Below-OS Trapping Module for Kernel Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software is limited in filtering malware behaviors due to operating system restrictions, allowing kernel mode malware to evade detection and compromise both the operating system and security software, as it can tamper with user mode memory and processes.
Innovation Solution
A system and method that employs a below-operating system trapping module to intercept and evaluate processor resource access attempts, using security rules to determine if the access is indicative of malware, thereby operating at a level below all operating systems to prevent malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If security software operates at the operating system level to filter malware behaviors, then it can access and analyze system processes, but it is prevented from installing arbitrary hooking within the kernel and its filtering capability is limited by operating system vendor timelines
Solution Approach 1:
The patent introduces a new operational dimension by placing the trapping module below the operating system kernel level. This dimensional shift allows the security software to access processor resources and system behaviors that are inaccessible at the traditional operating system level, thereby resolving the contradiction between filtering capability and security effectiveness.
Solution Approach 2:
The trapping module acts as an intermediary layer between the operating system and processor resources. It intercepts and analyzes system calls and processor accesses before they reach the kernel, enabling security filtering without requiring direct kernel modification or hooking, thus maintaining both versatility and reliability.
2Reliability
If security software installs arbitrary hooking within the kernel to enhance filtering, then it can monitor all system behaviors, but kernel mode malware can compromise both the operating system and the integrity of the security software itself
Solution Approach 1:
Instead of placing the security module within the kernel where it is vulnerable to compromise, the patent inverts the traditional approach by positioning the trapping module below the kernel level. This inversion allows the security software to monitor kernel behaviors without being part of the kernel, thereby maintaining detection capability while eliminating the risk of malware compromise.
Solution Approach 2:
The patent segments the system into distinct operational levels: the trapping module operates below the kernel, the kernel operates at its normal level, and user-mode applications operate above. This segmentation isolates the security functionality from potential malware attacks on the kernel, maintaining integrity while enabling comprehensive monitoring.
3Object-affected harmful factors
If kernel mode malware operates at the same level as security software to evade detection, then it can tamper with user mode memory and processes, but it requires complex methods to hide its presence from both user mode applications and kernel mode device drivers
Solution Approach 1:
The trapping module implements preliminary anti-action by intercepting and analyzing all kernel-mode accesses to user-mode memory and processes before the malware can execute its tampering operations. This preemptive monitoring detects malicious behaviors such as code injection and memory modification, neutralizing the malware's evasion capability before it can take effect.
Data Source
AI summary
A method for protecting an electronic device against malware includes consulting one or more security rules to determine a processor resource to protect, in a module below the level of all operating systems of the electronic device, intercepting an attempted access of the processor resource, accessing a processor resource control structure to determine a criteria by which the attempted access will be trapped, trapping the attempted access if the criteria is met, and consulting the one or more security rules to determine whether the attempted access is indicative of malware. The attempted access originates from the operational level of one of one or more operating systems of the electronic device.