Back to results
US 11,381,578 B1Granted
Network-based binary file extraction and analysis for malware detection
AssigneeFireEye Security Holdings US LLC
InventorsJayaraman Manni, Ashar Aziz, Fengmin Gong, Upendran Loganathan, Muhammad Amin
Life of this patent
Estimating the term…
Abstract
A system and method are disclosed for network-based file analysis for malware detection. Network content is received from a network tap. A binary packet is identified in the network content. A binary file, including the binary packet, is extracted from the network content. It is determined whether the extracted binary file is detected to be malware.
Claims20
A method for detecting malware as performed by a detection system, the method comprising:
- detecting a binary file within content received over a network, the binary file includes executable content;
- extracting the binary file from the received content;
- determining whether the binary file includes malicious content by comparing the binary file to information contained in a storage element including stored, known malware binary files, and upon classifying the binary file as malicious content based on a comparison of the binary file to a malware binary file of the known malware binary files, conducting operations to minimize impact on the system by the binary file by at least (i) initiating blocking of a transfer of the received content including the binary file, (ii) isolating the binary file from portions of the received content, or (iii) removing the binary file;
- and
- responsive to failing to classify the binary file as malicious content based on a prior determination that information associated with the binary fails to compare to information contained in the storage element including the stored, known malware binary files,
- executing the executable content of the binary file using a virtual environment component that performs operations of a software component, the software component comprises either (i) an application or (ii) an operating system,
- identifying the executable content of the binary file as malicious content based on identifying one or more behaviors produced by the virtual environment component during execution of the executable content of the binary file by at least examining the one or more behaviors of the virtual environment component against one or more expected behaviors, and
- responsive to detecting malicious content, conducting operations to minimize impact of the malicious content by at least (i) initiating blocking of communications including the binary file or (ii) removing the binary file from the communications.
5 more elements
A method conducted by a detection system for detecting malware, the method comprising:
- detecting a binary file within content received over a network, the binary file includes executable content;
- extracting the binary file from the received content;
- classifying, by a static analysis module, whether the binary file is either (i) suspicious content representing that the binary file potentially includes malicious content or (ii) non-suspicious content;
- upon classifying the binary file as non-suspicious content, discontinuing further analysis of the binary file;
- upon classifying the binary file as suspicious content, determining whether the binary file includes malicious content by comparing the binary file to information contained in a storage element including stored, known malware binary files, and upon classifying the binary file as malicious content, based on a comparison of the binary file to a malware binary file of the known malware binary files, conducting operations to minimize impact on the system by the binary file by removing the binary file;
- and
- responsive to failing to classify the binary file as malicious content after comparing the binary file to the information contained in the storage element including the stored, known malware binary files,
- executing the executable content of the binary file using a virtual environment component that performs operations of a software component, the software component comprises either (i) an application or (ii) an operating system,
- identifying the executable content of the binary file as malicious content based on identifying a difference between one or more behaviors during execution of the executable content of the binary file and one or more expected behaviors, and
- responsive to detecting malicious content, conducting operations to minimize impact of the malicious content by at least (i) initiating blocking of communications including the binary file or (ii) removing the binary file from the communications.
7 more elements
Dependencies are inferred from the claim text.