Below-OS Security Agent for Malware Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software is limited in filtering malware activities at the operating system kernel level, as native operating system services prevent arbitrary hooking, allowing kernel mode malware to evade detection and compromise both the operating system and security software.
Innovation Solution
A below-operating-system security agent traps attempted accesses to resources and consults security rules to determine if they indicate malware, operating at a level below all operating systems to intercept and manage malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software operates at the operating system kernel level, then it can filter and detect malware behaviors, but native operating system services prevent arbitrary hooking which limits the security software's ability to intercept and filter all malware activities
Solution Approach 1:
The patent transitions the security agent from operating at the operating system kernel level to operating below the operating system level. This dimensional change in the execution environment allows the security agent to intercept resource accesses before they reach the operating system, bypassing the limitation of native operating system services that prevent arbitrary hooking at the kernel level.
2Ease of operation
If security software operates at the operating system kernel level, then it can integrate with operating system services, but kernel mode malware can operate at the same level and compromise both the operating system and the security software itself
Solution Approach 1:
The patent positions the security agent in a lower execution level dimension, below the operating system kernel. This creates a hierarchical separation where the security agent operates in a more privileged position, preventing kernel mode malware from compromising it while still maintaining the ability to intercept and filter resource accesses that would otherwise reach the operating system services.
3Ease of manufacture
If security software uses native operating system services for filtering, then it can leverage existing OS functionality, but the filtering functionality is limited and only available on timelines decided by the operating system vendor
Solution Approach 1:
The patent extracts the security filtering functionality from the operating system kernel environment and places it in a separate below-operating-system execution level. This extraction allows the security agent to implement filtering logic independently of operating system service limitations, gaining flexibility in when and how to intercept resource accesses without being constrained by operating system vendor timelines or kernel-level restrictions.
Data Source
AI summary
A system for protecting an electronic device against malware includes a memory, an operating system configured to execute on the electronic device, and a below-operating-system security agent. The below-operating-system security agent is configured to trap an attempted access of a resource of the electronic device, access one or more security rules to determine whether the attempted access is indicative of malware, and operate at a level below all of the operating systems of the electronic device accessing the memory. The attempted access includes attempting to write instructions to the memory and attempting to execute the instructions.