Bootkit Detection via Hash Integrity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, including antivirus scanning and two-phase malware detection, are inadequate in detecting bootkits, which can evade detection by modifying operating system functions and hiding in boot records, leading to potential serious impacts on computer and network infrastructure.
Innovation Solution
A bootkit detection system that monitors changes in boot locations by generating baseline and snapshot hashes of boot content, using integrity checks to identify anomalies, and employing virtual environments to execute suspicious samples, thereby detecting bootkits even if they attempt to hide or modify boot records.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus scanning software is used to detect malware, then known malware can be identified through signature matching, but bootkits can evade detection by modifying operating system functions and hiding in boot records
Solution Approach 1:
The system performs preliminary integrity checks of boot records by comparing current hash values against baseline hashes stored in a database. This preliminary detection action identifies bootkits before they can fully compromise the system, as the baseline hashes are established when the boot records are known to be clean.
Solution Approach 2:
The patent introduces an intermediary mechanism using virtual machines to safely execute and monitor suspicious boot records. The virtual machine environment acts as a mediator between the suspected malicious boot record and the host system, allowing analysis of bootkit behavior without direct compromise of the host.
2Reliability
If two-phase malware detection with virtual machines is used, then numerous types of malware can be detected, but the system complexity increases
Solution Approach 1:
The detection system is segmented into distinct functional components: a first phase for heuristic analysis of network traffic, a second phase for virtual machine execution and behavior monitoring, and a third phase for integrity checking of boot records. This segmentation allows each component to handle specific detection tasks independently, improving overall reliability while maintaining manageable complexity.
Solution Approach 2:
The virtual machine environment serves multiple functions: executing suspicious samples for behavior analysis, providing a safe isolation zone for potentially malicious code, and enabling monitoring of system calls and registry changes. This multi-functionality reduces the need for separate dedicated systems for each detection task.
3Reliability
If boot records are continuously monitored for changes, then bootkits can be detected in real-time, but system performance and resource consumption increase
Solution Approach 1:
Instead of continuous monitoring, the system performs periodic integrity checks by comparing current boot record hashes against stored baseline hashes. This periodic action maintains security awareness while minimizing resource consumption, as the checks are performed at critical boot-up moments rather than continuously throughout system operation.
Solution Approach 2:
The patent replaces continuous mechanical monitoring with hash-based integrity verification. By substituting the mechanical process of continuous scanning with cryptographic hash comparison, the system achieves real-time detection capability with minimal computational overhead, as hash comparison is much faster than full content scanning.
Data Source
AI summary
Techniques detect bootkits resident on a computer by detecting a change or attempted change to contents of boot locations (e.g., the master boot record) of persistent storage, which may evidence a resident bootkit. Some embodiments may monitor computer operations seeking to change the content of boot locations of persistent storage, where the monitored operations may include API calls performing, for example, WRITE, READ or APPEND operations with respect to the contents of the boot locations. Other embodiments may generate a baseline hash of the contents of the boot locations at a first point of time and a hash snapshot of the boot locations at a second point of time, and compare the baseline hash and hash snapshot where any difference between the two hash values constitutes evidence of a resident bootkit.