Interactive Malware Detector

1 ) A non-transitory computer readable medium including computer readable instructions configured to cause one or more processors to perform a process comprising:

a) receiving a request from a source application intended for a destination application;

b) sending a challenge to the source application, the challenge configured to invoke an expected challenge response from at least one component of the source application;

c) receiving a challenge response generated by the source application; and

d) allowing the request to proceed to the destination application if the challenge response satisfies the expected challenge response.

2 ) The non-transitory computer readable medium according to claim 1 , wherein the request is one of the following:

a) a SIP request;

b) an http request;

c) an https request;

d) and ftp request;

e) an IMAP request; and

f) a pop request;

3 ) The non-transitory computer readable medium according to claim 1 , wherein the source application and destination application reside on different machines.

4 ) The non-transitory computer readable medium according to claim 1 , wherein the source application and destination application resides on the same machine.

5 ) The non-transitory computer readable medium according to claim 1 , wherein at least one of the source application and destination application reside on a virtual machine.

6 ) The non-transitory computer readable medium according to claim 1 , wherein at least one of the source application and destination application reside on a physical machine.

7 ) The non-transitory computer readable medium according to claim 1 , wherein the source application resides on one of:

a) a client machine; or

b) a host machine.

8 ) The non-transitory computer readable medium according to claim 1 , wherein the challenge includes at least one of:

a) a request for a calculation;

b) a request for a programed operation;

c) a request intended to generate a specific error code;

d) a request to translate data;

e) a java challenge;

f) a flash challenge;

g) an html challenge; or

h) a redirect challenge.

9 ) The non-transitory computer readable medium according to claim 1 , wherein the challenge is configured to test for at least one expected characteristic of at least one of:

a) the source application protocol; and

b) the source application functionality.

10 ) The non-transitory computer readable medium according to claim 1 , wherein the expected challenge response includes at least one of the following:

a) a calculation result;

b) a result of a programmed operation;

c) a specific error code;

d) translated data;

e) a web page including java;

f) a web page including flash;

g) a redirected web page; and

h) an expected type of data.

11 ) The non-transitory computer readable medium according to claim 1 , wherein the component includes at least one of:

a) a javascript component;

b) an html component;

c) a flash component; and

d) a SIP component.

12 ) The non-transitory computer readable medium according to claim 1 , further comprising pre-filtering the request.

13 ) The non-transitory computer readable medium according to claim 1 , wherein the request passed a pre-filter stage.

14 ) The non-transitory computer readable medium according to claim 1 , wherein the request satisfies a predetermined format.

15 ) The non-transitory computer readable medium according to claim 1 , wherein the request satisfies a known signature.

16 ) The non-transitory computer readable medium according to claim 1 , wherein said receiving the request includes receiving the request through a proxy.

17 ) A non-transitory computer readable medium comprising computer readable instructions configured to cause one or more processors to allow a received request from a source application intended for a destination application to proceed to the destination application if a component of the source application generates a challenge response that satisfies an expected challenge response in reply to a challenge from the one or more processors.

18 ) An interactive detector comprising one or more processors configured as:

a) a challenger configured to send a challenge to a source application in response to an intercepted request intended for a destination application from the source application, the challenge configured to invoke an expected challenge response from at least one component of the source application; and

b) an authorizer configured to allow the request to proceed to the destination application if a received challenge response generated by the source application satisfies the expected challenge response.

19 ) The interactive detector according to claim 18 , further comprising a passive detector configured to allow the request to reach the challenger when the request satisfies a pre-filtering condition.

20 ) An interactive detector comprising one or more processors configured to intercept and allow a request from a source application intended for a destination application to proceed to the destination application if a component of the source application generates a challenge response that satisfies an expected challenge response in reply to a challenge from the interactive detector.