Cloud based just in time memory analysis for malware detection

A non-transitory computer readable medium having embodied thereon a program executable by a processor for performing a method for performing an analysis in a computing environment, the method comprising:

• receiving information from a computing device via a computer network interface;
• accessing computer data associated with the information received from the computing device, the accessed computer data including program code instructions executable by a processor;
• injecting instructions associated with instrumentation code into the accessed computer data, wherein operation of the instrumentation code is transparent to the program code instructions and the operation of the instrumentation code identifies contextual information relating to memory accesses performed by execution of the program code instructions;
• performing an analysis on the memory access contextual information when the instructions associated with the instrumentation code are executed, the analysis identifying a suspicious behavior associated with the memory accesses and a condition associated with the suspicious behavior;
• initiating operation of a first set of exception handling program code to label the program code as non-executable based on the condition;
• sending a message to the computing device based on the suspicious behavior identification, wherein a remaining portion of the computer data accessed is blocked from being sent to a second computing device based on message being received by the computing device;
• allowing further execution of the program code according to the first set of exception handling program code based on an identification that a first pattern of operations of the program codes does not match a pattern of operations of a set of malware;
• and
• identifying based on a second analysis performed on additional memory access contextual information that a second pattern of operations of the program code matches the pattern of operation of the set of malware.

A system for performing analysis in a cloud computing environment, the system comprising:

• a firewall that receives computer data requested by a client device of a first computer network;
• and
• an analysis computer physically isolated from the first computer network and communicatively coupled to the firewall, wherein the analysis computer:
• injects instructions associated with instrumentation code between program code instructions included in the requested computer data, wherein operation of the instrumentation code is transparent to the program code instructions and the operation of the instrumentation code identifies contextual information relating to memory accesses performed by execution of the program code instructions,
• performs an analysis on the memory access contextual information when the instructions associated with the instrumentation code are executed, the analysis identifying a suspicious behavior associated with the memory accesses and a condition associated with the suspicious behavior,
• initiates operation of a first set of exception handling program code to label the program code as non-executable based on the condition,
• sends a message to the firewall based on the suspicious behavior identification, wherein a remaining portion of the computer data is blocked from being sent to the client device based on the message being received by the firewall,
• allows further execution of the program code according to the first set of exception handling program code based on an identification that a first pattern of operations of the program codes does not match a pattern of operations of a set of malware, and
• identifies based on a second analysis performed on additional memory access contextual information that a second pattern of operations of the program code matches the pattern of operation of the set of malware.