Trend Micro Inc.

Zhichao Ding

Guangxiang Yang

Jun Qu

Renkui Tao

Yun Zhong

Systems and methods are presented for performing sandboxing to detect malware. Sample files are received and activated individually in separate sandboxes in one mode of operation. In another mode of operation, sample files are assigned to pools. Sample files of a pool are activated together in the same sandbox. The sample files of the pool are deemed to be normal when no anomalous event is detected in the sandbox. Otherwise, when an anomalous event is detected in the sandbox, the sample files of the pool are activated separately in separate sandboxes to isolate and identify malware among the sample files.

Detecting malware by pooled analysis of sample files in a sandbox

A network device has a Local Area Network (LAN) port and several Wide Area Network (WAN) ports. The network device detects a computing device that is connected to the LAN port initiating establishment of a TCP connection. The network device creates a TCP socket that establishes the TCP connection with the computing device and inspects TCP packets on the TCP connection to identify a cloud application associated with the TCP packets. The network device creates another TCP socket that establishes a TCP connection to the identified cloud application by way of a WAN port that is designated to be an output port for the identified cloud application. A routing path is created between the LAN port and the designated WAN port. Subsequent TCP packets originated by the computing device for the identified cloud application are forwarded along the routing path.

Application-aware routing in network address translation environments

An email inspection system receives emails that are addressed to recipients of a private computer network. The emails are inspected for malicious content, and security information of emails that pass inspection is recorded. When an email is detected to have malicious content, the recorded security information of emails is checked to identify compromised emails, which are emails that previously passed inspection but include the same malicious content. A notification email is sent to recipients of compromised emails. The notification email includes Simple Mail Transfer Protocol headers that facilitate identification of the recipients, blocking of incoming emails with the same malicious content, and identification of public Mail Transfer Agents that send malicious emails, i.e., emails with malicious content.

Systems and methods for inspecting emails for malicious content

A computer analyzes a message attachment protected by a password. The message is intercepted from a sender before the message reaches the recipient. The computer cannot open, decrypt, unpack or decompress the attachment because the computer cannot parse the password. The message is modified to render the attachment unusable by the recipient and a URL is added. After the modified message is sent to the recipient, the computer receives the correct password from the recipient allowing the computer to open the attachment and perform anti-malware scanning. If malicious, the attachment is quarantined, deleted or blocked. If not malicious, the attachment (password-protected or not) is downloaded to the recipient, sent by e-mail or text message, or made available on a Web site. The recipient may be a mobile device or computer. Software may be part of an e-mail server, part of a mail transfer agent, or part of a separate computer.

Growing community of inventors

Nanjing, China

Zhichao Ding