Boot Process Emulation for Bootkit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware technologies are ineffective in detecting bootkit malware, which infiltrates the computer system's boot process and evades detection by modifying the boot record, making it difficult to counter and remove.
Innovation Solution
An automated computer-implemented method that emulates the boot process of a computer system, allowing for the detection of unknown programs and abnormalities in the boot process, including bootkits, without the need for external boot devices, by analyzing physical parameter data and executing boot code in a virtual environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware technologies are used, then existing protection features are maintained, but bootkit malware can bypass detection by modifying the boot record
Solution Approach 1:
The patent applies preliminary action by performing boot process emulation before the actual boot occurs. The system creates a virtual environment that replicates the boot sequence and executes boot code in advance, allowing detection of malicious modifications to the boot record before they can affect the real system. This preemptive emulation enables the system to identify bootkit malware attempts prior to execution.
Solution Approach 2:
The patent employs copying by creating a virtual copy of the boot process and boot code in an emulated environment. Instead of directly analyzing the real boot record which may be modified by bootkits, the system copies the boot process into a virtual machine where it can be safely observed and analyzed. This copy allows detection of malicious behavior without compromising the actual system.
2Reliability
If external boot technologies are used for detection, then boot process malware can be detected during anti-virus scanning, but specialized external disks or devices are required and users must take specific targeted actions
Solution Approach 1:
The patent implements self-service by enabling the system to automatically perform boot process emulation and detection without requiring user intervention. The emulation environment automatically executes boot code, monitors for malicious behavior, and generates reports. This automated approach eliminates the need for users to manually create external boot devices or perform targeted evaluation actions, while maintaining reliable malware detection.
3Difficulty of detecting and measuring
If boot process emulation is implemented, then detection of unknown programs and abnormalities is enabled, but system complexity increases
Solution Approach 1:
The patent uses an intermediary approach by introducing a virtual machine as a mediator between the real system and the boot process analysis. The virtual machine serves as an intermediate environment that isolates the emulation process from the host system, allowing complex boot code to be executed and analyzed safely. This intermediary layer simplifies the overall system architecture by providing a standardized platform for boot process emulation without requiring direct manipulation of complex hardware configurations.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
System and method for detecting malware on a target computer system having a bootable device. Boot process information stored on the bootable device that at least partially defines a boot process of the target computer system is obtained, along with physical parameter data defining a storage arrangement structure of the bootable device. The boot process of the target computer system is emulated based on the boot process information and on the physical parameter data. The emulation includes executing instructions of the boot process information and tracking data accessed from the bootable device. A data structure representing the data accessed from the bootable device is stored during the emulation of the boot process. The data structure can be analyzed for any presence of boot process malware.