Boot Driver Interceptor for Rootkit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rootkits, a type of malware, are difficult to detect as they activate before the operating system boots up and mask their existence, evading conventional antivirus detection mechanisms by infecting boot drivers and hiding from signature-based checks.
Innovation Solution
A system and method that involves a driver interceptor to identify and intercept boot drivers not initialized by the boot loader, replacing their entry points with an intercept handler to store and access original routines, allowing for detection and analysis of malicious activity even when concealed by rootkits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus detection mechanisms are used, then the system can detect known viruses using signature-based checks, but rootkits can mask their existence and evade detection by intercepting function calls and hiding from signature checks
Solution Approach 1:
The patent applies preliminary action by installing the antivirus application in the master boot record before other boot drivers are loaded. This early installation allows the antivirus to intercept initialization routines of boot drivers before rootkits can establish their concealment mechanisms, enabling detection of malicious code at the earliest possible stage in the boot process
Solution Approach 2:
The patent uses an intercept handler as an intermediary component that sits between the boot loader and boot drivers. This handler captures initialization routine calls and redirects them, allowing the antivirus to examine driver code and detect rootkits without interfering with normal system operation. The intercept handler acts as a mediator that enables secure observation of driver initialization
2Reliability
If rootkits infect boot drivers and mask their existence, then the rootkits can maintain persistent access to the system, but this makes it difficult to access and analyze the original malicious routines for detection
Solution Approach 1:
The patent applies copying by creating a copy of the boot driver's initialization routine code in the intercept handler's memory space. When the boot loader calls the initialization routine, the intercept handler captures the code, stores it in its own memory space, and then executes it. This copying mechanism allows the antivirus to retain a copy of the malicious code for later analysis while still allowing the system to function, enabling detection without requiring direct access to the concealed rootkit
Data Source
AI summary
Disclosed are systems and methods for detecting access of boot driver routines by malware. An example method includes identifying, by the driver interceptor, the one or more boot drivers that have been loaded into memory but not yet initialized; installing, by the driver interceptor, an interceptor handler operable to intercept calls of initialization routines of the one or more identified boot drivers; intercepting, by the driver interceptor, program calls to the initialization routines of the one or more identified boot drivers; storing, by intercept handler, information about the boot driver that is provided by the driver in the course of its initialization, wherein information contains at least address of the entry point for one or more routines of the boot driver; and providing access, by driver interceptor, to the routines of the boot driver by previously stored addresses of the entry points.