Endpoint Sandboxing for Threat Detection

The patent performs preliminary sandboxing analysis on suspicious files before they are allowed to execute on the endpoint. Files are submitted to a remote threat analysis engine that executes them in a sandboxed environment and analyzes their behavior in advance, determining threat status before the file can cause harm. This preliminary action enables both fast detection (by blocking known threats immediately) and high accuracy (by catching zero-day and polymorphic malware through behavioral analysis).

The patent introduces a sandboxed environment as an intermediary between the suspicious file and the endpoint system. The file is executed in this isolated intermediate environment rather than directly on the endpoint, allowing safe observation of its behavior. This intermediary enables accurate threat detection without compromising the endpoint, resolving the contradiction between fast detection and accurate detection of malicious behavior.

The patent extracts the complex threat analysis function from the endpoint system and relocates it to a remote cloud-based threat analysis engine. The endpoint security application only needs to perform simple tasks like detecting suspicious files and submitting them for analysis, while the heavy lifting of deep packet inspection and behavioral analysis is performed remotely. This extraction maintains high threat detection capability while significantly reducing endpoint system complexity and resource requirements.

The remote threat analysis engine performs self-service by automatically executing suspicious files in sandboxed environments and analyzing their behavior without requiring complex endpoint infrastructure. The engine independently handles threat detection, file execution, and result reporting, simplifying the overall system architecture while maintaining reliable threat detection capability.