System and method for advanced malware analysis

Patent metadata

Field	Value
Publication number	US-9106692-B2
Application number	US-201313755917-A
Country	US
Kind code	B2
Filing date	Jan 31, 2013
Priority date	Jan 31, 2013
Publication date	Aug 11, 2015
Grant date	Aug 11, 2015

Abstract

A system and a method for advanced malware analysis. The method filters incoming messages with a watch-list, the incoming messages including attachments, if an incoming message matches the watch-list, forwards the message to a malware detection engine, strips the attachments from the forwarded message, the one or more attachments including one or more executable files, launches a plurality of sandboxes, executes each of the executable files in the plurality of sandboxes, the sandboxes generating analysis results that may be used to determine whether each executable file is malicious, normalizes the analysis results, evaluates the risk level of the attachments to the forwarded message based on the normalized analysis results of the executable files in the attachments to the forwarded message, and, if the risk level of an attachment to the forwarded message is above a certain level, determines that the forwarded message is malicious and permanently quarantines the forwarded message.

First claim

The invention claimed is:

1. A method for advanced malware analysis comprising:
filtering incoming messages with a watch-list, wherein the incoming messages include one or more attachments;
when an incoming message matches the watch-list, forwarding the message to a malware detection engine;
stripping the one or more attachments from the forwarded message, wherein the one or more attachments include one or more executable files;
launching a plurality of malware analysis plat…

Assignees

• Northrop Grumman Systems Corp

Inventors

• Smith Calvin H
• Maclean Kenneth
• Liu Jason J
• Mann Stephen
• Mann Wendy
• Chapin Ryan

Classifications

• H04L63/1441 Primary

  Electricity · mapped topic