Systems and methods for dynamic cloud-based malware behavior analysis

A zero day/zero hour malware detection method implemented by a processor, the malware detection method comprising:

• receiving unknown content from a distributed security system based on monitoring a plurality of users with the distributed security system;
• sending the unknown content to a sandbox to perform a dynamic analysis, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner;
• receiving data from the dynamic analysis;
• determining if the unknown content is malware based on a combination of results from the dynamic analysis and a static analysis;
• and
• updating the distributed security system with a malware signature of the unknown content if the unknown content is malware.

A zero day/zero hour malware detection system, comprising:

• a network interface;
• a processor communicatively coupled to the network interface;
• and
• memory storing instructions that, when executed, cause the processor to
• receive unknown content from a distributed security system via the network interface based on monitoring a plurality of users with the distributed security system;
• send the unknown content to a sandbox to perform a dynamic analysis, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner;
• receive data from the dynamic analysis;
• determine if the unknown content is malware based on a combination of results from the dynamic analysis and a static analysis;
• and
• update the distributed security system via the network interface with a malware signature of the unknown content if the unknown content is malware.

A distributed security system, comprising:

• a plurality of nodes monitoring traffic associated with a plurality of users;
• and
• a malware detection server comprising a network interface, a processor communicatively coupled to the network interface, and memory storing instructions that, when executed, causes the processor to
• receive unknown content from a node of the plurality of nodes via the network interface based on the monitoring traffic;
• send the unknown content to a sandbox to perform a dynamic analysis, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner;
• receive data from the dynamic analysis;
• determine if the unknown content is malware based on a combination of results from the dynamic analysis and a static analysis;
• and
• update the distributed security system via the network interface with a malware signature of the unknown content if the unknown content is malware.