Fireeye, Inc.

A 10 Networks, Incorporated

Wei Zheng

Abhishek Singh

Shivani Deshpande

Amit Malik

Liang Han

A malware detection system configured to detect suspiciousness in obfuscated content. A multi-stage static detection logic is utilized to detect obfuscation, make the obfuscated content accessible, identify suspiciousness in the accessible content and filter non-suspicious non-obfuscated content from further analysis. The multi-stage static detection logic includes a controller, a de-constructor, and a post-processor. The controller is configured to receive content while the de-constructor configured to receive content from the controller and deconstruct the content using the analysis technique selected by the controller. The post-processor is configured to receive the de-constructed content from the de-constructor, determine whether a specimen within the de-constructed content is suspicious, and remove non-suspicious content from further analysis.

Multistage system and method for analyzing obfuscated content for malware

A malware detection system configured to detect suspiciousness in obfuscated content. A multi-stage static detection logic is utilized to detect obfuscation, make the obfuscated content accessible, identify suspiciousness in the accessible content and filter non-suspicious non-obfuscated content from further analysis. The system is configured to identify obfuscated content, de-obfuscate obfuscated content, identify suspicious characteristics in the de-obfuscated content, execute a virtual machine to process the suspicious network content and detect malicious network content while removing from further analysis non-suspicious network content.

A service gateway includes a fast path module for processing data packets without using packet buffers and a normal path module for processing data packets using packet buffers. The fast path module receives a service request data packet from a client side session, determines that the service request data packet cannot be processed by the fast path module, and in response, sends the service request data packet to the normal path module. After receiving the service request data packet, the normal path module retrieves a first proxy session record created by the fast path module, where the first proxy session record is associated with a client session record for the client side session, creates a second proxy session record based on the service request data packet and the client session record, and processes the service request data packet according to the second proxy session record.

Growing community of inventors

Fremont, CA, United States of America

Wei Zheng