Malicious network content detection

A computer implemented method for detecting one or more malicious uniform resource locators (URLs) contained within electronic messages, comprising:

• determining whether an URL is suspicious by at least (i) comparing, by a web malware detection system, the URL to a white list of acceptable URLs and a black list of malicious URLs, and (iii) determining that the URL is suspicious when not found in either the white list or the black list;
• analyzing the URL when the URL is determined to be suspicious by at least executing an application within a virtual environment of the web malware detection system, loading the web content associated with the suspicious URL into the virtual environment, processing the received web content associated with the suspicious URL within the virtual environment, and monitoring for an undesirable behavior during the processing of the received web content;
• and
• identifying, as a malicious URL, the suspicious URL based on the undesirable behavior monitored within the virtual environment.

A system for detecting one or more malicious uniform resource locators (URLs) contained within electronic messages malicious network content, comprising:

• an electronic message malware detection system comprising a processor and configured to:
• receive an electronic message,
• analyze the electronic message to detect a URL within message content of the electronic message, and
• provide the URL to a web malware detection system;
• and
• the web malware detection system coupled with the electronic message malware detection system and different than the electronic message malware detection system, the web malware detection system being configured to:
• send a request message for web content associated with the URL and, in response, receiving the web content, and
• execute the web content associated with the URL within a virtual environment to determine whether one or more undesirable behaviors have occurred,
• wherein the web malware detection system determines whether the URL is suspicious by (i) comparing the URL to a white list of acceptable URLs and a black list of malicious URLs, and (ii) determining that the URL is suspicious when not found in either the white list or the black list,
• wherein the web malware detection system being further configured to identify, as a malicious URL, the suspicious URL based on the occurrence of the one or more undesirable behaviors.

A method for detecting malicious network content, comprising:

• receiving a uniform resource locator (URL);
• determining whether the URL is suspicious based, at least in part, on accessing and analyzing the detected URL in accordance with (i) a plurality of confirmed malicious URLs maintained as part of a black list stored remotely from the system or (ii) a plurality of accessible URLs maintained as part of a white list;
• in response to a determination that the detected URL is suspicious, processing the suspicious URL by at least analyzing content, received in response to a request based on the suspicious URL, within a virtual environment, wherein the virtual environment includes a network browser application being executed to receive content associated with a response to a request message routed to the URL;
• and
• identifying the suspicious URL as malicious based on results of the processing of the suspicious URL in the virtual environment.