Scanning of partial downloads
There is disclosed in one example a hardware computing platform, including: a processor; a memory; a network interface; and a security module, including instructions to cause the processor to: receive a request to download a file via the network interface; download a first portion of the file into a buffer of the memory; analyze the first portion for malware characteristics; assign a security classification to the file according to the analysis of the first portion; and act on the security classification.
1. A hardware computing platform, comprising:
a processor circuit;
a memory;
a network interface; and
a security module, comprising instructions encoded within the memory to cause the processor circuit to:
receive, via the network interface, a request to download a full file from the internet;
download a first portion of the file into a buffer of the memory, wherein the first portion is less than the full file;
pause the download, and while the download is paused, convert the first portion into an image and analyze the image using computer vision to determine whether the file is likely malware; and
resume the download only if the file is determined to be not likely malware.
2. The hardware computing platform of claim 1 , wherein the first portion is between 70% and 90% of the full file.
3. The hardware computing platform of claim 1 , wherein the instructions are further to provision a machine learning engine, and wherein analyzing the first portion comprises operating the machine learning engine.
4. The hardware computing platform of claim 3 , wherein the machine learning engine comprises a neural network.
5. The hardware computing platform of claim 4 , wherein the neural network is configured and trained for computer vision analysis.
6. The hardware computing platform of claim 5 , wherein the neural network is trained on partial downloads.
7. The hardware computing platform of claim 4 , wherein the instructions are further to featurize the first portion before analyzing.
8. The hardware computing platform of claim 7 , wherein featurizing comprises converting the first portion to an image.
9. The hardware computing platform of claim 8 , wherein converting the first portion to an image comprises lossy compression.
10. The hardware computing platform of claim 8 , wherein converting the first portion to an image comprises zero-padding the first portion to a square.
11. An endpoint device comprising the hardware computing platform of claim 1 .
12. A network gateway device comprising the hardware computing platform of claim 1 .
13. One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to:
partially download a file from an untrusted source;
after partially downloading, pause the download;
featurize the partially downloaded file;
analyze the features for malware characteristics using computer vision to determine if the file is likely malware; and
resume download of the file only if the file is not likely malware.
14. The one or more tangible, non-transitory computer-readable media of claim 13 , wherein the instructions are further to hook a layer of a network stack.
15. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein the instructions are further to provide a shim application, and to insert the shim application into a network stack.
16. The one or more tangible, non-transitory computer-readable media of claim 14 , wherein the instructions are further to download a second portion of the file and analyze the second portion of the file, wherein analyzing the features further comprises comparing the partially downloaded file with the second portion of the file.
17. The one or more tangible, non-transitory computer-readable media of claim 16 , wherein the instructions are further to download a third portion of the file and analyze the third portion, wherein analyzing the features further comprises comparing the partially downloaded file with the second portion of the file and the third portion of the file.
18. A method of analyzing file downloads, comprising:
training a computer vision system on a combination of complete and partial downloads;
pausing downloading of the full file;
while downloading of the full file is paused, operating the computer vision system to analyze the partially downloaded file;
based on the analysis of the partially downloaded file, determining whether the full file is likely malware; and
resuming downloading of the file only if the full file is not likely malware.
19. The method of claim 18 , further comprising inserting a shim application into a network stack.