Anti-Key Logger System Using API Stack Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus solutions and methods are ineffective in detecting and preventing form-grabbing key loggers, which steal financial and identity information by capturing data from online forms, and are prone to system instability and easy modification by malware authors.
Innovation Solution
An anti-key logger system that operates at the most privileged access level, detecting browser form submission events and clearing confidential data without requiring malware detection, thereby preventing key loggers from capturing sensitive information, and includes a mechanism to protect against hook-based key loggers by inserting itself in the API stack to ensure no other hooks can circumvent the protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current anti-virus solutions are used to detect key logging malware, then malware detection capability is maintained, but detection effectiveness deteriorates because form-grabbing key loggers steal data before submission
Solution Approach 1:
The patent applies preliminary action by clearing form data immediately upon detecting a form submission event, before the data can be captured by key loggers. The anti-key logger monitors for form submission initiation calls and clears confidential data from data inputs at the earliest possible moment, preventing the data from being transmitted to or stored by malicious software.
Solution Approach 2:
The patent uses an intermediary approach by inserting protection code into the API stack at a privileged access level. This intermediary layer monitors and intercepts form submission events, acting as a mediator between the user's browser and potential key logging malware. The protection code clears data before it can be captured, while still allowing legitimate form submissions to proceed.
2Reliability
If hook-based protection methods are implemented, then key logger interception is improved, but system stability deteriorates due to API stack modifications
Solution Approach 1:
The patent achieves universality by implementing protection at the API stack level that works across multiple browsers and operating systems without requiring browser-specific modifications. The protection mechanism uses standard API hooks that are universally supported, allowing the same solution to protect against key loggers in Internet Explorer, Firefox, Safari, and other browsers while maintaining system stability.
3Object-affected harmful factors
If form data is cleared before submission, then key logger capture is prevented, but legitimate form functionality may be disrupted
Solution Approach 1:
The patent applies the skipping principle by rapidly clearing form data immediately after detecting the form submission initiation event and before the data can be captured by key loggers. The protection mechanism operates so quickly that it clears the data in the time gap between form submission initiation and actual data transmission, allowing legitimate form functionality to proceed uninterrupted while preventing malicious capture.
Data Source
AI summary
An apparatus, system, and method is disclosed for protecting against key logger malware. The protection includes protection form grabbing keylogger malware. In response to detecting a form submission event from a browser associated with a user entering data into a form, confidential data is cleared to prevent it being captured by malware. Additional protection of data inputs, entered at a driver level, may be provided as an additional level of protection against hook based malware operating at a virtual keyboard level or operating system level. Data inputs received at a physical driver level may be protected as they pass through a virtual keyboard level and an operating system level. The projection against malware may be provided as a preventive measure that does not require detection of the key logger malware itself.