System and method for detecting malicious traffic using a virtual machine configured with a select software environment
AssigneeFireEye Security Holdings US LLC
InventorAshar Aziz
Life of this patent
Estimating the term…
Abstract
A system for detecting malware is described. The system features a traffic analysis device and a network device. The traffic analysis device is configured to receive data over a communication network, selectively filter the data, and output a first portion of the data to the network device. The network device is communicatively coupled with and remotely located from the traffic analysis device. The network device features software that, upon execution, (i) monitors behaviors of one or more virtual machines processing the first portion of the data received as output from the traffic analysis device, and (ii) detects, based on the monitored behaviors, a presence of malware in the first virtual machine.
Claims24
A system comprising:
- one or more sensors, each sensor including (i) a virtualized network including one or more virtual machines each including software maintained within a non-transitory memory storage device associated with the one or more virtual machines that supports message exchanges with one or more other virtual machines within the virtualized network, and (ii) a controller configured to orchestrate activities within the virtualized network and monitor one or more behaviors detected within the virtualized network;
- and
- a sensor manager communicatively coupled to the one or more sensors, the sensor manager to coordinate communications or operations among the one or more sensors,
- wherein a sensor of the one or more sensors is configured to monitor behaviors of at least a first virtual machine corresponding to a first computing system by at least monitoring network activities conducted by information being processed within the first virtual machine to determine an anomalous behavior by at least the first virtual machine.
A system comprising:
- a first sensor including (i) a virtualized network including one or more virtual machines each including software maintained within a non-transitory memory storage device associated with the one or more virtual machines that supports message exchanges with one or more other virtual machines within the virtualized network, and (ii) a controller configured to orchestrate activities within the virtualized network and monitor one or more behaviors detected within the virtualized network, wherein the sensor being configured to accelerate activities in the virtualized network in order to reduce a time for detecting a time-delayed malware;
- and
- a sensor manager configured to be communicatively coupled to at least the first sensor, the sensor manager to coordinate communications or operations between the first sensor and a second sensor different than the first sensor.
A system comprising:
- a non-transitory memory storage device;
- one or more sensors being software maintained within the non-transitory memory storage device, each sensor including (i) a virtualized network including one or more virtual machines each including software that, when in operation, supports message exchanges with one or more other virtual machines within the virtualized network, and (ii) a controller configured to orchestrate activities within the virtualized network and monitor one or more behaviors detected within the virtualized network;
- and
- a sensor manager being software maintained within the non-transitory memory storage device, the sensor manager to coordinate communications or operations among the one or more sensors,
- wherein a sensor of the one or more sensors is configured to monitor behaviors of at least a first virtual machine corresponding to a first computing system by at least monitoring network activities conducted by information being processed within the first virtual machine to determine at least an execution anomaly or a communication anomaly.
Dependencies are inferred from the claim text.