DETECTING A MALICIOUS FILE INFECTION VIA SANDBOXING

摘要

A device may receive a trigger to determine whether a malicious file is operating on a client device. The device may determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device. The network activity profile may include information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment. The device may monitor network activity associated with the client device. The device may determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device. The device may provide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.

主权项

1. A device, comprising:
one or more processors to:
receive a trigger to determine whether a malicious file is operating on a client device;determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device,
the network activity profile including information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment;monitor network activity associated with the client device;determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device; andprovide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.