Abstract: According to one embodiment, a system features a network security device and a cloud computing service. The network security device is configured to determine whether an object includes one or more characteristics associated with a malicious attack. The cloud computing service, communicatively coupled to and remotely located from the network security device, includes virtual execution logic that, upon execution by a processing unit deployed as part of the cloud computing service and after the network security device determining that the object includes the one or more characteristics associated with the malicious attack, processes the object and monitors for behaviors of at least the object suggesting the object is associated with a malicious attack.

Abstract: According to one embodiment, a system features a network security device and a cloud computing service. The network security device is configured to determine whether an object includes one or more characteristics associated with a malicious attack. The cloud computing service, communicatively coupled to and remotely located from the network security device, includes virtual execution logic that, upon execution by a processing unit deployed as part of the cloud computing service and after the network security device determining that the object includes the one or more characteristics associated with the malicious attack, processes the object and monitors for behaviors of at least the object suggesting the object is associated with a malicious attack.

Abstract: According to one embodiment, a system features analysis circuitry and detection circuitry. The analysis circuitry features a first processing unit and a first memory that includes a filtering logic configured to produce a second plurality of objects from a received first plurality of objects. The second plurality of objects is a subset of the first plurality of objects. The detection circuitry is communicatively coupled to and remotely located from the analysis circuitry. The detection circuitry includes a second processing unit and a second memory. The second memory includes a virtual execution logic to process content within at least a first object of the second plurality of objects. The virtual execution logic is configured to monitor for behaviors, during the processing of the first object, and determine whether any or all of the monitored behaviors correspond to activities indicative that the first object is associated with a malicious attack.

Abstract: According to one embodiment, a network security device configured to detect malicious content within received network traffic comprises a traffic analysis controller (TAC) is provided. The traffic analysis controller comprises a network processing unit (NPU) and is configured to perform at least packet processing on the NPU with a set of pre-filters. In addition, the network security device further comprises a central processing unit (CPU) and is configured to perform at least virtual machine (VM)-based processing. The set of pre-filters is configured to distribute objects of received network traffic such that either static analysis or dynamic analysis may be performed on an object to determine whether the object contains malicious content. The static analysis may be performed on either the NPU or the CPU while the dynamic analysis is performed on the CPU.

Abstract: A system for tracing operations executed by a network device on a packet wherein a network device may capture a packet and determine whether the packet is a candidate for tracing; if the packet is a candidate for tracing the network device may set a trace option identifier within the packet indicating that the packet is to be tagged in association with operations performed on or in association with the packet by the network device. The network device may tag the packet with one or more tags in response to the trace option identifier, export the packet with the trace option identifier, generate a report based on the tags and send the report to a network management station.

Abstract: Methods and systems for utilizing captured packets to determine the operations performed on packets by a network device are described. One or more packets are captured and forwarded through the network device. Operations performed on the captured IP packets are logged.

Abstract: A system for tracing operations executed by a network device on a packet wherein a network device may capture a packet and determine whether the packet is a candidate for tracing; if the packet is a candidate for tracing the network device may set a trace option identifier within the packet indicating that the packet is to be tagged in association with operations performed on or in association with the packet by the network device. The network device may tag the packet with one or more tags in response to the trace option identifier, export the packet with the trace option identifier, generate a report based on the tags and send the report to a network management station.

Abstract: Methods and systems for utilizing captured packets to determine the operations performed on packets by a network device are described. One or more packets are captured and forwarded through the network device. Operations performed on the captured IP packets are logged.

Abstract: Methods and systems for utilizing captured packets to determine the operations performed on packets by a network device are described. One or more packets are captured and forwarded through the network device. Operations performed on the captured IP packets are logged.

Abstract: Methods and systems for determining the operations performed on packets by a network device are described. A simulated packet is input into a network device. The path taken by the simulated packet is traced. Also, the operations performed on the simulated packet are logged. Further, the operations performed on the simulated packet and configuration information of the operations are analyzed and displayed.

Abstract: Methods and systems for utilizing captured packets to determine the operations performed on packets by a network device are described. One or more packets are captured and forwarded through the network device. Operations performed on the captured IP packets are logged.

Abstract: Methods and systems for determining the operations performed on packets by a network device are described. A simulated packet is input into a network device. The path taken by the simulated packet is traced. Also, the operations performed on the simulated packet are logged. Further, the operations performed on the simulated packet and configuration information of the operations are analyzed and displayed.