Early Boot Driver for Malicious Code Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing threat management systems fail to detect and mitigate malicious code that launches early in the boot process before user-mode malware scanning tools become available, evading detection and compromising system security.

Innovation Solution

A security driver loads early in the boot process to detect and record processes, then utilizes user-mode scanners to perform asynchronous and synchronous scans for malware, preventing execution until scans are complete, and remediating any malicious code identified, with additional background scans of the entire disk.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If malware scanning tools are deployed in user mode, then comprehensive malware detection capability is improved, but malicious code launched early in boot process before user mode is available cannot be detected

Engineering Contradiction:

Improvemalware detection capabilityVSAvoiddetection time window

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies preliminary action by deploying a kernel-mode driver that activates during the boot process before user mode is available. This driver records all processes launched during boot, preserving them for later analysis. By preparing the detection infrastructure in advance (kernel-mode driver with process recording capability), the system ensures no malicious code escapes detection regardless of when it launches.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses an intermediary approach by introducing a kernel-mode driver as a mediator between the boot process and user-mode scanning tools. The driver captures process information that would otherwise be inaccessible to user-mode tools, bridging the gap between early boot activities and later comprehensive scanning. This intermediary preserves evidence for post-analysis without requiring direct real-time interaction during boot.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If synchronous scanning is performed on all processes, then detection thoroughness is improved, but system performance and boot time are degraded

Engineering Contradiction:

Improvedetection thoroughnessVSAvoidsystem performance

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent implements periodic action by performing malware scanning asynchronously after the boot process completes, rather than synchronously during boot. The kernel-mode driver records processes during boot, then user-mode scanning tools analyze these recorded processes periodically after system initialization. This timing separation ensures thorough detection without impacting boot performance or system responsiveness.

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The patent applies preliminary action by having the kernel-mode driver record all process information during boot in advance, preparing the data set for later asynchronous scanning. This preliminary data collection allows comprehensive analysis to occur after boot completion, eliminating the need to wait for scanning results during the critical boot phase and thus maintaining system performance.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If kernel-mode driver is deployed for early process detection, then detection coverage is improved, but system complexity and security risks are increased

Engineering Contradiction:

Improvedetection coverageVSAvoidsystem architecture complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The kernel-mode driver operates autonomously during boot, self-activating and recording processes without requiring complex external coordination. The driver manages its own lifecycle, automatically initializing when the kernel loads and continuing to record processes until user mode becomes available. This self-service operation reduces system complexity by eliminating the need for complex inter-component coordination protocols.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11182486B2Early boot driver for start-up detection of malicious code

Publication Date: 2021.11.23 SOPHOS LTD

AI summary

A security driver loads early in the boot process for a compute instance and detects processes that are subsequently launched. The detected processes can be recorded, and then scanned with any suitable malware scanning tool(s) once a user mode is available on the compute instance. After the operating system is installed and a user mode is available, other scanning tools may also be deployed (e.g., in the user mode) to augment security of the compute instance.