System and method for detecting malicious network content using virtual environment components

A non-transitory computer readable storage medium deployed within a controller and having stored thereon instructions executable by a processor for performing operations comprising:

• receiving network content detected to be suspicious;
• configuring a virtual environment to operate as a virtual machine by at least selecting one or more virtual environment components, operating as part of the virtual environment, based on information within the suspicious network content, the one or more virtual environment components include a virtual environment operating system and a virtual environment application that mimic performance characteristics of corresponding components of a client device;
• processing the suspicious network content by the virtual environment component;
• identifying the suspicious network content as including malicious network content based on an agent monitoring at least one or more behaviors associated with the virtual environment component and for changes to settings of the virtual environment component that occur when processing the suspicious network content within the virtual environment;
• and
• generating and distributing information for repairing damage to one or more digital devices caused by the malicious network content, wherein the one or more digital devices are suspected of receiving the malicious network content.

A system for detecting malicious network content, comprising:

• a processor;
• and
• a memory that includes software including
• one or more software modules adapted, when executed by the processor, to (i) receive content detected to be suspicious, (ii) configure a virtual environment to operate as a virtual machine by at least selecting one or more virtual environment components, operating as part of the virtual environment, based on information within the suspicious content, the one or more virtual environment components include a virtual environment operating system and a virtual environment application that mimic performance characteristics of corresponding components of a client device, and (iii) processing the suspicious content by a virtual environment component of the one or more virtual environment components, and
• an agent configured, when executed by the processor, to identify the suspicious content as potential malicious content based on at least monitoring one or more behaviors associated with the virtual environment component and for changes to settings of the virtual environment component that occur when processing the suspicious network content within the virtual environment,
• wherein the one or more software modules being further adapted, when executed by the processor, to generate and distribute information for repairing damage to one or more digital devices caused by the potential malicious content, wherein the one or more digital devices are suspected of receiving the potential malicious content.

A computer implemented method for detecting malicious network content by a system, comprising:

• receiving content detected to be suspicious;
• configuring a virtual machine including one or more virtual environment components that are selected based, at least in part, on information within the suspicious content, the one or more virtual environment components include a virtual environment operating system and a virtual environment application that mimic performance characteristics of corresponding components of a destination device;
• processing the suspicious content by the virtual machine;
• identifying the suspicious content as including potential malicious content based on an agent monitoring one or more behaviors associated with the virtual environment component and for changes to settings of the virtual environment component that occur when processing the suspicious content within the virtual environment;
• and
• generating and distributing information for repairing damage to one or more digital devices caused by the potential malicious content, wherein the one or more digital devices are suspected of receiving the potential malicious content.