Real-time prevention of malicious content via dynamic analysis

A method for detecting malicious content, the method comprising:

• receiving data at a sandbox device, wherein the data is received from a separate firewall device after the separate firewall device receives the data from a sender device, and wherein a first portion of the data being sent to a destination device while holding a second portion of the data at the separate firewall device until at least after an observation of the data at the sandbox device;
• observing that a first action is performed when instructions included in the received data are executed at the sandbox device;
• determining a classification of the received data based on the first action, wherein the classification is associated with malware;
• sending a message to the separate firewall device regarding the classification of the received data as being associated with malware;
• and
• performing a corrective action based on the classification of the received data as being associated with malware.

A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for detecting malicious content, the method comprising:

• receiving data at a sandbox device, wherein the data is received from a separate firewall device after the separate firewall device receives the data from a sender device, and wherein a first portion of the data being sent to a destination device while holding a second portion of the data at the separate firewall device until at least after an observation of the data at the sandbox device;
• observing that a first action is performed when instructions included in the received data are executed at the sandbox device;
• determining a classification of the received data based on the first action, wherein the classification is associated with malware;
• sending a message to the separate firewall device regarding the classification of the received data as being associated with malware;
• and
• performing a corrective action based on the classification of the received data as being associated with malware.

A system for detecting malicious content, the system comprising:

• a separate firewall device that:
• receives a data set sent from a sender device, wherein the data set is directed to a destination device,
• sends the data set for analysis,
• sends a first portion of the data set to the destination device, and
• holds a second portion of the data set;
• and
• a sandbox device separate from the separate firewall device, wherein the sandbox device:
• receives the data set from the separate firewall device,
• observes that a first action is performed when instructions included in the first data set are executed,
• determines a classification of the received data based on the first action, wherein the classification is associated with malware,
• sends a message to the separate firewall device regarding the classification of the received data as being associated with malware, and
• performs a corrective action based on the classification of the received data as being associated with malware.