Anti-Forensics Defense via Command Interception and Evidence Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity methods, including anti-rootkit programs, are inadequate in detecting and preventing the self-destruction and trace removal of advanced malicious software, making digital forensics investigations difficult or impossible.
Innovation Solution
A system and method that identifies suspicious objects on a computing device, intercepts and blocks deletion commands, and stores both the objects and their digital artifacts in a repository, along with monitoring and recording their actions, to prevent the destruction of forensic evidence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-rootkit programs are used to detect malicious software, then detection capability is improved, but prevention of trace removal is insufficient
Solution Approach 1:
The system performs preliminary actions by creating forensic copies of suspicious objects and their artifacts before they can be deleted. The monitoring component proactively duplicates files, registry keys, and other digital artifacts to a secure location, ensuring evidence preservation occurs before malicious software can execute its self-destruct mechanism.
Solution Approach 2:
The system introduces an intermediary monitoring component that sits between the malicious software and the system resources it attempts to manipulate. This intermediary intercepts deletion commands, file system operations, and registry modifications, allowing the system to detect and prevent trace removal while maintaining normal operation of legitimate processes.
2Loss of information
If monitoring and blocking of deletion commands is implemented, then preservation of forensic evidence is improved, but system complexity increases
Solution Approach 1:
The system segments the security functionality into distinct modular components: a monitoring component that observes system operations, a decision component that evaluates whether actions constitute trace removal, and an enforcement component that executes blocking or preservation actions. This modular architecture reduces overall system complexity by allowing each component to be independently developed, tested, and maintained.
Solution Approach 2:
The monitoring component continuously observes system operations and provides feedback to the decision component, which adjusts its behavior based on the observed patterns. When deletion commands are detected, the system provides feedback by blocking the operation and preserving the evidence, creating a closed-loop control system that adapts to different malicious behaviors while maintaining manageable complexity.
3Measurement precision
If all suspicious objects are monitored continuously, then detection accuracy is improved, but processing overhead increases
Solution Approach 1:
The system applies local quality by differentiating the monitoring intensity based on the specific characteristics and behavior of each suspicious object. Rather than uniformly monitoring all objects at maximum intensity, the system adjusts monitoring granularity according to the threat level and behavior patterns observed, reducing processing overhead while maintaining high detection accuracy for critical threats.
Data Source
AI summary
Disclosed herein are systems and methods for preventing anti-forensics actions. In one exemplary aspect, a method may identify a suspicious object from a plurality of objects on a computing device and monitor actions performed by the suspicious object. The method may intercept a first command by the suspicious object to create and/or modify a digital artifact on the computing device and subsequent to intercepting the first command, intercept a second command by the suspicious object to delete at least one of the suspicious object and the digital artifact. In response to intercepting both the first command to create and/or modify the digital artifact and the second command to delete at least one of the suspicious object and the digital artifact, the method may block the second command, and may store the suspicious object and the digital artifact in a digital repository.