Bypassing Malware Infected Drivers via Alternate Communication Path
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rootkits pose a significant challenge due to their ability to hide within operating systems and evade detection by security software, as they can hook into device drivers and manipulate data to avoid being identified or removed.
Innovation Solution
A separate driver and driver chain are created to access resources and data, allowing for direct communication with devices and files, bypassing potentially infected drivers and avoiding detection by rootkit defense mechanisms, enabling the detection and removal of rootkits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a security application attempts to detect rootkits by accessing infected drivers, then rootkit detection capability is improved, but the rootkit can detect the threat and hide its existence or reinstall itself, causing detection reliability to deteriorate
Solution Approach 1:
The patent introduces a separate driver and driver chain as an intermediary component that mediates between the security application and the infected driver. This intermediary allows the security application to access and detect rootkits without triggering the rootkit's defense mechanisms, as the rootkit only monitors requests passing through the infected driver chain, not through the separate driver path.
2Object-affected harmful factors
If rootkits hook into device drivers to monitor and manipulate I/O requests, then their ability to hide and protect themselves is improved, but this creates a barrier that prevents security software from accessing infected resources, worsening the difficulty of detection and removal
Solution Approach 1:
The patent segments the driver chain into multiple independent paths: the original infected driver chain that the rootkit monitors, and a separate clean driver chain that security software uses to access infected resources. By dividing the monolithic driver access path into separate segments, the security software can bypass the rootkit's monitoring hook and directly access the underlying device and infected files.
Data Source
AI summary
Aspects of the present disclosure relate to setting up an alternate communication path to a device, resource, file, etc., in order to avoid a potentially infected driver. New drivers may be established as part of the alternate communications path, thereby providing access to a device, resource, etc. using drivers that are known to be clean or, in other words, not infected by a rootkit. In doing so, a rootkit hunter, e.g., antivirus software, antimalware software, etc., may access an infected device, resource, etc. without alerting a rootkit, thereby avoiding activation of the rootkit's defensive mechanisms. In one aspect, an I/O request may be serviced by using the new communications path bypassing any potentially infected drivers while another request may be serviced using a previously established communications path. The responses (e.g., data returned, action performed, etc.) of the requests may then be compared.