# US 9,882,924 B2 · Systems and methods for malware analysis of network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,924 B2 - Document ID: US9882924B2 - Status: Granted - Kind: B2 - Application number: 15/063,705 - Filed: 2016-03-08 - Published: 2016-09-15 - Granted: 2018-01-30 - Earliest claimed: 2015-03-12 - Assignees: Forcepoint LLC - Applicants: Forcepoint LLC - Inventors: Monty D. McDougal; John S. Lear; Julian A. Zottl; Jesse J. Lee - Web page: https://patentgrep.com/patent/US9882924B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 51/08: Annexed information, e.g. attachments - H04L 51/212: using filtering or selective blocking - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Generally discussed herein are systems, devices, and methods for malware analysis. In one or more embodiments, a method can include copying application layer data traffic to create copied application layer data traffic, forwarding at least a portion of the application layer data traffic to a destination client prior to a malware analysis of corresponding copied application layer data traffic, determining whether the copied application layer data traffic includes a specified property, and in response to a determination that the copied application layer data traffic includes the specified property, storing the copied application layer data traffic determined to include the specified property for subsequent malware analysis, the stored copied application layer data traffic including context data of the copied application layer data traffic. ## Claims ### Claim 1 A non-transitory machine-readable storage device including instructions stored thereon that, when executed by processing circuitry of a machine, configure the processing circuitry to perform operations comprising: copying application layer data traffic to create copied application layer data traffic; forwarding at least a portion of the application layer data traffic to a destination client prior to a malware analysis of corresponding copied application layer data traffic; determining whether the copied application layer data traffic includes a specified property; and in response to a determination that the copied application layer data traffic includes the specified property, storing the copied application layer data traffic determined to include the specified property for subsequent malware analysis, the stored copied application layer data traffic including context data of the copied application layer data traffic. ### Claim 2 (depends on 1) The storage device of claim 1, wherein the specified property is data indicating that the application layer data traffic is one or more of electronic mail (email) traffic that includes an attachment, a file, and an executable. ### Claim 3 (depends on 2) The storage device of claim 2, further comprising instructions stored thereon that, when executed by processing circuitry of the machine, configure the processing circuitry to perform operations comprising: sessionizing the copied application layer data traffic prior to determining whether the copied application layer data traffic includes the specified property and wherein storing the copied application layer data traffic includes storing the sessionized copied application layer data traffic. ### Claim 4 (depends on 3) The storage device of claim 3, wherein the sessionized copied application layer data traffic includes content of the email as well as context of the email including two or more of a sender address, a recipient address, a send port, a receive port, a sender identity, a recipient identity, a time of transmission, a copy contact, a blind copy contact, a subject line content, an author, and time of creation. ### Claim 5 (depends on 4) The storage device of claim 4, further comprising instructions stored thereon that, when executed by processing circuitry of the machine, configure the processing circuitry to perform operations comprising: decrypting the copied application layer data traffic prior to determining if the copied application layer data traffic includes the specified property. ### Claim 6 (depends on 4) The storage device of claim 4, further comprising instructions stored thereon that, when executed by processing circuitry of the machine, configure the processing circuitry to perform operations comprising: converting the sessionized copied application layer data traffic into a format compatible with a malware analysis module before storing the sessionized copied application layer data traffic. ### Claim 7 (depends on 6) The storage device of claim 6, wherein the format compatible with the malware analysis module includes a Message Transfer Agent (MTA) format. ### Claim 8 (depends on 4) The storage device of claim 4, wherein the instructions for determining whether the copied application layer data traffic includes a specified property include instructions for decoding a multipurpose internet mail extension (MIME) header to determine the specified property. ### Claim 9 A method for malware analysis performed by one or more hardware processors, the method comprising: copying application layer data traffic to create copied application layer data traffic; forwarding at least a portion of the application layer data traffic to a destination client prior to a malware analysis of corresponding copied application layer data traffic; determining whether the copied application layer data traffic includes a specified property; and in response to a determination that the copied application layer data traffic includes the specified property, storing the copied application layer data traffic determined to include the specified property for subsequent malware analysis, the stored copied application layer data traffic including context data of the copied application layer data traffic. ### Claim 10 (depends on 9) The method of claim 9, wherein the specified property is data indicating that the application layer data traffic is electronic mail (email) traffic that includes an attachment. ### Claim 11 (depends on 10) The method of claim 10, further comprising: sessionizing the copied application layer data traffic prior to determining whether the copied application layer data traffic includes the specified property and wherein storing the copied application layer data traffic includes storing the sessionized copied application layer data traffic. ### Claim 12 (depends on 11) The method of claim 11, wherein the sessionized copied application layer data traffic includes content of the email as well as context of the email including two or more of a sender address, a recipient address, a send port, a receive port, a sender identity, a recipient identity, a time of transmission, a copy contact, a blind copy contact, a subject line content, an author, and time of creation. ### Claim 13 (depends on 12) The method of claim 12, further comprising: decrypting the copied application layer data traffic prior to determining if the copied application layer data traffic includes the specified property. ### Claim 14 (depends on 12) The method of claim 12, further comprising: converting the sessionized copied application layer data traffic into a format compatible with a malware analysis module before storing the sessionized copied application layer data traffic. ### Claim 15 (depends on 14) The method of claim 14, wherein the format compatible with the malware analysis module includes a Message Transfer Agent (MTA) format. ### Claim 16 (depends on 12) The method of claim 12, wherein determining whether the copied application layer data traffic includes a specified property includes decoding a multipurpose internet mail extension (MIME) header to determine the specified property. ### Claim 17 (depends on 12) The method of claim 12, wherein the application layer data traffic is communicated between a client and a gateway such that the application layer data traffic of the client is copied prior to being received at the gateway. ### Claim 18 A system comprising: a first hardware module communicatively situated between an originating client and a destination client, the first hardware module to: copy the application layer data traffic to create copied application layer data traffic; forward at least a portion of the application layer data traffic to the destination client prior to a malware analysis of corresponding copied application layer data traffic; determine whether the copied application layer data traffic includes a specified property; and in response to a determination that the copied application layer data traffic includes the specified property, store the copied application layer data traffic determined to include the specified property for subsequent malware analysis, the stored copied application layer data traffic including context data of the copied application layer data traffic; and a second hardware module to perform a malware analysis on the stored copied application layer data traffic. ### Claim 19 (depends on 18) The system of claim 18, further comprising: the destination client; a network gateway to route application layer data traffic from the originating client towards the destination client; and wherein the second hardware module is further to provide a communication to the destination client in response to a determination that the stored copied application layer data traffic includes malware. ### Claim 20 (depends on 18) The system of claim 18, wherein the first hardware module is further to determine whether the copied application layer data traffic includes a specified property including decoding a multipurpose internet mail extension (MIME) header to determine the specified property.