Systems and methods to detect malicious media files

A method comprising:

• receiving data from an incoming network connection;
• detecting, within the data, at least a portion of a media file;
• determining a file type of the media file from the detected portion of the media file;
• extracting the media file from the data received from the incoming network connection;
• parsing the media file based on the determined file type to locate a suspicious tag, wherein the suspicious tag is part of a set of tags and wherein the set of tags vary as a function of the determined file type;
• extracting an embedded uniform resource locator (URL) from the suspicious tag;
• determining whether the embedded URL is malicious, comprising:
• determining whether the embedded URL matches a known malicious URL within a local database;
• and
• submitting the embedded URL to a domain reputation system to analyze the embedded URL against a centralized database wherein submitting is only performed if a match is not found within the local database;
• and
• blocking the media file if the embedded URL is malicious.

A system comprising:

• a network;
• a database including data related to potentially malicious URLs;
• and
• a computer communicatively coupled to the database, the computer including:
• a network interface connecting the computer to the network;
• a memory containing instructions;
• and
• one or more processors communicatively coupled to the memory, wherein the instructions, when executed by the one or more processors, cause the computer to:
• monitor data transferred over the network through the network interface;
• detect, within the data transferred over the network, at least a portion of a media file;
• determine a file type of the media file from the detected portion of the media file;
• parse the media the based on the determined file type to locate suspicious tags, wherein the suspicious tags are part of a set of tags and wherein the set of tags vary as a function of the determined file type;
• extract an embedded uniform resource locator (URL) from a suspicious tag;
• determine whether the embedded URL is malicious, comprising:
• determining whether the embedded URL matches data related to potentially malicious URLs within the database;
• and
• submitting the embedded URL to a domain reputation system to analyze the embedded URL against a centralized database wherein submitting is only performed if a match is not found within the database;
• and
• discard the media the if the embedded URL is malicious.