Security mechanism for suspicious files
Embodiments are directed to a method of monitoring a suspicious file, including: receiving, from a web server, a first file; encrypting, by an intermediary network device, the first file; transferring the encrypted file, from the intermediary network device, to an end device; transferring the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and receiving a malware analysis result, from the malware analysis device. If the malware analysis result indicates the first file is not a malware, requesting a key; decrypting the encrypted file using the key; and accessing the decrypted file.
1. A method of monitoring a suspicious file, comprising:
receiving, by an intermediary network device, a first file from a web server;
encrypting, by an intermediary network device, the first file;
transferring the encrypted file, from the intermediary network device, to an end device;
transferring the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and
receiving, by the intermediary network device or the end device, a malware analysis result, from the malware analysis device;
if the malware analysis result indicates that the first file is not a malware,
requesting, by the end device, a key from the intermediary network device or the malware analysis device;
decrypting, by the end device, the encrypted file using the key; and
accessing, by the end device, the decrypted file.
2. The method of claim 1 , wherein the key is stored at the intermediary network device.
3. The method of claim 1 , wherein the key is stored at the malware analysis device.
4. The method of claim 1 , wherein the intermediary network device comprises one of a network gateway, a proxy server, a firewall, and an intrusion prevention system.
5. The method of claim 1 , wherein the step of encrypting comprises encrypting the first file using a stream cipher.
6. The method of claim 1 , further comprising: transferring a file header to the end device, wherein the file header and the encrypted file are combined to form a pre-programmed file on the end device.
7. The method of claim 6 , wherein the first file includes a plurality of file portions, wherein the step of receiving, from a web server, a first file comprises receiving the plurality of file portions sequentially, and the step of encrypting comprises encrypting the plurality of file portions sequentially.
8. A system for monitoring a suspicious file, the system comprising:
an intermediary network device, comprising a processor configured to:
receive, from a web server, a first file;
obfuscate, by an intermediary network device, the first file;
transfer the obfuscated file, from the intermediary network device, to an end device;
transfer the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and
receive, by the intermediary network device or the end device, a malware analysis result, from the malware analysis device;
if the malware analysis result indicates that the first file is not a malware,
request, by the end device, a key from the intermediary network device or the malware analysis device;
de-obfuscate, by the end device, the obfuscated file using the key; and
access, by the end device, the de-obfuscated file.
9. The system of claim 8 , wherein the key is stored at the intermediary network device.
10. The system of claim 8 , wherein the key is stored at the malware analysis device.
11. The system of claim 8 , wherein the intermediary network device comprises one of a network gateway, a proxy server, a firewall, and an intrusion prevention system.
12. The system of claim 8 , wherein the processor is further configured to:
transfer a file header to the end device, wherein the file header and the obfuscated file are combined to form a pre-programmed file on the end device.
13. The system of claim 12 , wherein the first file includes a plurality of file portions, wherein the processor is configured to:
receive the plurality of file portions sequentially, and
de-obfuscate the plurality of file portions sequentially.
14. The system of claim 12 , wherein the processor is further configured to:
if the malware analysis result indicates the first file is a malware,
delete the obfuscated file.
15. A computer program product for monitoring a suspicious file, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to
receive, from a web server, a first file;
encrypt, by an intermediary network device, the first file;
transfer the encrypted file, from the intermediary network device, to an end device;
transfer the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and
receive a malware analysis result, from the malware analysis device;
if the malware analysis result indicates the first file is not a malware,
request, by the end device, a key;
decrypt, by the end device, the encrypted file using the key; and
access, by the end device, the decrypted file.
16. The computer program product of claim 15 , wherein the key is stored at the intermediary network device.
17. The computer program product of claim 15 , wherein the key is stored at the malware analysis device.
18. The computer program product of claim 15 , wherein the intermediary network device comprises one of a network gateway, a proxy server, a firewall, and an intrusion prevention system.
19. The computer program product of claim 15 , wherein the program instructions further cause the processor to
transfer a file header to the end device, wherein the file header and the encrypted file are combined to form a pre-programmed file on the end device.
20. The computer program product of claim 19 , wherein the program instructions further cause the processor to
receive the plurality of file portions sequentially, and
encrypt the plurality of file portions sequentially.