Fireeye, Inc.

Fireeye Security Holdings US LLC

Jayaraman Manni

Ashar Aziz

Wei-Lung Lai

Muhammad Amin

Philip Eun

Michael M Berrow

Fengmin Gong

Ramesh Radhakrishnan

Upendran Loganathan

Osman Abdoul Ismael

Adrian Drzewiecki

Samuel Yie

Bahman Mahbod

Abhishek Singh

A system and method are disclosed for network-based file analysis for malware detection. Network content is received from a network tap. A binary packet is identified in the network content. A binary file, including the binary packet, is extracted from the network content. It is determined whether the extracted binary file is detected to be malware.

Network-based binary file extraction and analysis for malware detection

Malicious network content is identified based on the behavior of one or more virtual environment components which process network content in a virtual environment. Network content can be monitored and analyzed using a set of heuristics. The heuristics identify suspicious network content communicated over a network. The suspicious network content can further be analyzed in a virtual environment that includes one or more virtual environment components. Each virtual environment component is configured to mimic live environment components, for example a browser application component or an operating system component. The suspicious network content is replayed in the virtual environment using one or more of the virtual environment components. The virtual environment component behavior is analyzed in view of an expected behavior to identify malicious network content. The malicious network content is then identified and processed.

System and method for detecting malicious network content using virtual environment components

Exemplary systems and methods for malware attack detection and identification are provided. A malware detection and identification system a controller that features an analysis environment including a virtual machine. The analysis environment to (1) receive data by the virtual machine of the analysis environment and identify a portion of the data that have been received from one or more untrusted, (2) monitor state information associated with the identified portion of the data during execution by the virtual machine, (3) identify an outcome of the state information by tracking the state information during execution of the identified portion of the data by the virtual machine, and (4) determine whether the identified outcome comprises a redirection in control flow during execution by the virtual machine of the portion of the data, the redirection in the control flow constituting an unauthorized activity.

System and method for threat detection and identification

In communication with networked electronic devices, a method for providing a holistic view of a malware attack potentially being conducted on these networked electronic devices is described. The method includes requesting analytic data from each of the plurality of networked electronic devices. Thereafter, the analytic data from each of the networked electronic devices is analyzed to correlate analytic data from each of the plurality of networked electronic devices in order to provide the holistic view of a malware attack potentially being conducted. After correlation, display information is generated, where the display information includes the correlated analytic data.

Correlation and consolidation holistic views of analytic data pertaining to a malware attack

Exemplary systems and methods for detecting a communication channel of a bot. In exemplary embodiments, presence of a communication channel between a first network device and a second network device is detected. Data from the communication channel is scanned and used to determine if a suspected bot communication exists. If a bot communication is detected, then a recovery process may be initiated.

System and method for bot detection

Systems and methods for malware attack prevention are provided. The malware attack prevention system features a heuristic module, an analysis environment and an interception module. The heuristic module is configured to (i) receive incoming data from a particular source over a first communication path and (ii) analyze the incoming data to determine whether the incoming data is suspicious, where the suspicious incoming data represents a prescribed likelihood that the incoming data is associated with a malware attack. The analysis environment is configured to analyze the suspicious incoming data to identify whether the suspicious incoming data is associated with a malware attack. Lastly, the interception module is configured to redirect a subsequent flow of data from the particular source to the malware attack prevention system in response to determining, by at least the heuristic module, that the incoming data is suspicious.

Systems and methods for malware attack prevention by intercepting flows of information

In communication with security appliances, an electronic device for providing a holistic view of a malware attack is described. The electronic device features one or more processors and a storage device. The storage device includes aggregation logic, correlation logic, consolidation logic, and display logic: The aggregation logic is configured to receive input attributes and analysis attributes from each of the security appliances. The correlation logic attempts to find relationships between analysis attributes provided from each security appliance. The consolidation logic receives at least (i) a first analysis attribute from a first security appliance and (ii) a second analysis attribute from a second security appliance in response to the first analysis attribute corresponding to the second analysis attribute. The display logic generates display information including the consolidated input attributes.

Correlation and consolidation of analytic data for holistic view of malware attack

Systems and methods for malware containment on connection is provided. In exemplary embodiments, a malware containment method is described that performs a number of operations. The method involves redirecting network data received over a communication network to a virtual machine. The virtual machine is configured to simulate functionality of a digital device. Furthermore, the method involves analyzing of the redirected network data that including analyzing a response of the virtual machine to processing of the network data within the virtual machine to identify a malware attack. Thereafter, the method involves continuing to redirect the network data for processing by the virtual machine until expiration of a predetermined period of time without detection of malware, or continuing to redirect the network data for processing by the virtual machine beyond the predetermined period of time when malware is detected.

System and method for malware containment

Electronic device for aggregation, correlation and consolidation of analysis attributes

According to one embodiment, a method for correlating and consolidating analytic data to provide a holistic view of a malware attack. The method comprises receiving analytic data from a plurality of electronic devices. The analytic data from each electronic device of the plurality of electronic devices comprises input attributes and analysis attributes. Thereafter, the analytic data is correlated by determining whether a first analysis attribute provided by a first electronic device of the plurality of electronic devices matches a second analysis attribute provided by a second electronic device of the plurality of electronic devices. In response determining that the first analysis attribute provided by the first electronic device matches the second analysis attribute provided by the second electronic device, the input attributes associated with the first analysis attribute and the second analysis attribute are consolidated for subsequent display.

Correlation and consolidation of analytic data for holistic view of a malware attack

Systems and methods for malware containment on connection is provided. In exemplary embodiments, digital devices are quarantined for a predetermined period of time upon connection to the communication network. When a digital device is quarantined, all network data transmitted by the digital device is temporarily directed to a controller which then analyzes the network data to identify unauthorized activity and/or malware within the newly connected digital device. An exemplary method to contain malware comprises detecting a digital device upon connection with a communication network, temporarily redirecting network data from the digital device, and analyzing the network data to identify malware within the digital device.

Techniques for detecting malicious attacks may monitor activities during execution of content (e.g., network downloads and email) to identify an instruction backdoor on a computer. An instruction backdoor is malware that opens a port for listening for instructions from a remote server. Such instructions may trigger activation of malicious activity. These techniques employ virtual machines that, in a controlled and monitored environment, permit content, when loaded and executed, to open ports. When those ports are not the authorized ones used for communications by known programs installed on the computer, an instruction backdoor is discovered.

Growing community of inventors

San Jose, CA, United States of America

Jayaraman Manni