Method and server for determining malicious files in network traffic

A server for determining malicious files in a network traffic of a data communication network, the server including:

• a processor communicatively coupled to the data communication network;
• and
• a non-transitory computer-readable medium storing instructions,
• the processor, upon executing the instructions, being configured to:
• receive, from the data communication network, the network traffic;
• retrieve a plurality of files from the network traffic;
• analyze the plurality of files in order to detect at least one suspicious file by checking whether a format of a given one of the plurality of files matches a known suspicious format;
• in response to identifying that the given one of the plurality of files is associated with a suspicious file format, determine whether there is a behavioral report associated with the given one of the plurality of files;
• if the behavioral report exists, analyze the behavioral report to determine presence therein of data indicative of the given one of the plurality of files being a suspicious file,
• in response to the analyzing rendering a positive result, identify the given one of the plurality of files as being the at least one suspicious file;
• run the at least one suspicious file in at least one virtual machine, the at least one virtual machine being associated with a set of status parameters;
• determine changes in the set of the status parameters of the at least of one specified virtual machine;
• receive the changes in the set of the status parameters;
• and
• analyze the changes in the set of the status parameters using a set of analysis rules such that to classify the at least one suspicious file as a malicious file based on the changes in the set of the status parameters being indicative of the at least one file being the malicious file.