Systems and methods for detecting malicious network content

A system for detecting malicious network content, comprising:

• a controller configured to detect suspicious network content in network content in transit over a communications network between a sending system and a destination system, the controller comprising:
• a heuristic analyzer configured to:
• inspect one or more packets of network content from the communications network,
• determine, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content,
• identify the one or more packets of network content as suspicious when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies a first threshold value, wherein the network content identified as suspicious potentially includes malicious network content, and
• filter, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfying the first threshold value, the identified one or more packets from the network content comprising filtered suspicious network content;
• one or more virtual machines communicatively coupled to the heuristic analyzer, the one or more virtual machines being configured to simulate receipt and processing of the filtered suspicious network content by the destination system to verify the inclusion of malicious network content in the network content, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score associated with another one or more packets of network content;
• and
• an analysis environment comprising a computing processor and configured to analyze a response of the one or more virtual machines to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying a second threshold value different from the first threshold value.

A non-transitory computer readable storage medium having stored thereon instructions executable by a processor for performing a method, the method comprising:

• monitoring on a computer system an exchange of network content over a communications network between a sending system and a receiving system, the monitoring comprising identifying by a processor a suspicious characteristic of one or more packets of network content;
• determining on the computer system, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content;
• identifying the one or more packets of network content as suspicious on the computer system when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies a first threshold value, wherein the network content identified as suspicious potentially includes malicious network content;
• filtering, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfying the first threshold value, the identified one or more packets from the network content comprising filtered suspicious network content;
• executing a virtual machine on the computer system to simulate receipt and processing of the filtered suspicious network content by the receiving system, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score associated with another one or more packets of network content;
• and
• analyzing a response of the virtual machine on the computer system to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying a second threshold value different from the first threshold value.

A method for detecting malicious network content, comprising:

• monitoring an exchange of network content over a communications network between a sending system and a destination system, the monitoring comprising identifying a suspicious characteristic of one or more packets of network content;
• and
• detecting malicious network content without interrupting the exchange of network content between the sending system and the destination system, comprising:
• determining by a controller, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content,
• identifying by the controller the one or more packets of network content as suspicious when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies a first threshold value, wherein the network content identified as suspicious potentially includes malicious network content,
• filtering, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfying the first threshold value, the identified one or more packets from the network content comprising filtered suspicious network content,
• executing a virtual machine by the controller to simulate receipt and processing of the filtered suspicious network content by the destination system, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score associated with another one or more packets of network content, and
• analyzing a response of the virtual machine by the controller to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying a second threshold value different from the first threshold value.

A system for detecting malicious network content, comprising:

• a controller to detect suspicious network content, in network content in transit over a communications network between a sending system and a destination system, without interrupting the exchange of network content between the sending system and the destination system, the controller comprising:
• a heuristic analyzer to:
• inspect one or more packets of network content copied from the communications network,
• determine, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content,
• identify the one or more packets of network content as suspicious when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies a first threshold value, wherein the network content identified as suspicious potentially includes malicious network content, and
• filter, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfying the first threshold value, the identified one or more packets from the network content comprising filtered suspicious network content;
• one or more virtual machines communicatively coupled to the heuristic analyzer, the one or more virtual machines to simulate receipt and processing of the filtered suspicious network content by the destination system to verify the inclusion of malicious network content in the network content, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score associated with another one or more packets of network content;
• and
• an analysis environment comprising a computing processor, the analysis environment to analyze a response of the one or more virtual machines to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the one or more virtual machines indicates that the filtered suspicious network content includes malicious network content by satisfying a second threshold value different from the first threshold value.

A method for detecting malicious network content, comprising:

• monitoring receipt of a first network content and a second network content over a communications network, the monitoring comprising identifying by a processor a suspicious characteristic of the first network content and a suspicious characteristic of the second network content;
• determining by the processor, based on at least the suspicious characteristics of the first network content and the second network content, a score that corresponds to a probability that the identified suspicious characteristic of the first network content indicates malicious network content and a score that corresponds to a probability that the identified suspicious characteristic of the second network content indicates malicious network content;
• identifying by the processor the first network content and the second network content as suspicious network content when the corresponding scores of the first network content and the second network content satisfy an identification threshold value, wherein network content identified as suspicious potentially includes malicious network content;
• filtering the first network content and the second network content to generate filtered suspicious network content based, at least in part, on the scores of the first network content and the second network content satisfying the identification threshold value, wherein the corresponding scores of the first network content and the second network content are different;
• executing a virtual machine by a controller to process at least one of the first network content and the second network content as filtered suspicious network content, wherein filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic indicates malicious network content relative to a score associated with another network content;
• and
• analyzing a response of the virtual machine by the controller to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying an analysis threshold value different from the identification threshold value.

A method for detecting malicious network content, comprising:

• monitoring receipt of network content over a communications network, the monitoring comprising identifying by a processor a suspicious characteristic of one or more packets of network content;
• determining by the processor, based on at least the suspicious characteristic, a score that corresponds to a probability that the identified suspicious characteristic of the one or more packets indicates malicious network content;
• identifying by the processor the one or more packets of network content as suspicious when the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies an identification threshold value, wherein the network content identified as suspicious potentially includes malicious network content;
• filtering, based at least in part on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content satisfies the identification threshold value, the identified one or more packets from the network content comprising filtered suspicious network content;
• executing a virtual machine by a controller to process the filtered suspicious network content, wherein the filtered suspicious network content is scheduled for processing by the virtual machine in an order based, at least in part, on the score that corresponds to the probability that the identified suspicious characteristic of the one or more packets indicates malicious network content relative to a score of one or more packets of another network content;
• and
• analyzing a response of the virtual machine by the controller to detect malicious network content in the filtered suspicious network content when a second score that is based at least in part on the response of the virtual machine indicates that the filtered suspicious network content includes malicious network content by satisfying an analysis threshold value different from the identification threshold value.