Electronic message analysis for malware detection

Patent metadata

Field	Value
Publication number	US-9106694-B2
Application number	US-201113089191-A
Country	US
Kind code	B2
Filing date	Apr 18, 2011
Priority date	Apr 1, 2004
Publication date	Aug 11, 2015
Grant date	Aug 11, 2015

Abstract

An electronic message is analyzed for malware contained in the message. Text of an electronic message may be analyzed to detect and process malware content in the electronic message itself. The present technology may analyze an electronic message and attachments to electronic messages to detect a uniform resource location (URL), identify whether the URL is suspicious, and analyze all suspicious URLs to determine if they are malware. The analysis may include re-playing the suspicious URL in a virtual environment which simulates the intended computing device to receive the electronic message. If the re-played URL is determined to be malicious, the malicious URL is added to a black list which is updated throughout the computer system.

First claim

What is claimed is:

1. A computer implemented method for detecting malicious network content by a network content processing system, comprising:
receiving an electronic email message;
analyzing the electronic email message to detect a uniform resource locator (URL) address within message content of the electronic email message;
determining whether the detected URL address within the message content is suspicious;
in response to a determination that the detected URL address i…

Assignees

• Aziz Ashar
• Uyeno Henry
• Manni Jay
• Amin Muhammad
• Staniford Stuart
• Fireeye Inc

Inventors

• Aziz Ashar
• Uyeno Henry
• Manni Jay
• Amin Muhammad
• Staniford Stuart

Classifications

• G06F21/56

  Physics · mapped topic

• H04L63/145 Primary

  Electricity · mapped topic

• H04L63/1416 Primary

  Electricity · mapped topic

• G06F21/562

  Physics · mapped topic

• H04L51/212

  Electricity · mapped topic