Abstract: There is provided a method which forwards an anomaly to cloud based malware analysis and detection system in order to analyze files having this anomaly and increase zero-day malware detection throughput for files attached to emails. The method takes data from a binary file for calculating the true file type and the file extension, then applies a contradiction check to control whether the file extension seen in a file name is consistent with the file type. The file of the attachment is forwarded to a zero-day malware analysis queue, implementing zero-day malware classification, if the file extension is not reflecting the true file type. If the file extension and the true file type are consistent, the method forwards the file of the attachment to a malware analysis and detection queue, implementing traditional unknown file classification.

Abstract: There is provided a method of reducing false positive rate by using available contextual information on any sample, such as file name of the sample at a client machine, file path folder structure of the sample at client machine, download location of the sample and others, thus narrowing down the search space in first step of generic statistical classification and introducing new specific classifiers deliberately trained for each case.