Boot Time Driver for Master Boot Record Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current anti-virus methods are ineffective against malware that infects the master boot record (MBR), allowing malware to evade detection and remain undetected, necessitating offline disinfection methods with poor usability and user unawareness of infection.

Innovation Solution

A method and apparatus that load a boot time driver during operating system loading to read and analyze MBR data for malicious entities, controlling the system to disable them, thereby preventing malware from hooking the OS and allowing for real-time detection and removal without offline booting.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If malware is installed into the MBR and hooks access to the infected MBR, then the malware can withstand anti-virus scanning and remain undetected, but the system becomes vulnerable to malware infection

Engineering Contradiction:
Improvesystem securityVSAvoidmalware detection
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements preliminary action by loading a boot-time driver that reads and analyzes the MBR before the malware can establish its hooks and filters. The driver captures the original MBR content immediately during system boot, before malware has a chance to interfere with the scanning process, thus enabling detection of malware that would otherwise remain hidden.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary component - a boot-time driver - that acts as a mediator between the anti-virus scanning system and the MBR. This driver bypasses the malware's hooks by directly reading the MBR at a lower level, allowing the scanning system to access authentic MBR content without being fooled by malware-generated fake content.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If offline disinfection methods are used to remove MBR malware, then malware can be removed, but usability deteriorates and users may remain unaware of infection

Engineering Contradiction:
Improvemalware removal effectivenessVSAvoiddisinfection usability
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent implements self-service by enabling the anti-virus system to automatically detect and remove MBR malware during normal system operation without requiring user intervention to boot from external media. The boot-time driver continuously monitors and protects the MBR, allowing the system to self-heal from infections without user awareness or action.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The patent ensures continuity of useful action by maintaining constant protection of the MBR through a loaded boot-time driver that operates throughout system usage. Unlike offline methods that require system shutdown and external booting, this approach provides continuous real-time monitoring and protection, eliminating gaps where malware could reinfect the system.

Inventive Principle:
Principle #20Continuity of useful action

3Object-affected harmful factors

If malware patches system drivers and hooks MBR access, then malware protection against scanning is achieved, but system integrity is compromised

Engineering Contradiction:
Improvemalware evasion capabilityVSAvoidMBR integrity
Core Design Contradiction:
Object-affected harmful factorsVSStability of the object's composition

Solution Approach 1:

The patent applies preliminary anti-action by having the boot-time driver read and preserve the original MBR content before malware can patch or corrupt it. The driver stores a clean copy of the MBR and can restore it if malware modification is detected, preventing malware from establishing its persistent presence while maintaining the original system state.

Inventive Principle:
Principle #9Preliminary anti-action

Solution Approach 2:

The patent implements feedback by continuously monitoring the MBR for changes and comparing it against the known good state. When malware attempts to modify the MBR, the system detects the change through the boot-time driver and can trigger restoration of the original content, creating a closed-loop protection mechanism that actively counteracts malware modifications.

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP2729893B1Security method and apparatus
Publication Date: 2018.08.29 F SECURE CORP
  • EP2729893B1 patent drawingFigure 1
  • EP2729893B1 patent drawingFigure 2~3

AI summary

In accordance with an example embodiment of the present invention, there is provided an apparatus, comprising: at least one processor; and at least one memory including executable instructions. The at least one memory and the executable instructions are configured to, in cooperation with the at least one processor, cause the apparatus to perform at least the following: during the loading of an operating system, loading a boot time driver installed by an anti-virus application; reading a master boot record data by the boot time driver as soon as the operating system is ready to handle the request for reading the master boot record data; analyzing the collected master boot record data to identify any malicious entities; and in the event that malicious entities are identified, controlling the behavior of the processing system in order to disable the malicious entity.