# US 10,873,589 B2 · Real-time prevention of malicious content via dynamic analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,589 B2 - Document ID: US10873589B2 - Status: Granted - Kind: B2 - Application number: 15/671,445 - Filed: 2017-08-08 - Published: 2019-02-14 - Granted: 2020-12-22 - Earliest claimed: 2017-08-08 - Assignees: SonicWALL, Inc. - Applicants: SonicWALL Inc. - Inventors: Senthil Cheetancheri; Alex Dubrovsky; Sachin Holagi - Web page: https://patentgrep.com/patent/US10873589B2 ## CPC - G06F 21/563: {by source code analysis} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/567: {using dedicated hardware} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This disclosure is related to methods and apparatus used to for preventing malicious content from reaching a destination via a dynamic analysis engine may operate in real-time when packetized data is received. Data packets sent from a source computer may be received and be forwarded to an analysis computer that may monitor actions performed by executable program code included within the set of data packets when making determinations regarding whether the data packet set should be classified as malware. In certain instances all but a last data packet of the data packet set may also be sent to the destination computer while the analysis computer executes and monitors the program code included in the data packet set. In instances when the analysis computer identifies that the data packet set does include malware, the malware may be blocked from reaching the destination computer by not sending the last data packet to the destination computer. ## Claims ### Claim 1 A method for preventing malicious content from reaching a destination computer, the method comprising: receiving a plurality of data packets at a sandbox computing device that were forwarded by a firewall, wherein the plurality of data packets except for at least one packet are also sent to the destination computer; executing instructions included in the plurality of data packets received at the sandbox computing device; observing one or more actions that are performed when the instructions included in the plurality of data packets received at the sandbox computing device are executed; identifying that the one or more observed actions include de-obfuscating instructions in the plurality of data packets received at the sandbox computing device that when executed would access an inappropriate data storage location; and identifying that the plurality of data packets received at the sandbox computing device include malware based on the identification of the instructions that would access the inappropriate data storage location, wherein the at least one data packet not sent to the destination computer is then dropped by the firewall as a result of the malware being identified as present in the plurality of data packets received at the sandbox computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein de-obfuscating the instructions includes decrypting at least a portion of data included in the plurality of data packets. ### Claim 3 (depends on 1) The method of claim 1, wherein de-obfuscating the instructions includes reordering at least a portion of data included in the plurality of data packets. ### Claim 4 (depends on 1) The method of claim 1, further comprising identifying that at least one other action of the one or more observed actions includes de-obfuscating further instructions for execution from data included in the plurality of data packets. ### Claim 5 (depends on 4) The method of claim 4, further comprising identifying that the at least one other action of the one or more observed actions is unauthorized, wherein identifying that the plurality of data packets includes the malware is further based on the other unauthorized action. ### Claim 6 (depends on 1) The method of claim 1, wherein: each of the plurality of data packets are intercepted at the firewall, the plurality of data packets are sent from the firewall to the sandbox computing device, and the firewall sends the plurality of data packets except for the at least one packet to the destination computer. ### Claim 7 (depends on 1) The method of claim 1, wherein a message is sent to the destination computer, the message indicating that the plurality of data packets are being analyzed for the malicious content. ### Claim 8 (depends on 1) The method of claim 1, wherein the plurality of data packets were received based on a request sent by the destination computer to download data from a sending computer and a subsequent request to download the data from the sending computer is intercepted and not sent to the sending computer. ### Claim 9 (depends on 1) The method of claim 1, wherein the accessing of the inappropriate data storage location is an unauthorized action associated with at least one of writing to a boot block, changing a registry setting, transmitting data from a recipient computer, deleting data at the recipient computer, and changing or intercepting a basic input/output (BIOS) instruction associated with the recipient computer. ### Claim 10 A non-transitory computer readable storage medium having embodied thereon a program executable by a processor for implementing a method for preventing malicious content from reaching a destination computer, the method comprising: receiving a plurality of data packets at a sandbox computing device that were forwarded by a firewall, wherein the plurality of data packets except for at least one packet are also sent to the destination computer; executing instructions included in the plurality of data packets received at the sandbox computing device; observing one or more actions that are performed when the instructions included in the plurality of data packets received at the sandbox computing device are executed; identifying that the one or more observed actions include de-obfuscating instructions in the plurality of data packets that when executed would access an inappropriate data storage location; and identifying that the plurality of data packets received at the sandbox computing device include malware based on the identification of the instructions that would access the inappropriate data storage location, wherein the at least one data packet not sent to the destination computer is then dropped by the firewall as a result of the malware being identified as present in the plurality of data packets received at the sandbox computing device. ### Claim 11 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein de-obfuscating the instructions includes decrypting at least a portion of data included in the plurality of data packets. ### Claim 12 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein de-obfuscating the instructions includes reordering at least a portion of data included in the plurality of data packets. ### Claim 13 (depends on 10) The non-transitory computer-readable storage medium of claim 10, further comprising instructions executable to identify that at least one other action of the one or more observed actions includes de-obfuscating further instructions for execution from data included in the plurality of data packets. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, further comprising instructions executable to identify that the at least one other action of the one or more observed actions is unauthorized, wherein identifying that the plurality of data packets includes the malware is further based on the other unauthorized action. ### Claim 15 (depends on 10) The non-transitory computer-readable storage medium of claim 10, wherein: each of the plurality of data packets are intercepted at the firewall, the plurality of data packets are sent from the firewall to the sandbox computing device, and the firewall sends the plurality of data packets except for the at least one packet to the destination computer. ### Claim 16 An apparatus for preventing malicious content from reaching a destination computer, the apparatus comprising: a network interface of an a sandbox computing device that receives a plurality of data packets forwarded by a firewall, wherein the, the plurality of data packets except for at least one packet are also sent to the destination computer; a processor of the sandbox computing device that: executes instructions included in the plurality of data packets received at the sandbox computing device, and executes instructions stored in a memory of the analysis computer the sandbox computing device, wherein the execution of the instructions stored in the memory results in the processor: observing one or more actions performed when the instructions included in the data packets received at the sandbox computing device are executed, identifying that the one or more observed actions include de-obfuscating instructions in the plurality of data packets received at the sandbox computing device that when executed would access an inappropriate data storage location, and identifying that the plurality of data packets received at the sandbox computing device include malware based on the identification of the instructions that would access the inappropriate data storage location, wherein the at least one data packet not sent to the destination computer is then dropped by the firewall as a result of the malware being identified as present in the plurality of data packets received at the sandbox computing device.