Just in time memory analysis for malware detection

A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for detecting malware, the method comprising:

• analyzing program code using instrumentation code that remains transparent to an application associated with the program code;
• passing context information relating to behavior of the program code in real-time from the instrumentation code;
• identifying one or more suspicious actions performed by the program code based on the context information, wherein the suspicious actions include one or more of:
• writing data to a memory region and subsequently accessing the same memory region for execution, or loading data into a portion of memory and marking the data as executable;
• classifying the program code as suspicious based on the identification of the one or more suspicious actions;
• and
• performing a corrective action based on the classification.

An apparatus for detecting malware, the apparatus comprising:

• a firewall configured to receive data packets from a source computer and to identify suspected data packets;
• an analysis computer in communication with the firewall, the analysis computer comprising a memory and a processor that executes instructions out of the memory to:
• receive a data set associated with the suspected data packets from the firewall;
• execute program code included in the data set;
• monitor actions performed by the program code during execution to identify whether the program code performs a malicious action;
• and
• send a result of the monitoring to the firewall;
• and
• wherein the firewall is further configured to prevent the data packets from reaching a destination computer based on the result indicating that the program code performs the malicious action.