The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Mar. 14, 2017

Filed:

Apr. 23, 2015
Applicant:

Fireeye, Inc., Milpitas, CA (US);

Inventors:

Varun Jain, Milpitas, CA (US);

Abhishek Singh, Milpitas, CA (US);

Assignee:

FireEye, Inc., Milpitas, CA (US);

Attorney:
Primary Examiner:
Int. Cl.
CPC ...
G06F 12/14 (2006.01); H04L 29/06 (2006.01); G06F 11/30 (2006.01); G06F 21/56 (2013.01); G06N 99/00 (2010.01);
U.S. Cl.
CPC ...
G06F 21/562 (2013.01); G06F 21/563 (2013.01); G06N 99/005 (2013.01); H04L 63/145 (2013.01); G06F 2221/033 (2013.01);
Abstract

According to one embodiment of the disclosure, a computerized method is described to detect a malicious object through its attempt to utilize reflection. The computerized method comprises receiving, by a network device, an object for analysis. Thereafter, the network device conducts a first analysis within a sandboxed environment. The first analysis determines whether the object is configured to utilize reflection. According to one embodiment, the first analysis involves analysis of the content of the object by a static analysis engine. Alternatively, or in addition to this analysis, the behavior of the object by an attempt to access a reflection API may determine that the object is utilizing reflection. Responsive to the network device determining that the object utilizes reflection, a second analysis is conducted to determine whether the object is malicious.


Find Patent Forward Citations

Loading…