the unknown executable application; extracting the unknown executable application from the wrapped unknown executable application if a sandbox exists; sending only the unknown executable application to the sandbox on the computer or handheld device of the end user. ### Claim 16 A method to securely deliver executables to an endpoint comprising: monitoring network traffic; identifying an unknown executable application based on at least one policy; wrapping the unknown executable application by a packer which is made independent of platforms by performing resource changes by raw binary modification without using resource API of Windows SDK; determining if a sandbox exists on a computer or handheld device of an end user; extracting the unknown executable application from the wrapped application if a sandbox exists; sending only the unknown executable application to the sandbox on the computer or handheld device of the end user. ### Claim 17 A network appliance comprising: an interceptor which receives network traffic and analyzes said network traffic for executable applications; at least one predefined policy applied to said executable applications to separate an unknown executable application; a packer which produces a wrapped executable application by wrapping the unknown executable application; said network appliance determining if a sandbox exists on a computer or handheld device and extracts the unknown executable application from the wrapped application if a sandbox exists; a data transmission connection to deliver said wrapped executable application or deliver only the unknown executable application if said sandbox exists on said computer or handheld device. ### Claim 18 (depends on 17) The network appliance of claim 17, wherein the wrapping includes a sandbox and the unknown executable application is placed inside the sandbox to produce the wrapped executable application. ### Claim 19 (depends on 17) The network appliance of claim 17, wherein the wrapping includes providing at least one executable script with the unknown executable application; delivering the at least one executable script with the unknown executable application as the wrapped executable application. ### Claim 20 (depends on 19) The network appliance of claim 19, wherein said at least one executable script is run on a computer or handheld device of an end user. ### Claim 21 A system for securely delivering executables to an endpoint comprising: a network appliance having an interceptor which receives network traffic from a network and analyzes said network traffic for executable applications; at least one predefined policy applied to said executable applications to separate an unknown executable application; a packer which produces a wrapped executable application by wrapping the unknown executable application; said network appliance determining if a sandbox exists on a computer or handheld device and extracts the unknown executable application from the wrapped application if a sandbox exists; a data transmission connection to deliver only said unknown executable application to a client system; said client system comprising said computer or handheld device connected to said network; said unknown executable application running in a sandbox on said client system and behaviour analysis is performed on said unknown executable application in said sandbox. ### Claim 22 (depends on 21) The system of claim 21 wherein the wrapping of the unknown executable application includes a sandbox and the unknown executable application is placed inside the sandbox to produce the wrapped executable application. ### Claim 23 (depends on 21) The system of claim 21, wherein the wrapping includes providing at least one executable script with the unknown executable application; delivering the at least one executable script with the unknown executable application as the wrapped executable application. ### Claim 24 (depends on 23) The system of claim 23, wherein said at least one executable script is run on the computer or handheld device.