Boot Time Driver for Master Boot Record Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus methods are ineffective against malware that infects the master boot record (MBR), allowing malware to evade detection and remain undetected, necessitating offline disinfection methods with poor usability and user unawareness of infection.
Innovation Solution
A method and apparatus that load a boot time driver during operating system loading to read and analyze MBR data for malicious entities, controlling the system to disable them, thereby preventing malware from hooking the OS and allowing for real-time detection and removal without offline booting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware is installed into the MBR and hooks access to the infected MBR, then the malware can withstand anti-virus scanning and remain undetected, but the system becomes vulnerable to malware infection
Solution Approach 1:
The patent implements preliminary action by loading a boot-time driver that reads and analyzes the MBR before the malware can establish its hooks and filters. The driver captures the original MBR content immediately during system boot, before malware has a chance to interfere with the scanning process, thus enabling detection of malware that would otherwise remain hidden.
Solution Approach 2:
The patent introduces an intermediary component - a boot-time driver - that acts as a mediator between the anti-virus scanning system and the MBR. This driver bypasses the malware's hooks by directly reading the MBR at a lower level, allowing the scanning system to access authentic MBR content without being fooled by malware-generated fake content.
2Reliability
If offline disinfection methods are used to remove MBR malware, then malware can be removed, but usability deteriorates and users may remain unaware of infection
Solution Approach 1:
The patent implements self-service by enabling the anti-virus system to automatically detect and remove MBR malware during normal system operation without requiring user intervention to boot from external media. The boot-time driver continuously monitors and protects the MBR, allowing the system to self-heal from infections without user awareness or action.
Solution Approach 2:
The patent ensures continuity of useful action by maintaining constant protection of the MBR through a loaded boot-time driver that operates throughout system usage. Unlike offline methods that require system shutdown and external booting, this approach provides continuous real-time monitoring and protection, eliminating gaps where malware could reinfect the system.
3Object-affected harmful factors
If malware patches system drivers and hooks MBR access, then malware protection against scanning is achieved, but system integrity is compromised
Solution Approach 1:
The patent applies preliminary anti-action by having the boot-time driver read and preserve the original MBR content before malware can patch or corrupt it. The driver stores a clean copy of the MBR and can restore it if malware modification is detected, preventing malware from establishing its persistent presence while maintaining the original system state.
Solution Approach 2:
The patent implements feedback by continuously monitoring the MBR for changes and comparing it against the known good state. When malware attempts to modify the MBR, the system detects the change through the boot-time driver and can trigger restoration of the original content, creating a closed-loop protection mechanism that actively counteracts malware modifications.
Data Source
Figure 1
Figure 2~3
AI summary
In accordance with an example embodiment of the present invention, there is provided an apparatus, comprising: at least one processor; and at least one memory including executable instructions. The at least one memory and the executable instructions are configured to, in cooperation with the at least one processor, cause the apparatus to perform at least the following: during the loading of an operating system, loading a boot time driver installed by an anti-virus application; reading a master boot record data by the boot time driver as soon as the operating system is ready to handle the request for reading the master boot record data; analyzing the collected master boot record data to identify any malicious entities; and in the event that malicious entities are identified, controlling the behavior of the processing system in order to disable the malicious entity.