Simultaneous screening of untrusted digital files

摘要

A plurality of untrusted digital files are run simultaneously in fewer sandboxes than there are files, while monitoring for malicious activity. Preferably, only one sandbox is used. If the monitoring detects malicious activity, either the files are run again in individual sandboxes, or the files are divided among subsets whose files are run simultaneously in one or more sandboxes, while monitoring for malicious activity.

主权项

1. A computer security method comprising:
(a) inserting each of a plurality of untrusted digital files into at least one sandbox, wherein a number of said at least one sandbox is smaller than a number of said untrusted digital files; (b) simultaneously running said untrusted digital files in said at least one sandbox; (c) monitoring said running of said untrusted digital files for malicious activity; and (d) for each of said at least one sandbox, if said monitoring detects said malicious activity then:
(i) dividing said untrusted digital files among a plurality of subsets;(ii) for each of said subsets, repeating running of each said untrusted digital file, in a respective sandbox; and(iii) monitoring said repeating running in each respective sandbox for malicious activity.