Method and apparatus for detecting malware in network traffic

A network gateway apparatus, comprising:

• at least one processor;
• a communication interface configured to send and receive data over a network;
• and
• a memory containing a plurality of program instructions executable by the at least one processor, the plurality of program instructions being configured to cause the at least one processor to:
• execute, in an emulation environment, an executable file as it is being received by the network gateway apparatus serially over the network via the communication interface, execution of the executable file in the emulation environment beginning once a block of data including an entry point of the executable file has been received, execution of the executable file in the emulation environment halting whenever an instruction in the executable file references data not yet received and resuming once the data not yet received has been received, execution of the executable file in the emulation environment ceasing upon satisfaction of a termination condition;
• examine the emulation environment for indications that the executable file includes malware;
• and
• take corrective action responsive to results of examining the emulation environment for indications that the executable file includes malware.

A computer-readable storage medium containing a plurality of program instructions executable by a processor for detecting malware in network traffic, the plurality of program instructions comprising:

• a first instruction segment configured to execute, in an emulation environment, an executable file as it is being received serially over a network, execution of the executable file in the emulation environment beginning once a block of data including an entry point of the executable file has been received, execution of the executable file in the emulation environment halting whenever an instruction in the executable file references data not yet received and resuming once the data not yet received has been received, execution of the executable file in the emulation environment ceasing upon satisfaction of a termination condition;
• a second instruction segment configured to examine the emulation environment for indications that the executable file includes malware;
• and
• a third instruction segment configured to take corrective action responsive to results of examining the emulation environment for indications that the executable file includes malware.