# US 10,454,953 B1 · System and method for separated packet processing and static analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,953 B1 - Document ID: US10454953B1 - Status: Granted - Kind: B1 - Application number: 15/728,436 - Filed: 2017-10-09 - Granted: 2019-10-22 - Earliest claimed: 2014-03-28 - Assignees: FireEye, Inc. - Applicants: FireEye, Inc. - Inventors: Muhammad Amin; Masood Mehmood; Ramaswamy Ramaswamy; Madhusudan Challa; Shrikrishna Karandikar - Web page: https://patentgrep.com/patent/US10454953B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, a system features a network security device and a cloud computing service. The network security device is configured to determine whether an object includes one or more characteristics associated with a malicious attack. The cloud computing service, communicatively coupled to and remotely located from the network security device, includes virtual execution logic that, upon execution by a processing unit deployed as part of the cloud computing service and after the network security device determining that the object includes the one or more characteristics associated with the malicious attack, processes the object and monitors for behaviors of at least the object suggesting the object is associated with a malicious attack. ## Claims ### Claim 1 A server, comprising: a first blade server including a first processing unit and a filtering logic that, when executed by the first processing unit, is configured to receive a first plurality of objects and identify, without execution of any object of the first plurality of objects, at least a first object of the first plurality of objects having characteristics associated with a malicious attack; and a second blade server communicatively coupled to the first blade server, the second blade server includes a second processing unit being different from the first processing unit, the second processing unit to (i) process at least the first object provided from the first blade server when the first object includes characteristics associated with a malicious attack, (ii) monitor at least behaviors of the first object during processing, and (iii) determine whether any of the monitored behaviors correspond to activities indicative that the first object is associated with a malicious attack. ### Claim 2 (depends on 1) The server of claim 1, wherein the second blade server further comprising reporting logic that, when executed by the second processing unit, issues an alert message identifying at least the first object being associated with a malicious attack. ### Claim 3 (depends on 2) The server of claim 2, wherein the alert message includes a text message. ### Claim 4 (depends on 1) The server of claim 1, wherein the second blade server being implemented as part of a cloud computing service. ### Claim 5 (depends on 1) The server of claim 1, wherein the first blade server to perform one or more exploit signature checks that include a comparison of one or more pre-stored exploit signatures to content of the first object. ### Claim 6 (depends on 1) The server of claim 1, wherein the first blade server to perform an heuristic analysis that analyzes the first object using metadata or attributes of the first object to determine whether a certain portion of the first object has characteristics that suggest the first object is associated with a malicious attack. ### Claim 7 (depends on 1) The server of claim 1, wherein the second blade server includes at least one virtual machine that is configured to process the content within at least the first object. ### Claim 8 (depends on 1) The server of claim 1, wherein the one or more characteristics further comprise a particular source address that is associated with a known exploit. ### Claim 9 (depends on 1) The server of claim 1, wherein the one or more characteristics further comprise a particular destination address that is associated with a known exploit. ### Claim 10 A system, comprising: a network security device configured to determine whether an object includes one or more characteristics associated with a malicious attack without execution of the object, the one or more characteristics include at least a Uniform Resource Locator (URL) that suggests the object is associated with a known exploit; and a cloud computing service communicatively coupled to and remotely located from the network security device, the cloud computing service including a virtual execution logic that, upon execution of the object by a processing unit deployed as part of the cloud computing service and, after the network security device determining that content of the object includes the one or more characteristics associated with the malicious attack, monitors for behaviors of the object suggesting the object is associated with a malicious attack. ### Claim 11 (depends on 10) The system of claim 10, wherein the cloud computing service further comprising reporting logic that, when executed by the processing unit, transmits an alert message to a network administrator, user, or another entity upon identifying at least the object being associated with a malicious attack. ### Claim 12 (depends on 10) The system of claim 10, wherein the network security device to perform one or more exploit signature checks that include a comparison of one or more pre-stored exploit signatures to the content of the object. ### Claim 13 (depends on 10) The system of claim 10, wherein the network security device to perform an heuristic analysis that analyzes the object using metadata or attributes of the object to determine whether a certain portion of the object has characteristics that suggest the object is associated with a malicious attack. ### Claim 14 (depends on 10) The system of claim 10, wherein the virtual execution logic that, upon execution by the processing unit, includes at least one virtual machine that is configured to process the object. ### Claim 15 (depends on 10) The system of claim 10, wherein the virtual execution logic is deployed within a dynamic analysis engine implemented within the cloud computing service. ### Claim 16 (depends on 15) The system of claim 15, wherein the dynamic analysis engine includes one or more software modules being executed by the processing unit within the cloud computing service that are configured to process the object and monitor for the behaviors of the object. ### Claim 17 (depends on 16) The system of claim 16, wherein the processing unit is a virtual processor. ### Claim 18 A system, comprising: a network security device configured to determine whether an object includes one or more characteristics associated with a malicious attack without execution of the object, the one or more characteristics include a particular source address that suggests the object is associated with a known exploit; and a cloud computing service communicatively coupled to and remotely located from the network security device, the cloud computing service including a virtual execution logic that, upon execution of the object by a processing unit deployed as part of the cloud computing service and, after the network security device determining that content of the object includes the one or more characteristics associated with the malicious attack, monitors for behaviors of the object suggesting the object is associated with a malicious attack. ### Claim 19 (depends on 18) The system of claim 18, wherein the cloud computing service further comprising reporting logic that, when executed by the processing unit, transmits an alert message to a network administrator, user, or another entity upon identifying at least the object being associated with a malicious attack. ### Claim 20 (depends on 18) The system of claim 18, wherein the network security device to perform one or more exploit signature checks that include a comparison of one or more pre-stored exploit signatures to the content of the object. ### Claim 21 (depends on 18) The system of claim 18, wherein the network security device to perform an heuristic analysis that analyzes the object using metadata or attributes of the object to determine whether a certain portion of the object has characteristics that suggest the object is associated with a malicious attack. ### Claim 22 (depends on 18) The system of claim 18, wherein the virtual execution logic that, upon execution by the processing unit, includes at least one virtual machine that is configured to process the object. ### Claim 23 (depends on 18) The system of claim 18, wherein the virtual execution logic is deployed within a dynamic analysis engine implemented within the cloud computing service. ### Claim 24 (depends on 23) The system of claim 23, wherein the dynamic analysis engine includes one or more software modules being executed by the processing unit within the cloud computing service that are configured to process the object and monitor for the behaviors of the object. ### Claim 25 (depends on 24) The system of claim 24, wherein the processing unit is a virtual processor. ### Claim 26 A system, comprising: a network security device configured to determine whether an object includes one or more characteristics associated with a malicious attack without execution of the object, the one or more characteristics include a particular destination address that suggests the object is associated with a known exploit; and a cloud computing service communicatively coupled to and remotely located from the network security device, the cloud computing service including a virtual execution logic that, upon execution of the object by a processing unit deployed as part of the cloud computing service and, after the network security device determining that content of the object includes the one or more characteristics associated with the malicious attack, monitors for behaviors of the object suggesting the object is associated with a malicious attack. ### Claim 27 (depends on 26) The system of claim 26, wherein the cloud computing service further comprising reporting logic that, when executed by the processing unit, transmits an alert message to a network administrator, user, or another entity upon identifying at least the object being associated with a malicious attack. ### Claim 28 (depends on 26) The system of claim 26, wherein the network security device to perform one or more exploit signature checks that include a comparison of one or more pre-stored exploit signatures to the content of the object. ### Claim 29 (depends on 26) The system of claim 26, wherein the network security device to perform an heuristic analysis that analyzes the object using metadata or attributes of the object to determine whether a certain portion of the object has characteristics that suggest the object is associated with a malicious attack. ### Claim 30 (depends on 20) The system of claim 20, wherein the virtual execution logic that, upon execution by the processing unit, includes at least one virtual machine that is configured to process the object. ### Claim 31 (depends on 26) The system of claim 26, wherein the virtual execution logic is deployed within a dynamic analysis engine implemented within the cloud computing service. ### Claim 32 (depends on 31) The system of claim 31, wherein the dynamic analysis engine includes one or more software modules being executed by the processing unit within the cloud computing service that are configured to process the object and monitor for the behaviors of the object. ### Claim 33 (depends on 32) The system of claim 32, wherein the processing unit is a virtual processor.