Intermediary Network Device Encrypts Suspicious Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing suspicious files in a network environment face challenges such as high memory usage, user risk exposure, and difficulty in enforcing malware analysis on end devices, particularly due to the need for maintaining file connections and large storage requirements, as well as the potential for agent bypassing.
Innovation Solution
A method involving an intermediary network device that encrypts and transfers suspicious files to a malware analysis device, with the end device requesting a decryption key upon receiving a clean analysis result, allowing secure access to the original file while reducing memory and storage burdens, and optionally storing the key at the intermediary or malware analysis device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the intermediary network device maintains a connection to the suspicious file until completion of malware analysis, then the file can be securely analyzed, but the memory footprint on the intermediary network device becomes high
Solution Approach 1:
The patent extracts the suspicious file from the intermediary network device's memory after initial analysis setup, transferring it to a malware analysis device for complete analysis. This removes the memory burden from the intermediary device while maintaining security through controlled access mechanisms.
Solution Approach 2:
The patent introduces a separate malware analysis device as an intermediary component between the intermediary network device and the file analysis process. This mediator handles the resource-intensive analysis work, allowing the original intermediary device to maintain security oversight without bearing the memory burden.
2Ease of operation
If the intermediary network device notifies users of malware analysis result later without blocking the suspicious file, then user experience is improved, but users are put at risk by accessing potentially malicious files
Solution Approach 1:
The patent applies preliminary anti-action by encrypting the suspicious file before transfer and maintaining encryption during the analysis process. This preemptive security measure ensures that even if users access the file during analysis, they cannot execute or be harmed by malicious content, as the file remains encrypted and inaccessible.
3Productivity
If the intermediary network device keeps the suspicious file locally and sends it to users if clean, then file delivery is efficient, but large local storage space is required
Solution Approach 1:
The patent creates an encrypted copy of the suspicious file for transfer to the malware analysis device, while the original file remains on the intermediary network device in encrypted form. This copying approach allows efficient file delivery to users (who receive the encrypted file they already have) without requiring large local storage, as only encrypted versions are retained.
4Adaptability or versatility
If malware analysis function is performed by an agent residing in an end device, then analysis can be performed locally, but the agent can be bypassed by disabling it and installation enforcement is difficult
Solution Approach 1:
The patent replaces the end-device agent model with an intermediary network device that mandates file encryption and controlled transfer to a centralized malware analysis device. This intermediary approach ensures reliable enforcement of malware analysis by controlling the file transmission path, eliminating the possibility of bypassing through agent disabling while maintaining local analysis capabilities through the encrypted file transfer process.
Data Source
AI summary
Embodiments are directed to a method of monitoring a suspicious file, including: receiving, from a web server, a first file; encrypting, by an intermediary network device, the first file; transferring the encrypted file, from the intermediary network device, to an end device; transferring the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and receiving a malware analysis result, from the malware analysis device. If the malware analysis result indicates the first file is not a malware, requesting a key; decrypting the encrypted file using the key; and accessing the decrypted file.