# US 10,482,243 B2 · Multi-threat analyzer array system and method of use > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,243 B2 - Document ID: US10482243B2 - Status: Granted - Kind: B2 - Application number: 15/442,743 - Filed: 2017-02-27 - Published: 2018-02-15 - Granted: 2019-11-19 - Earliest claimed: 2016-02-25 - Assignees: Cyren, Inc. - Applicants: Cyren Inc. - Inventors: Lior Kohavi; Ido Rosner; Geffen Tzur; Friðrik Skúlason; Michael Kajiloti - Web page: https://patentgrep.com/patent/US10482243B2 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/554: {involving event detection and direct action} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1433: {Vulnerability analysis} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for determining the threat level of a sample, comprising: providing a multi-analyzer array running on a server comprising a static analyzer, a plurality of dynamic analyzers, an arbitrator, at least one post processing process, and a normalizer process; analyzing the sample by the static analyzer to produce a static analysis; review of the static analysis by the arbitrator to determine which of the plurality of dynamic analyzers to utilize for dynamic analysis of the sample; dynamic analysis of the sample by one of the plurality of dynamic analyzers as chosen by the arbitrator to produce a dynamic analysis of the sample, normalizing the dynamic analysis by the normalizer to a format for post processing by the at least one post processing process; analysis of the normalized dynamic analysis by the at least one post processing process to provide a post processing analysis and to determine a threat level of the sample; and analysis by the arbitrator of the post processing analysis and the threat level of the sample to determine whether to further analyze the sample in one of the plurality of dynamic analyzers not previously chosen by the arbitrator. ## Claims ### Claim 1 A method for determining the threat level of a sample, comprising: a. providing a multi-analyzer array running on a server comprising a static analyzer, a plurality of dynamic analyzers, an arbitrator, at least one post processing process, and a normalizer process, wherein at least two of the plurality of dynamic analyzers are sandboxes, wherein each of the at least two sandboxes is of a different sandbox developer; b. analyzing the sample by said static analyzer to produce a static analysis; c. review of said static analysis by said arbitrator to determine based on said static analysis which of said plurality of dynamic analyzers to utilize for dynamic analysis of said sample; d. by the normalizer, translating of the request to the determined dynamic analyzer from a generic request syntax into the request syntax used by the determined dynamic analyzer; e. dynamic analysis of the sample by the determined dynamic analyzers as chosen by said arbitrator to produce a dynamic analysis of said sample, f. normalizing said dynamic analysis by said normalizer to a format for post processing by said at least one post processing process; g. analysis of the normalized dynamic analysis by said at least one post processing process to provide a post processing analysis and to determine a threat level of said sample; and h. analysis by said arbitrator of said post processing analysis and said threat level of said sample to determine whether to further analyze said sample in one of said plurality of dynamic analyzers not previously chosen by said arbitrator. ### Claim 2 (depends on 1) The method of claim 1 wherein said at least one post processing process comprises a process selected from the group consisting of: a. an OS analyzer; b. a network analyzer; c. file analyzer; d. image analyzer; and e. scorer. ### Claim 3 (depends on 2) The method of claim 2 wherein said network analyzer gathers further analysis of network traffic from said reputation systems and/or IDS. ### Claim 4 (depends on 1) The method of claim 1 wherein said array further comprises a translator and wherein said translator translates requests for analysis sent to said analyzers. ### Claim 5 (depends on 1) The method of claim 1 wherein said array further comprises a database and wherein said database stores at least one of task queues for processes in said array; said dynamic or said static analyses. ### Claim 6 (depends on 1) The method of claim 1 wherein said sandbox comprises clients with configurations differentiated by at least one of: operating system, network configuration, software and/or hardware architecture, software configuration, or hardware configuration. ### Claim 7 (depends on 1) The method of claim 1 wherein at least one of said plurality of analyzers comprises a sandbox-less environment. ### Claim 8 (depends on 7) The method of claim 7 wherein said sandbox-less environment comprises application modules designed to simulate human activity, wherein said simulated activity includes at least one of mouse movements, keyboard strokes, website form interaction or dialog window interaction. ### Claim 9 (depends on 1) The method of claim 1 wherein each of said plurality of analyzers comprises a configuration selected from the group consisting of: a. operating system, b. network configuration, c. software and/or hardware architecture, d. software configuration, e. hardware configuration, and f. a combination of the above. ### Claim 10 (depends on 1) The method of claim 1 wherein said static analysis comprises at least one of basic emulation, YARA analysis and antivirus analysis. ### Claim 11 (depends on 1) The method of claim 1 further comprising providing a visualization of the said determining of said threat level comprising, via a web interface: a. graphically portraying the stages in said determining using said threat level with icons representing said static analysis, said dynamic analysis, and said post processing interconnected by lines illustrating the flow of said determining, and b. updating said determined threat level graphically represented by a score as said score is calculated. ### Claim 12 A system for determining the threat level of a sample, comprising: a. a multi-analyzer array running on a server, wherein the server is a computing device comprising a data processor and the ability to execute one or more instructions, the array comprising: i. a static analyzer, ii. a plurality of dynamic analyzers, wherein at least two of the plurality of dynamic analyzers are sandboxes, wherein each of the at least two sandboxes is of a different sandbox developer, iii. an arbitrator, iv. at least one post processing process, and v. a normalizer process; wherein said sample is analyzed by said static analyzer to produce a static analysis; wherein said arbitrator reviews said static analysis to determine based on said static analysis which of said plurality of dynamic analyzers to utilize for dynamic analysis of said sample; wherein the normalizer translates the request to the determined dynamic analyzer from a generic request syntax into the request syntax used by the determined dynamic analyzer; wherein the determined dynamic analyzer as chosen by said arbitrator performs dynamic analysis of the sample to produce a dynamic analysis of said sample, wherein said normalizer normalizes said dynamic analysis to a format for post processing by said at least one post processing process; wherein said at least one post processing process analyzes the normalized dynamic analysis to provide a post processing analysis and to determine a threat level of said sample; and wherein said arbitrator analyzes said post processing analysis and said threat level of said sample to determine whether to further analyze said sample in one of said plurality of dynamic analyzers not previously chosen by said arbitrator. ### Claim 13 (depends on 12) The system of claim 12 wherein said at least one post processing process comprises a process selected from the group consisting of: a. an OS analyzer; b. a network analyzer; c. file analyzer; d. image analyzer; and e. scorer. ### Claim 14 (depends on 13) The system of claim 13 wherein said array further comprises reputation systems and IDS and said network analyzer gathers further analysis of network traffic from said reputation systems and/or IDS. ### Claim 15 (depends on 12) The system of claim 12 wherein said array further comprises a translator and wherein said translator translates requests for analysis sent to said analyzers. ### Claim 16 (depends on 12) The system of claim 12 wherein said array further comprises a database and wherein said database stores at least one of task queues for processes in said array; said dynamic or said static analyses. ### Claim 17 (depends on 12) The system of claim 12 wherein said sandbox comprises clients with configurations differentiated by at least one of: operating system, network configuration, software and/or hardware architecture, software configuration, or hardware configuration. ### Claim 18 (depends on 12) The system of claim 12 wherein at least one of said plurality of analyzers comprises a sandbox-less environment. ### Claim 19 (depends on 18) The system of claim 18 wherein said sandbox-less environment comprises application modules designed to simulate human activity, wherein said simulated activity includes at least one of mouse movements, keyboard strokes, website form interaction or dialog window interaction. ### Claim 20 (depends on 12) The system of claim 12 wherein each of said plurality of analyzers comprises a configuration selected from the group consisting of: a. operating system, b. network configuration, c. software and/or hardware architecture, d. software configuration, e. hardware configuration, and f. a combination of the above. ### Claim 21 (depends on 12) The system of claim 12 wherein said static analysis comprises at least one of basic emulation, YARA analysis and antivirus analysis. ### Claim 22 (depends on 12) The system of claim 12 wherein said array comprises a visualizer and wherein said visualizer provides a visualization of the said determining of said threat level comprising, via a web interface, graphically portraying the stages in said determining said threat level with icons representing said static analysis, said dynamic analysis, and said post processing interconnected by lines illustrating the flow of said determining, and updating said determined threat level represented by a score as said score is calculated. ### Claim 23 (depends on 12) The system of claim 12 wherein said static analysis comprises determining expected behavior of the sample and wherein analysis of the normalized dynamic analysis comprises determining whether the sample performed according to the expected behavior. ### Claim 24 (depends on 12) The system of claim 12 wherein determining whether to further analyze said sample in one of said plurality of dynamic analyzers is based on a factor chosen from the list consisting of: a. whether the sample exhibited all of the expected behavior determined as part of the static analysis; b. evasion by the sample of the first dynamic analyzer; c. incompatibility of the first dynamic analysis environment; d. whether additional behaviors of the sample were exposed in the first dynamic analysis necessitating a further analysis; e. whether a further analysis will significantly add to a determined malware score; f. whether a further analysis will provide more and valuable information about the sample; and g. a combination of the above.